admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity
Files
e3d6b11ac399e94de1778d537c52c733db45d00d
splunk-security_content/docs/baselines.spec.md
T
Rico Valdez 57f9a028c0 more updates for spec
2019-10-24 13:10:17 -06:00

1346 lines
19 KiB
Markdown
Raw Blame History

This file contains ambiguous Unicode characters
This file contains Unicode characters that might be confused with other characters. If you think that this is intentional, you can safely ignore this warning. Use the Escape button to reveal them.
# Baseline Manifest Schema
```
https://api.splunkresearch.com/schemas/baselines.json
```
The fields that make up the manifest of a version 2 baseline search
| Abstract | Extensible | Status | Identifiable | Custom Properties | Additional Properties | Defined In |
|----------|------------|--------|--------------|-------------------|-----------------------|------------|
| Can be instantiated | Yes | Experimental | No | Forbidden | Permitted | |
# Baseline Manifest Properties
| Property | Type | Required | Nullable | Defined by |
|----------|------|----------|----------|------------|
| [baseline](#baseline) | `object` | **Required** | No | Baseline Manifest (this schema) |
| [creation_date](#creation_date) | `string` | **Required** | No | Baseline Manifest (this schema) |
| [data_metadata](#data_metadata) | `object` | **Required** | No | Baseline Manifest (this schema) |
| [description](#description) | `string` | **Required** | No | Baseline Manifest (this schema) |
| [eli5](#eli5) | `string` | **Required** | No | Baseline Manifest (this schema) |
| [entities](#entities) | `enum[]` | Optional | No | Baseline Manifest (this schema) |
| [how_to_implement](#how_to_implement) | `string` | **Required** | No | Baseline Manifest (this schema) |
| [id](#id) | `string` | **Required** | No | Baseline Manifest (this schema) |
| [known_false_positives](#known_false_positives) | `string` | **Required** | No | Baseline Manifest (this schema) |
| [maintainers](#maintainers) | `object[]` | **Required** | No | Baseline Manifest (this schema) |
| [modification_date](#modification_date) | `string` | **Required** | No | Baseline Manifest (this schema) |
| [name](#name) | `string` | **Required** | No | Baseline Manifest (this schema) |
| [original_authors](#original_authors) | `object[]` | **Required** | No | Baseline Manifest (this schema) |
| [spec_version](#spec_version) | `integer` | **Required** | No | Baseline Manifest (this schema) |
| [type](#type) | `enum` | **Required** | No | Baseline Manifest (this schema) |
| [version](#version) | `string` | **Required** | No | Baseline Manifest (this schema) |
| `*` | any | Additional | Yes | this schema *allows* additional properties |
## baseline
`baseline`
* is **required**
* type: `object`
* defined in this schema
### baseline Type
`object` with following properties:
| Property | Type | Required |
|----------|------|----------|
| `phantom`| | Optional |
| `splunk`| | Optional |
#### phantom
`phantom`
* is optional
* type: reference
##### phantom Type
* []() – `#/definitions/phantom`
#### splunk
`splunk`
* is optional
* type: reference
##### splunk Type
* []() – `#/definitions/splunk`
## creation_date
The date the baseline manifest was created
`creation_date`
* is **required**
* type: `string`
* defined in this schema
### creation_date Type
`string`
### creation_date Example
```json
"2019-02-14"
```
## data_metadata
Information about the date being ingested
`data_metadata`
* is **required**
* type: `object`
* defined in this schema
### data_metadata Type
`object` with following properties:
| Property | Type | Required |
|----------|------|----------|
| `data_eventtypes`| array | Optional |
| `data_models`| array | Optional |
| `data_source`| array | **Required** |
| `data_sourcetypes`| array | Optional |
| `providing_technologies`| array | **Required** |
#### data_eventtypes
A list of eventtypes, if any, used by this search
`data_eventtypes`
* is optional
* type: `string[]`* at least `0` items in the array
##### data_eventtypes Type
Array type: `string[]`
All items must be of the type:
`string`
##### data_eventtypes Example
```json
wineventlog
```
#### data_models
A list of data models, if any, used by this search
`data_models`
* is optional
* type: `enum[]`* at least `0` items in the array
##### data_models Type
Array type: `enum[]`
All items must be of the type:
Unknown type ``.
```json
{
"description": "A list of data models, if any, used by this search",
"examples": [
"Network_Resolution"
],
"items": {
"enum": [
"Alerts",
"Application_State",
"Authentication",
"Certificates",
"Change_Analysis",
"Change",
"Cloud_Infrastructure",
"Malware",
"Email",
"Identity_Management",
"Network_Resolution",
"Network_Traffic",
"Vulnerabilities",
"Web",
"Network_Sessions",
"Updates",
"Risk",
"Endpoint"
],
"simpletype": "`enum`",
"meta:enum": {
"Alerts": "",
"Application_State": "",
"Authentication": "",
"Certificates": "",
"Change_Analysis": "",
"Cloud_Infrastructure": "",
"Change": "",
"Malware": "",
"Email": "",
"Identity_Management": "",
"Network_Resolution": "",
"Network_Traffic": "",
"Vulnerabilities": "",
"Web": "",
"Network_Sessions": "",
"Updates": "",
"Risk": "",
"Endpoint": ""
}
},
"minItems": 0,
"type": "array",
"uniqueItems": true,
"simpletype": "`enum[]`"
}
```
##### data_models Example
```json
Network_Resolution
```
#### data_source
A high-level description of the type of data needed for this search to complete
`data_source`
* is **required**
* type: `string[]`* at least `0` items in the array
##### data_source Type
Array type: `string[]`
All items must be of the type:
`string`
##### data_source Example
```json
DNS
```
#### data_sourcetypes
The list of sourcetypes, if any, used by this search
`data_sourcetypes`
* is optional
* type: `string[]`* at least `0` items in the array
##### data_sourcetypes Type
Array type: `string[]`
All items must be of the type:
`string`
##### data_sourcetypes Example
```json
stream:dns
```
#### providing_technologies
A list of technologies that provide this data
`providing_technologies`
* is **required**
* type: `enum[]`* at least `0` items in the array
##### providing_technologies Type
Array type: `enum[]`
All items must be of the type:
Unknown type ``.
```json
{
"description": "A list of technologies that provide this data",
"examples": [
"Bro"
],
"items": {
"enum": [
"Apache",
"AWS",
"Bro",
"Microsoft Windows",
"Linux",
"macOS",
"Netbackup",
"Splunk Enterprise",
"Splunk Enterprise Security",
"Splunk Stream",
"Active Directory",
"Bluecoat",
"Carbon Black Response",
"Carbon Black Protect",
"CrowdStrike Falcon",
"Microsoft Exchange",
"Nessus",
"Palo Alto Firewall",
"Qualys",
"Sysmon",
"Tanium",
"Ziften",
"Censys",
"Passive Total",
"WHOIS"
],
"simpletype": "`enum`",
"meta:enum": {
"Apache": "",
"AWS": "",
"Bro": "",
"Microsoft Windows": "",
"Linux": "",
"macOS": "",
"Netbackup": "",
"Splunk Enterprise": "",
"Splunk Enterprise Security": "",
"Splunk Stream": "",
"Active Directory": "",
"Bluecoat": "",
"Carbon Black Response": "",
"Carbon Black Protect": "",
"CrowdStrike Falcon": "",
"Microsoft Exchange": "",
"Nessus": "",
"Palo Alto Firewall": "",
"Qualys": "",
"Sysmon": "",
"Tanium": "",
"Ziften": "",
"Censys": "",
"Passive Total": "",
"WHOIS": ""
}
},
"minItems": 0,
"type": "array",
"uniqueItems": true,
"simpletype": "`enum[]`"
}
```
##### providing_technologies Example
```json
Bro
```
## description
A description of what the search is is doing to create a baseline
`description`
* is **required**
* type: `string`
* defined in this schema
### description Type
`string`
### description Example
```json
"The search takes corporate and common cloud provider domains configured under `cim_corporate_email_domains.csv`, `cim_corporate_web_domains.csv`, and `cloud_domains.csv` finds their responses across the last 30 days from data in the `Network_Traffic` datamodel, then stores the output under the `discovered_dns_records.csv` lookup"
```
## eli5
Explain it like I am 5 - A detail description of the SPL of the search, written in a style that can be understood by a future Splunk expert
`eli5`
* is **required**
* type: `string`
* defined in this schema
### eli5 Type
`string`
### eli5 Example
```json
"Discover the DNS records and their answers for domains owned by the company using network traffic events. The discovered events are exported as a lookup named `discovered_dns_records.csv`"
```
## entities
A list of entities that will used in the story flow or are relevant to the security investigation.
`entities`
* is optional
* type: `enum[]`
* at least `0` items in the array
* defined in this schema
### entities Type
Array type: `enum[]`
All items must be of the type:
Unknown type ``.
```json
{
"description": "A list of entities that will used in the story flow or are relevant to the security investigation.",
"examples": [
"dest",
"user"
],
"items": {
"enum": [
"accessKeyId",
"arn",
"awsRegion",
"bucketName",
"City",
"Country",
"dest_port",
"dest",
"event_id",
"instanceId",
"message_id",
"networkAclId",
"process_name",
"process",
"recipient",
"Region",
"resourceId",
"session_id",
"src_ip",
"src_mac",
"src_user",
"src",
"user",
"query",
"answer"
],
"simpletype": "`enum`",
"meta:enum": {
"accessKeyId": "",
"arn": "",
"awsRegion": "",
"bucketName": "",
"City": "",
"Country": "",
"dest_port": "",
"dest": "",
"event_id": "",
"instanceId": "",
"message_id": "",
"networkAclId": "",
"process_name": "",
"process": "",
"recipient": "",
"Region": "",
"resourceId": "",
"session_id": "",
"src_ip": "",
"src_mac": "",
"src_user": "",
"src": "",
"user": "",
"query": "",
"answer": ""
}
},
"minItems": 0,
"type": "array",
"uniqueItems": true,
"simpletype": "`enum[]`"
}
```
### entities Examples
```json
"dest"
```
```json
"user"
```
## how_to_implement
A discussion on how to implement this search, from what needs to be ingested, config files modified, and suggested per site modifications
`how_to_implement`
* is **required**
* type: `string`
* defined in this schema
### how_to_implement Type
`string`
### how_to_implement Example
```json
"To successfully implement this search, you must be ingesting DNS logs, and populating the Network_Resolution data model. Also make sure that the cim_corporate_web_domains and cim_corporate_email_domains lookups are populated with the domains owned by your corporation"
```
## id
The unique identifier for the search
`id`
* is **required**
* type: `string`
* defined in this schema
### id Type
`string`
### id Example
```json
"c096f721-8842-42ce-bfc7-74bd8c72b7c3"
```
## known_false_positives
Describe the known false postives while the analyst builds the baseline.
`known_false_positives`
* is **required**
* type: `string`
* defined in this schema
### known_false_positives Type
`string`
### known_false_positives Example
```json
"Please vet the lookup created by this baseline search."
```
## maintainers
An array of the current maintainers of the Analytic Story.
`maintainers`
* is **required**
* type: `object[]`
* defined in this schema
### maintainers Type
Array type: `object[]`
All items must be of the type:
`object` with following properties:
| Property | Type | Required |
|----------|------|----------|
| `company`| string | **Required** |
| `email`| string | **Required** |
| `name`| string | **Required** |
#### company
Company associated with the person maintaining this search
`company`
* is **required**
* type: `string`
##### company Type
`string`
##### company Example
```json
Splunk
```
#### email
Email address of the person maintaining this search
`email`
* is **required**
* type: `string`
##### email Type
`string`
##### email Example
```json
daftpunk@splunk.com
```
#### name
Name of the person maintaining this search
`name`
* is **required**
* type: `string`
##### name Type
`string`
##### name Example
```json
Daft Punk
```
## modification_date
The date of the most recent modification to the search
`modification_date`
* is **required**
* type: `string`
* defined in this schema
### modification_date Type
`string`
### modification_date Example
```json
"2019-02-14"
```
## name
The name of the search that creates the baseline
`name`
* is **required**
* type: `string`
* defined in this schema
### name Type
`string`
### name Example
```json
"Discover DNS records"
```
## original_authors
A list of the original authors of the search
`original_authors`
* is **required**
* type: `object[]`
* defined in this schema
### original_authors Type
Array type: `object[]`
All items must be of the type:
`object` with following properties:
| Property | Type | Required |
|----------|------|----------|
| `company`| string | **Required** |
| `email`| string | **Required** |
| `name`| string | **Required** |
#### company
Company associated with the person who originally authored the search
`company`
* is **required**
* type: `string`
##### company Type
`string`
##### company Example
```json
Splunk
```
#### email
Email address of the person who originally authored the search
`email`
* is **required**
* type: `string`
##### email Type
`string`
##### email Example
```json
daftpunk@splunk.com
```
#### name
Name of the person who originally authored the search
`name`
* is **required**
* type: `string`
##### name Type
`string`
##### name Example
```json
Daft Punk
```
## spec_version
The version of the detection search specification this manifest follows
`spec_version`
* is **required**
* type: `integer`
* defined in this schema
### spec_version Type
`integer`
### spec_version Example
```json
"2.0"
```
## type
The type of baseline
`type`
* is **required**
* type: `enum`
* defined in this schema
The value of this property **must** be equal to one of the [known values below](#type-known-values).
### type Known Values
| Value | Description |
|-------|-------------|
| `splunk` | |
| `phantom` | |
| `uba` | |
### type Example
```json
"splunk"
```
## version
The version of the search
`version`
* is **required**
* type: `string`
* defined in this schema
### version Type
`string`
### version Examples
```json
"1"
```
```json
"2"
```
# Baseline Manifest Definitions
| Property | Type | Group |
|----------|------|-------|
| [phantom_server](#phantom_server) | `string` | `https://api.splunkresearch.com/schemas/baselines.json#/definitions/phantom` |
| [playbook_name](#playbook_name) | `string` | `https://api.splunkresearch.com/schemas/baselines.json#/definitions/phantom` |
| [playbook_url](#playbook_url) | `string` | `https://api.splunkresearch.com/schemas/baselines.json#/definitions/phantom` |
| [schedule](#schedule) | `object` | `https://api.splunkresearch.com/schemas/baselines.json#/definitions/splunk` |
| [search](#search) | `string` | `https://api.splunkresearch.com/schemas/baselines.json#/definitions/splunk` |
| [sensitivity](#sensitivity) | `string` | `https://api.splunkresearch.com/schemas/baselines.json#/definitions/phantom` |
| [severity](#severity) | `string` | `https://api.splunkresearch.com/schemas/baselines.json#/definitions/phantom` |
## phantom_server
IP address and username of the phantom server. Currently, we will ship this value as automation (hostname) and we encourage the users to modify those values according to their environment. Eg: automation (hostname)
`phantom_server`
* is optional
* type: `string`
* defined in this schema
### phantom_server Type
`string`
### phantom_server Example
```json
"automation (hostname)"
```
## playbook_name
Name of the playbook. This name should be the same as the name on phantom community repository on github with underscores and appended with community/<playbook_name>. The playbooks are hosted on https://github.com/phantomcyber/playbooks. Eg: community/simple_network_enrichment
`playbook_name`
* is optional
* type: `string`
* defined in this schema
### playbook_name Type
`string`
### playbook_name Example
```json
"community/dns_hijack_investigation"
```
## playbook_url
Url of the playbook on Phantom website.
`playbook_url`
* is optional
* type: `string`
* defined in this schema
### playbook_url Type
`string`
### playbook_url Example
```json
"https://my.phantom.us/4.1/playbook/dns-hijack-investigation/"
```
## schedule
Various fields to assist in scheduling the search
`schedule`
* is optional
* type: `object`
* defined in this schema
### schedule Type
`object` with following properties:
| Property | Type | Required |
|----------|------|----------|
| `cron_schedule`| string | Optional |
| `earliest_time`| string | Optional |
| `latest_time`| string | Optional |
#### cron_schedule
Schedule of the search in cron format
`cron_schedule`
* is optional
* type: `string`
##### cron_schedule Type
`string`
##### cron_schedule Example
```json
0 * * * *
```
#### earliest_time
The earliest time the search should run in Splunk format
`earliest_time`
* is optional
* type: `string`
##### earliest_time Type
`string`
##### earliest_time Example
```json
-70m@m
```
#### latest_time
The latest time tes search should run against in Splunk format
`latest_time`
* is optional
* type: `string`
##### latest_time Type
`string`
##### latest_time Example
```json
-10m@m
```
## search
The search (in SPL) executed within core Splunk for investgation.
`search`
* is optional
* type: `string`
* defined in this schema
### search Type
`string`
### search Example
```json
"| inputlookup discovered_dns_records.csv | rename answer as discovered_answer | join domain[|tstats summariesonly=true count values(DNS.record_type) as type, values(DNS.answer) as current_answer values(DNS.src) as src from datamodel=Network_Resolution where DNS.message_type=RESPONSE DNS.answer!=\"unknown\" DNS.answer!=\"\" by DNS.query | rename DNS.query as query | where query!=\"unknown\" | rex field=query \"(?<domain>\\w+\\.\\w+?)(?:$|/)\"] | makemv delim=\" \" answer | makemv delim=\" \" type | sort -count | table count,src,domain,type,query,current_answer,discovered_answer | makemv current_answer | mvexpand current_answer | makemv discovered_answer | eval n=mvfind(discovered_answer, current_answer) | where isnull(n)"
```
## sensitivity
TLP colors (White, Green, Amber or Red)
`sensitivity`
* is optional
* type: `string`
* defined in this schema
### sensitivity Type
`string`
### sensitivity Example
```json
"green"
```
## severity
Severity in phantom (High, Medium, Low)
`severity`
* is optional
* type: `string`
* defined in this schema
### severity Type
`string`
### severity Example
```json
"medium"
```
Reference in New Issue View Git Blame Copy Permalink