divious1
8.5 KiB
Response Schema Schema
http://example.com/example.json
schema for phase
| Abstract | Extensible | Status | Identifiable | Custom Properties | Additional Properties | Access Restrictions | Defined In |
|---|---|---|---|---|---|---|---|
| Can be instantiated | No | Unknown status | No | Forbidden | Allowed | none | responses_phase.spec.json |
Response Schema Type
object (Response Schema)
Response Schema Default Value
The default value is:
{}
Response Schema Properties
| Property | Type | Required | Nullable | Defined by |
|---|---|---|---|---|
| author | string |
Required | cannot be null | Response Schema |
| date | string |
Required | cannot be null | Response Schema |
| description | string |
Required | cannot be null | Response Schema |
| id | string |
Required | cannot be null | Response Schema |
| name | string |
Required | cannot be null | Response Schema |
| response_task | array |
Required | cannot be null | Response Schema |
| tags | object |
Required | cannot be null | Response Schema |
| version | integer |
Required | cannot be null | Response Schema |
| sla | integer |
Optional | cannot be null | Response Schema |
| sla_type | string |
Optional | cannot be null | Response Schema |
| references | array |
Optional | cannot be null | Response Schema |
| Additional Properties | Any | Optional | can be null |
author
Author of the phase
author
-
is required
-
Type:
string -
cannot be null
-
defined in: Response Schema
author Type
string
author Examples
Rico Valdez, Patrick Bareiß, Splunk
date
date of creation or modification, format yyyy-mm-dd
date
-
is required
-
Type:
string -
cannot be null
-
defined in: Response Schema
date Type
string
date Examples
'2019-12-06'
description
Description of phase
description
-
is required
-
Type:
string -
cannot be null
-
defined in: Response Schema
description Type
string
description Examples
Response phase descripion.
id
UUID as unique identifier
id
-
is required
-
Type:
string -
cannot be null
-
defined in: Response Schema
id Type
string
id Examples
fb4c31b0-13e8-4155-8aa5-24de4b8d6717
name
Name of phase
name
-
is required
-
Type:
string -
cannot be null
-
defined in: Response Schema
name Type
string
name Examples
Preparation
response_task
Response phase is divided into task(s) to be completed. These will used to referenced known response_task parameters. Order is as positioned and with unique name.
response_task
-
is required
-
Type:
array -
cannot be null
-
defined in: Response Schema
response_task Type
array
response_task Constraints
minimum number of items: the minimum number of items for this array is: 1
response_task Default Value
The default value is:
{}
response_task Examples
id: 7c72d944-3995-4485-8e57-67b4c353989b
name: Prepare for Incident Handling
id: c36f3f48-e0bb-4c20-a62a-cdc8f6418892
name: Preventing Incidents
id: 0dc849b2-2eb4-4fd2-add1-b6cc475765f0
name: Practice
tags
An array of key value pairs for tagging
tags
-
is required
-
Type:
object(Details) -
cannot be null
-
defined in: Response Schema
tags Type
object (Details)
tags Constraints
minimum number of items: the minimum number of items for this array is: 1
unique items: all items in this array must be unique. Duplicates are not allowed.
tags Default Value
The default value is:
{}
tags Examples
analytic_story: credential_dumping
version
version of detection, e.g. 1 or 2 ...
version
-
is required
-
Type:
integer -
cannot be null
-
defined in: Response Schema
version Type
integer
version Examples
1
sla
Measured integer for Service Level Agreement for completion of the phase
sla
-
is optional
-
Type:
integer -
cannot be null
-
defined in: Response Schema
sla Type
integer
sla Examples
5
30
sla_type
Duration for measured integer for Service Level Agreement for completion of the phase (e.g. minutes, or hours, etc)
sla_type
-
is optional
-
Type:
string -
cannot be null
-
defined in: Response Schema
sla_type Type
string
sla_type Default Value
The default value is:
"minutes"
sla_type Examples
minutes
hours
days
references
A list of references for this response, phase or task (e.g. web or printed citation)
references
-
is optional
-
Type:
string[](3.1 Preparation) -
cannot be null
-
defined in: Response Schema
references Type
string[] (3.1 Preparation)
references Default Value
The default value is:
[]
references Examples
https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-61r2.pdf
Additional Properties
Additional properties are allowed and do not have to follow a specific schema