splunk-security_content/docs/spec/baselines.md

Baseline Schema Schema

http://example.com/example.json

schema for baselines

Abstract	Extensible	Status	Identifiable	Custom Properties	Additional Properties	Access Restrictions	Defined In
Can be instantiated	No	Unknown status	No	Forbidden	Allowed	none	baselines.spec.json

Baseline Schema Type

object (Baseline Schema)

Baseline Schema Properties

Property	Type	Required	Nullable	Defined by
author	string	Required	cannot be null	Baseline Schema
date	string	Required	cannot be null	Baseline Schema
description	string	Required	cannot be null	Baseline Schema
how_to_implement	string	Optional	cannot be null	Baseline Schema
id	string	Required	cannot be null	Baseline Schema
name	string	Required	cannot be null	Baseline Schema
search	string	Required	cannot be null	Baseline Schema
tags	object	Required	cannot be null	Baseline Schema
datamodel	array	Optional	cannot be null	Baseline Schema
version	integer	Required	cannot be null	Baseline Schema
Additional Properties	Any	Optional	can be null

author

Author of the baseline

author

• is required

• Type: string

• cannot be null

• defined in: Baseline Schema

author Type

string

author Examples

Bahvin Patel, Splunk

date

date of creation or modification, format yyyy-mm-dd

date

• is required

• Type: string

• cannot be null

• defined in: Baseline Schema

date Type

string

date Examples

'2019-12-06'

description

A detailed description of the baseline

description

• is required

• Type: string

• cannot be null

• defined in: Baseline Schema

description Type

string

description Examples

>-
  This search looks for CloudTrail events where an AWS instance is started and
  creates a baseline of most recent time (latest) and the first time (earliest)
  we've seen this region in our dataset grouped by the value awsRegion for the
  last 30 days

how_to_implement

information about how to implement. Only needed for non standard implementations.

how_to_implement

• is optional

• Type: string

• cannot be null

• defined in: Baseline Schema

how_to_implement Type

string

how_to_implement Examples

>-
  This search requires Sysmon Logs and a Sysmon configuration, which includes
  EventCode 10 for lsass.exe.

id

UUID as unique identifier

id

• is required

• Type: string

• cannot be null

• defined in: Baseline Schema

id Type

string

id Examples

fc0edc95-ff2b-48b0-9f6f-63da3789fd63

name

name

• is required

• Type: string (Name of baseline)

• cannot be null

• defined in: Baseline Schema

name Type

string (Name of baseline)

name Examples

Previously Seen AWS Regions

search

The Splunk search for the baseline

search

• is required

• Type: string

• cannot be null

• defined in: Baseline Schema

search Type

string

search Examples

>-
  cloudtrail StartInstances | stats earliest(_time) as earliest latest(_time) as
  latest by awsRegion | outputlookup previously_seen_aws_regions.csv

tags

An array of key value pairs for tagging

tags

• is required

• Type: object (Details)

• cannot be null

• defined in: Baseline Schema

tags Type

object (Details)

tags Constraints

minimum number of items: the minimum number of items for this array is: 1

unique items: all items in this array must be unique. Duplicates are not allowed.

tags Default Value

The default value is:

{}

tags Examples

analytic_story: suspicious_aws_ec2_activities
custom_key: custom_value

datamodel

datamodel used in the search

datamodel

• is optional

• Type: string[]

• cannot be null

• defined in: Baseline Schema

datamodel Type

string[]

datamodel Examples

Endpoint

version

version of baseline, e.g. 1 or 2 ...

version

• is required

• Type: integer

• cannot be null

• defined in: Baseline Schema

version Type

integer

version Examples

1

Additional Properties

Additional properties are allowed and do not have to follow a specific schema