splunk-security_content/spec/deployments.spec.json

{
  "$id": "http://example.com/example.json",
  "$schema": "http://json-schema.org/draft-07/schema",
  "additionalProperties": true,
  "default": {},
  "description": "schema for deployment",
  "properties": {
    "alert_action": {
      "$id": "#/properties/alert_action",
      "additionalProperties": true,
      "default": {},
      "description": "Set alert action parameter for search",
      "examples": [
        {
          "email": {
            "message": "Splunk Alert $name$ triggered %fields%",
            "subject": "Splunk Alert $name$",
            "to": "test@test.com"
          },
          "index": {
            "name": "asx"
          },
          "notable": {
            "rule_description": "%description%",
            "rule_title": "%name%"
          }
        }
      ],
      "properties": {
        "email": {
          "$id": "#/properties/alert_action/properties/email",
          "additionalProperties": true,
          "default": {},
          "description": "By enabling it, an email is sent with the results",
          "examples": [
            {
              "message": "Splunk Alert $name$ triggered %fields%",
              "subject": "Splunk Alert $name$",
              "to": "test@test.com"
            }
          ],
          "properties": {
            "message": {
              "$id": "#/properties/alert_action/properties/email/properties/message",
              "default": "",
              "description": "message of email",
              "examples": [
                "Splunk Alert $name$ triggered %fields%"
              ],
              "type": "string"
            },
            "subject": {
              "$id": "#/properties/alert_action/properties/email/properties/subject",
              "default": "",
              "description": "Subject of email",
              "examples": [
                "Splunk Alert $name$"
              ],
              "type": "string"
            },
            "to": {
              "$id": "#/properties/alert_action/properties/email/properties/to",
              "default": "",
              "description": "Recipient of email",
              "examples": [
                "test@test.com"
              ],
              "type": "string"
            }
          },
          "required": [
            "to",
            "subject",
            "message"
          ],
          "type": "object"
        },
        "index": {
          "$id": "#/properties/alert_action/properties/index",
          "additionalProperties": true,
          "default": {},
          "description": "By enabling it, the results are stored in another index",
          "examples": [
            {
              "name": "asx"
            }
          ],
          "properties": {
            "name": {
              "$id": "#/properties/alert_action/properties/index/properties/name",
              "default": "",
              "description": "Name of the index",
              "examples": [
                "asx"
              ],
              "type": "string"
            }
          },
          "required": [
            "name"
          ],
          "type": "object"
        },
        "notable": {
          "$id": "#/properties/alert_action/properties/notable",
          "additionalProperties": true,
          "default": {},
          "description": "By enabling it, a notable is generated",
          "examples": [
            {
              "rule_description": "%description%",
              "rule_title": "%name%"
            }
          ],
          "properties": {
            "rule_description": {
              "$id": "#/properties/alert_action/properties/notable/properties/rule_description",
              "default": "",
              "description": "Rule description of the notable event",
              "examples": [
                "%description%"
              ],
              "type": "string"
            },
            "rule_title": {
              "$id": "#/properties/alert_action/properties/notable/properties/rule_title",
              "default": "",
              "description": "Rule title of the notable event",
              "examples": [
                "%name%"
              ],
              "type": "string"
            }
          },
          "required": [
            "rule_title",
            "rule_description"
          ],
          "type": "object"
        }
      },
      "type": "object"
    },
    "date": {
      "$id": "#/properties/date",
      "default": "",
      "description": "date of creation or modification, format yyyy-mm-dd",
      "examples": [
        "2019-12-06"
      ],
      "type": "string"
    },
    "description": {
      "$id": "#/properties/description",
      "default": "",
      "description": "description of the deployment configuration",
      "examples": [
        "This deployment configuration provides a standard scheduling policy over all rules."
      ],
      "type": "string"
    },
    "id": {
      "$id": "#/properties/id",
      "default": "",
      "description": "uuid as unique identifier",
      "examples": [
        "fb4c31b0-13e8-4155-8aa5-24de4b8d6717"
      ],
      "type": "string"
    },
    "name": {
      "$id": "#/properties/name",
      "default": "",
      "description": "Name of deployment configuration",
      "examples": [
        "Deployment Configuration all Detections"
      ],
      "type": "string"
    },
    "scheduling": {
      "$id": "#/properties/scheduling",
      "additionalProperties": true,
      "default": {},
      "description": "allows to set scheduling parameter",
      "examples": [
        {
          "cron_schedule": "*/10 * * * *",
          "earliest_time": "-10m",
          "latest_time": "now",
          "schedule_window": "auto"
        }
      ],
      "properties": {
        "cron_schedule": {
          "$id": "#/properties/scheduling/properties/cron_schedule",
          "default": "",
          "description": "Cron schedule to schedule the Splunk searches.",
          "examples": [
            "*/10 * * * *"
          ],
          "type": "string"
        },
        "earliest_time": {
          "$id": "#/properties/scheduling/properties/earliest_time",
          "default": "",
          "description": "earliest time of search",
          "examples": [
            "-10m"
          ],
          "type": "string"
        },
        "latest_time": {
          "$id": "#/properties/scheduling/properties/latest_time",
          "default": "",
          "description": "latest time of search",
          "examples": [
            "now"
          ],
          "type": "string"
        },
        "schedule_window": {
          "$id": "#/properties/scheduling/properties/schedule_window",
          "default": "",
          "description": "schedule window for search",
          "examples": [
            "auto"
          ],
          "type": "string"
        }
      },
      "required": [
        "cron_schedule",
        "earliest_time",
        "latest_time"
      ],
      "type": "object"
    },
    "tags": {
      "$id": "#/properties/tags",
      "additionalProperties": true,
      "default": {},
      "description": "An array of key value pairs for tagging",
      "examples": [
        {
          "analytics_story": "credential_dumping"
        }
      ],
      "minItems": 1,
      "type": "object",
      "uniqueItems": true
    }
  },
  "required": [
    "name",
    "id",
    "date",
    "description",
    "scheduling",
    "alert_action",
    "tags"
  ],
  "title": "Deployment Schema",
  "type": "object"
}