security_content/spec/playbooks.spec.json at develop · codingWithJimmy/security_content · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
{
    "$id": "http://example.com/example.json",
    "$schema": "http://json-schema.org/draft-07/schema",
    "additionalProperties": true,
    "description": "schema for playbooks",
    "properties": {
        "author": {
            "$id": "#/properties/author",
            "default": "",
            "description": "Author of the playbook",
            "examples": [
                "Lou Stella, Splunk"
            ],
            "type": "string"
        },
        "date":{
            "$id": "#/properties/date",
            "default": "",
            "description": "date of creation or modification, format yyyy-mm-dd",
            "examples": [
                "2021-09-28"
            ],
            "type": "string"
        },
        "description": {
            "$id": "#/properties/description",
            "default": "",
            "description": "A detailed description of the playbook",
            "examples": [
                "This playbook investigates and contains ransomware detected on endpoints."
            ],
            "type": "string"
        },
        "how_to_implement": {
            "$id": "#/properties/how_to_implement",
            "default": "",
            "description": "information about how to implement the playbook in Splunk SOAR",
            "examples": [
                "This playbook requires the Splunk SOAR apps for Palo Alto Networks Firewalls, Palo Alto Wildfire, LDAP, and Carbon Black Response."
            ],
            "type": "string"
        },
        "references": {
            "$id": "#/properties/references",
            "additionalItems": true,
            "default": [],
            "description": "A list of references for this playbook",
            "examples": [
                [
                    "https://www.splunk.com/en_us/blog/security/splunk-soar-playbooks-gcp-unusual-service-account-usage.html"
                ]
            ],
            "items": {
                "$id": "#/properties/references/items",
                "default": "",
                "description": "An explanation about the purpose of this instance.",
                "examples": [
                    "https://www.splunk.com/en_us/blog/security/splunk-soar-playbooks-gcp-unusual-service-account-usage.html"
                ],
                "title": "The Items Schema",
                "type": "string"
            },
            "type": "array"
        },
        "id": {
            "$id": "#/properties/id",
            "default": "",
            "description": "UUID as unique identifier",
            "examples":[
                "fb4c31b0-13e8-4155-8aa5-24de4b8d6717"
            ],
            "type": "string"
        },
        "playbook":{
            "$id": "#/properties/playbook",
            "default": "",
            "description": "name of playbook file within same directory without suffix",
            "examples":[
                "ransomware_investigate_and_contain"
            ],
            "type": "string"
        },
        "name": {
            "$id": "#/properties/name",
            "default": "",
            "examples": [
            "Ransomware Investigate and Contain"
            ],
            "title": "name of playbook",
            "type": "string"
        },
        "app_list":{
            "$id": "#/properties/app_list",
            "default": "",
            "examples": [
                "LDAP"
            ],
            "type": "array"
        },
        "tags": {
            "$id": "#/properties/tags",
            "additionalProperties": true,
            "default": {},
            "description": "An array of key value pairs for tagging",
            "examples":[
                {
                    "analytic_story": "Ransomware",
                    "detections": "Conti Common Exec parameter",
                    "platform_tags": "Investigate",
                    "playbook_fields": "Username",
                    "product": "Splunk SOAR",
                    "defend_technique_id": "D3-DA"
                }
            ],
            "minItems": 1,
            "type": "object",
            "uniqueItems": true
        },
        "type":{
            "$id": "#/properties/type",
            "default": "",
            "description": "type of playbook",
            "examples": [
                "Investigation"
            ],
            "items": {
                "enum": [
                    "Investigation",
                    "Response"
                ],
                "type": "string"
            },
            "type": "string"
        },
        "version": {
            "$id": "#/properties/version",
            "default": 0,
            "description": "version of playbook, e.g. 1 or 2...",
            "examples": [
                2
            ],
            "type": "integer"
        }
    },
    "required": [
        "name",
        "id",
        "version",
        "date",
        "description",
        "type",
        "author",
        "playbook",
        "tags"
    ],
    "title": "Playbook schema",
    "type": "object"
}