Skip to content

deployments.spec.md

Latest commit

 

History

History
656 lines (311 loc) · 7.06 KB

deployments.spec.md

File metadata and controls

656 lines (311 loc) · 7.06 KB
Raw

Deployment Schema Schema

http://example.com/example.json

schema for deployment

Abstract Extensible Status Identifiable Custom Properties Additional Properties Defined In
Can be instantiated No Experimental No Forbidden Permitted

Deployment Schema Properties

Property Type Required Nullable Default Defined by
alert_action object Required No {} Deployment Schema (this schema)
date string Required No "" Deployment Schema (this schema)
description string Required No "" Deployment Schema (this schema)
id string Required No "" Deployment Schema (this schema)
name string Required No "" Deployment Schema (this schema)
scheduling object Required No {} Deployment Schema (this schema)
tags object Required No {} Deployment Schema (this schema)
* any Additional Yes this schema allows additional properties

alert_action

Set alert action parameter for search

alert_action

  • is required
  • type: object
  • default: {}
  • defined in this schema

alert_action Type

object with following properties:

Property Type Required Default
email object Optional {}
index object Optional {}
notable object Optional {}

email

By enabling it, an email is sent with the results

email

  • is optional
  • type: object
  • default: {}
email Type

object with following properties:

Property Type Required Default
message string Required ""
subject string Required ""
to string Required ""

message

message of email

message

  • is required
  • type: string
  • default: ""
message Type

string

message Example
Splunk Alert $name$ triggered %fields%

subject

Subject of email

subject

  • is required
  • type: string
  • default: ""
subject Type

string

subject Example
Splunk Alert $name$

to

Recipient of email

to

  • is required
  • type: string
  • default: ""
to Type

string

to Example
test@test.com
email Example
[object Object]

index

By enabling it, the results are stored in another index

index

  • is optional
  • type: object
  • default: {}
index Type

object with following properties:

Property Type Required Default
name string Required ""

name

Name of the index

name

  • is required
  • type: string
  • default: ""
name Type

string

name Example
asx
index Example
[object Object]

notable

By enabling it, a notable is generated

notable

  • is optional
  • type: object
  • default: {}
notable Type

object with following properties:

Property Type Required Default
rule_description string Required ""
rule_title string Required ""

rule_description

Rule description of the notable event

rule_description

  • is required
  • type: string
  • default: ""
rule_description Type

string

rule_description Example
%description%

rule_title

Rule title of the notable event

rule_title

  • is required
  • type: string
  • default: ""
rule_title Type

string

rule_title Example
%name%
notable Example
[object Object]

alert_action Example

{
  "email": {
    "message": "Splunk Alert $name$ triggered %fields%",
    "subject": "Splunk Alert $name$",
    "to": "test@test.com"
  },
  "index": {
    "name": "asx"
  },
  "notable": {
    "rule_description": "%description%",
    "rule_title": "%name%"
  }
}

date

date of creation or modification, format yyyy-mm-dd

date

  • is required
  • type: string
  • default: ""
  • defined in this schema

date Type

string

date Example

"2019-12-06"

description

description of the deployment configuration

description

  • is required
  • type: string
  • default: ""
  • defined in this schema

description Type

string

description Example

"This deployment configuration provides a standard scheduling policy over all rules."

id

uuid as unique identifier

id

  • is required
  • type: string
  • default: ""
  • defined in this schema

id Type

string

id Example

"fb4c31b0-13e8-4155-8aa5-24de4b8d6717"

name

Name of deployment configuration

name

  • is required
  • type: string
  • default: ""
  • defined in this schema

name Type

string

name Example

"Deployment Configuration all Detections"

scheduling

allows to set scheduling parameter

scheduling

  • is required
  • type: object
  • default: {}
  • defined in this schema

scheduling Type

object with following properties:

Property Type Required Default
cron_schedule string Required ""
earliest_time string Required ""
latest_time string Required ""
schedule_window string Optional ""

cron_schedule

Cron schedule to schedule the Splunk searches.

cron_schedule

  • is required
  • type: string
  • default: ""
cron_schedule Type

string

cron_schedule Example
*/10 * * * *

earliest_time

earliest time of search

earliest_time

  • is required
  • type: string
  • default: ""
earliest_time Type

string

earliest_time Example
-10m

latest_time

latest time of search

latest_time

  • is required
  • type: string
  • default: ""
latest_time Type

string

latest_time Example
now

schedule_window

schedule window for search

schedule_window

  • is optional
  • type: string
  • default: ""
schedule_window Type

string

schedule_window Example
auto

scheduling Example

{
  "cron_schedule": "*/10 * * * *",
  "earliest_time": "-10m",
  "latest_time": "now",
  "schedule_window": "auto"
}

tags

An array of key value pairs for tagging

tags

  • is required
  • type: object
  • default: {}
  • defined in this schema

tags Type

object with following properties:

Property Type Required

tags Example

{
  "analytics_story": "credential_dumping"
}