response_tasks.md

Response Schema Schema

https://raw.githubusercontent.com/splunk/security_content/develop/docs/spec/response_tasks.spec.json

schema for response task

Abstract	Extensible	Status	Identifiable	Custom Properties	Additional Properties	Access Restrictions	Defined In
Can be instantiated	No	Unknown status	No	Forbidden	Allowed	none	response_tasks.spec.json

Response Schema Type

object (Response Schema)

Response Schema Default Value

The default value is:

{}

Response Schema Properties

Property	Type	Required	Nullable	Defined by
author	string	Required	cannot be null	Response Schema
date	string	Required	cannot be null	Response Schema
description	string	Required	cannot be null	Response Schema
id	string	Required	cannot be null	Response Schema
name	string	Required	cannot be null	Response Schema
sla	integer	Optional	cannot be null	Response Schema
sla_type	string	Optional	cannot be null	Response Schema
automation	object	Optional	cannot be null	Response Schema
tags	object	Required	cannot be null	Response Schema
version	integer	Required	cannot be null	Response Schema
references	array	Optional	cannot be null	Response Schema
Additional Properties	Any	Optional	can be null

author

Author of the response task

author

• is required

• Type: string

• cannot be null

• defined in: Response Schema

author Type

string

author Examples

ButterCup, Splunk

date

date of creation or modification, format yyyy-mm-dd

date

• is required

• Type: string

• cannot be null

• defined in: Response Schema

date Type

string

date Examples

'2019-12-06'

description

Description of response task

description

• is required

• Type: string

• cannot be null

• defined in: Response Schema

description Type

string

description Examples

Response example.

id

UUID as unique identifier

id

• is required

• Type: string

• cannot be null

• defined in: Response Schema

id Type

string

id Examples

fb4c31b0-13e8-4155-8aa5-24de4b8d6717

name

Name of response task

name

• is required

• Type: string

• cannot be null

• defined in: Response Schema

name Type

string

name Examples

Response Example

sla

Measured integer for Service Level Agreement for completion of the phase

sla

• is optional

• Type: integer

• cannot be null

• defined in: Response Schema

sla Type

integer

sla Examples

5

30

sla_type

Duration for measured integer for Service Level Agreement for completion of the phase (e.g. minutes, or hours, etc)

sla_type

• is optional

• Type: string

• cannot be null

• defined in: Response Schema

sla_type Type

string

sla_type Default Value

The default value is:

"minutes"

sla_type Examples

minutes

hours

days

automation

An array of key value pairs for defining actions and playbooks

automation

• is optional

• Type: object (Details)

• cannot be null

• defined in: Response Schema

automation Type

object (Details)

automation Constraints

minimum number of items: the minimum number of items for this array is: 1

unique items: all items in this array must be unique. Duplicates are not allowed.

automation Default Value

The default value is:

{
  "is_note_required": false,
  "sla_type": "minutes",
  "sla": "",
  "role": "",
  "action": [],
  "playbooks": []
}

automation Examples

is_note_required: false
sla_type: minutes
sla: 30
action:
  - run_query
playbooks:
  - scm: local
    playbook: automate something
  - scm: local
    playbook: automate something else

tags

An array of key value pairs for tagging

tags

• is required

• Type: object (Details)

• cannot be null

• defined in: Response Schema

tags Type

object (Details)

tags Constraints

minimum number of items: the minimum number of items for this array is: 1

unique items: all items in this array must be unique. Duplicates are not allowed.

tags Default Value

The default value is:

{}

tags Examples

analytic_story: credential_dumping

version

version of detection, e.g. 1 or 2 ...

version

• is required

• Type: integer

• cannot be null

• defined in: Response Schema

version Type

integer

version Examples

1

references

A list of references for this response, phase or task (e.g. web or printed citation)

references

• is optional

• Type: string[] (Blue Team Handbook by Don Murdoch - Amazon)

• cannot be null

• defined in: Response Schema

references Type

string[] (Blue Team Handbook by Don Murdoch - Amazon)

references Default Value

The default value is:

[]

references Examples

- Blue Team Handbook by Don Murdoch - Alarm Triage Overview pages 146-148
- https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-61r2.pdf

Additional Properties

Additional properties are allowed and do not have to follow a specific schema