security_content/spec/baselines.spec.json at develop · zbraiterman/security_content · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
{
  "$id": "http://example.com/example.json",
  "$schema": "http://json-schema.org/draft-07/schema",
  "additionalProperties": true,
  "description": "schema for baselines",
  "properties": {
    "author": {
      "$id": "#/properties/author",
      "default": "",
      "description": "Author of the baseline",
      "examples": [
        "Bahvin Patel, Splunk"
      ],
      "type": "string"
    },
    "date": {
      "$id": "#/properties/date",
      "default": "",
      "description": "date of creation or modification, format yyyy-mm-dd",
      "examples": [
        "2019-12-06"
      ],
      "type": "string"
    },
    "description": {
      "$id": "#/properties/description",
      "default": "",
      "description": "A detailed description of the baseline ",
      "examples": [
        "This search looks for CloudTrail events where an AWS instance is started and creates a baseline of most recent time (latest) and the first time (earliest) we've seen this region in our dataset grouped by the value awsRegion for the last 30 days"
      ],
      "type": "string"
    },
    "how_to_implement": {
      "$id": "#/properties/how_to_implement",
      "default": "",
      "description": "information about how to implement. Only needed for non standard implementations.",
      "examples": [
        "This search requires Sysmon Logs and a Sysmon configuration, which includes EventCode 10 for lsass.exe."
      ],
      "type": "string"
    },
    "id": {
      "$id": "#/properties/id",
      "default": "",
      "description": "UUID as unique identifier",
      "examples": [
        "fc0edc95-ff2b-48b0-9f6f-63da3789fd63"
      ],
      "type": "string"
    },
    "name": {
      "$id": "#/properties/name",
      "default": "",
      "examples": [
        "Previously Seen AWS Regions"
      ],
      "title": "Name of baseline",
      "type": "string"
    },
    "search": {
      "$id": "#/properties/search",
      "default": "",
      "description": "The Splunk search for the baseline",
      "examples": [
        "cloudtrail StartInstances | stats earliest(_time) as earliest latest(_time) as latest by awsRegion | outputlookup previously_seen_aws_regions.csv"
      ],
      "type": "string"
    },
    "tags": {
      "$id": "#/properties/tags",
      "additionalProperties": true,
      "default": {},
      "description": "An array of key value pairs for tagging",
      "examples": [
        {
          "analytic_story": "suspicious_aws_ec2_activities",
          "custom_key": "custom_value"
        }
      ],
      "minItems": 1,
      "type": "object",
      "uniqueItems": true
    },
    "datamodel": {
      "$id": "#/properties/datamodel",
      "default": "",
      "description": "datamodel used in the search",
      "examples": [
        "Endpoint"
      ],
      "items": {
        "enum": [
          "Endpoint",
          "Network_Traffic",
          "Authentication",
          "Change",
          "Change_Analysis",
          "Email",
          "Endpoint",
          "Network_Resolution",
          "Network_Sessions",
          "Network_Traffic",
          "UEBA",
          "Updates",
          "Vulnerabilities",
          "Web"
        ],
        "type": "string"
      },
      "type": "array"
    },
    "version": {
      "$id": "#/properties/version",
      "default": 0,
      "description": "version of baseline, e.g. 1 or 2 ...",
      "examples": [
        1
      ],
      "type": "integer"
    }
  },
  "required": [
    "name",
    "id",
    "version",
    "date",
    "description",
    "author",
    "search",
    "tags"
  ],
  "title": "Baseline Schema",
  "type": "object"
}