baselines.spec.json

{
  "$id": "https://api.splunkresearch.com/schemas/baselines.json",
  "$schema": "http://json-schema.org/draft-07/schema#",
  "definitions": {
    "phantom": {
      "properties": {
        "phantom_server": {
          "description": "IP address and username of the Phantom server. Currently, we ship these values as automation (hostname) and encourage users to modify them according to their environments: for example, automation (hostname)",
          "examples": [
            "automation (hostname)"
          ],
          "type": "string"
        },
        "playbook_name": {
          "description": "Name of the playbook. This name should be the same as the name on the Phantom community repository on github, with underscores, and appended with \"community/<playbook_name>.\" The playbooks are hosted on https://github.com/phantomcyber/playbooks. For example: community/simple_network_enrichment.",
          "examples": [
            "community/dns_hijack_investigation"
          ],
          "type": "string"
        },
        "playbook_url": {
          "description": "URL of the playbook on the Phantom website",
          "examples": [
            "https://my.phantom.us/4.1/playbook/dns-hijack-investigation/"
          ],
          "type": "string"
        },
        "schedule": {
          "description": "Various fields used to assist in scheduling the search",
          "properties": {
            "cron_schedule": {
              "description": "Schedule of the search in cron format",
              "examples": [
                "0 * * * *"
              ],
              "type": "string"
            },
            "earliest_time": {
              "description": "The earliest time the search should run in Splunk format",
              "examples": [
                "-70m@m"
              ],
              "type": "string"
            },
            "latest_time": {
              "description": "The latest time the search should run again in Splunk format",
              "examples": [
                "-10m@m"
              ],
              "type": "string"
            }
          },
          "type": "object"
        },
        "sensitivity": {
          "description": "TLP colors (White, Green, Amber, or Red)",
          "examples": [
            "green"
          ],
          "type": "string"
        },
        "severity": {
          "description": "Severity in Phantom (High, Medium, Low)",
          "examples": [
            "medium"
          ],
          "type": "string"
        }
      },
      "required": [
        "phantom_server",
        "playbook_name",
        "playbook_url"
      ],
      "type": "object"
    },
    "splunk": {
      "properties": {
        "schedule": {
          "description": "Various fields to assist in scheduling the search",
          "properties": {
            "cron_schedule": {
              "description": "Schedule of the search in cron format",
              "examples": [
                "0 * * * *"
              ],
              "type": "string"
            },
            "earliest_time": {
              "description": "The earliest time the search should run in Splunk format",
              "examples": [
                "-70m@m"
              ],
              "type": "string"
            },
            "latest_time": {
              "description": "The latest time the search should run again in Splunk format",
              "examples": [
                "-10m@m"
              ],
              "type": "string"
            }
          },
          "type": "object"
        },
        "search": {
          "description": "The search (in SPL) executed within Splunk Enterprise for investigation",
          "examples": [
            "| inputlookup discovered_dns_records.csv | rename answer as discovered_answer | join domain[|tstats summariesonly=true count values(DNS.record_type) as type, values(DNS.answer) as current_answer values(DNS.src) as src from datamodel=Network_Resolution where DNS.message_type=RESPONSE DNS.answer!=\"unknown\" DNS.answer!=\"\" by DNS.query | rename DNS.query as query | where query!=\"unknown\" | rex field=query \"(?<domain>\\w+\\.\\w+?)(?:$|/)\"] | makemv delim=\" \" answer |  makemv delim=\" \" type | sort -count | table count,src,domain,type,query,current_answer,discovered_answer | makemv current_answer  | mvexpand current_answer | makemv discovered_answer | eval n=mvfind(discovered_answer, current_answer) | where isnull(n)"
          ],
          "type": "string"
        }
      },
      "required": [
        "search",
        "schedule"
      ],
      "type": "object"
    }
  },
  "description": "The fields that make up the manifest of a version 2 baseline search",
  "properties": {
    "baseline": {
      "anyOf": [
        {
          "required": [
            "splunk"
          ]
        },
        {
          "required": [
            "phantom"
          ]
        }
      ],
      "properties": {
        "phantom": {
          "$ref": "#/definitions/phantom"
        },
        "splunk": {
          "$ref": "#/definitions/splunk"
        }
      },
      "type": "object"
    },
    "creation_date": {
      "description": "The date the baseline manifest was created",
      "examples": [
        "2019-02-14"
      ],
      "type": "string"
    },
    "data_metadata": {
      "description": "Information about the data being ingested",
      "properties": {
        "data_eventtypes": {
          "description": "A list of eventtypes, if any, used by this search",
          "examples": [
            "wineventlog"
          ],
          "items": {
            "type": "string"
          },
          "minItems": 0,
          "type": "array",
          "uniqueItems": true
        },
        "data_models": {
          "description": "A list of data models, if any, used by this search",
          "examples": [
            "Network_Resolution"
          ],
          "items": {
            "enum": [
              "Alerts",
              "Application_State",
              "Authentication",
              "Certificates",
              "Change_Analysis",
              "Change",
              "Cloud_Infrastructure",
              "Malware",
              "Email",
              "Identity_Management",
              "Network_Resolution",
              "Network_Traffic",
              "Vulnerabilities",
              "Web",
              "Network_Sessions",
              "Updates",
              "Risk",
              "Endpoint"
            ]
          },
          "minItems": 0,
          "type": "array",
          "uniqueItems": true
        },
        "data_source": {
          "description": "A high-level description of the type of data needed for this search to complete",
          "examples": [
            "DNS"
          ],
          "items": {
            "type": "string"
          },
          "minItems": 0,
          "type": "array",
          "uniqueItems": true
        },
        "data_sourcetypes": {
          "description": "The list of sourcetypes, if any, used by this search",
          "examples": [
            "stream:dns"
          ],
          "items": {
            "type": "string"
          },
          "minItems": 0,
          "type": "array",
          "uniqueItems": true
        },
        "providing_technologies": {
          "description": "A list of technologies that provide this data",
          "examples": [
            "Bro"
          ],
          "items": {
            "enum": [
              "Apache",
              "AWS",
              "Bro",
              "Microsoft Windows",
              "Linux",
              "macOS",
              "Netbackup",
              "Splunk Enterprise",
              "Splunk Enterprise Security",
              "Splunk Stream",
              "Active Directory",
              "Bluecoat",
              "Carbon Black Response",
              "Carbon Black Protect",
              "CrowdStrike Falcon",
              "Microsoft Exchange",
              "Nessus",
              "Palo Alto Firewall",
              "Qualys",
              "Sysmon",
              "Tanium",
              "Ziften",
              "Censys",
              "Passive Total",
              "WHOIS"
            ]
          },
          "minItems": 0,
          "type": "array",
          "uniqueItems": true
        }
      },
      "required": [
        "data_source",
        "providing_technologies"
      ],
      "type": "object"
    },
    "description": {
      "description": "A description of what the search is is doing to create a baseline",
      "examples": [
        "The search takes corporate and common cloud-provider domains configured under \"cim_corporate_email_domains.csv,\" \"cim_corporate_web_domains.csv,\" and \"cloud_domains.csv,\" finds their responses across the last 30 days from data in the \"Network_Traffic\" data model, then stores the output under the \"discovered_dns_records.csv\" lookup."
      ],
      "type": "string"
    },
    "eli5": {
      "description": "Explain it Like I'm 5: A detailed description of the SPL in the search, written in a style that can be understood by a future Splunk expert.",
      "examples": [
        "Discover the DNS records and their answers for domains owned by the company using network traffic events. The discovered events are exported as a lookup named \"discovered_dns_records.csv.\""
      ],
      "type": "string"
    },
    "entities": {
      "description": "A list of entities that will be used in the story flow or that are relevant to the security investigation.",
      "examples": [
        "dest",
        "user"
      ],
      "items": {
        "enum": [
          "accessKeyId",
          "arn",
          "awsRegion",
          "bucketName",
          "City",
          "Country",
          "dest_port",
          "dest",
          "event_id",
          "instanceId",
          "message_id",
          "networkAclId",
          "process_name",
          "process",
          "recipient",
          "Region",
          "resourceId",
          "session_id",
          "src_ip",
          "src_mac",
          "src_user",
          "src",
          "user",
          "query",
          "answer"
        ]
      },
      "minItems": 0,
      "type": "array",
      "uniqueItems": true
    },
    "how_to_implement": {
      "description": "A discussion of how to implement this search, from what needs to be ingested, config files modified, and suggested per-site modifications",
      "examples": [
        "To successfully implement this search, you must be ingesting DNS logs and populating the Network_Resolution data model. Also make sure that the cim_corporate_web_domains and cim_corporate_email_domains lookups are populated with the domains owned by your corporation."
      ],
      "type": "string"
    },
    "id": {
      "description": "The unique identifier for the search",
      "examples": [
        "c096f721-8842-42ce-bfc7-74bd8c72b7c3"
      ],
      "type": "string"
    },
    "known_false_positives": {
      "description": "Describe the known false postives while the analyst builds the baseline.",
      "examples": [
        "Please vet the lookup created by this baseline search."
      ],
      "type": "string"
    },
    "maintainers": {
      "description": "An array of the current maintainers of the Analytic Story.",
      "items": {
        "properties": {
          "company": {
            "description": "Company associated with the person maintaining this search",
            "examples": [
              "Splunk"
            ],
            "type": "string"
          },
          "email": {
            "description": "Email address of the person maintaining this search",
            "examples": [
              "daftpunk@splunk.com"
            ],
            "type": "string"
          },
          "name": {
            "description": "Name of the person maintaining this search",
            "examples": [
              "Daft Punk"
            ],
            "type": "string"
          }
        },
        "required": [
          "name",
          "email",
          "company"
        ],
        "type": "object"
      },
      "type": "array"
    },
    "modification_date": {
      "description": "The date of the most recent modification to the search",
      "examples": [
        "2019-02-14"
      ],
      "type": "string"
    },
    "name": {
      "description": "The name of the search that creates the baseline",
      "examples": [
        "Discover DNS records"
      ],
      "type": "string"
    },
    "original_authors": {
      "description": "A list of the original authors of the search",
      "items": {
        "properties": {
          "company": {
            "description": "Company associated with the person who originally authored the search",
            "examples": [
              "Splunk"
            ],
            "type": "string"
          },
          "email": {
            "description": "Email address of the person who originally authored the search",
            "examples": [
              "daftpunk@splunk.com"
            ],
            "type": "string"
          },
          "name": {
            "description": "Name of the person who originally authored the search",
            "examples": [
              "Daft Punk"
            ],
            "type": "string"
          }
        },
        "required": [
          "name",
          "email",
          "company"
        ],
        "type": "object"
      },
      "type": "array"
    },
    "spec_version": {
      "description": "The version of the detection search specification this manifest follows",
      "examples": [
        "2.0"
      ],
      "type": "integer"
    },
    "type": {
      "description": "The type of baseline",
      "enum": [
        "splunk",
        "phantom",
        "uba"
      ],
      "examples": [
        "splunk"
      ]
    },
    "version": {
      "description": "The version of the search",
      "examples": [
        "1",
        "2"
      ],
      "type": "string"
    }
  },
  "required": [
    "id",
    "creation_date",
    "data_metadata",
    "eli5",
    "known_false_positives",
    "how_to_implement",
    "maintainers",
    "modification_date",
    "original_authors",
    "name",
    "description",
    "type",
    "spec_version",
    "version",
    "baseline"
  ],
  "title": "Baseline Manifest",
  "type": "object"
}