shashank-elastic
620 lines
14 KiB
JSON
620 lines
14 KiB
JSON
{
|
|
"$schema": "http://json-schema.org/draft-04/schema#",
|
|
"additionalProperties": false,
|
|
"properties": {
|
|
"actions": {
|
|
"items": {
|
|
"type": [
|
|
"string",
|
|
"number",
|
|
"object",
|
|
"array",
|
|
"boolean"
|
|
]
|
|
},
|
|
"type": "array"
|
|
},
|
|
"alert_suppression": {
|
|
"additionalProperties": false,
|
|
"properties": {
|
|
"duration": {
|
|
"additionalProperties": false,
|
|
"properties": {
|
|
"unit": {
|
|
"enum": [
|
|
"s",
|
|
"m",
|
|
"h"
|
|
],
|
|
"enumNames": [],
|
|
"type": "string"
|
|
},
|
|
"value": {
|
|
"description": "AlertSupressionValue",
|
|
"minimum": 1,
|
|
"type": "integer"
|
|
}
|
|
},
|
|
"required": [
|
|
"unit",
|
|
"value"
|
|
],
|
|
"type": "object"
|
|
}
|
|
},
|
|
"required": [
|
|
"duration"
|
|
],
|
|
"type": "object"
|
|
},
|
|
"author": {
|
|
"items": {
|
|
"type": "string"
|
|
},
|
|
"type": "array"
|
|
},
|
|
"building_block_type": {
|
|
"enum": [
|
|
"default"
|
|
],
|
|
"type": "string"
|
|
},
|
|
"data_view_id": {
|
|
"type": "string"
|
|
},
|
|
"description": {
|
|
"type": "string"
|
|
},
|
|
"enabled": {
|
|
"type": "boolean"
|
|
},
|
|
"exceptions_list": {
|
|
"items": {
|
|
"type": [
|
|
"string",
|
|
"number",
|
|
"object",
|
|
"array",
|
|
"boolean"
|
|
]
|
|
},
|
|
"type": "array"
|
|
},
|
|
"false_positives": {
|
|
"items": {
|
|
"type": "string"
|
|
},
|
|
"type": "array"
|
|
},
|
|
"filters": {
|
|
"items": {
|
|
"additionalProperties": false,
|
|
"properties": {
|
|
"$state": {
|
|
"additionalProperties": false,
|
|
"properties": {
|
|
"store": {
|
|
"enum": [
|
|
"appState",
|
|
"globalState"
|
|
],
|
|
"enumNames": [],
|
|
"type": "string"
|
|
}
|
|
},
|
|
"required": [
|
|
"store"
|
|
],
|
|
"type": "object"
|
|
},
|
|
"meta": {
|
|
"additionalProperties": false,
|
|
"properties": {
|
|
"alias": {
|
|
"type": "string"
|
|
},
|
|
"controlledBy": {
|
|
"type": "string"
|
|
},
|
|
"disabled": {
|
|
"type": "boolean"
|
|
},
|
|
"group": {
|
|
"type": "string"
|
|
},
|
|
"index": {
|
|
"type": "string"
|
|
},
|
|
"isMultiIndex": {
|
|
"type": "boolean"
|
|
},
|
|
"key": {
|
|
"type": "string"
|
|
},
|
|
"negate": {
|
|
"type": "boolean"
|
|
},
|
|
"params": {
|
|
"type": "string"
|
|
},
|
|
"type": {
|
|
"type": "string"
|
|
},
|
|
"value": {
|
|
"type": "string"
|
|
}
|
|
},
|
|
"type": "object"
|
|
},
|
|
"query": {
|
|
"anyOf": [
|
|
{
|
|
"additionalProperties": false,
|
|
"properties": {
|
|
"wildcard": {
|
|
"additionalProperties": {
|
|
"additionalProperties": false,
|
|
"properties": {
|
|
"case_insensitive": {
|
|
"type": "boolean"
|
|
},
|
|
"value": {
|
|
"type": "string"
|
|
}
|
|
},
|
|
"required": [
|
|
"case_insensitive",
|
|
"value"
|
|
],
|
|
"type": "object"
|
|
},
|
|
"type": "object"
|
|
}
|
|
},
|
|
"type": "object"
|
|
},
|
|
{
|
|
"additionalProperties": {
|
|
"type": [
|
|
"string",
|
|
"number",
|
|
"object",
|
|
"array",
|
|
"boolean"
|
|
]
|
|
},
|
|
"type": "object"
|
|
}
|
|
]
|
|
}
|
|
},
|
|
"required": [
|
|
"meta"
|
|
],
|
|
"type": "object"
|
|
},
|
|
"type": "array"
|
|
},
|
|
"from": {
|
|
"type": "string"
|
|
},
|
|
"index": {
|
|
"items": {
|
|
"type": "string"
|
|
},
|
|
"type": "array"
|
|
},
|
|
"interval": {
|
|
"description": "Interval",
|
|
"pattern": "^\\d+[mshd]$",
|
|
"type": "string"
|
|
},
|
|
"investigation_fields": {
|
|
"additionalProperties": false,
|
|
"properties": {
|
|
"field_names": {
|
|
"items": {
|
|
"description": "NonEmptyStr",
|
|
"minLength": 1,
|
|
"type": "string"
|
|
},
|
|
"type": "array"
|
|
}
|
|
},
|
|
"required": [
|
|
"field_names"
|
|
],
|
|
"type": "object"
|
|
},
|
|
"language": {
|
|
"enum": [
|
|
"eql",
|
|
"esql",
|
|
"kuery",
|
|
"lucene"
|
|
],
|
|
"enumNames": [],
|
|
"type": "string"
|
|
},
|
|
"license": {
|
|
"type": "string"
|
|
},
|
|
"max_signals": {
|
|
"description": "MaxSignals",
|
|
"minimum": 1,
|
|
"type": "integer"
|
|
},
|
|
"meta": {
|
|
"additionalProperties": {
|
|
"type": [
|
|
"string",
|
|
"number",
|
|
"object",
|
|
"array",
|
|
"boolean"
|
|
]
|
|
},
|
|
"type": "object"
|
|
},
|
|
"name": {
|
|
"description": "RuleName",
|
|
"pattern": "^[a-zA-Z0-9].+?[a-zA-Z0-9\\[\\]()]$",
|
|
"type": "string"
|
|
},
|
|
"note": {
|
|
"description": "MarkdownField",
|
|
"type": "string"
|
|
},
|
|
"query": {
|
|
"type": "string"
|
|
},
|
|
"references": {
|
|
"items": {
|
|
"type": "string"
|
|
},
|
|
"type": "array"
|
|
},
|
|
"related_integrations": {
|
|
"items": {
|
|
"additionalProperties": false,
|
|
"properties": {
|
|
"integration": {
|
|
"description": "NonEmptyStr",
|
|
"minLength": 1,
|
|
"type": "string"
|
|
},
|
|
"package": {
|
|
"description": "NonEmptyStr",
|
|
"minLength": 1,
|
|
"type": "string"
|
|
},
|
|
"version": {
|
|
"description": "NonEmptyStr",
|
|
"minLength": 1,
|
|
"type": "string"
|
|
}
|
|
},
|
|
"required": [
|
|
"package",
|
|
"version"
|
|
],
|
|
"type": "object"
|
|
},
|
|
"min_compat": "8.3",
|
|
"type": "array"
|
|
},
|
|
"required_fields": {
|
|
"items": {
|
|
"additionalProperties": false,
|
|
"properties": {
|
|
"ecs": {
|
|
"type": "boolean"
|
|
},
|
|
"name": {
|
|
"description": "NonEmptyStr",
|
|
"minLength": 1,
|
|
"type": "string"
|
|
},
|
|
"type": {
|
|
"description": "NonEmptyStr",
|
|
"minLength": 1,
|
|
"type": "string"
|
|
}
|
|
},
|
|
"required": [
|
|
"ecs",
|
|
"name",
|
|
"type"
|
|
],
|
|
"type": "object"
|
|
},
|
|
"min_compat": "8.3",
|
|
"type": "array"
|
|
},
|
|
"risk_score": {
|
|
"description": "MaxSignals",
|
|
"maximum": 100,
|
|
"minimum": 1,
|
|
"type": "integer"
|
|
},
|
|
"risk_score_mapping": {
|
|
"items": {
|
|
"additionalProperties": false,
|
|
"properties": {
|
|
"field": {
|
|
"type": "string"
|
|
},
|
|
"operator": {
|
|
"enum": [
|
|
"equals"
|
|
],
|
|
"type": "string"
|
|
},
|
|
"value": {
|
|
"type": "string"
|
|
}
|
|
},
|
|
"required": [
|
|
"field"
|
|
],
|
|
"type": "object"
|
|
},
|
|
"type": "array"
|
|
},
|
|
"rule_id": {
|
|
"description": "UUIDString",
|
|
"pattern": "^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$",
|
|
"type": "string"
|
|
},
|
|
"rule_name_override": {
|
|
"type": "string"
|
|
},
|
|
"setup": {
|
|
"description": "MarkdownField",
|
|
"min_compat": "8.3",
|
|
"type": "string"
|
|
},
|
|
"severity": {
|
|
"enum": [
|
|
"low",
|
|
"medium",
|
|
"high",
|
|
"critical"
|
|
],
|
|
"enumNames": [],
|
|
"type": "string"
|
|
},
|
|
"severity_mapping": {
|
|
"items": {
|
|
"additionalProperties": false,
|
|
"properties": {
|
|
"field": {
|
|
"type": "string"
|
|
},
|
|
"operator": {
|
|
"enum": [
|
|
"equals"
|
|
],
|
|
"type": "string"
|
|
},
|
|
"severity": {
|
|
"type": "string"
|
|
},
|
|
"value": {
|
|
"type": "string"
|
|
}
|
|
},
|
|
"required": [
|
|
"field"
|
|
],
|
|
"type": "object"
|
|
},
|
|
"type": "array"
|
|
},
|
|
"tags": {
|
|
"items": {
|
|
"type": "string"
|
|
},
|
|
"type": "array"
|
|
},
|
|
"threat": {
|
|
"items": {
|
|
"additionalProperties": false,
|
|
"properties": {
|
|
"framework": {
|
|
"enum": [
|
|
"MITRE ATT&CK"
|
|
],
|
|
"type": "string"
|
|
},
|
|
"tactic": {
|
|
"additionalProperties": false,
|
|
"properties": {
|
|
"id": {
|
|
"type": "string"
|
|
},
|
|
"name": {
|
|
"type": "string"
|
|
},
|
|
"reference": {
|
|
"description": "TacticURL",
|
|
"pattern": "^https://attack.mitre.org/tactics/TA[0-9]+/$",
|
|
"type": "string"
|
|
}
|
|
},
|
|
"required": [
|
|
"id",
|
|
"name",
|
|
"reference"
|
|
],
|
|
"type": "object"
|
|
},
|
|
"technique": {
|
|
"items": {
|
|
"additionalProperties": false,
|
|
"properties": {
|
|
"id": {
|
|
"type": "string"
|
|
},
|
|
"name": {
|
|
"type": "string"
|
|
},
|
|
"reference": {
|
|
"description": "TechniqueURL",
|
|
"pattern": "^https://attack.mitre.org/techniques/T[0-9]+/$",
|
|
"type": "string"
|
|
},
|
|
"subtechnique": {
|
|
"items": {
|
|
"additionalProperties": false,
|
|
"properties": {
|
|
"id": {
|
|
"type": "string"
|
|
},
|
|
"name": {
|
|
"type": "string"
|
|
},
|
|
"reference": {
|
|
"description": "SubTechniqueURL",
|
|
"pattern": "^https://attack.mitre.org/techniques/T[0-9]+/[0-9]+/$",
|
|
"type": "string"
|
|
}
|
|
},
|
|
"required": [
|
|
"id",
|
|
"name",
|
|
"reference"
|
|
],
|
|
"type": "object"
|
|
},
|
|
"type": "array"
|
|
}
|
|
},
|
|
"required": [
|
|
"id",
|
|
"name",
|
|
"reference"
|
|
],
|
|
"type": "object"
|
|
},
|
|
"type": "array"
|
|
}
|
|
},
|
|
"required": [
|
|
"framework",
|
|
"tactic"
|
|
],
|
|
"type": "object"
|
|
},
|
|
"type": "array"
|
|
},
|
|
"threshold": {
|
|
"additionalProperties": false,
|
|
"properties": {
|
|
"cardinality": {
|
|
"items": {
|
|
"additionalProperties": false,
|
|
"properties": {
|
|
"field": {
|
|
"type": "string"
|
|
},
|
|
"value": {
|
|
"description": "ThresholdValue",
|
|
"minimum": 1,
|
|
"type": "integer"
|
|
}
|
|
},
|
|
"required": [
|
|
"field",
|
|
"value"
|
|
],
|
|
"type": "object"
|
|
},
|
|
"type": "array"
|
|
},
|
|
"field": {
|
|
"description": "CardinalityFields",
|
|
"items": {
|
|
"description": "NonEmptyStr",
|
|
"minLength": 1,
|
|
"type": "string"
|
|
},
|
|
"maxItems": 3,
|
|
"type": "array"
|
|
},
|
|
"value": {
|
|
"description": "ThresholdValue",
|
|
"minimum": 1,
|
|
"type": "integer"
|
|
}
|
|
},
|
|
"required": [
|
|
"field",
|
|
"value"
|
|
],
|
|
"type": "object"
|
|
},
|
|
"throttle": {
|
|
"type": "string"
|
|
},
|
|
"timeline_id": {
|
|
"description": "TimelineTemplateId",
|
|
"enum": [
|
|
"db366523-f1c6-4c1f-8731-6ce5ed9e5717",
|
|
"91832785-286d-4ebe-b884-1a208d111a70",
|
|
"76e52245-7519-4251-91ab-262fb1a1728c",
|
|
"495ad7a7-316e-4544-8a0f-9c098daee76e",
|
|
"4d4c0b59-ea83-483f-b8c1-8c360ee53c5c",
|
|
"e70679c2-6cde-4510-9764-4823df18f7db",
|
|
"300afc76-072d-4261-864d-4149714bf3f1",
|
|
"3e47ef71-ebfc-4520-975c-cb27fc090799",
|
|
"3e827bab-838a-469f-bd1e-5e19a2bff2fd",
|
|
"4434b91a-94ca-4a89-83cb-a37cdc0532b7"
|
|
],
|
|
"enumNames": [],
|
|
"type": "string"
|
|
},
|
|
"timeline_title": {
|
|
"description": "TimelineTemplateTitle",
|
|
"enum": [
|
|
"Generic Endpoint Timeline",
|
|
"Generic Network Timeline",
|
|
"Generic Process Timeline",
|
|
"Generic Threat Match Timeline",
|
|
"Comprehensive File Timeline",
|
|
"Comprehensive Process Timeline",
|
|
"Comprehensive Network Timeline",
|
|
"Comprehensive Registry Timeline",
|
|
"Alerts Involving a Single User Timeline",
|
|
"Alerts Involving a Single Host Timeline"
|
|
],
|
|
"enumNames": [],
|
|
"type": "string"
|
|
},
|
|
"timestamp_override": {
|
|
"type": "string"
|
|
},
|
|
"to": {
|
|
"type": "string"
|
|
},
|
|
"type": {
|
|
"enum": [
|
|
"threshold"
|
|
],
|
|
"type": "string"
|
|
}
|
|
},
|
|
"required": [
|
|
"author",
|
|
"description",
|
|
"language",
|
|
"name",
|
|
"query",
|
|
"risk_score",
|
|
"rule_id",
|
|
"severity",
|
|
"threshold",
|
|
"type"
|
|
],
|
|
"type": "object"
|
|
} |