security_content/schemas/FilebackedMacro.schema.json at develop · splunk/security_content · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
{
   "additionalProperties": false,
   "description": "Represents a Macro object. The macro objects are backed by YML files.\n\nMacros may be used in SPL searches and, if they exist in searches,\nthey are found and ensured to exist at runtime validation time.\n\nTODO: At this time, 'nested' macros are not validated.\nThis means that contentctl will not validate macros that\nare used within other macros.",
   "properties": {
      "name": {
         "description": "The name of the macro.",
         "title": "Name",
         "type": "string"
      },
      "id": {
         "description": "Each Security Content Object must have a unique identifier. This is particularly important when leveraging many of the Content Versioning features built into Enterprise Security 8+. Unique ids may be generated with a python command such as `uuid.uuid4()` or similar.",
         "format": "uuid",
         "title": "Id",
         "type": "string"
      },
      "version": {
         "description": "The version of this object. This number MUST be incremented in the following circumstances:\n1. Any time the object in this file is modified\n2. Any time that the serialization logic for this object changes, changing what is written in its conf file stanza(s)\n3. Any time that an object this object references, for example via enrichment, causes a change in its associated conf file stanzas(s).\nThis final determination is challenging to make manually, so the `contentctl inspect command` will help identify when this a version increment is required.",
         "exclusiveMinimum": 0,
         "title": "Version",
         "type": "integer"
      },
      "creation_date": {
         "description": "The date that this object was created. This should NEVER be updated.",
         "format": "date",
         "title": "Creation Date",
         "type": "string"
      },
      "modification_date": {
         "description": "The date that this object was last modified. This should be updated whenever the object is modified.",
         "format": "date",
         "title": "Modification Date",
         "type": "string"
      },
      "author": {
         "description": "The author of this object. This is a freeform string that can be used to identify the author of the object. It will eventually be replaced by a more detailed Contributors list.",
         "title": "Author",
         "type": "string"
      },
      "description": {
         "description": "The description of the macro. This can be either human-generated, in the case of FilebackedMacros, or is a static string in the case of filter macros.",
         "title": "Description",
         "type": "string"
      },
      "references": {
         "description": "A list of references to external resources that are relevant to this object. This can include links to documentation, blog posts, or other resources that provide additional context or information about the object.",
         "items": {
            "format": "uri",
            "maxLength": 2083,
            "minLength": 1,
            "type": "string"
         },
         "minItems": 0,
         "title": "References",
         "type": "array",
         "uniqueItems": true
      },
      "definition": {
         "description": "The definition of the macro.\nWARNING - NESTED MACROS ARE NOT VALIDATED - USE THEM AT YOUR OWN RISK. ",
         "minLength": 1,
         "title": "Definition",
         "type": "string"
      },
      "arguments": {
         "description": "A list of arguments for the macro. These are the names of the arguments that are expected to be passed to the macro. Note that not every macro requires 1 or more arguments.",
         "items": {
            "type": "string"
         },
         "title": "Arguments",
         "type": "array"
      }
   },
   "required": [
      "name",
      "id",
      "version",
      "creation_date",
      "modification_date",
      "author",
      "description",
      "definition"
   ],
   "title": "FilebackedMacro",
   "type": "object"
}