Story.schema.json

{
   "$defs": {
      "AllContentEnum": {
         "description": "Enum for Security Content that is used in production.\n\nNOTE: This enum is dynamically populated at runtime.",
         "enum": [
            "3cx_ioc_domains",
            "Default Baseline",
            "Default EventBasedDetection",
            "ace_access_rights_lookup",
            "ace_flag_lookup",
            "ace_type_lookup",
            "admon",
            "advanced_audit_policy_guids",
            "amazon_security_lake",
            "api_call_by_user_baseline",
            "appdynamics_security",
            "applocker",
            "applockereventcodes",
            "asr_rules",
            "attacker_tools",
            "audit_searches",
            "audittrail",
            "aws_bedrock_claude",
            "aws_cloudwatchlogs_eks",
            "aws_config",
            "aws_description",
            "aws_ecr_users",
            "aws_ecr_users_asl",
            "aws_s3_accesslogs",
            "aws_securityhub_finding",
            "aws_securityhub_firehose",
            "aws_service_accounts",
            "azure_audit",
            "azure_monitor_aad",
            "azure_monitor_activity",
            "azuread",
            "base64decode",
            "baseline_blocked_outbound_connections",
            "bootloader_inventory",
            "brandMonitoring_lookup",
            "brand_abuse_dns",
            "brand_abuse_email",
            "brand_abuse_web",
            "bro_ssl_json",
            "browser_app_list",
            "browser_process_and_path",
            "builtin_groups_lookup",
            "capi2_operational",
            "certificateservices_lifecycle",
            "char_conversion_matrix",
            "circleci",
            "cisco_ai_defense",
            "cisco_asa",
            "cisco_duo_activity",
            "cisco_duo_administrator",
            "cisco_ios",
            "cisco_isovalent",
            "cisco_isovalent_allowed_images",
            "cisco_isovalent_process_connect",
            "cisco_isovalent_process_exec",
            "cisco_network_visibility_module_flowdata",
            "cisco_networks",
            "cisco_sd_wan_service_proxy_access",
            "cisco_sd_wan_syslog",
            "cisco_secure_access_dns",
            "cisco_secure_access_proxy",
            "cisco_secure_firewall",
            "cisco_secure_firewall_appid_remote_mgmt_and_desktop_tools",
            "cisco_secure_firewall_filetype_lookup",
            "cisco_secure_firewall_inside_to_outside",
            "cisco_snort_ids_to_threat_mapping",
            "cloud_api_calls_from_previously_unseen_user_roles_activity_window",
            "cloud_instances_enough_data",
            "cloudtrail",
            "cloudwatch_eks",
            "cloudwatch_vpc",
            "cloudwatchlogs_vpcflow",
            "crowdstrike_identities",
            "crowdstrike_stream",
            "crushftp",
            "decommissioned_buckets",
            "discovered_dns_records",
            "domain_admins",
            "domains",
            "driverinventory",
            "dynamic_dns_providers",
            "dynamic_dns_providers_default",
            "dynamic_dns_providers_local",
            "dynamic_dns_web_traffic",
            "ec2_modification_api_calls",
            "esxi_syslog",
            "evilginx_phishlets_0365",
            "evilginx_phishlets_amazon",
            "evilginx_phishlets_aws",
            "evilginx_phishlets_facebook",
            "evilginx_phishlets_github",
            "evilginx_phishlets_google",
            "evilginx_phishlets_outlook",
            "excluded_cloud_binaries",
            "executable_extensions",
            "f5_bigip_rogue",
            "fillnull_config",
            "filter_rare_process_allow_list",
            "github",
            "github_enterprise",
            "github_known_users",
            "github_organizations",
            "google_gcp_pubnet_message",
            "google_gcp_pubsub_message",
            "gsuite_calendar",
            "gsuite_drive",
            "gsuite_gmail",
            "gws_login_mfa_methods",
            "gws_reports_admin",
            "gws_reports_login",
            "hijacklibs",
            "hijacklibs_loaded",
            "iis_get_webglobalmodule",
            "iis_operational_logs",
            "images_to_repository",
            "important_audit_policy_subcategory_guids",
            "is_net_windows_file",
            "is_net_windows_file_macro",
            "is_nirsoft_software",
            "is_nirsoft_software_macro",
            "is_suspicious_file_extension_lookup",
            "is_windows_system_file",
            "is_windows_system_file_macro",
            "ivanti_vtm_audit",
            "k8s_container_network_io_baseline",
            "k8s_container_network_io_ratio_baseline",
            "k8s_process_resource_baseline",
            "k8s_process_resource_ratio_baseline",
            "kube_allowed_images",
            "kube_allowed_locations",
            "kube_allowed_user_agents",
            "kube_allowed_user_groups",
            "kube_allowed_user_names",
            "kube_audit",
            "kube_container_falco",
            "kube_objects_events",
            "kubernetes_azure",
            "kubernetes_container_controller",
            "kubernetes_metrics",
            "legit_domains",
            "linux_auditd",
            "linux_auditd_normalized_execve_process",
            "linux_auditd_normalized_proctitle_process",
            "linux_hosts",
            "linux_offsec_tool_processes",
            "linux_shells",
            "linux_tool_discovery_process",
            "local_file_inclusion_paths",
            "lolbas_file_path",
            "loldrivers",
            "lookup_rare_process_allow_list_default",
            "lookup_rare_process_allow_list_local",
            "lookup_uncommon_processes_default",
            "lookup_uncommon_processes_local",
            "m365_copilot_graph_api",
            "m365_exported_ediscovery_prompt_logs",
            "malicious_powershell_strings",
            "malware_user_agents",
            "mandatory_job_for_workflow",
            "mandatory_step_for_job",
            "mcp_server",
            "moveit_sftp_logs",
            "ms365_defender_incident_alerts",
            "ms_defender",
            "ms_defender_atp_alerts",
            "msad_guid_lookup",
            "msexchange_management",
            "netbackup",
            "network_acl_activity_baseline",
            "network_acl_events",
            "nginx_access_logs",
            "non_public_ip_blocks",
            "normalized_service_binary_field",
            "ntlm_audit",
            "o365_graph",
            "o365_management_activity",
            "o365_messagetrace",
            "o365_suspect_search_terms_regex",
            "okta",
            "oldsummaries_config",
            "ollama_server",
            "osquery_macro",
            "osquery_process",
            "papercutng",
            "path_traversal_spl_injection",
            "pingid",
            "potential_password_in_username_false_positive_reduction",
            "potentially_malicious_code_on_cmdline_tokenize_score",
            "powershell",
            "previously_seen_S3_access_from_remote_ip",
            "previously_seen_api_calls_from_user_roles",
            "previously_seen_aws_cross_account_activity",
            "previously_seen_aws_regions",
            "previously_seen_cloud_api_calls_per_user_role",
            "previously_seen_cloud_api_calls_per_user_role_forget_window",
            "previously_seen_cloud_compute_creations_by_user",
            "previously_seen_cloud_compute_creations_by_user_search_window_begin_offset",
            "previously_seen_cloud_compute_image_search_window_begin_offset",
            "previously_seen_cloud_compute_images",
            "previously_seen_cloud_compute_images_forget_window",
            "previously_seen_cloud_compute_instance_type_forget_window",
            "previously_seen_cloud_compute_instance_types",
            "previously_seen_cloud_compute_instance_types_search_window_begin_offset",
            "previously_seen_cloud_instance_modifications_by_user",
            "previously_seen_cloud_instance_modifications_by_user_search_window_begin_offset",
            "previously_seen_cloud_provisioning_activity_forget_window",
            "previously_seen_cloud_provisioning_activity_sources",
            "previously_seen_cloud_region_forget_window",
            "previously_seen_cloud_regions",
            "previously_seen_cloud_regions_search_window_begin_offset",
            "previously_seen_cmd_line_arguments",
            "previously_seen_ec2_amis_lookup",
            "previously_seen_ec2_instance_types_lookup",
            "previously_seen_ec2_launches_by_user_lookup",
            "previously_seen_ec2_modifications_by_user",
            "previously_seen_gcp_storage_access_from_remote_ip",
            "previously_seen_provisioning_activity_src",
            "previously_seen_running_windows_services",
            "previously_seen_users_console_logins",
            "previously_seen_windows_services_forget_window",
            "previously_seen_windows_services_window",
            "previously_seen_zoom_child_processes_forget_window",
            "previously_seen_zoom_child_processes_window",
            "previously_unseen_cloud_provisioning_activity_window",
            "printservice",
            "privileged_azure_ad_roles",
            "process_auditpol",
            "process_bitsadmin",
            "process_certutil",
            "process_cmd",
            "process_copy",
            "process_csc",
            "process_cscript",
            "process_curl",
            "process_diskshadow",
            "process_dllhost",
            "process_dsquery",
            "process_dxdiag",
            "process_esentutl",
            "process_fodhelper",
            "process_gpupdate",
            "process_hh",
            "process_installutil",
            "process_microsoftworkflowcompiler",
            "process_msbuild",
            "process_mshta",
            "process_msiexec",
            "process_net",
            "process_netsh",
            "process_nltest",
            "process_ntdsutil",
            "process_office_products",
            "process_office_products_parent",
            "process_ping",
            "process_powershell",
            "process_procdump",
            "process_psexec",
            "process_rclone",
            "process_reg",
            "process_regasm",
            "process_regedit",
            "process_regsvcs",
            "process_regsvr32",
            "process_route",
            "process_runas",
            "process_rundll32",
            "process_sc",
            "process_schtasks",
            "process_sdelete",
            "process_setspn",
            "process_sqlcmd",
            "process_verclsid",
            "process_vssadmin",
            "process_wbadmin",
            "process_wermgr",
            "process_wmic",
            "process_wscript",
            "prohibited_apps_launching_cmd",
            "prohibited_apps_launching_cmd_macro",
            "prohibited_processes",
            "prohibited_softwares",
            "pua_named_pipes",
            "pua_user_agents",
            "ransomware_extensions",
            "ransomware_extensions_lookup",
            "ransomware_notes",
            "ransomware_notes_lookup",
            "remote_access_software",
            "remote_access_software_exceptions",
            "remote_access_software_usage_exceptions",
            "remoteconnectionmanager",
            "remove_valid_domains",
            "risk_index",
            "rmm_user_agents",
            "s3_accesslogs",
            "s3_deletion_baseline",
            "scripting_tools_user_agents",
            "secureapp_attack",
            "secureapp_es_field_mappings",
            "security_content_ctime",
            "security_content_summariesonly",
            "security_group_activity_baseline",
            "security_group_api_calls",
            "security_services_lookup",
            "splunk_crash_log",
            "splunk_python",
            "splunk_risky_command",
            "splunkd",
            "splunkd_failed_auths",
            "splunkd_investigation_rest_handler",
            "splunkd_ui",
            "splunkd_web",
            "splunkd_webs",
            "splunkd_webx",
            "splunkda",
            "sslbl_ssl_certificate_blacklist",
            "stream_dns",
            "stream_http",
            "stream_tcp",
            "subjectinterfacepackage",
            "summariesonly_config",
            "suricata",
            "suspicious_c2_named_pipes",
            "suspicious_c2_user_agents",
            "suspicious_email_attachments",
            "suspicious_named_pipes",
            "suspicious_ports_list",
            "suspicious_rmm_named_pipes",
            "suspicious_writes",
            "suspicious_writes_lookup",
            "sysmon",
            "system_network_configuration_discovery_tools",
            "threat_snort_count",
            "typo_squatted_python_packages",
            "uacbypass_process_name",
            "uncommon_processes",
            "windchill_log4j",
            "windows_exchange_iis",
            "windows_protocol_handlers",
            "windows_shells",
            "windows_suspicious_services",
            "windows_suspicious_tasks",
            "wineventlog_application",
            "wineventlog_appxdeploymentserver",
            "wineventlog_appxpackaging",
            "wineventlog_rdp",
            "wineventlog_security",
            "wineventlog_system",
            "wineventlog_task_scheduler",
            "wmi",
            "zeek_rpc",
            "zeek_ssl",
            "zeek_x509",
            "zoom_first_time_child_process",
            "zoom_index",
            "zscaler_proxy"
         ],
         "title": "AllContentEnum",
         "type": "string"
      },
      "DeprecationInfo": {
         "additionalProperties": false,
         "description": "Information required for the deprecation and removal of a Security Content Object.",
         "properties": {
            "reason": {
               "description": "The reason this content is scheduled for removal",
               "title": "Reason",
               "type": "string"
            },
            "removed_in_version": {
               "description": "The version in which this content will be removed. That means it should be present in older versions, but no longer present starting with this version. If it is still present in this version of the app, a validation error will be generated at build time.",
               "examples": [
                  "1.0.0",
                  "2.1.3",
                  "1.0.0-beta.1"
               ],
               "format": "version",
               "title": "Removed In Version",
               "type": "string"
            },
            "replacement_content": {
               "description": "Any appropriate content that may replace this piece of content.",
               "items": {
                  "$ref": "#/$defs/AllContentEnum"
               },
               "title": "Replacement Content",
               "type": "array",
               "uniqueItems": true
            }
         },
         "required": [
            "reason",
            "removed_in_version"
         ],
         "title": "DeprecationInfo",
         "type": "object"
      },
      "StoryCategory": {
         "description": "Enum for story categories.\n\nTODO: Provide information and authoritative documentation around where these are defined in Enterprise Security or how they render.",
         "enum": [
            "Abuse",
            "Adversary Tactics",
            "Best Practices",
            "Cloud Security",
            "Compliance",
            "Malware",
            "Uncategorized",
            "Vulnerability",
            "Account Compromise",
            "Data Destruction",
            "Lateral Movement",
            "Privilege Escalation",
            "Ransomware",
            "Unauthorized Software"
         ],
         "title": "StoryCategory",
         "type": "string"
      },
      "StoryUseCase": {
         "description": "Enum for story use cases.\n\nTODO: Provide information and authoritative documentation around where these\nare defined in Enterprise Security or how they render.",
         "enum": [
            "Fraud Detection",
            "Compliance",
            "Application Security",
            "Security Monitoring",
            "Advanced Threat Detection",
            "Insider Threat",
            "Other"
         ],
         "title": "StoryUseCase",
         "type": "string"
      }
   },
   "additionalProperties": false,
   "description": "Represents an Analytic Story object.\n\nAnalytic Stories are collections of related detections around a common theme.\nFor example, they may help with finding evidence of exploitation around a common\ncategory, like Ransomware or Powershell abuse, or related actions by a\nThreat Actor or CVE.",
   "properties": {
      "name": {
         "description": "Each Security Content Object must have a unique name. Due to issues with how local/default stanzas are merged in the Splunk products, these names MUST NOT change between subsequent releases of content packs.",
         "title": "Name",
         "type": "string"
      },
      "id": {
         "description": "Each Security Content Object must have a unique identifier. This is particularly important when leveraging many of the Content Versioning features built into Enterprise Security 8+. Unique ids may be generated with a python command such as `uuid.uuid4()` or similar.",
         "format": "uuid",
         "title": "Id",
         "type": "string"
      },
      "version": {
         "description": "The version of this object. This number MUST be incremented in the following circumstances:\n1. Any time the object in this file is modified\n2. Any time that the serialization logic for this object changes, changing what is written in its conf file stanza(s)\n3. Any time that an object this object references, for example via enrichment, causes a change in its associated conf file stanzas(s).\nThis final determination is challenging to make manually, so the `contentctl inspect command` will help identify when this a version increment is required.",
         "exclusiveMinimum": 0,
         "title": "Version",
         "type": "integer"
      },
      "creation_date": {
         "description": "The date that this object was created. This should NEVER be updated.",
         "format": "date",
         "title": "Creation Date",
         "type": "string"
      },
      "modification_date": {
         "description": "The date that this object was last modified. This should be updated whenever the object is modified.",
         "format": "date",
         "title": "Modification Date",
         "type": "string"
      },
      "author": {
         "description": "The author of this object. This is a freeform string that can be used to identify the author of the object. It will eventually be replaced by a more detailed Contributors list.",
         "title": "Author",
         "type": "string"
      },
      "description": {
         "description": "A description of the Security Content Object. This should be a human-readable description of the object, including its purpose.",
         "title": "Description",
         "type": "string"
      },
      "references": {
         "description": "A list of references to external resources that are relevant to this object. This can include links to documentation, blog posts, or other resources that provide additional context or information about the object.",
         "items": {
            "format": "uri",
            "maxLength": 2083,
            "minLength": 1,
            "type": "string"
         },
         "minItems": 0,
         "title": "References",
         "type": "array",
         "uniqueItems": true
      },
      "deprecation_info": {
         "anyOf": [
            {
               "$ref": "#/$defs/DeprecationInfo"
            },
            {
               "type": "null"
            }
         ],
         "default": null,
         "description": "Information about the deprecation of this object."
      },
      "status": {
         "description": "The status of this Story. It may only be 'production' or 'deprecated'. Only RemovedContent will have status 'removed' and there is no notion of an 'experimental' story.",
         "enum": [
            "production",
            "deprecated"
         ],
         "title": "Status",
         "type": "string"
      },
      "narrative": {
         "description": "The narrative is a much more verbose than just the description field (which tends to be more brief). It gives far more detail about the Analytic Story.",
         "title": "Narrative",
         "type": "string"
      },
      "category": {
         "description": "The category of the story. WARNING - due to limitations in the allowed values in analyticstories.conf, only the first category will be serialized into analyticstories.conf. This behavior was present in legacy contentctl as well. This single value can be accessed via the 'category_single_value' property, which returns the first value in this list.",
         "items": {
            "$ref": "#/$defs/StoryCategory"
         },
         "minItems": 1,
         "title": "Category",
         "type": "array"
      },
      "usecase": {
         "$ref": "#/$defs/StoryUseCase",
         "description": "The use case of the story."
      },
      "threat_group": {
         "description": "A list of groups who leverage the techniques list in this Analytic Story.",
         "items": {
            "type": "string"
         },
         "title": "Threat Group",
         "type": "array"
      },
      "product": {
         "description": "A set of Splunk products where this story is applicable.",
         "items": {
            "enum": [
               "Splunk Enterprise",
               "Splunk Enterprise Security",
               "Splunk Cloud",
               "Splunk Behavioral Analytics"
            ],
            "type": "string"
         },
         "minItems": 1,
         "title": "Product",
         "type": "array",
         "uniqueItems": true
      },
      "cve": {
         "description": "A set of one or more CVEs that are associated with this Detection.",
         "items": {
            "pattern": "^CVE-\\d{4}-\\d{4,7}$",
            "type": "string"
         },
         "minItems": 0,
         "title": "Cve",
         "type": "array",
         "uniqueItems": true
      }
   },
   "required": [
      "name",
      "id",
      "version",
      "creation_date",
      "modification_date",
      "author",
      "description",
      "status",
      "narrative",
      "category",
      "usecase",
      "product"
   ],
   "title": "Story",
   "type": "object"
}