Skip to content

Commit 5c48ed6

Browse files
mtyzzmtyzz
authored
XDR-15964 add detection_sources to incident (#457)
Epic: https://cisco-sbg.atlassian.net/browse/XDR-15686 Closes: https://cisco-sbg.atlassian.net/browse/XDR-15694 Summary: Adds optional `detection_sources` field to the Incident object. `detection_sources` differs from `source` in that `source` is the promoter of the incident, whereas `detection_sources` is the a set of aggregated sources of detections, such as sightings, that are found in the incident. This is meant be a searchable field on the Incidents List in the UI (see the epic above) and as such must be available via Lucene query. Local generative and testing steps: 1. Ran `lein doc` and commited results 2. Ran `lein test`, which passed
1 parent 8db5084 commit 5c48ed6

26 files changed

+106
-64
lines changed

‎doc/json/actor.json

+1-1
Original file line numberDiff line numberDiff line change
@@ -26,7 +26,7 @@
2626
"motivation" : "Ego",
2727
"planning_and_operational_support" : "string",
2828
"revision" : 10,
29-
"schema_version" : "1.3.20",
29+
"schema_version" : "1.3.21",
3030
"short_description" : "string",
3131
"sophistication" : "Aspirant",
3232
"source" : "string",

‎doc/json/asset.json

+1-1
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,7 @@
1212
"id" : "string",
1313
"language" : "string",
1414
"revision" : 10,
15-
"schema_version" : "1.3.20",
15+
"schema_version" : "1.3.21",
1616
"short_description" : "string",
1717
"source" : "string",
1818
"source_uri" : "string",

‎doc/json/asset_mapping.json

+1-1
Original file line numberDiff line numberDiff line change
@@ -17,7 +17,7 @@
1717
"value" : "1.2.3.4"
1818
},
1919
"revision" : 10,
20-
"schema_version" : "1.3.20",
20+
"schema_version" : "1.3.21",
2121
"source" : "string",
2222
"source_uri" : "string",
2323
"specificity" : "Low",

‎doc/json/asset_properties.json

+1-1
Original file line numberDiff line numberDiff line change
@@ -15,7 +15,7 @@
1515
"value" : "string"
1616
} ],
1717
"revision" : 10,
18-
"schema_version" : "1.3.20",
18+
"schema_version" : "1.3.21",
1919
"source" : "string",
2020
"source_uri" : "string",
2121
"timestamp" : "2016-01-01T01:01:01.000Z",

‎doc/json/attack_pattern.json

+1-1
Original file line numberDiff line numberDiff line change
@@ -16,7 +16,7 @@
1616
} ],
1717
"language" : "string",
1818
"revision" : 10,
19-
"schema_version" : "1.3.20",
19+
"schema_version" : "1.3.21",
2020
"short_description" : "string",
2121
"source" : "string",
2222
"source_uri" : "string",

‎doc/json/bundle.json

+23-22
Original file line numberDiff line numberDiff line change
@@ -28,7 +28,7 @@
2828
"motivation" : "Ego",
2929
"planning_and_operational_support" : "string",
3030
"revision" : 10,
31-
"schema_version" : "1.3.20",
31+
"schema_version" : "1.3.21",
3232
"short_description" : "string",
3333
"sophistication" : "Aspirant",
3434
"source" : "string",
@@ -62,7 +62,7 @@
6262
"value" : "1.2.3.4"
6363
},
6464
"revision" : 10,
65-
"schema_version" : "1.3.20",
65+
"schema_version" : "1.3.21",
6666
"source" : "string",
6767
"source_uri" : "string",
6868
"specificity" : "Low",
@@ -92,7 +92,7 @@
9292
"value" : "string"
9393
} ],
9494
"revision" : 10,
95-
"schema_version" : "1.3.20",
95+
"schema_version" : "1.3.21",
9696
"source" : "string",
9797
"source_uri" : "string",
9898
"timestamp" : "2016-01-01T01:01:01.000Z",
@@ -119,7 +119,7 @@
119119
"id" : "string",
120120
"language" : "string",
121121
"revision" : 10,
122-
"schema_version" : "1.3.20",
122+
"schema_version" : "1.3.21",
123123
"short_description" : "string",
124124
"source" : "string",
125125
"source_uri" : "string",
@@ -151,7 +151,7 @@
151151
} ],
152152
"language" : "string",
153153
"revision" : 10,
154-
"schema_version" : "1.3.20",
154+
"schema_version" : "1.3.21",
155155
"short_description" : "string",
156156
"source" : "string",
157157
"source_uri" : "string",
@@ -185,7 +185,7 @@
185185
"language" : "string",
186186
"names" : [ "string" ],
187187
"revision" : 10,
188-
"schema_version" : "1.3.20",
188+
"schema_version" : "1.3.21",
189189
"short_description" : "string",
190190
"source" : "string",
191191
"source_uri" : "string",
@@ -259,7 +259,7 @@
259259
"source" : "string"
260260
} ],
261261
"revision" : 10,
262-
"schema_version" : "1.3.20",
262+
"schema_version" : "1.3.21",
263263
"short_description" : "string",
264264
"source" : "string",
265265
"source_uri" : "string",
@@ -297,7 +297,7 @@
297297
"revision" : 10,
298298
"row_count" : 10,
299299
"rows" : [ [ "anything" ] ],
300-
"schema_version" : "1.3.20",
300+
"schema_version" : "1.3.21",
301301
"short_description" : "string",
302302
"source" : "string",
303303
"source_uri" : "string",
@@ -335,7 +335,7 @@
335335
"language" : "string",
336336
"reason" : "string",
337337
"revision" : 10,
338-
"schema_version" : "1.3.20",
338+
"schema_version" : "1.3.21",
339339
"source" : "string",
340340
"source_uri" : "string",
341341
"timestamp" : "2016-01-01T01:01:01.000Z",
@@ -366,7 +366,7 @@
366366
},
367367
"language" : "string",
368368
"revision" : 10,
369-
"schema_version" : "1.3.20",
369+
"schema_version" : "1.3.21",
370370
"source" : "string",
371371
"source_uri" : "string",
372372
"timestamp" : "2016-01-01T01:01:01.000Z",
@@ -383,6 +383,7 @@
383383
"categories" : [ "Attrition" ],
384384
"confidence" : "High",
385385
"description" : "string",
386+
"detection_sources" : [ "string" ],
386387
"discovery_method" : "Agent Disclosure",
387388
"external_ids" : [ "string" ],
388389
"external_references" : [ {
@@ -408,7 +409,7 @@
408409
},
409410
"promotion_method" : "Automated",
410411
"revision" : 10,
411-
"schema_version" : "1.3.20",
412+
"schema_version" : "1.3.21",
412413
"scores" : {
413414
"asset" : 10.0
414415
},
@@ -451,7 +452,7 @@
451452
"negate" : true,
452453
"producer" : "string",
453454
"revision" : 10,
454-
"schema_version" : "1.3.20",
455+
"schema_version" : "1.3.21",
455456
"severity" : "Critical",
456457
"short_description" : "string",
457458
"source" : "string",
@@ -500,7 +501,7 @@
500501
"reason" : "string",
501502
"reason_uri" : "string",
502503
"revision" : 10,
503-
"schema_version" : "1.3.20",
504+
"schema_version" : "1.3.21",
504505
"severity" : "Critical",
505506
"source" : "string",
506507
"source_uri" : "string",
@@ -533,7 +534,7 @@
533534
"labels" : [ "adware" ],
534535
"language" : "string",
535536
"revision" : 10,
536-
"schema_version" : "1.3.20",
537+
"schema_version" : "1.3.21",
537538
"short_description" : "string",
538539
"source" : "string",
539540
"source_uri" : "string",
@@ -563,7 +564,7 @@
563564
"entity_type" : "string"
564565
} ],
565566
"revision" : 10,
566-
"schema_version" : "1.3.20",
567+
"schema_version" : "1.3.21",
567568
"source" : "string",
568569
"source_uri" : "string",
569570
"timestamp" : "2016-01-01T01:01:01.000Z",
@@ -585,7 +586,7 @@
585586
"language" : "string",
586587
"relationship_type" : "attributed-to",
587588
"revision" : 10,
588-
"schema_version" : "1.3.20",
589+
"schema_version" : "1.3.21",
589590
"short_description" : "string",
590591
"source" : "string",
591592
"source_ref" : "string",
@@ -597,7 +598,7 @@
597598
"type" : "relationship"
598599
} ],
599600
"revision" : 10,
600-
"schema_version" : "1.3.20",
601+
"schema_version" : "1.3.21",
601602
"short_description" : "string",
602603
"sighting_refs" : [ "string" ],
603604
"sightings" : [ {
@@ -865,7 +866,7 @@
865866
} ],
866867
"resolution" : "detected",
867868
"revision" : 10,
868-
"schema_version" : "1.3.20",
869+
"schema_version" : "1.3.21",
869870
"sensor" : "endpoint",
870871
"sensor_coordinates" : {
871872
"observables" : [ {
@@ -912,7 +913,7 @@
912913
"id" : "string",
913914
"language" : "string",
914915
"revision" : 10,
915-
"schema_version" : "1.3.20",
916+
"schema_version" : "1.3.21",
916917
"short_description" : "string",
917918
"source" : "string",
918919
"source_uri" : "string",
@@ -958,7 +959,7 @@
958959
"labels" : [ "credential-exploitation" ],
959960
"language" : "string",
960961
"revision" : 10,
961-
"schema_version" : "1.3.20",
962+
"schema_version" : "1.3.21",
962963
"short_description" : "string",
963964
"source" : "string",
964965
"source_uri" : "string",
@@ -1099,7 +1100,7 @@
10991100
"last_modified_date" : "2016-01-01T01:01:01.000Z",
11001101
"published_date" : "2016-01-01T01:01:01.000Z",
11011102
"revision" : 10,
1102-
"schema_version" : "1.3.20",
1103+
"schema_version" : "1.3.21",
11031104
"short_description" : "string",
11041105
"source" : "string",
11051106
"source_uri" : "string",
@@ -1180,7 +1181,7 @@
11801181
"strategy" : "Attack Surface Reduction"
11811182
} ],
11821183
"revision" : 10,
1183-
"schema_version" : "1.3.20",
1184+
"schema_version" : "1.3.21",
11841185
"short_description" : "string",
11851186
"source" : "string",
11861187
"source_uri" : "string",

‎doc/json/campaign.json

+1-1
Original file line numberDiff line numberDiff line change
@@ -19,7 +19,7 @@
1919
"language" : "string",
2020
"names" : [ "string" ],
2121
"revision" : 10,
22-
"schema_version" : "1.3.20",
22+
"schema_version" : "1.3.21",
2323
"short_description" : "string",
2424
"source" : "string",
2525
"source_uri" : "string",

0 commit comments

Comments
 (0)