security_content/.yamlfieldorder at develop · splunk/security_content · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
# Root field order for detection YAML files.
#
# The formatter moves whole top-level YAML blocks and does not re-emit YAML.
# This preserves indentation, spaces, comments, scalar style, and nested content
# inside each field block.
target_paths:
    - detections/

extensions:
    - .yml
    - .yaml

# Unknown top-level fields are kept intact and appended after configured fields.
unknown_fields: append

root_field_order:
    - name
    - id
    - version
    - creation_date
    - modification_date
    - author
    - status
    - type
    - description
    - data_source
    - search
    - how_to_implement
    - known_false_positives
    - references
    - drilldown_searches
    - finding
    - intermediate_findings
    - threat_objects
    - analytic_story
    - threat_group
    - asset_type
    - cve
    - atomic_guid
    - mitre_attack_id
    - product
    - category
    - security_domain
    - baselines
    - tests
    - deprecation_info