Data/Baseline.schema.json
|
{ "$schema": "https://json-schema.org/draft/2020-12/schema", "title": "EndpointForge baseline", "type": "object", "required": ["Name", "Version", "Description", "Controls"], "additionalProperties": false, "properties": { "$schema": { "type": "string" }, "Name": { "type": "string", "pattern": "^[A-Za-z0-9][A-Za-z0-9._-]*$" }, "Version": { "type": "string", "pattern": "^\\d+\\.\\d+\\.\\d+(?:-[0-9A-Za-z.-]+)?$" }, "Description": { "type": "string", "minLength": 1, "pattern": "^[^\\u0000-\\u001F\\u007F]+$" }, "Controls": { "type": "array", "minItems": 1, "maxItems": 256, "items": { "$ref": "#/$defs/control" } } }, "$defs": { "control": { "type": "object", "required": ["Id", "Title", "Type", "Severity", "DesiredValue", "Remediable"], "allOf": [ { "if": { "properties": { "Type": { "const": "Registry" } } }, "then": { "required": ["Path", "ValueName"], "properties": { "Path": { "pattern": "^(?:[Hh][Kk][Ll][Mm]|[Hh][Kk][Cc][Uu]):\\\\.+$" } } } }, { "if": { "properties": { "Type": { "const": "Service" } } }, "then": { "required": ["Name"], "anyOf": [{ "required": ["StartupType"] }, { "required": ["Status"] }] } }, { "if": { "properties": { "Type": { "const": "FirewallProfile" } } }, "then": { "required": ["Name"], "properties": { "DesiredValue": { "type": "boolean" } } } }, { "if": { "properties": { "Type": { "const": "Defender" } } }, "then": { "required": ["Property"], "properties": { "DesiredValue": { "type": "boolean" } } } }, { "if": { "properties": { "Type": { "const": "WindowsOptionalFeature" } } }, "then": { "required": ["Name"], "properties": { "DesiredValue": { "enum": ["Enabled", "Disabled"] } } } }, { "if": { "properties": { "Type": { "enum": [ "FileExists", "FileContainsText", "WindowsEvent", "TcpPort", "BitLocker", "SecureBoot", "Tpm", "PendingRestart", "DiskSpace", "WindowsUpdateAvailable", "InstalledApplication", "ScheduledTaskHealth", "DefenderSignatureHealth", "FileFreshness", "CertificateExpiry", "DnsResolution", "HttpEndpointHealth", "ProcessRunning", "LocalGroupMembership" ] } } }, "then": { "properties": { "Remediable": { "const": false }, "RequiresReboot": { "const": false } } } }, { "if": { "properties": { "Type": { "enum": [ "FirewallProfile", "SecureBoot", "FileExists", "FileContainsText", "WindowsEvent", "TcpPort", "PendingRestart", "DiskSpace", "WindowsUpdateAvailable", "InstalledApplication", "ScheduledTaskHealth", "DefenderSignatureHealth", "FileFreshness", "CertificateExpiry", "DnsResolution", "HttpEndpointHealth", "ProcessRunning", "LocalGroupMembership" ] } } }, "then": { "properties": { "DesiredValue": { "type": "boolean" } } } }, { "if": { "properties": { "Type": { "const": "FileExists" } } }, "then": { "required": ["Path"] } }, { "if": { "properties": { "Type": { "const": "FileContainsText" } } }, "then": { "required": ["Path", "Text"] } }, { "if": { "properties": { "Type": { "const": "WindowsEvent" } } }, "then": { "required": ["LogName", "EventIds"] } }, { "if": { "properties": { "Type": { "const": "TcpPort" } } }, "then": { "required": ["HostName", "Port"], "properties": { "TimeoutMilliseconds": { "maximum": 10000 } } } }, { "if": { "properties": { "Type": { "const": "DiskSpace" } } }, "then": { "anyOf": [{ "required": ["MinimumFreePercent"] }, { "required": ["MinimumFreeGB"] }] } }, { "if": { "properties": { "Type": { "const": "WindowsUpdateAvailable" } } }, "then": { "properties": { "TimeoutSeconds": { "type": "integer", "minimum": 10, "maximum": 600, "default": 120 } } } }, { "if": { "properties": { "Type": { "const": "InstalledApplication" } } }, "then": { "required": ["ApplicationName"], "not": { "required": ["ExactVersion", "MinimumVersion"] }, "allOf": [ { "if": { "required": ["Architecture"], "properties": { "Architecture": { "const": "User" } } }, "then": { "required": ["Scope"], "properties": { "Scope": { "enum": ["CurrentUser", "All"] } } } }, { "if": { "required": ["Scope"], "properties": { "Scope": { "const": "CurrentUser" } } }, "then": { "properties": { "Architecture": { "enum": ["All", "User"] } } } }, { "if": { "required": ["Architecture"], "properties": { "Architecture": { "enum": ["x64", "x86"] } } }, "then": { "properties": { "Scope": { "enum": ["Machine", "All"] } } } } ] } }, { "if": { "properties": { "Type": { "const": "ScheduledTaskHealth" } } }, "then": { "required": ["TaskName", "MaximumAgeMinutes"], "properties": { "TaskPath": { "type": "string", "minLength": 1, "maxLength": 1024, "pattern": "^\\\\(?:(?!\\.{1,2}\\\\)[^\\\\/\\u0000-\\u001F\\u007F*?\\[\\]]+\\\\)*$", "default": "\\" } } } }, { "if": { "properties": { "Type": { "const": "FileFreshness" } } }, "then": { "required": ["Path", "MaximumAgeMinutes"] } }, { "if": { "properties": { "Type": { "const": "CertificateExpiry" } } }, "then": { "required": ["Thumbprint"] } }, { "if": { "properties": { "Type": { "const": "DnsResolution" } } }, "then": { "required": ["HostName"], "properties": { "HostName": { "type": "string", "minLength": 3, "maxLength": 254, "pattern": "^(?=.{1,254}$)(?!\\d{1,3}(?:\\.\\d{1,3}){3}\\.?$)(?:[A-Za-z0-9](?:[A-Za-z0-9-]{0,61}[A-Za-z0-9])?\\.)+[A-Za-z0-9](?:[A-Za-z0-9-]{0,61}[A-Za-z0-9])?\\.?$" } } } }, { "if": { "properties": { "Type": { "const": "HttpEndpointHealth" } } }, "then": { "required": ["Uri"], "properties": { "Uri": { "type": "string", "format": "uri", "maxLength": 2048, "pattern": "^[Hh][Tt][Tt][Pp][Ss]?://(?:[A-Za-z0-9](?:[A-Za-z0-9.-]*[A-Za-z0-9])?\\.[A-Za-z0-9-]+|\\d{1,3}(?:\\.\\d{1,3}){3})(?::\\d{1,5})?(?:/[^?#*?\\[\\]\\s]*)?$" } } } }, { "if": { "properties": { "Type": { "const": "ProcessRunning" } } }, "then": { "required": ["ProcessName"] } }, { "if": { "properties": { "Type": { "const": "LocalGroupMembership" } } }, "then": { "required": ["GroupName", "MemberName"], "properties": { "TimeoutSeconds": { "type": "integer", "minimum": 10, "maximum": 60, "default": 15 } } } }, { "if": { "properties": { "Type": { "const": "BitLocker" } } }, "then": { "properties": { "DesiredValue": { "const": "On" } } } }, { "if": { "properties": { "Type": { "const": "Tpm" } } }, "then": { "properties": { "DesiredValue": { "type": "object", "required": ["TpmPresent", "TpmReady"], "properties": { "TpmPresent": { "type": "boolean" }, "TpmReady": { "type": "boolean" } } } } } } ], "properties": { "Id": { "type": "string", "pattern": "^[A-Za-z0-9][A-Za-z0-9._-]*$" }, "Title": { "type": "string", "minLength": 1, "pattern": "^[^\\u0000-\\u001F\\u007F]+$" }, "Description": { "type": "string", "pattern": "^[^\\u0000-\\u001F\\u007F]+$" }, "WhyItMatters": { "type": "string", "pattern": "^[^\\u0000-\\u001F\\u007F]+$" }, "HowChecked": { "type": "string", "pattern": "^[^\\u0000-\\u001F\\u007F]+$" }, "WhatWouldChange": { "type": "string", "pattern": "^[^\\u0000-\\u001F\\u007F]+$" }, "ManualAction": { "type": "string", "pattern": "^[^\\u0000-\\u001F\\u007F]+$" }, "SafetyNotes": { "type": "string", "pattern": "^[^\\u0000-\\u001F\\u007F]+$" }, "RecoveryGuidance": { "type": "string", "pattern": "^[^\\u0000-\\u001F\\u007F]+$" }, "Type": { "enum": [ "Registry", "Service", "FirewallProfile", "Defender", "WindowsOptionalFeature", "FileExists", "FileContainsText", "WindowsEvent", "TcpPort", "BitLocker", "SecureBoot", "Tpm", "PendingRestart", "DiskSpace", "WindowsUpdateAvailable", "InstalledApplication", "ScheduledTaskHealth", "DefenderSignatureHealth", "FileFreshness", "CertificateExpiry", "DnsResolution", "HttpEndpointHealth", "ProcessRunning", "LocalGroupMembership" ] }, "Severity": { "enum": ["Low", "Medium", "High", "Critical"] }, "DesiredValue": {}, "Remediable": { "type": "boolean" }, "RequiresReboot": { "type": "boolean" }, "Path": { "type": "string", "minLength": 3, "maxLength": 1024, "pattern": "^[^\\u0000-\\u001F\\u007F]+$", "description": "An exact registry path or local file path, depending on the item type. File paths cannot use wildcards, relative paths, links, mapped drives, or network shares." }, "ValueName": { "type": "string", "minLength": 1, "pattern": "^[^\\u0000-\\u001F\\u007F]+$" }, "ValueType": { "enum": ["String", "ExpandString", "Binary", "DWord", "MultiString", "QWord"] }, "Name": { "type": "string", "minLength": 1, "pattern": "^[^\\u0000-\\u001F\\u007F]+$" }, "StartupType": { "enum": ["Automatic", "Manual", "Disabled", ""] }, "Status": { "enum": ["Running", "Stopped", ""] }, "Property": { "type": "string", "minLength": 1, "pattern": "^[^\\u0000-\\u001F\\u007F]+$" }, "MountPoint": { "type": "string", "minLength": 1, "pattern": "^[^\\u0000-\\u001F\\u007F]+$" }, "Text": { "type": "string", "minLength": 1, "maxLength": 1024, "pattern": "^[^\\u0000-\\u001F\\u007F]+$", "description": "Exact ordinary text to find, not a regular expression or wildcard." }, "TailLines": { "type": "integer", "minimum": 1, "maximum": 10000, "default": 2000 }, "CaseSensitive": { "type": "boolean", "default": false }, "Encoding": { "enum": ["Utf8", "Unicode", "BigEndianUnicode", "Ascii"], "default": "Utf8" }, "LogName": { "type": "string", "minLength": 1, "maxLength": 256, "pattern": "^[^\\u0000-\\u001F\\u007F*?\\[\\]]+$" }, "ProviderName": { "type": "string", "minLength": 1, "maxLength": 256, "pattern": "^[^\\u0000-\\u001F\\u007F*?\\[\\]]+$" }, "EventIds": { "oneOf": [ { "type": "integer", "minimum": 0, "maximum": 65535 }, { "type": "array", "minItems": 1, "maxItems": 64, "uniqueItems": true, "items": { "type": "integer", "minimum": 0, "maximum": 65535 } } ] }, "LookbackMinutes": { "type": "integer", "minimum": 1, "maximum": 10080, "default": 60 }, "MinimumCount": { "type": "integer", "minimum": 1, "maximum": 1000, "default": 1 }, "HostName": { "type": "string", "minLength": 1, "maxLength": 255, "pattern": "^[^\\u0000-\\u0020\\u007F/\\\\*?\\[\\]]+$" }, "Port": { "type": "integer", "minimum": 1, "maximum": 65535 }, "TimeoutMilliseconds": { "type": "integer", "minimum": 100, "maximum": 30000, "default": 3000 }, "Drive": { "type": "string", "default": "%SystemDrive%", "pattern": "^(?:%[Ss][Yy][Ss][Tt][Ee][Mm][Dd][Rr][Ii][Vv][Ee]%|[A-Za-z]:\\\\?)$" }, "MinimumFreePercent": { "type": "integer", "minimum": 1, "maximum": 99 }, "MinimumFreeGB": { "type": "integer", "minimum": 1, "maximum": 1048576 }, "MaximumCount": { "type": "integer", "minimum": 0, "maximum": 1000, "default": 0 }, "IncludeOptional": { "type": "boolean", "default": false }, "IncludeDrivers": { "type": "boolean", "default": false }, "TimeoutSeconds": { "type": "integer", "minimum": 10, "maximum": 600 }, "ApplicationName": { "type": "string", "minLength": 1, "maxLength": 256, "pattern": "^[^\\u0000-\\u001F\\u007F*?\\[\\]]+$" }, "Publisher": { "type": "string", "minLength": 1, "maxLength": 256, "pattern": "^[^\\u0000-\\u001F\\u007F*?\\[\\]]+$" }, "ProductCode": { "type": "string", "minLength": 1, "maxLength": 256, "pattern": "^[^\\u0000-\\u001F\\u007F*?\\[\\]]+$" }, "Scope": { "enum": ["Machine", "CurrentUser", "All"], "default": "Machine" }, "Architecture": { "enum": ["All", "x64", "x86", "User"], "default": "All" }, "ExactVersion": { "type": "string", "minLength": 1, "maxLength": 256, "pattern": "^[^\\u0000-\\u001F\\u007F*?\\[\\]]+$" }, "MinimumVersion": { "type": "string", "pattern": "^\\d+(?:\\.\\d+){1,3}$" }, "TaskName": { "type": "string", "minLength": 1, "maxLength": 256, "pattern": "^[^\\u0000-\\u001F\\u007F/\\\\*?\\[\\]]+$" }, "TaskPath": { "type": "string", "minLength": 1, "maxLength": 1024, "pattern": "^\\\\(?:(?!\\.{1,2}\\\\)[^\\\\/\\u0000-\\u001F\\u007F*?\\[\\]]+\\\\)*$", "default": "\\" }, "MaximumAgeMinutes": { "type": "integer", "minimum": 1, "maximum": 525600 }, "ExpectedLastTaskResult": { "type": "integer", "minimum": 0, "maximum": 4294967295, "default": 0 }, "RequireEnabled": { "type": "boolean", "default": true }, "MaximumAgeDays": { "type": "integer", "minimum": 0, "maximum": 365, "default": 7 }, "StoreLocation": { "enum": ["LocalMachine", "CurrentUser"], "default": "LocalMachine" }, "StoreName": { "enum": ["My", "Root", "CA", "AuthRoot", "TrustedPeople", "TrustedPublisher"], "default": "My" }, "Thumbprint": { "type": "string", "minLength": 40, "maxLength": 40, "pattern": "^[A-Fa-f0-9]{40}$" }, "MinimumDaysRemaining": { "type": "integer", "minimum": 0, "maximum": 3650, "default": 30 }, "Uri": { "type": "string", "format": "uri", "maxLength": 2048, "pattern": "^[Hh][Tt][Tt][Pp][Ss]?://(?:[A-Za-z0-9](?:[A-Za-z0-9.-]*[A-Za-z0-9])?\\.[A-Za-z0-9-]+|\\d{1,3}(?:\\.\\d{1,3}){3})(?::\\d{1,5})?(?:/[^?#*?\\[\\]\\s]*)?$" }, "Method": { "enum": ["Head", "Get"], "default": "Head" }, "ExpectedStatusCode": { "type": "integer", "minimum": 100, "maximum": 599, "default": 200 }, "AllowRedirects": { "type": "boolean", "default": false }, "ProcessName": { "type": "string", "minLength": 1, "maxLength": 128, "pattern": "^(?![.][Ee][Xx][Ee]$)[^\\u0000-\\u001F\\u007F/\\\\:*?\\[\\]]+$" }, "GroupName": { "type": "string", "minLength": 1, "maxLength": 256, "pattern": "^[^\\u0000-\\u001F\\u007F*?\\[\\]]+$" }, "MemberName": { "type": "string", "minLength": 1, "maxLength": 256, "pattern": "^[^\\u0000-\\u001F\\u007F*?\\[\\]]+$" } } } } } |