From 311a8383666d75a3b7a8094b692beddeeacb6489 Mon Sep 17 00:00:00 2001 From: Maarten de Kruijf <16100232+MaartendeKruijf@users.noreply.github.com> Date: Thu, 7 May 2026 11:21:38 +0200 Subject: [PATCH 1/3] Added expression definitions to the schema's in SOARCA --- .../expression/expression.json | 28 +++++++++++++++++++ .../soarca-variable-assgnment-extension.json | 28 +++++++++++++++++++ 2 files changed, 56 insertions(+) create mode 100644 pkg/models/validator/schemas/soarca-variable-assignment-extension/expression/expression.json create mode 100644 pkg/models/validator/schemas/soarca-variable-assignment-extension/soarca-variable-assgnment-extension.json diff --git a/pkg/models/validator/schemas/soarca-variable-assignment-extension/expression/expression.json b/pkg/models/validator/schemas/soarca-variable-assignment-extension/expression/expression.json new file mode 100644 index 00000000..2b5108a8 --- /dev/null +++ b/pkg/models/validator/schemas/soarca-variable-assignment-extension/expression/expression.json @@ -0,0 +1,28 @@ +{ + "$id": "https://raw.githubusercontent.com/COSSAS/SOARCA/refs/heads/development/pkg/models/validator/schemas/soarca-variable-assignment-extension/expression/expression.json", + "$schema": "http://json-schema.org/draft-07/schema#", + "title": "expression", + "description": "The expression is the part of the extension to manipulate the raw output of steps. Multiple engines can be selected.", + "type": "object", + "properties": { + "type": { + "type": "string", + "enum": [ + "regex", + "jq", + "awk", + "sed", + "grep" + ], + "description": "The engine string that needs to be used with the expression" + }, + "expression": { + "type": "string", + "description": "The verbatim expression to be used by SOARCA." + } + }, + "required": [ + "type", + "expression" + ] +} \ No newline at end of file diff --git a/pkg/models/validator/schemas/soarca-variable-assignment-extension/soarca-variable-assgnment-extension.json b/pkg/models/validator/schemas/soarca-variable-assignment-extension/soarca-variable-assgnment-extension.json new file mode 100644 index 00000000..0e9dfcab --- /dev/null +++ b/pkg/models/validator/schemas/soarca-variable-assignment-extension/soarca-variable-assgnment-extension.json @@ -0,0 +1,28 @@ +{ + "$id": "https://raw.githubusercontent.com/COSSAS/SOARCA/refs/heads/development/pkg/models/validator/schemas/soarca-variable-assignment-extension/soarca-variable-assgnment-extension.json", + "$schema": "http://json-schema.org/draft-07/schema#", + "title": "soarca-assignment", + "description": "This extension is used by SOARCA to allow for variable assignment based on step results. All SOARCA action steps have defined results. These defined results can be mapped into specific variables. To allow these variables to be useful the results can be processed by a expression engine. Currently SOARCA supports jq and regex.", + "type": "object", + "properties": { + "type": { + "type": "string", + "enum": [ + "soarca-assignment" + ], + "description": "The value of this property MUST be layout." + }, + "step-result": { + "type": "string", + "description": "The step result from SOARCA that needs to passed to the regex and/or variable. This must be populated when the assignment is used." + }, + "variable": { + "type": "string", + "description": "The variable name denoted like __YOUR_VAR_NAME__ to put the output into. This must be populated when the assignment is used." + }, + "expression": { + "$ref": "./expression/expression.json", + "description": "The regular expression applied to the result before it's mapped into the variable. The expression is optional when the assignment is used." + } + } +} \ No newline at end of file From f66a541e6a3beb96e333a3437b9a1e9811bc0158 Mon Sep 17 00:00:00 2001 From: Maarten de Kruijf <16100232+MaartendeKruijf@users.noreply.github.com> Date: Thu, 7 May 2026 14:03:34 +0200 Subject: [PATCH 2/3] Added extension folder --- .../expression/expression.json | 28 +++++++++++++++++++ extensions/soarca-assignment/readme.md | 3 ++ .../soarca-variable-assgnment-extension.json | 28 +++++++++++++++++++ 3 files changed, 59 insertions(+) create mode 100644 extensions/soarca-assignment/expression/expression.json create mode 100644 extensions/soarca-assignment/readme.md create mode 100644 extensions/soarca-assignment/soarca-variable-assgnment-extension.json diff --git a/extensions/soarca-assignment/expression/expression.json b/extensions/soarca-assignment/expression/expression.json new file mode 100644 index 00000000..eafb27f5 --- /dev/null +++ b/extensions/soarca-assignment/expression/expression.json @@ -0,0 +1,28 @@ +{ + "$id": "https://raw.githubusercontent.com/COSSAS/SOARCA/refs/heads/development/extensions/soarca-assignment/expression/expression.json", + "$schema": "http://json-schema.org/draft-07/schema#", + "title": "expression", + "description": "The expression is the part of the extension to manipulate the raw output of steps. Multiple engines can be selected.", + "type": "object", + "properties": { + "type": { + "type": "string", + "enum": [ + "regex", + "jq", + "awk", + "sed", + "grep" + ], + "description": "The engine string that needs to be used with the expression" + }, + "expression": { + "type": "string", + "description": "The verbatim expression to be used by SOARCA." + } + }, + "required": [ + "type", + "expression" + ] +} \ No newline at end of file diff --git a/extensions/soarca-assignment/readme.md b/extensions/soarca-assignment/readme.md new file mode 100644 index 00000000..ef2b253d --- /dev/null +++ b/extensions/soarca-assignment/readme.md @@ -0,0 +1,3 @@ +# SOARCA assignment extension + +This is the definition of the SOARCA assignment extension. This extension is used by SOARCA to allow for variable assignment based on step results. All SOARCA action steps have defined results. These defined results can be mapped into specific variables. To allow these variables to be useful the results can be processed by a expression engine. Currently SOARCA supports jq and regex. \ No newline at end of file diff --git a/extensions/soarca-assignment/soarca-variable-assgnment-extension.json b/extensions/soarca-assignment/soarca-variable-assgnment-extension.json new file mode 100644 index 00000000..5c5f3e1f --- /dev/null +++ b/extensions/soarca-assignment/soarca-variable-assgnment-extension.json @@ -0,0 +1,28 @@ +{ + "$id": "https://raw.githubusercontent.com/COSSAS/SOARCA/refs/heads/development/extensions/soarca-assignment/soarca-variable-assgnment-extension.json", + "$schema": "http://json-schema.org/draft-07/schema#", + "title": "soarca-assignment", + "description": "This extension is used by SOARCA to allow for variable assignment based on step results. All SOARCA action steps have defined results. These defined results can be mapped into specific variables. To allow these variables to be useful the results can be processed by a expression engine. Currently SOARCA supports jq and regex.", + "type": "object", + "properties": { + "type": { + "type": "string", + "enum": [ + "soarca-assignment" + ], + "description": "The value of this property MUST be layout." + }, + "step-result": { + "type": "string", + "description": "The step result from SOARCA that needs to passed to the regex and/or variable. This must be populated when the assignment is used." + }, + "variable": { + "type": "string", + "description": "The variable name denoted like __YOUR_VAR_NAME__ to put the output into. This must be populated when the assignment is used." + }, + "expression": { + "$ref": "./expression/expression.json", + "description": "The regular expression applied to the result before it's mapped into the variable. The expression is optional when the assignment is used." + } + } +} \ No newline at end of file From 44432298811c18ee4a67895d5b0b8c7c9f40c86d Mon Sep 17 00:00:00 2001 From: Maarten de Kruijf <16100232+MaartendeKruijf@users.noreply.github.com> Date: Thu, 7 May 2026 14:34:07 +0200 Subject: [PATCH 3/3] Made type, step-result and variable required --- .../soarca-variable-assgnment-extension.json | 7 ++++++- .../soarca-variable-assgnment-extension.json | 7 ++++++- 2 files changed, 12 insertions(+), 2 deletions(-) diff --git a/extensions/soarca-assignment/soarca-variable-assgnment-extension.json b/extensions/soarca-assignment/soarca-variable-assgnment-extension.json index 5c5f3e1f..dc550f27 100644 --- a/extensions/soarca-assignment/soarca-variable-assgnment-extension.json +++ b/extensions/soarca-assignment/soarca-variable-assgnment-extension.json @@ -24,5 +24,10 @@ "$ref": "./expression/expression.json", "description": "The regular expression applied to the result before it's mapped into the variable. The expression is optional when the assignment is used." } - } + }, + "required": [ + "type", + "step-result", + "variable" + ] } \ No newline at end of file diff --git a/pkg/models/validator/schemas/soarca-variable-assignment-extension/soarca-variable-assgnment-extension.json b/pkg/models/validator/schemas/soarca-variable-assignment-extension/soarca-variable-assgnment-extension.json index 0e9dfcab..014211c1 100644 --- a/pkg/models/validator/schemas/soarca-variable-assignment-extension/soarca-variable-assgnment-extension.json +++ b/pkg/models/validator/schemas/soarca-variable-assignment-extension/soarca-variable-assgnment-extension.json @@ -24,5 +24,10 @@ "$ref": "./expression/expression.json", "description": "The regular expression applied to the result before it's mapped into the variable. The expression is optional when the assignment is used." } - } + }, + "required": [ + "type", + "step-result", + "variable" + ] } \ No newline at end of file