rule_schema.json

{
    "$schema": "http://json-schema.org/schema",
    "title": "Huorong HIPS Rule Schema",
    "description": "This is the schema for Huorong Internet Security Custom HIPS Rule",
    "type": "object",
    "properties": {
        "ver": {
            "type": "string",
            "description": "must be '5.0'",
            "const": "5.0",
            "default": "5.0"
        },
        "tag": {
            "type": "string",
            "description": "must be 'hipsuser'",
            "const": "hipsuser",
            "default": "hipsuser"
        },
        "data": {
            "type": "array",
            "items": {
                "type": "object",
                "description": "rule",
                "properties": {
                    "id": {
                        "type": "integer",
                        "description": "any, here set to 256",
                        "default": 256
                    },
                    "power": {
                        "type": "integer",
                        "description": "0:disbaled, 1:enabled",
                        "enum": [
                            0,
                            1
                        ],
                        "default": 0
                    },
                    "name": {
                        "type": "string",
                        "description": "name of rule"
                    },
                    "procname": {
                        "type": "string",
                        "description": "program process, wildcard support '*'(any), '>'(any except dir)",
                        "default": "*"
                    },
                    "treatment": {
                        "type": "integer",
                        "description": "action when triggered, 1:ask, 3:auto_block",
                        "enum": [
                            1,
                            3
                        ],
                        "default": 1
                    },
                    "policies": {
                        "type": "array",
                        "items": {
                            "type": "object",
                            "description": "target",
                            "properties": {
                                "montype": {
                                    "type": "integer",
                                    "description": "0:app_defense, 1:file_defense, 2:reg_defense",
                                    "enum": [
                                        0,
                                        1,
                                        2
                                    ],
                                    "default": 0
                                },
                                "action_type": {
                                    "type": "integer",
                                    "description": "monitered events: 1:Create, 2:Read, 4:Modify, 8:Delete, 16:Execute(app_def)",
                                    "minimum": 1,
                                    "maximum": 16,
                                    "default": 16
                                },
                                "res_path": {
                                    "type": "string",
                                    "description": "target path, wildcard support '*'(any), '>'(any except dir)",
                                    "default": "*"
                                }
                            },
                            "required": [
                                "montype",
                                "action_type",
                                "res_path"
                            ],
                            "defaultSnippets": [
                                {
                                    "label": "app_defense",
                                    "description": "app_defense template",
                                    "body": {
                                        "montype": 0,
                                        "action_type": 16,
                                        "res_path": "$1"
                                    }
                                },
                                {
                                    "label": "file_defense",
                                    "description": "file_defense template",
                                    "body": {
                                        "montype": 1,
                                        "action_type": 1,
                                        "res_path": "$1"
                                    }
                                },
                                {
                                    "label": "reg_defense",
                                    "description": "reg_defense template",
                                    "body": {
                                        "montype": 2,
                                        "action_type": 1,
                                        "res_path": "$1"
                                    }
                                }
                            ]
                        }
                    }
                },
                "required": [
                    "id",
                    "power",
                    "name",
                    "procname",
                    "treatment",
                    "policies"
                ],
                "defaultSnippets": [
                    {
                        "label": "new rule",
                        "description": "create rule template",
                        "body": {
                            "id": 256,
                            "power": 0,
                            "name": "[${1|Info,Warning,Threat|}][${2|AD,FD,RD|}${3:ID}]${4:name}",
                            "procname": "${5:*}",
                            "treatment": 1,
                            "policies": []
                        }
                    }
                ]
            }
        }
    }
}