Content Structure and Versioning

This document describes the current structure of the upstream Splunk Security Content repository and how content objects are versioned. The source files are mostly YAML, with JSON schemas in schemas/ defining the supported fields and validation rules.

Schema-Backed Content

Folder	Purpose
detections/	Detection searches, organized by category: application, cloud, endpoint, network, and web. Deprecated detections live under detections/deprecated.
baselines/	Scheduled searches that establish known-good or historical context, often by populating lookups used by detections.
stories/	Analytic Stories that group related detections around a threat, campaign, technique, or security use case.
macros/	Search macros used by detections, baselines, and dashboards. Filter macros also provide customer-tunable suppression points.
lookups/csv/	CSV lookup metadata and the CSV files they describe. These usually provide static indicators, allowlists, or enrichment values.
lookups/kvstore/	KV Store lookup definitions used for stateful or dynamically updated content.
data_sources/	Data source definitions, including source, sourcetype, supported add-ons, and field-level expectations. Detections reference these by name.
dashboards/	Dashboard metadata. Each dashboard also has a matching JSON dashboard definition.
playbooks/	SOAR playbook metadata and supporting playbook JSON. Supporting custom functions live under playbooks/custom_functions.
schedules/	Reusable schedule definitions, including cron schedule, earliest/latest time, and schedule window.
removed/	Metadata for content that has been removed after deprecation. Removed content is kept for lifecycle tracking and migration guidance.

Supporting Folders

• schemas/: JSON schemas for every supported schema-backed content type.
• response_templates/: Response template JSON used by response and investigation workflows.
• workbooks/: Workbook JSON assets.
• app_template/: Template files used when producing the distributable app.
• docs/: Repository documentation and static documentation assets.
• scripts/: Helper scripts for repository maintenance and reporting.
• deprecated/: Legacy documentation and historical assets. Current deprecated content belongs in each content folder's own deprecated/ subdirectory, or in removed/ after removal.

Release Versioning

Splunk Security Content releases use semantic versioning:

• <major>: Increases for incompatible changes, major schema changes, or packaging behavior changes that require consumers to adjust.
• <minor>: Increases when new content or compatible feature-level content changes are added.
• <patch>: Increases for fixes to existing content when no new content surface is introduced.

Release versioning is separate from individual content-object versioning. A release version describes the shipped package. A content-object version describes one YAML-defined object.

Detection Content Object Versioning

When updating a detection content object:

• Keep id stable.
• Keep creation_date stable.
• Update modification_date to the date of the change.
• Increment version if the changes touches important fields to how versioning is calculated internally.