Is your feature request related to a problem? Please describe.
- The detections .yml schema appears to be out of date. Fields that can be valid and used in detection content, specifically drilldown_searches and rba, are not reflected in the schema.
data_sources and response_templates schemas are missing.
Describe the solution you'd like
Update the detection schema to include missing fields (drilldown_searches, rba, etc), add missing schemas (data_sources and response_templates) with appropriate types and constraints. This would bring the schema in sync with the actual capabilities supported by the detection .yaml format.
Is your feature request related to a problem? Please describe.
data_sourcesandresponse_templatesschemas are missing.Describe the solution you'd like
Update the detection schema to include missing fields (drilldown_searches, rba, etc), add missing schemas (
data_sourcesandresponse_templates) with appropriate types and constraints. This would bring the schema in sync with the actual capabilities supported by the detection .yaml format.