opentide spec index
One-page index of active normative spec versions — each spec is independently versioned.
One-page index of active normative spec versions. There is no framework-wide version — each row is independently versioned.
| Spec | Version | Schema ID | Status | Path |
|---|---|---|---|---|
| Versioning | 1.1 | — | normative | specs/versioning.md |
| Metadata | 1.2 | — | normative | specs/metadata.md |
| Threat object | 1.0 | threat::1.0 | normative | specs/objects/threat-1.0.md |
| Objective object | 1.0 | objective::1.0 | normative | specs/objects/objective-1.0.md |
| Objective object | 1.1 | objective::1.1 | draft | specs/objects/objective-1.1.md |
| Rule object | 1.0 | rule::1.0 | normative | specs/objects/rule-1.0.md |
| Rule object | 1.1 | rule::1.1 | normative | specs/objects/rule-1.1.md |
| Workspace layout | 1.5 | — | normative | specs/workspace.md |
| Inflight preview shard | 1.0 | inflight.shard::1.0 | normative | specs/workspace.md |
| Configuration | 1.0 | — | normative | specs/configuration.md |
| Vocabulary format | 1.0 | — | normative | specs/vocabularies/format.md |
| Vocabulary catalog | 1.0 | — | normative | specs/vocabularies/catalog.md |
| Deployment lifecycle | 1.3 | — | normative | specs/deployment.md |
| Deployment state | 1.2 | deployment.state::1.0 | normative | specs/deployment-state.md |
| Metaschema keywords | 1.2 | — | normative | specs/metaschema-keywords.md |
| Platforms | 1.3 | — | normative | specs/platforms/index.md |
| Sentinel platform | 1.1 | platform::sentinel::1.0 | normative | specs/platforms/sentinel-1.0.md |
| Defender for Endpoint platform | 1.1 | platform::defender_for_endpoint::1.0 | normative | specs/platforms/defender-for-endpoint-1.0.md |
| Splunk platform | 1.0 | platform::splunk::1.0 | normative | specs/platforms/splunk-1.0.md |
| SentinelOne platform | 1.1 | platform::sentinel_one::1.0 | normative | specs/platforms/sentinel-one-1.0.md |
| Carbon Black Cloud platform | 1.1 | platform::carbon_black_cloud::1.0 | normative | specs/platforms/carbon-black-cloud-1.0.md |
| CrowdStrike platform | 1.1 | platform::crowdstrike::1.0 | normative | specs/platforms/crowdstrike-1.0.md |
| HarfangLab platform | 1.1 | platform::harfanglab::1.0 | normative | specs/platforms/harfanglab-1.0.md |
| Elastic Security platform | 1.1 | platform::elastic::1.0 | normative | specs/platforms/elastic-1.0.md |
| Validation | 1.4 | — | normative | specs/validation.md |
| Sharing | 1.3 | — | normative | specs/sharing.md |
| MISP connector | 1.0 | sharing::misp::1.0 | normative | specs/sharing/misp-1.0.md |
Reading the specs
New to the object model? Start with the overview, then Conformance for how MUST/SHOULD/MAY are used. Changes follow Governance.
Fixtures
Conformance examples live under fixtures/ and are referenced from object specs.