Я пытался проверить правильность схемы с помощью JsonSchemaValidator и получил ошибку:
При чтении значения «CWD» обнаружен неожиданный токен. Ожидается StartObject, есть String. Путь 'properties.details.oneOf [0] .properties.CWD', строка 278, позиция 43.
Полная схема JSON:
{
"$schema": "http://json-schema.org/draft-04/schema#",
"additionalProperties": false,
"definitions": {
"validString": {
"$ref": "#/definitions/validString",
"minLength": 1,
"not": {
"enum": [
"<N/A>"
]
}
},
"validInteger": {
"$ref": "#/definitions/validInteger",
"minimum": 0,
"not": {
"enum": [
-1
]
}
},
"validPath": {
"type": "object",
"properties": {
"dev": {
"title": "Device minor and major ID",
"$ref": "#/definitions/validString"
},
"file_type": {
"$ref": "#/definitions/validString"
},
"gname": {
"$ref": "#/definitions/validString"
},
"inode": {
"title": "inode number associated with the recorded file or directory",
"$ref": "#/definitions/validInteger"
},
"item": {
"title": "Item out of total items",
"$ref": "#/definitions/validInteger"
},
"mode": {
"title": "File or directory permissions",
"$ref": "#/definitions/validString"
},
"name": {
"title": "File or directory which was passed as an argument",
"$ref": "#/definitions/validString"
},
"node": {
"$ref": "#/definitions/validString"
},
"ogid": {
"title": "Object owner's group ID",
"$ref": "#/definitions/validInteger"
},
"ouid": {
"title": "Object owner's user ID",
"$ref": "#/definitions/validInteger"
},
"rdev": {
"title": "Device identifier for special files",
"$ref": "#/definitions/validString"
},
"type": {
"title": "Record type",
"$ref": "#/definitions/validString"
},
"uname": {
"$ref": "#/definitions/validString"
}
},
"required": [
"node",
"ouid",
"name",
"uname",
"file_type",
"type",
"rdev",
"dev",
"item",
"mode",
"gname",
"inode",
"ogid"
]
},
"validCwd": {
"type": "object",
"properties": {
"cwd": {
"title": "Current working directory",
"$ref": "#/definitions/validString"
},
"node": {
"title": "Current working directory",
"$ref": "#/definitions/validString"
},
"type": {
"enum": [
"CWD"
],
"title": "Record type",
"$ref": "#/definitions/validString"
}
},
"required": [
"node",
"type",
"cwd"
]
},
"validSyscall": {
"type": "object",
"properties": {
"a0": {
"title": "1st argument of the system call",
"$ref": "#/definitions/validString"
},
"a1": {
"title": "2nd argument of the system call",
"$ref": "#/definitions/validString"
},
"a2": {
"title": "3rd argument of the system call",
"$ref": "#/definitions/validString"
},
"a3": {
"title": "4th argument of the system call",
"$ref": "#/definitions/validString"
},
"arch": {
"title": "CPU architecture",
"$ref": "#/definitions/validString"
},
"auid": {
"title": "Audit user ID",
"$ref": "#/definitions/validString"
},
"egid": {
"title": "Effective group ID",
"$ref": "#/definitions/validInteger"
},
"euid": {
"title": "Effective user ID",
"$ref": "#/definitions/validInteger"
},
"exe": {
"$ref": "#/definitions/validString"
},
"exit": {
"title": "Exit code returned by the system call",
"type": "integer"
},
"fsgid": {
"title": "File system group ID",
"$ref": "#/definitions/validInteger"
},
"fsuid": {
"title": "File system user ID",
"$ref": "#/definitions/validInteger"
},
"gid": {
"title": "Group ID",
"$ref": "#/definitions/validInteger"
},
"gname": {
"$ref": "#/definitions/validString"
},
"items": {
"title": "Number of path records in the event",
"$ref": "#/definitions/validInteger"
},
"key": {
"$ref": "#/definitions/validString"
},
"node": {
"$ref": "#/definitions/validString"
},
"pid": {
"title": "Process ID",
"$ref": "#/definitions/validInteger"
},
"pname": {
"$ref": "#/definitions/validString"
},
"ppid": {
"title": "Parent process ID",
"$ref": "#/definitions/validInteger"
},
"ses": {
"title": "Session ID",
"$ref": "#/definitions/validString"
},
"sgid": {
"title": "Set group ID",
"$ref": "#/definitions/validInteger"
},
"success": {
"title": "System call succeeded or not",
"$ref": "#/definitions/validString"
},
"suid": {
"title": "Set user ID",
"$ref": "#/definitions/validInteger"
},
"syscall": {
"title": "Type of system call",
"$ref": "#/definitions/validInteger"
},
"tty": {
"title": "Terminal",
"$ref": "#/definitions/validString"
},
"type": {
"title": "Record type",
"enum": [
"SYSCALL"
],
"$ref": "#/definitions/validString"
},
"uid": {
"title": "User ID",
"$ref": "#/definitions/validInteger"
},
"uname": {
"$ref": "#/definitions/validString"
}
},
"required": [
"fsuid",
"tty",
"ses",
"uid",
"syscall",
"pid",
"uname",
"gname",
"sgid",
"auid",
"suid",
"gid",
"exit",
"ppid",
"type",
"node",
"a1",
"a0",
"a3",
"a2",
"pname",
"euid",
"key",
"arch",
"exe",
"success",
"items",
"fsgid",
"egid"
]
}
},
"properties": {
"component": {
"$ref": "#/definitions/validString"
},
"description": {
"$ref": "#/definitions/validString"
},
"details": {
"oneOf": [
{
"additionalProperties": false,
"properties": {
"CWD": "#/definitions/validCwd",
"SYSCALL": "#/definitions/validSyscall"
},
"required": [
"SYSCALL",
"CWD"
],
"type": "object"
},
{
"additionalProperties": false,
"properties": {
"CWD": "#/definitions/validCwd",
"SYSCALL": "#/definitions/validSyscall",
"PATH0": "#/definitions/validPath"
},
"required": [
"SYSCALL",
"PATH0",
"CWD"
],
"type": "object"
},
{
"additionalProperties": false,
"properties": {
"CWD": "#/definitions/validCwd",
"SYSCALL": "#/definitions/validSyscall",
"PATH0": "#/definitions/validPath",
"PATH1": "#/definitions/validPath"
},
"required": [
"SYSCALL",
"PATH0",
"PATH1",
"CWD"
],
"type": "object"
}
],
"type": "object"
},
"event_type": {
"additionalProperties": false,
"properties": {
"action": {
"title": "Event action",
"enum": [
"mkdir",
"open",
"rmdir",
"unlink"
],
"$ref": "#/definitions/validString"
},
"type": {
"title": "Event type",
"$ref": "#/definitions/validString"
}
},
"required": [
"action",
"type"
],
"type": "object"
},
"local_timestamp": {
"title": "Event creation time",
"$ref": "#/definitions/validString"
}
},
"required": [
"details",
"local_timestamp",
"component",
"event_type",
"description"
],
"type": "object"
}
