SIEM YAML

SIEM YAML is used to describe the index structure in Splunk / ELK that can be queried by Harness Agents.

To see how SIEM YAML works with query rules and Module examples, read SIEM Search, SIEM Rule, and Custom Module Examples.

Configuration Location

User-defined SIEM YAML is placed in:

custom/data/siem/*.yaml

Test YAML in the source repository is located at:

backend\custom\data\siem\*.yaml

Each YAML file describes a queryable index.

The backend currently only loads configuration from custom\data\siem\*.yaml. Only indexes written to YAML will appear in siem_explore_schema.

After modifying YAML, click Refresh / Validate in Custom Console → SIEM YAML to rescan and review the field table and key fields.

The custom\data\siem\ in the release package is an empty template by default and does not include test YAML.

Basic Structure

name: siem-network-traffic
backend: ELK
description: Network traffic logs

fields:
  - name: source.ip
    type: ip
    description: Source IP
    is_key_field: true
    sample_values: ["10.0.0.19"]

Field Description

Field	Description
name	Index name.
backend	ELK or Splunk.
description	Index purpose description.
fields[].name	Field name.
fields[].type	Field type.
fields[].description	Field meaning.
fields[].is_key_field	Whether to use as default aggregation field.
fields[].sample_values	Sample values.

Usage Scenarios

• siem_explore_schema uses it to display available indexes and fields.
• siem_adaptive_query uses it to determine backend and default aggregation fields.
• Skills such as SIEM Search / SIEM Rule / Threat Hunting use it to understand log structure.

Query Flow

SIEM YAML
  → siem_explore_schema displays indexes and fields
  → siem_keyword_search / siem_adaptive_query selects backend
  → Splunk / ELK executes query
  → Harness Agent summarizes evidence

YAML does not store log data, only index and field descriptions.

Usage Recommendations

• Only create YAML for indexes that need to be queried by Harness Agents.
• Write clear business meanings for key fields, not just field names.
• Mark high-value fields as is_key_field: true, such as user, host, IP, domain, process, cloud account, etc.
• Use the SIEM Index YAML Skill to help generate YAML.

Next Steps

• SIEM — Configure Splunk / ELK connections.
• SIEM Search — Let Harness Agents query logs based on SIEM YAML.
• SIEM Rule — Write detection rules based on index structure.
• Module Development — Use query results and alert fields to write alert processing logic.