|
|
|
|
@ -28,7 +28,7 @@ and attachments and finally publishing it.<br /><br />
|
|
|
|
|
During this first step, you will be create a basic event without any actual attributes, but storing general information such as a description, time and risk level of the incident. To start creating the event, click on the New Event button on the left and fill out the form you are presented with. The following fields need to be filled out:<br /><br />
|
|
|
|
|
<p><img src="/img/doc/add_event.png" alt = "" style="float:right;" title = "Fill this form out to create a skeleton event, before proceeding to populate it with attributes and attachments."/></p>
|
|
|
|
|
<ul>
|
|
|
|
|
<li><b>Date:</b> The date when the incident has happened.<br /><br /></li>
|
|
|
|
|
<li><b>Date:</b> The date when the incident has happened. Just click this field and a date-picker will pop up where you can select the desired date.<br /><br /></li>
|
|
|
|
|
<li><b>Distribution:</b>
|
|
|
|
|
<a id="distribution"></a>This setting controls, who will be able to see this event once it becomes published and eventually when it becomes pulled.
|
|
|
|
|
Apart from being able to set which users on this server are allowed to see the event, this also controls whether
|
|
|
|
|
@ -60,7 +60,7 @@ and attachments and finally publishing it.<br /><br />
|
|
|
|
|
<br /><br /></li>
|
|
|
|
|
</ul>
|
|
|
|
|
</li>
|
|
|
|
|
<li><b>Risk:</b> This field indicates the risk level of the event. Incidents can be categorised into three different threat categories (low, medium, high). This field can alternatively be left as undefined. The 3 options are:</li>
|
|
|
|
|
<li><b>Threat Level:</b> This field indicates the risk level of the event. Incidents can be categorised into three different threat categories (low, medium, high). This field can alternatively be left as undefined. The 3 options are:</li>
|
|
|
|
|
<li style="list-style: none;"><ul>
|
|
|
|
|
<li><i>Low:</i> General mass malware.</li>
|
|
|
|
|
<li><i>Medium:</i> Advanced Persistent Threats (APT)</li>
|
|
|
|
|
@ -87,9 +87,10 @@ Keep in mind that the system searches for regular expressions in the value field
|
|
|
|
|
<li><b>Distribution:</b> This drop-down list allows you to control who will be able to see this attribute.
|
|
|
|
|
The distribution is inherited by attributes: the most restrictive setting wins.
|
|
|
|
|
For more info <a href="#distribution">click here</a>.<br /><br /></li>
|
|
|
|
|
<li><b>Contextual Comment:</b> Add a comment to the attribute. This will not be used for correlation<br /><br /></li>
|
|
|
|
|
<li><b>IDS Signature:</b> This option allows the attribute to be used as an IDS signature when exporting the NIDS data, unless it is being overruled by the white-list. For more information about the whitelist, head over to the <?php echo $this->Html->link(__('administration', true), array('controller' => 'pages', 'action' => 'display', 'doc', 'administration', '#' => 'whitelist')); ?> section.<br /><br /></li>
|
|
|
|
|
<li><b>Contextual Comment:</b> Add a comment to the attribute. This will not be used for correlation.<br /><br /></li>
|
|
|
|
|
<li><b>Value:</b> The actual value of the attribute, enter data about the value based on what is valid for the chosen attribute type. For example, for an attribute of type ip-src (source IP address), 11.11.11.11 would be a valid value. For more information on types and values, <?php echo $this->Html->link(__('click here', true), array('controller' => 'pages', 'action' => 'display', 'doc', 'categories_and_types')); ?>.<br /><br /></li>
|
|
|
|
|
<li><b>Contextual Comment:</b> You can add some comments to the attribute that will not be used for correlation but instead serves as purely an informational field.<br /><br /></li>
|
|
|
|
|
<li><b>For Intrusion Detection System:</b> This option allows the attribute to be used as an IDS signature when exporting the NIDS data, unless it is being overruled by the white-list. For more information about the whitelist, head over to the <?php echo $this->Html->link(__('administration', true), array('controller' => 'pages', 'action' => 'display', 'doc', 'administration', '#' => 'whitelist')); ?> section.<br /><br /></li>
|
|
|
|
|
<li><b>Batch import:</b> If there are several attributes of the same type to enter (such as a list of IP addresses, it is possible to enter them all into the same value-field, separated by a line break between each line. This will allow the system to create separate lines for the each attribute. <br /><br /></li>
|
|
|
|
|
</ul>
|
|
|
|
|
<hr />
|
|
|
|
|
@ -103,11 +104,12 @@ You can also upload attachments, such as the malware itself, report files from e
|
|
|
|
|
<p><img src="/img/doc/add_attachment.png" alt = "Add attachment" title = "Point the uploader to the file you want to upload. Make sure to mark it as malware if the uploaded file is harmful, that way it will be neutralised."/></p><br />
|
|
|
|
|
<ul>
|
|
|
|
|
<li><b>Category:</b> The category is the same as with the attributes, it answers the question of what the uploaded file is meant to describe.<br /><br /></li>
|
|
|
|
|
<li><b>Upload field:</b> By hitting browse, you can browse your file system and point the uploader to the file that you want to attach to the attribute. This will then be uploaded when the upload button is pushed.<br /><br /></li>
|
|
|
|
|
<li><b>Malware:</b> This check-box marks the file as malware and as such it will be zipped and passworded, to protect the users of the system from accidentally downloading and executing the file. Make sure to tick this if you suspect that the filed is infected, before uploading it.<br /><br /></li>
|
|
|
|
|
<li><b>Distribution:</b> This drop-down list allows you to control who will be able to see this attachment.
|
|
|
|
|
The distribution is inherited by attributes: the most restrictive setting wins.
|
|
|
|
|
For more info <a href="#distribution">click here</a>.<br /><br /></li>
|
|
|
|
|
<li><b>Upload field:</b> By hitting browse, you can browse your file system and point the uploader to the file that you want to attach to the attribute. This will then be uploaded when the upload button is pushed.<br /><br /></li>
|
|
|
|
|
<li><b>Malware:</b> This check-box marks the file as malware and as such it will be zipped and passworded, to protect the users of the system from accidentally downloading and executing the file. Make sure to tick this if you suspect that the filed is infected, before uploading it.<br /><br /></li>
|
|
|
|
|
<li><b>Contextual Comment:</b> You can add some comments to the attribute that will not be used for correlation but instead serves as purely an informational field.<br /><br /></li>
|
|
|
|
|
</ul>
|
|
|
|
|
<hr />
|
|
|
|
|
<h3>Populate from IOC</h3>
|
|
|
|
|
@ -115,10 +117,15 @@ It is also possible to attempt to import the data contained in a .ioc file, The
|
|
|
|
|
<p><img src="/img/doc/ioc1.png" alt = "OpenIOC1" title = "The import tool will list the successful and failed entries after the process is done."/></p><br />
|
|
|
|
|
<p><img src="/img/doc/ioc2.png" alt = "OpenIOC2" title = "You'll also be able to see a graph of the imported .ioc file and how successful the import was."/></p><br />
|
|
|
|
|
<hr />
|
|
|
|
|
<h3>Populate from ThreatConnect</h3>
|
|
|
|
|
You can also import the data from a ThreatConnect export csv file. The following columns are used by the import tool (and are thus mandatory fields to select during the export): <br /><ul><li>Type</li><li>Value</li><li>Confidence</li><li>Description</li><li>Source</li></ul>The result will be a list of attributes that get added to the currently selected event, each of which will be marked with a comment that indicates that its origin being from a ThreatConnect import.
|
|
|
|
|
<hr />
|
|
|
|
|
<h3>Publish an event:</h3>
|
|
|
|
|
<p><img src="/img/doc/publish.png" alt = "Publish" style="float:right;" title = "Only use publish (no email) for minor changes such as the correction of typos."/></p><br />
|
|
|
|
|
Once all the attributes and attachments that you want to include with the event are uploaded / set, it is time to finalise its creation by publishing the event (click on publish event in the event view). This will alert the eligible users of it (based on the private-controls of the event and its attributes/attachments and whether they have auto-alert turned on), push the event to instances that your instance connects to and propagate it further based on the distribution rules. It also readies the network related attributes for NIDS signature creation (through the NIDS signature export feature, for more information, go to the export section.).<br /><br />
|
|
|
|
|
There is an alternate way of publishing an event without alerting any other users, by using the "publish (no email)" button. This should only be used for minor edits (such as correcting a typo). <br />
|
|
|
|
|
<br />
|
|
|
|
|
If your instance has background jobs enabled then the event might not get published immediately.
|
|
|
|
|
<hr />
|
|
|
|
|
<a id="browsing_events"></a><h2>Browsing past events:</h2>
|
|
|
|
|
The MISP interface allows the user to have an overview over or to search for events and attributes of events that are already stored in the system in various ways.<br /><br />
|
|
|
|
|
@ -126,15 +133,15 @@ The MISP interface allows the user to have an overview over or to search for eve
|
|
|
|
|
On the left menu bar, the option "List events" will generate a list of the last 60 events. While the attributes themselves aren't shown in this view, the following pieces of information can be seen:<br /><br />
|
|
|
|
|
<img src="/img/doc/list_events2.png" alt = "List events" title = "This is the list of events in the system. Use the buttons to the right to alter or view any of the events."/><br /><br />
|
|
|
|
|
<ul>
|
|
|
|
|
<li><b>Valid.:</b> Validation, an event that has been published counts as validated, marked by a checkmark. Unpublished events are marked by a cross.<br /><br /></li>
|
|
|
|
|
<li><b>Published:</b> Already published events are marked by a checkmark. Unpublished events are marked by a cross.<br /><br /></li>
|
|
|
|
|
<li><b>Org:</b> The organisation that created the event.<br /><br /></li>
|
|
|
|
|
<li><b>Owner Org:</b> The organisation that owns the event on this instance. This field is only visible to administrators. <br /><br /></li>
|
|
|
|
|
<li><b>ID:</b> The event's ID number, assigned by the system when the event was first entered (or in the case of an event that was synchronized, when it was first copied over - more on synchronisation in chapter xy)<br /><br /></li>
|
|
|
|
|
<li><b>Tags:</b> Tags that are assigned to this event.<br /><br /></li>
|
|
|
|
|
<li><b>#:</b> The number of attributes that the event has.<br /><br /></li>
|
|
|
|
|
<li><b>Email:</b> The e-mail address of the event's reporter.<br /><br /></li>
|
|
|
|
|
<li><b>#Attr.:</b> The number of attributes that the event has.<br /><br /></li>
|
|
|
|
|
<li><b>Email:</b> The e-mail address of the event's reporter. This is not visible to regular users. Organisation administrators can see the e-mail addresses of their own organisation's users.<br /><br /></li>
|
|
|
|
|
<li><b>Date:</b> The date of the attack.<br /><br /></li>
|
|
|
|
|
<li><b>Risk:</b> The risk level of the attack, the following levels are possible:<br /><br /></li>
|
|
|
|
|
<li><b>Threat Level:</b> The risk level of the attack, the following levels are possible:<br /><br /></li>
|
|
|
|
|
<li style="list-style: none;"><ul>
|
|
|
|
|
<li><b>Low:</b> General Malware</li>
|
|
|
|
|
<li><b>Medium:</b> Advanced Persistent Threats (APTs)</li>
|
|
|
|
|
@ -159,31 +166,98 @@ On the left menu bar, the option "List events" will generate a list of the last
|
|
|
|
|
<h3>Filters</h3>It is also possible to filter the events shown by clicking on the small magnifying glass icons next to the field names and entering a filter term.<br /><br />
|
|
|
|
|
<h3>Event view</h3>
|
|
|
|
|
<img src="/img/doc/event_detail.png" alt = "Event" title = "This view includes the basic information about an event, a link to related events, all attributes and attachments with tools to modify or delete them and extra functions for publishing the event or getting in touch with the event's reporter."/><br /><br /></li>
|
|
|
|
|
<li><b>List of related events:</b> Events can be related by having one or more attributes that are exact matches. For example, if two events both contain a source IP attribute of 11.11.11.11 then they are related. The list of events that are related the currently shown one, are listed under "Related Events", as links (titled the related event's date and ID number) to the events themselves.<br /><br /></li>
|
|
|
|
|
<li><b>Attributes:</b> A list of all attributes attached to the event, including its category, type, value, whether the attribute in itself is related to another event, whether the flag signalling that the attribute can be turned into an IDS signature is on, and a field showing the current privacy setting of the attribute.Attributes can also be modified or deleted via the 3 buttons at the end of each line.<br /><br />
|
|
|
|
|
Using the modify button will bring up the attribute creation view, with all data filled out with the attribute's currently stored data.<br /><br /></li>
|
|
|
|
|
<li><b>Event History:</b> View the logs of the event that show how the event has changed over time, including the contribution from other organisations in the form of proposals.<br /><br /></li>
|
|
|
|
|
<li><b>Contributors:</b> Shows a list of the organisations that have contributed to the event via proposals. If you click any of the logos listed here, you'll get redirected to a filtered event history view, including only the changes made by the organisation.</li>
|
|
|
|
|
<li><b><u>General Event Information</u></b><br /><br /><ul>
|
|
|
|
|
<li><b>ID:</b> The ID of the event.</li><br />
|
|
|
|
|
<li><b>Uuid:</b> In order to avoid collisions between events and attributes (during for example a sync) a Uuid is assigned that uniquely identifies each of them.</li><br />
|
|
|
|
|
<li><b>Org</b> The organisation that has originally created the event. The logo (if it exists on the server, alternatively a string) representing the organisation is also shown int he right upper corner.</li><br />
|
|
|
|
|
<li><b>Contributors:</b> Shows a list of the organisations that have contributed to the event via proposals. If you click any of the logos listed here, you'll get redirected to a filtered event history view, including only the changes made by the organisation.</li><br />
|
|
|
|
|
<li><b>Tags:</b> A list of tags associated with the event. Clicking a tag will show a list of events with the same tag attached. The little cross next to each tag allows you to remove the tag from the event, whilst the '+' button allows you to assign a tag. For the latter two options to be visible, you have to have tagging permission.</li><br />
|
|
|
|
|
<li><b>Date:</b> The date of detection, set by the user that creates the event, not to be confused with the creation date of the event.</li><br />
|
|
|
|
|
<li><b>Threat Level:</b> The assigned threat level of the event.</li><br />
|
|
|
|
|
<li><b>Analysis:</b> The status of the analysis.</li><br />
|
|
|
|
|
<li><b>Distribution:</b> This shows the distribution rules applied to this event, controlling whether only the creating organisation can see (Your organisation only) it or everyone on the instance (This community only). The two remaining settings allow the event to be propagated to organisations on remote connected instances.</li><br />
|
|
|
|
|
<li><b>Info:</b> A short description of the event itself. Make sure not to put information in here that could be used for correlation purposes and be better suited as an Attribute. </li><br />
|
|
|
|
|
<li><b>Published:</b> Whether the event has been published or not. Publishing allows the attributes of the event to be used for all eligible exports and it notifies users that have subscribed to the event alerts. Also, a publish initiates a push to all eligible instances. </li><br />
|
|
|
|
|
</ul></li>
|
|
|
|
|
<li><b><u>List of Related Events</u></b><br /><br />The list of relations is shown on the right hand side of the general event information. Events can be related by having one or more attributes that are exact matches. For example, if two events both contain a source IP attribute of 11.11.11.11 then they are related. The list of events that are related the currently shown one, are listed under "Related Events", as links (titled the related event's date and ID number) to the events themselves.</li><br />
|
|
|
|
|
<li><b><u>Data Element Toggles</u></b><br /><br />
|
|
|
|
|
<p>You can control some of the data that is shown on this page using three toggles. The elements that can be disabled are the pivot threads, the attributes (and proposals) and the Discussions. You can collapse these elements and then expand them again using the same button.</p>
|
|
|
|
|
</li>
|
|
|
|
|
<li><b><u>Pivot Threads</u></b><br /><br />While moving from event to event through the relation links (a process that we refer to as pivoting), you create a path that shows which events you have traversed. This path is reset by leaving the event view and navigating elsewhere in the application or by deleting the root pivot element. <br /><br />
|
|
|
|
|
Each event visited is represented by a bubble in the pivot thread graph, connected by lines that show how the user has arrived at the next connected event. It is possible to jump back to an earlier relation and pivot to another event through that, creating branches in the graph.<br /><br />The currently selected event is coloured blue in the graph. If you would like to delete an element from the graph (including all of elements that branch off of it) just click on the small x within a pivot bubble. For a deletion to be possible the following conditions have to be met:<br /><br />
|
|
|
|
|
<ul><li>The pivot element to be deleted cannot be on the path that leads to the currently selected event</li><br />
|
|
|
|
|
<li>The pivot element residing in the graph's root can always be deleted - this will simply reset the current pivot thread</li></ul><br />
|
|
|
|
|
</li>
|
|
|
|
|
<li><b><u>Attributes and Proposals</u></b><br /><br /><ul> A list of all attributes and proposals attached to the event. The fields for each of them only differ in the available actions and the fact that for proposals to attributes all fields are blank that would stay unchanged if the proposal was accepted (for example, proposing a change to an attribute to turn the IDS flag on will have all fields apart from the IDS flag blank in the proposal. Here is a list of what each of the fields represents: <br /><br />
|
|
|
|
|
<ul>
|
|
|
|
|
<li><b>Date</b>: The date of the last modification to the attribute. Proposals don't have a date of last edit.</li><br />
|
|
|
|
|
<li><b>Category</b>: The category of the attribute or proposal. For a list of possible categories visit the section on <a href="/pages/display/doc/categories_and_types">categories and types</a>.</li><br />
|
|
|
|
|
<li><b>Type</b>: The type of the attribute or proposal. For a list of possible categories visit the section on <a href="/pages/display/doc/categories_and_types">categories and types</a>.</li><br />
|
|
|
|
|
<li><b>Value</b>: The value or value-pair of the attribute. This is the main payload of the attribute, which is described by the category and type columns. For certain types of attributes that are made up of value-pairs the two parts will be split by a pipe (|), such as for filename|md5. The value field(s) are used by the correlation engine to find relations between events. In value-pair attributes both values are correlated individually. </li><br />
|
|
|
|
|
<li><b>Comment</b>: Attributes can have a contextual comment to further describe the attribute. These comments are not used for correlation and are purely informative. </li><br />
|
|
|
|
|
<li><b>Related Events</b>: A list of the event IDs that also contain an attribute with the same value. </li><br />
|
|
|
|
|
<li><b>IDS</b>: Flags an attribute as an indicator of compromise, allowing it to be included in all of the eligible exports. </li><br />
|
|
|
|
|
<li><b>Distribution</b>: Defines the distribution of the attribute individually. An attribute can have a different distribution level than the event. In any case, the lowest distribution level of the two is used. </li><br />
|
|
|
|
|
<li><b>Actions</b>: The user can interact with the events through these buttons, which will be further described in the next portion of the guide as they differ for attributes and proposals. </li><br />
|
|
|
|
|
</ul> <br />
|
|
|
|
|
Depending on the colour coding of the row, you can have an attribute, a proposal to the event or a proposal to an attribute:<br /><br />
|
|
|
|
|
<ul>
|
|
|
|
|
<li><b>Attributes</b>: Each uncoloured line represents an Attribute.</li><br />
|
|
|
|
|
<li><b>Proposals to an Event</b>: Each gray line at the end of the list represents a Proposal to an event. These are proposals for a new attribute, mostly unrelated to any of the currently existing attributes. If the creator of the event accepts one of these a new attribute will be created.</li><br />
|
|
|
|
|
<li><b>Proposals to an Attribute</b>: Each attribute can have several edit proposals. These will be placed right below the attribute that the proposal affects and - as with the event proposals - is coloured grey. The original attribute's row is coloured blue if a proposal exists for it.</li><br />
|
|
|
|
|
</ul>
|
|
|
|
|
Using the modify button will bring up the attribute creation view, with all data filled out with the attribute's currently stored data.<br /><br /></li>
|
|
|
|
|
</ul></li>
|
|
|
|
|
<li><b><u>Event Discussion Thread</u></b></li><br />
|
|
|
|
|
Each event has its own assigned discussion where users (that are eligible to see the event) can participate in an open discussion. The users are anonymised in the messages, all that other users will see is their user ID number and their organisation. To post a message on the Event Discussion, either use the reply button on a previous post or use the quickresponse field at the bottom of the page.
|
|
|
|
|
Each post is made up of the following:<br /><br />
|
|
|
|
|
<ul>
|
|
|
|
|
<li><b>Date: </b>The date when the post was created.</li><br />
|
|
|
|
|
<li><b>Post navigation: </b>This should the post's ID as well as a link to jump to the top of the discussion thread on the page itself.</li><br />
|
|
|
|
|
<li><b>Organisation logo: </b>If such an image exists for the organisation that has posted the message, then the logo is shown.</li><br />
|
|
|
|
|
<li><b>Message: </b>The body of the post itself. This can also include automatically generated links to other events and threads as well as show quoted test in embedded bubbles. Editing an event will also append a post with a message indicating that it was edited together with the timestamp of the edit.</li><br />
|
|
|
|
|
<li><b>User: </b>The e-mail address of the poster if he/she is from the organisation as the current user. Alternatively a generated sting is shown that includes the user ID of the user, so that his/her e-mail address could remain hidden whilst still being identifiable.</li><br />
|
|
|
|
|
<li><b>Action buttons: </b>Edit, Delete and Reply. The first two of the three options are only available to the poster of the message or a site admin. Quoting a post will automatically include the original message in [quote] tags. </li><br />
|
|
|
|
|
</li>
|
|
|
|
|
</ul>
|
|
|
|
|
Here is a list of the various tools you can use while using this feature:<br /><br />
|
|
|
|
|
<ul>
|
|
|
|
|
<li><b>Pagination:</b> There are 5 posts visible on each event page, if there have been more messages posted, use the previous and next button to navigate through the thread. This will not reload the rest of the page.</li><br />
|
|
|
|
|
<li><b>Discussion Tags:</b> Users can quote something by encapsulating it in [quote][/quote] tags, they can create a link to another event with the [event][/event] tags or to another discussion thread with [thread][/thread].</li><br />
|
|
|
|
|
<li><b>Quick Post:</b> Adding a post will take the user to a separate add Post page, something that can be a bit of an inconvenience. To avoid this, there is a quick post button, where users can add messages on the fly without having to reload the page. On top of the quick post field, 3 buttons allow users to generate quote, event and thread tags quickly. </li>
|
|
|
|
|
</ul>
|
|
|
|
|
</ul>
|
|
|
|
|
<hr />
|
|
|
|
|
<h3>Event History:</h3>
|
|
|
|
|
View the logs of the event that show how the event has changed over time, including the contribution from other organisations in the form of proposals. There are two ways to get to this view, either by clicking on View Event History on the side menu of an event view, or by clicking on a contribing organisation's logo on the event view. The latter will show a restricted form of the logs, showing only Proposals created by the selected organisation. The fields shown in this view are as described as follows:<br /><br />
|
|
|
|
|
<ul>
|
|
|
|
|
<li><b>Org</b>: The logo (or in the lack thereof a string representation) of the organisation.</li><br />
|
|
|
|
|
<li><b>Action</b>: Each entry in the log happens during an action, such as the creation, modification or deletion of data and some special actions (such as accepting a proposal). This field shows which action caused the entry to be created. </li><br />
|
|
|
|
|
<li><b>Model</b>: As described above, a log entry is generated on certain actions. This field shows which type of data was affected that caused the log entry to be created (such as a change to the event, the creation of an attribute, the discarding of a proposal, etc).</li><br />
|
|
|
|
|
<li><b>Title</b>: This is a short description of the change itself and it is not nearly as detailed as the information administrators get in the audit logs. However, for attributes and proposals the category / type and value of the created or edited attribute is shown. </li><br />
|
|
|
|
|
<li><b>Created</b>: The date and time of the log entry's creation.</li>
|
|
|
|
|
</ul>
|
|
|
|
|
<hr />
|
|
|
|
|
<h3>Listing all attributes:</h3>
|
|
|
|
|
Apart from having a list of all the events, it is also possible to get a list of all the stored attributes in the system by clicking on the list attributes button. The produced list of attributes will include the followings fields:<br /><br />
|
|
|
|
|
<img src="/img/doc/list_attributes2.png" alt = "" title = "Use the buttons to the right to view the event that this attribute belongs to or to modify/delete the attribute."/><br /><br />
|
|
|
|
|
<ul>
|
|
|
|
|
<li><b>Event:</b> This is the ID number of the event that the attribute is tied to. If an event belongs to your organisation, then this field will be coloured red.<br /><br /></li>
|
|
|
|
|
<li><b>Org:</b> The organisation that has created the event.</li>
|
|
|
|
|
<li><b>Org:</b> The organisation that has created the event.</li><br />
|
|
|
|
|
<li><b>Category:</b> The category of the attribute, showing what the attribute describes (for example the malware's payload). For more information on categories, go to section xy<br /><br /></li>
|
|
|
|
|
<li><b>Type:</b> The type of the value contained in the attribute (for example a source IP address). For more information on types, go to section xy<br /><br /></li>
|
|
|
|
|
<li><b>Value:</b> The actual value of the attribute, describing an aspect, defined by the category and type fields of the malware (for example 11.11.11.11).<br /><br /></li>
|
|
|
|
|
<li><b>Signature:</b> Shows whether the attribute has been flagged for NIDS signature generation or not.<br /><br /></li>
|
|
|
|
|
<li><b>Comment:</b> An optional contextual comment attached to the attribute.<br /><br /></li>
|
|
|
|
|
<li><b>IDS:</b> Shows whether the attribute has been flagged for NIDS signature generation or not.<br /><br /></li>
|
|
|
|
|
<li><b>Actions:</b> A set of buttons that allow you to view the event that the attribute is tied to, to edit the attribute (using the same view as what is used to set up attributes, but filled out with the attribute's current data) and a delete button. <br /><br /></li>
|
|
|
|
|
</ul>
|
|
|
|
|
<hr />
|
|
|
|
|
<h3>Searching for attributes:</h3>
|
|
|
|
|
Apart from being able to list all events, it is also possible to search for data contained in the value field of an attribute, by clicking on the "Search Attributes" button.<br /><br />
|
|
|
|
|
<img src="/img/doc/search_attribute.png" alt = "Search attribute" title = "You can search for attributes by searching for a phrase contained in its value. Narrow your search down by selecting a type and/or a category which the event has to belong to."/><br /><br />
|
|
|
|
|
This will bring up a form that lets you enter one or several search strings (separate search strings with line breaks) that will be compared to the values of all attributes, along with options to narrow down the search based on category and type. The entered search string has to be an exact match with (the sub-string of) a value. A second text field makes it possible to enter event IDs for events that should be excluded from the search (again, each line represents an event ID to be excluded).<br /><br />
|
|
|
|
|
The list generated by the search will look exactly the same as listing all attributes, except that only the attributes that matched the search criteria will be listed (to find out more about the list attributes view, <?php echo $this->Html->link(__('click here', true), array('controller' => 'pages', 'action' => 'display', 'doc', 'categories_and_types')); ?>.). The search parameters will be shown above the produced list and the search terms will be highlighted.<br />
|
|
|
|
|
This will bring up a form that lets you enter one or several search strings (separate search strings with line breaks) that will be compared to the values of all attributes, along with options to narrow down the search based on category and type. The entered search string has to be an exact match with (the sub-string of) a value. A second text field makes it possible to enter event IDs for events that should be excluded from the search (again, each line represents an event ID to be excluded). The third text field allows the user to restrict the results to attributes from certain organisations or to attributes not created by certain other organisations, using the above described syntax.<br /><br />
|
|
|
|
|
The list generated by the search will look exactly the same as listing all attributes, except that only the attributes that matched the search criteria will be listed (to find out more about the list attributes view, <?php echo $this->Html->link(__('click here', true), array('controller' => 'pages', 'action' => 'display', 'doc', 'categories_and_types')); ?>.). The search parameters will be shown above the produced list and the search terms will be highlighted.<br /><br />
|
|
|
|
|
The last option is a checkbox that restricts all of the results to attributes that are marked as IDS signatures.<br />
|
|
|
|
|
<br /><img src="/img/doc/search_attribute_result.png" alt = "" title = "You can view the event that an attribute belongs to with the view button, or you can edit/delete the attribute via the buttons on the right."/><br />
|
|
|
|
|
<hr />
|
|
|
|
|
<a id="update_events"></a><h2>Updating and modifying events and attributes:</h2>
|
|
|
|
|
@ -199,26 +273,29 @@ By default, the message will be sent to every member of the organisation that po
|
|
|
|
|
<hr />
|
|
|
|
|
<a id="automation"></a><h2>Automation:</h2>
|
|
|
|
|
It is possible to quickly and conveniently export the data contained within the system using the automation features located in the main menu on the left (available to users with authentication key access only). There are various sets of data that can be exported, by using the authentication key provided by the system (also shown on the export page). If for whatever reason you would need to invalidate your current key and get a new one instead (for example due to the old one becoming compromised) just hit the reset link next to the authentication key in the export view or in your "my profile" view.<br /><br />
|
|
|
|
|
The following types of export are possible:<br /><br />
|
|
|
|
|
<h3>XML export:</h3>
|
|
|
|
|
Exports all attributes and the event data of every single event in the database (that you are eligible to see) in the XML format. The usage is:<br /><br /><i><server>/events/xml/<authentication_key></i><br /><br />
|
|
|
|
|
In order to export the data about a single event and its attributes, use the following syntax:<br /><br />
|
|
|
|
|
<i><server>/events/xml/<authentication_key>/<EventID></i><br /><br />
|
|
|
|
|
<h3>NIDS export:</h3>
|
|
|
|
|
This allows the user to export all network related attributes (that you are eligible to see) under the Snort format. The attributes have to belong to a published event and they have to have IDS signature generation enabled. The types that will be used when creating the export are: email-dst, ip-src, ip-dst, snort, url, domain. The usage is as follows:<br /><br /><i><server>/events/nids/<authentication_key></i><br /><br />
|
|
|
|
|
<h3>Hash database export:</h3>
|
|
|
|
|
There are two hash formats (sha1 and md5) in which all filenames stored in the system can be exported. Events need to be published and the IDS Signature field needs to be turned on for this export. The usage is as follows:<br /><br />
|
|
|
|
|
For MD5: <i><server>events/hids_md5/<authentication_key></i><br /><br />
|
|
|
|
|
For SHA1: <i><server>events/hids_sha1/<authentication_key></i><br /><br />
|
|
|
|
|
<h3>Text export:</h3>
|
|
|
|
|
It is also possible to export a list of all eligible attributes that match a specific type into a plain text file. The format to do this is:<br /><br />
|
|
|
|
|
<i><server>/events/text/<authentication_key>/<type></i><br /><br />
|
|
|
|
|
Type could be any valid type (as according to the list of <?php echo $this->Html->link(__('categories and types', true), array('controller' => 'pages', 'action' => 'display', 'doc', 'categories_and_types')); ?>), for example md5, ip-src or comment.<br />
|
|
|
|
|
To find out about the various export formats and the usage within the automation functions, please read the page on <a href="/events/automation">automation</a>.
|
|
|
|
|
<hr />
|
|
|
|
|
<a id="export"></a><h2>Exporting data:</h2>
|
|
|
|
|
For users that do not have authentication key access, an alternate export feature is available that relies on your interactive login to the site. To access these, just use the automation menu button to the left and you'll be presented with a list of export options. The results of the export will automatically be offered as a file download.<br /><br/>
|
|
|
|
|
<br /><img src="/img/doc/export.png" alt = "" title = "Use the export features here to quickly download data in various formats"/><br /><br />
|
|
|
|
|
Apart from that, it's also possible to export all events involved in a search attribute result table, by using the "Download results as XML" button on the left menu bar. <br /><br />
|
|
|
|
|
For users that do not have authentication key access, an alternate export feature is available that relies on your interactive login to the site. To access these, just use the export menu button to the left and you'll be presented with a list of export options.<br /><br/>
|
|
|
|
|
Depending on your server's configuration, you will be presented with one of two possible pages, depending on whether you have background processing enabled or not. (The setting on this instance is currently set to: <code><?php echo (Configure::read('MISP.background_jobs') == true ? 'On' : 'Off'); ?></code>)<br /><br />
|
|
|
|
|
<br /><h4>Export page with background jobs <code>disabled</code></h4>
|
|
|
|
|
The page will list a set of export formats that you can immediately download as a file. Just click on the desired export format and MISP will start collecting all the data that you will receive in a file. Keep in mind that this can be a lengthy process. To avoid having to wait, consult with your instance's site administrator about enabling the background processing.<br />
|
|
|
|
|
<br /><img src="/img/doc/export.png" alt = "" title = "Use the export features here to quickly download data in various formats"/><br />
|
|
|
|
|
<br /><h4>Export page with background jobs <code>enabled</code></h4>
|
|
|
|
|
If the background jobs are enabled, you'll be redirected to a different version of the export page. Here you will see a table with all of the major export formats and the current status of the cached export files. Keep in mind that these are generated on an organisation by organisation basis, so even though others have generated newer export caches your organisation may have an outdated cache. You can simply issue a generate command (by clicking the "Generate" button) on the desired export type and the background workers will start fetching and assembling your cache. A progress bar will show the progress of the export process.<br />
|
|
|
|
|
Once done, you can click "Download" to download the freshly generated cache file. If the cache is already up to date from before, then you don't have to regenerate the cache, just click on the "download" button. <br /> <br />
|
|
|
|
|
You may have noticed that the TEXT export only has a generate button - this is because TEXT exports are made up of a lot of types of exports, all of which get generated together. To download any of these files, just click on any of the attribute types at the bottom of the table.</br /><br />
|
|
|
|
|
A quick description of each of the fields in the table:<br /><br />
|
|
|
|
|
<ul>
|
|
|
|
|
<li><b>Type</b>: The type of the export (such as XML, Suricata, MD5, etc.).</li><br />
|
|
|
|
|
<li><b>Last Update</b>: The generation date of the current cache for the given export type.</li><br />
|
|
|
|
|
<li><b>Description</b>: A description of the export format. </li><br />
|
|
|
|
|
<li><b>Outdated</b>: This compares the cache generation date to the last timestamp when an event was updated and lets you know whether the cache is outdated or not. </li><br />
|
|
|
|
|
<li><b>Progress</b>: Shows the progress of the last initiated generation process.</li><br />
|
|
|
|
|
<li><b>Actions</b>: Download or Generate the given cache with these buttons. </li><br />
|
|
|
|
|
</ul>
|
|
|
|
|
<br /><h4>Exporting search results and individual events</h4>
|
|
|
|
|
Apart from the options offered by the export pages, it's also possible to export all events involved in a search attribute result table, by using the "Download results as XML" button on the left menu bar. <br /><br />
|
|
|
|
|
<br /><img src="/img/doc/export_search.png" alt = "" title = "Download a .xml from all the events that are shown through an attribute in the search results."/><br /><br />
|
|
|
|
|
Each event's view has its own export feature, both as an XML export and as a .ioc file. To reach these features, just navigate to an event and use the appropriate buttons on the right side.<br /><br />
|
|
|
|
|
<br /><img src="/img/doc/export_event.png" alt = "" title = "Download a .xml or a .ioc of the event."/><br /><br />
|
|
|
|
|
@ -234,6 +311,8 @@ In order to share data with a remote server via pushes and pulls, you need to re
|
|
|
|
|
<li><b>Authkey:</b> The authentication key that you have received from the hosting organisation of the remote instance.<br /><br /></li>
|
|
|
|
|
<li><b>Push:</b> This check-box controls whether your server is allowed to push to the remote instance.<br /><br /></li>
|
|
|
|
|
<li><b>Pull:</b> This check-box controls whether your server can request to pull all data from the remote instance.<br /><br /></li>
|
|
|
|
|
<li><b>Self Signed:</b> Ticking this checkbox will allow syncing with instances using self-signed certificates.<br /><br /></li>
|
|
|
|
|
<li><b>Certificate File:</b> If the instance that you want to connect to has their entire own certificate chain, you can use this to import a .pem file with it and override CakePHP's standard root CA file.<br /><br /></li>
|
|
|
|
|
</ul>
|
|
|
|
|
<b>If you are an administrator</b>, trying to allow another instance to connect to your own, it is vital that two rules are followed when setting up a synchronisation account: <br /><br />
|
|
|
|
|
<ul>
|
|
|
|
|
@ -256,7 +335,7 @@ The platform is also <a href="http://en.wikipedia.org/wiki/Representational_stat
|
|
|
|
|
Use any HTTP compliant library to perform requests. However to make clear you are doing a REST request you need to either specify the Accept type to application/xml, or append .xml to the url<br /><br />
|
|
|
|
|
The following table shows the relation of the request type and the resulting action:<br /><br />
|
|
|
|
|
|
|
|
|
|
<table style="width:250px;" summary="">
|
|
|
|
|
<table style="width:350px;" summary="">
|
|
|
|
|
<colgroup>
|
|
|
|
|
<col width="18%">
|
|
|
|
|
<col width="34%">
|
|
|
|
|
@ -312,32 +391,37 @@ Authorization: XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX</pre>
|
|
|
|
|
<response>
|
|
|
|
|
<Event>
|
|
|
|
|
<id>57</id>
|
|
|
|
|
<date>2012-11-19</date>
|
|
|
|
|
<risk>Undefined</risk>
|
|
|
|
|
<info>Test</info>
|
|
|
|
|
<user_id>1</user_id>
|
|
|
|
|
<published>0</published>
|
|
|
|
|
<org>NCIRC</org>
|
|
|
|
|
<date>2014-03-04</date>
|
|
|
|
|
<threat_level_id>1</threat_level_id>
|
|
|
|
|
<info>Code monkey doing code monkey stuff</info>
|
|
|
|
|
<published>1</published>
|
|
|
|
|
<uuid>50aa54aa-f7a0-4d74-910d-10f0ff32448e</uuid>
|
|
|
|
|
<revision>0</revision>
|
|
|
|
|
<private>0</private>
|
|
|
|
|
<attribute_count>0</attribute_count>
|
|
|
|
|
<communitie>0</communitie>
|
|
|
|
|
<distribution>This Community-only</distribution>
|
|
|
|
|
<attribute_count>1</attribute_count>
|
|
|
|
|
<analysis>1</analysis>
|
|
|
|
|
<timestamp>1393327600</timestamp>
|
|
|
|
|
<distribution>1</distribution>
|
|
|
|
|
<proposal_email_lock>0</proposal_email_lock>
|
|
|
|
|
<orgc>Iglocska</orgc>
|
|
|
|
|
<locked>0</locked>
|
|
|
|
|
<publish_timestamp>1393327600</publish_timestamp>
|
|
|
|
|
<Attribute>
|
|
|
|
|
<id>9577</id>
|
|
|
|
|
<event_id>123</event_id>
|
|
|
|
|
<category>Artifacts dropped</category>
|
|
|
|
|
<type>other</type>
|
|
|
|
|
<category>Artifacts dropped</category>
|
|
|
|
|
<to_ids>1</to_ids>
|
|
|
|
|
<uuid>50aa54bd-adec-4544-b494-10f0ff32448e</uuid>
|
|
|
|
|
<revision>1</revision>
|
|
|
|
|
<private>0</private>
|
|
|
|
|
<cluster>0</cluster>
|
|
|
|
|
<communitie>0</communitie>
|
|
|
|
|
<value>0</value>
|
|
|
|
|
<distribution>0</distribution>
|
|
|
|
|
<event_id>57</event_id>
|
|
|
|
|
<distribution>1</distribution>
|
|
|
|
|
<timestamp>1393327600</timestamp>
|
|
|
|
|
<comment>This is an Attribute</comment>
|
|
|
|
|
<value>Some_attribute</value>
|
|
|
|
|
<ShadowAttribute />
|
|
|
|
|
</Attribute>
|
|
|
|
|
<ShadowAttribute />
|
|
|
|
|
<RelatedEvent />
|
|
|
|
|
</Event>
|
|
|
|
|
<xml_version>2.2.0</xml_version>
|
|
|
|
|
</response></pre>
|
|
|
|
|
|
|
|
|
|
<h4>Example - Add new Event</h4>
|
|
|
|
|
@ -348,101 +432,100 @@ Accept: application/xml
|
|
|
|
|
Authorization: XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX</pre>
|
|
|
|
|
<p>And the request body:</p>
|
|
|
|
|
<pre><Event>
|
|
|
|
|
<id>14</id>
|
|
|
|
|
<org>ORG</org>
|
|
|
|
|
<date>2012-11-26</date>
|
|
|
|
|
<risk>Undefined</risk>
|
|
|
|
|
<info>Event information</info>
|
|
|
|
|
<user_id>1</user_id>
|
|
|
|
|
<alerted>0</alerted>
|
|
|
|
|
<uuid>4f8c2c4e-00dc-42c9-83ad-76e9ff32448e</uuid>
|
|
|
|
|
<private>0</private>
|
|
|
|
|
<published>0</published>
|
|
|
|
|
<id>72</id>
|
|
|
|
|
<org>NCIRC</org>
|
|
|
|
|
<date>2014-03-04</date>
|
|
|
|
|
<threat_level_id>1</threat_level_id>
|
|
|
|
|
<info>Something concise</info>
|
|
|
|
|
<published>1</published>
|
|
|
|
|
<uuid>50aa54aa-f7a0-4d74-920d-10f0ff32448e</uuid>
|
|
|
|
|
<attribute_count>1</attribute_count>
|
|
|
|
|
<analysis>1</analysis>
|
|
|
|
|
<timestamp>1393328991</timestamp>
|
|
|
|
|
<distribution>1</distribution>
|
|
|
|
|
<proposal_email_lock>0</proposal_email_lock>
|
|
|
|
|
<orgc>Iglocska</orgc>
|
|
|
|
|
<locked>0</locked>
|
|
|
|
|
<publish_timestamp>1393329599</publish_timestamp>
|
|
|
|
|
<Attribute>
|
|
|
|
|
<id>116</id>
|
|
|
|
|
<event_id>14</event_id>
|
|
|
|
|
<type>ip-dst</type>
|
|
|
|
|
<category>Network activity</category>
|
|
|
|
|
<id>9577</id>
|
|
|
|
|
<type>other</type>
|
|
|
|
|
<category>Artifacts dropped</category>
|
|
|
|
|
<to_ids>1</to_ids>
|
|
|
|
|
<uuid>4f8c2cc3-0410-4bf0-8559-5b9dff32448e</uuid>
|
|
|
|
|
<revision>1</revision>
|
|
|
|
|
<private>0</private>
|
|
|
|
|
<value>1.1.1.111</value>
|
|
|
|
|
<category_order>g</category_order>
|
|
|
|
|
</Attribute>
|
|
|
|
|
<Attribute>
|
|
|
|
|
<id>117</id>
|
|
|
|
|
<event_id>14</event_id>
|
|
|
|
|
<type>malware-sample</type>
|
|
|
|
|
<category>Payload delivery</category>
|
|
|
|
|
<to_ids>0</to_ids>
|
|
|
|
|
<uuid>4f8c2d08-7e6c-4648-8730-50a7ff32448e</uuid>
|
|
|
|
|
<revision>1</revision>
|
|
|
|
|
<private>0</private>
|
|
|
|
|
<value>.doc|3f6f1aaab6171925c81de9b34a8fcf8e</value>
|
|
|
|
|
<category_order>c</category_order>
|
|
|
|
|
<data />
|
|
|
|
|
<uuid>50aa54bd-adec-4544-b412-10f0ff32448e</uuid>
|
|
|
|
|
<event_id>57</event_id>
|
|
|
|
|
<distribution>1</distribution>
|
|
|
|
|
<timestamp>1393328991</timestamp>
|
|
|
|
|
<comment>This is an Attribute</comment>
|
|
|
|
|
<value>Some_attribute</value>
|
|
|
|
|
<ShadowAttribute />
|
|
|
|
|
</Attribute>
|
|
|
|
|
<ShadowAttribute />
|
|
|
|
|
<RelatedEvent />
|
|
|
|
|
</Event></pre>
|
|
|
|
|
<p>The response you're going to get is the following data:</p>
|
|
|
|
|
<pre>
|
|
|
|
|
HTTP/1.1 100 Continue
|
|
|
|
|
HTTP/1.1 200 Continue
|
|
|
|
|
Date: Mon, 26 Nov 2012 14:17:11 GMT
|
|
|
|
|
Server: Apache/2.2.13 (Win32) PHP/5.2.10
|
|
|
|
|
X-Powered-By: PHP/5.2.10
|
|
|
|
|
Set-Cookie: CAKEPHP=deleted; expires=Sun, 27-Nov-2012 14:17:11 GMT; path=/
|
|
|
|
|
Set-Cookie: CAKEPHP=a4ok3lr5p9n5drqj27025i4le3; expires Mon, 26-Nov-2012 18:17:11 GMT; path=/; HttpOnly
|
|
|
|
|
Content-Length: 1466
|
|
|
|
|
Date: Tue, 04-Mar-2014 15:00:00
|
|
|
|
|
Server: Apache/2.2.22 (Ubuntu) PHP/5.4.9-4ubuntu2.3
|
|
|
|
|
X-Powered-By: PHP/5.4.9-4ubuntu2.3
|
|
|
|
|
Set-Cookie: CAKEPHP=deleted; expires=Wed, 05-Mar-2014 15:00:00 GMT; path=/
|
|
|
|
|
Set-Cookie: CAKEPHP=a4ok3lr5p9n5drqj27025i4le3; expires Tue, 04-Mar-2014 15:00:00 GMT; path=/; HttpOnly
|
|
|
|
|
Content-Length: 1 kB
|
|
|
|
|
Content-Type: application/xml
|
|
|
|
|
|
|
|
|
|
<?xml version="1.0" encoding="UTF-8">
|
|
|
|
|
<response>
|
|
|
|
|
<Event>
|
|
|
|
|
<id>14</id>
|
|
|
|
|
<org>ORG</org>
|
|
|
|
|
<date>2012-11-26</date>
|
|
|
|
|
<risk>Undefined</risk>
|
|
|
|
|
<info>Event information</info>
|
|
|
|
|
<user_id>1</user_id>
|
|
|
|
|
<published>0</published>
|
|
|
|
|
<uuid>4f8c2c4e-00dc-42c9-83ad-76e9ff32448e</uuid>
|
|
|
|
|
<revision>0</revision>
|
|
|
|
|
<private>0</private>
|
|
|
|
|
<attribute_count>0</attribute_count>
|
|
|
|
|
<communitie>0</communitie>
|
|
|
|
|
<distribution>All communities</distribution>
|
|
|
|
|
<id>76</id>
|
|
|
|
|
<org>NCIRC</org>
|
|
|
|
|
<date>2014-03-04</date>
|
|
|
|
|
<threat_level_id>1</threat_level_id>
|
|
|
|
|
<info>Something concise</info>
|
|
|
|
|
<published>1</published>
|
|
|
|
|
<uuid>50aa54aa-f7a0-4d74-920d-10f0ff32448e</uuid>
|
|
|
|
|
<attribute_count>1</attribute_count>
|
|
|
|
|
<analysis>1</analysis>
|
|
|
|
|
<timestamp>1393328991</timestamp>
|
|
|
|
|
<distribution>1</distribution>
|
|
|
|
|
<proposal_email_lock>0</proposal_email_lock>
|
|
|
|
|
<orgc>Iglocska</orgc>
|
|
|
|
|
<locked>0</locked>
|
|
|
|
|
<publish_timestamp>1393947960</publish_timestamp>
|
|
|
|
|
<Attribute>
|
|
|
|
|
<id>116</id>
|
|
|
|
|
<event_id>14</event_id>
|
|
|
|
|
<category>Network activity</category>
|
|
|
|
|
<type>ip-dst</type>
|
|
|
|
|
<id>10462</id>
|
|
|
|
|
<type>other</type>
|
|
|
|
|
<category>Artifacts dropped</category>
|
|
|
|
|
<to_ids>1</to_ids>
|
|
|
|
|
<uuid>4f8c2cc3-0410-4bf0-8559-5b9dff32448e</uuid>
|
|
|
|
|
<revision>1</revision>
|
|
|
|
|
<private>0</private>
|
|
|
|
|
<cluster>0</cluster>
|
|
|
|
|
<communitie>0</communitie>
|
|
|
|
|
<value>1.1.1.111</value>
|
|
|
|
|
<distribution>All communities</distribution>
|
|
|
|
|
<category_order>g</category_order>
|
|
|
|
|
</Attribute>
|
|
|
|
|
<Attribute>
|
|
|
|
|
<id>117</id>
|
|
|
|
|
<event_id>14</event_id>
|
|
|
|
|
<category>Payload delivery</category>
|
|
|
|
|
<type>malware-sample</type>
|
|
|
|
|
<to_ids>0</to_ids>
|
|
|
|
|
<uuid>4f8c2d08-7e6c-4648-8730-50a7ff32448e</uuid>
|
|
|
|
|
<revision>1</revision>
|
|
|
|
|
<private>0</private>
|
|
|
|
|
<cluster>0</cluster>
|
|
|
|
|
<communitie>0</communitie
|
|
|
|
|
<value>.doc|3f6f1aaab6171925c81de9b34a8fcf8e</value>
|
|
|
|
|
<distribution>All communities</distribution>
|
|
|
|
|
<category_order>c</category_order>
|
|
|
|
|
<uuid>50aa54bd-adec-4544-b412-10f0ff32448e</uuid>
|
|
|
|
|
<event_id>76</event_id>
|
|
|
|
|
<distribution>1</distribution>
|
|
|
|
|
<timestamp>1393328991</timestamp>
|
|
|
|
|
<comment/>
|
|
|
|
|
<value>Some_attribute</value>
|
|
|
|
|
<ShadowAttribute/>
|
|
|
|
|
</Attribute>
|
|
|
|
|
<ShadowAttribute/>
|
|
|
|
|
<RelatedEvent>
|
|
|
|
|
<id>75</id>
|
|
|
|
|
<org>NCIRC</org>
|
|
|
|
|
<date>2012-11-19</date>
|
|
|
|
|
<info>Code monkey doing code monkey stuff</info>
|
|
|
|
|
<uuid>50aa54aa-f7a0-4d74-910d-10f0ff32448e</uuid>
|
|
|
|
|
<published>1</published>
|
|
|
|
|
<analysis>1</analysis>
|
|
|
|
|
<attribute_count>1</attribute_count>
|
|
|
|
|
<orgc>Iglocska</orgc>
|
|
|
|
|
<timestamp>1393327600</timestamp>
|
|
|
|
|
<distribution>1</distribution>
|
|
|
|
|
<proposal_email_lock>0</proposal_email_lock>
|
|
|
|
|
<locked>0</locked>
|
|
|
|
|
<threat_level_id>1</threat_level_id>
|
|
|
|
|
<publish_timestamp>1393947655</publish_timestamp>
|
|
|
|
|
</RelatedEvent>
|
|
|
|
|
</Event>
|
|
|
|
|
<xml_version>2.2.0</xml_version>
|
|
|
|
|
</response>
|
|
|
|
|
</pre>
|
|
|
|
|
<p>The respone from requesting an invalid page</p>
|
|
|
|
|
@ -450,7 +533,7 @@ Content-Type: application/xml
|
|
|
|
|
<?xml version = "1.0" encoding = "UTF-8"?>
|
|
|
|
|
<response>
|
|
|
|
|
<name>Not Found</name>
|
|
|
|
|
<url>/Waldo/</url>
|
|
|
|
|
<url>/The_meaning_of_life</url>
|
|
|
|
|
</response>
|
|
|
|
|
</pre>
|
|
|
|
|
</div>
|
iglocska