From 2ceb38c741f9432432114998d0c0f8fa36686083 Mon Sep 17 00:00:00 2001
From: Alexandre Dulaunoy <a@foo.be>
Date: Sat, 20 Feb 2021 17:28:50 +0100
Subject: [PATCH] chg: [data] describeTypes updated

---
 pymisp/data/describeTypes.json | 1030 ++++++++++++++++----------------
 1 file changed, 521 insertions(+), 509 deletions(-)

diff --git a/pymisp/data/describeTypes.json b/pymisp/data/describeTypes.json
index f3e4bde..645df75 100644
--- a/pymisp/data/describeTypes.json
+++ b/pymisp/data/describeTypes.json
@@ -1,138 +1,134 @@
 {
   "result": {
     "categories": [
+      "Internal reference",
+      "Targeting data",
       "Antivirus detection",
+      "Payload delivery",
       "Artifacts dropped",
+      "Payload installation",
+      "Persistence mechanism",
+      "Network activity",
+      "Payload type",
       "Attribution",
       "External analysis",
       "Financial fraud",
-      "Internal reference",
-      "Network activity",
-      "Other",
-      "Payload delivery",
-      "Payload installation",
-      "Payload type",
-      "Persistence mechanism",
-      "Person",
-      "Social network",
       "Support Tool",
-      "Targeting data"
+      "Social network",
+      "Person",
+      "Other"
     ],
     "category_type_mappings": {
       "Antivirus detection": [
-        "anonymised",
-        "attachment",
-        "comment",
-        "hex",
         "link",
+        "comment",
+        "text",
+        "hex",
+        "attachment",
         "other",
-        "text"
+        "anonymised"
       ],
       "Artifacts dropped": [
-        "anonymised",
-        "attachment",
-        "authentihash",
-        "cdhash",
-        "comment",
-        "cookie",
-        "filename",
-        "filename-pattern",
-        "filename|authentihash",
-        "filename|impfuzzy",
-        "filename|imphash",
-        "filename|md5",
-        "filename|pehash",
-        "filename|sha1",
-        "filename|sha224",
-        "filename|sha256",
-        "filename|sha3-224",
-        "filename|sha3-256",
-        "filename|sha3-384",
-        "filename|sha3-512",
-        "filename|sha384",
-        "filename|sha512",
-        "filename|sha512/224",
-        "filename|sha512/256",
-        "filename|ssdeep",
-        "filename|tlsh",
-        "filename|vhash",
-        "gene",
-        "hex",
-        "impfuzzy",
-        "imphash",
-        "kusto-query",
-        "malware-sample",
         "md5",
-        "mime-type",
-        "mutex",
-        "named pipe",
-        "other",
-        "pattern-in-file",
-        "pattern-in-memory",
-        "pdb",
-        "pgp-private-key",
-        "pgp-public-key",
-        "process-state",
-        "regkey",
-        "regkey|value",
         "sha1",
         "sha224",
         "sha256",
-        "sha3-224",
-        "sha3-256",
-        "sha3-384",
-        "sha3-512",
         "sha384",
         "sha512",
         "sha512/224",
         "sha512/256",
-        "sigma",
+        "sha3-224",
+        "sha3-256",
+        "sha3-384",
+        "sha3-512",
         "ssdeep",
-        "stix2-pattern",
+        "imphash",
         "telfhash",
-        "text",
+        "impfuzzy",
+        "authentihash",
         "vhash",
+        "cdhash",
+        "filename",
+        "filename|md5",
+        "filename|sha1",
+        "filename|sha224",
+        "filename|sha256",
+        "filename|sha384",
+        "filename|sha512",
+        "filename|sha512/224",
+        "filename|sha512/256",
+        "filename|sha3-224",
+        "filename|sha3-256",
+        "filename|sha3-384",
+        "filename|sha3-512",
+        "filename|authentihash",
+        "filename|vhash",
+        "filename|ssdeep",
+        "filename|tlsh",
+        "filename|imphash",
+        "filename|impfuzzy",
+        "filename|pehash",
+        "regkey",
+        "regkey|value",
+        "pattern-in-file",
+        "pattern-in-memory",
+        "filename-pattern",
+        "pdb",
+        "stix2-pattern",
+        "yara",
+        "sigma",
+        "attachment",
+        "malware-sample",
+        "named pipe",
+        "mutex",
+        "process-state",
         "windows-scheduled-task",
-        "windows-service-displayname",
         "windows-service-name",
-        "x509-fingerprint-md5",
+        "windows-service-displayname",
+        "comment",
+        "text",
+        "hex",
         "x509-fingerprint-sha1",
+        "x509-fingerprint-md5",
         "x509-fingerprint-sha256",
-        "yara"
+        "other",
+        "cookie",
+        "gene",
+        "kusto-query",
+        "mime-type",
+        "anonymised",
+        "pgp-public-key",
+        "pgp-private-key"
       ],
       "Attribution": [
-        "anonymised",
-        "campaign-id",
-        "campaign-name",
-        "comment",
-        "dns-soa-email",
-        "email",
-        "other",
-        "text",
         "threat-actor",
-        "whois-creation-date",
+        "campaign-name",
+        "campaign-id",
+        "whois-registrant-phone",
         "whois-registrant-email",
         "whois-registrant-name",
         "whois-registrant-org",
-        "whois-registrant-phone",
         "whois-registrar",
-        "x509-fingerprint-md5",
+        "whois-creation-date",
+        "comment",
+        "text",
         "x509-fingerprint-sha1",
-        "x509-fingerprint-sha256"
+        "x509-fingerprint-md5",
+        "x509-fingerprint-sha256",
+        "other",
+        "dns-soa-email",
+        "anonymised",
+        "email"
       ],
       "External analysis": [
-        "AS",
-        "anonymised",
-        "attachment",
-        "bro",
-        "comment",
-        "community-id",
-        "cortex",
-        "cpe",
-        "domain",
-        "domain|ip",
+        "md5",
+        "sha1",
+        "sha256",
+        "sha3-224",
+        "sha3-256",
+        "sha3-384",
+        "sha3-512",
         "filename",
-        "filename-pattern",
         "filename|md5",
         "filename|sha1",
         "filename|sha256",
@@ -140,385 +136,391 @@
         "filename|sha3-256",
         "filename|sha3-384",
         "filename|sha3-512",
-        "github-repository",
-        "hassh-md5",
-        "hasshserver-md5",
-        "hostname",
+        "ip-src",
         "ip-dst",
         "ip-dst|port",
-        "ip-src",
         "ip-src|port",
-        "ja3-fingerprint-md5",
-        "jarm-fingerprint",
-        "link",
         "mac-address",
         "mac-eui-64",
-        "malware-sample",
-        "md5",
-        "other",
-        "pattern-in-file",
-        "pattern-in-memory",
-        "pattern-in-traffic",
-        "regkey",
-        "regkey|value",
-        "sha1",
-        "sha256",
-        "sha3-224",
-        "sha3-256",
-        "sha3-384",
-        "sha3-512",
-        "snort",
-        "text",
+        "hostname",
+        "domain",
+        "domain|ip",
         "url",
         "user-agent",
+        "regkey",
+        "regkey|value",
+        "AS",
+        "snort",
+        "bro",
+        "zeek",
+        "pattern-in-file",
+        "pattern-in-traffic",
+        "pattern-in-memory",
+        "filename-pattern",
         "vulnerability",
+        "cpe",
         "weakness",
-        "x509-fingerprint-md5",
+        "attachment",
+        "malware-sample",
+        "link",
+        "comment",
+        "text",
         "x509-fingerprint-sha1",
+        "x509-fingerprint-md5",
         "x509-fingerprint-sha256",
-        "zeek"
+        "ja3-fingerprint-md5",
+        "jarm-fingerprint",
+        "hassh-md5",
+        "hasshserver-md5",
+        "github-repository",
+        "other",
+        "cortex",
+        "anonymised",
+        "community-id"
       ],
       "Financial fraud": [
-        "aba-rtn",
-        "anonymised",
-        "bank-account-nr",
-        "bic",
-        "bin",
         "btc",
-        "cc-number",
-        "comment",
         "dash",
-        "hex",
+        "xmr",
         "iban",
-        "other",
-        "phone-number",
+        "bic",
+        "bank-account-nr",
+        "aba-rtn",
+        "bin",
+        "cc-number",
         "prtn",
+        "phone-number",
+        "comment",
         "text",
-        "xmr"
+        "other",
+        "hex",
+        "anonymised"
       ],
       "Internal reference": [
-        "anonymised",
-        "comment",
-        "git-commit-id",
-        "hex",
+        "text",
         "link",
+        "comment",
         "other",
-        "text"
+        "hex",
+        "anonymised",
+        "git-commit-id"
       ],
       "Network activity": [
-        "AS",
-        "anonymised",
-        "attachment",
-        "bro",
-        "comment",
-        "community-id",
-        "cookie",
+        "ip-src",
+        "ip-dst",
+        "ip-dst|port",
+        "ip-src|port",
+        "port",
+        "hostname",
         "domain",
         "domain|ip",
+        "mac-address",
+        "mac-eui-64",
         "email",
         "email-dst",
         "email-src",
-        "email-subject",
         "eppn",
-        "favicon-mmh3",
-        "filename-pattern",
-        "hassh-md5",
-        "hasshserver-md5",
-        "hex",
-        "hostname",
-        "hostname|port",
-        "http-method",
-        "ip-dst",
-        "ip-dst|port",
-        "ip-src",
-        "ip-src|port",
-        "ja3-fingerprint-md5",
-        "jarm-fingerprint",
-        "mac-address",
-        "mac-eui-64",
-        "other",
-        "pattern-in-file",
-        "pattern-in-traffic",
-        "port",
-        "snort",
-        "stix2-pattern",
-        "text",
-        "uri",
         "url",
+        "uri",
         "user-agent",
+        "http-method",
+        "AS",
+        "snort",
+        "pattern-in-file",
+        "filename-pattern",
+        "stix2-pattern",
+        "pattern-in-traffic",
+        "attachment",
+        "comment",
+        "text",
         "x509-fingerprint-md5",
         "x509-fingerprint-sha1",
         "x509-fingerprint-sha256",
-        "zeek"
+        "ja3-fingerprint-md5",
+        "jarm-fingerprint",
+        "hassh-md5",
+        "hasshserver-md5",
+        "other",
+        "hex",
+        "cookie",
+        "hostname|port",
+        "bro",
+        "zeek",
+        "anonymised",
+        "community-id",
+        "email-subject",
+        "favicon-mmh3",
+        "dkim",
+        "dkim-signature"
       ],
       "Other": [
-        "anonymised",
-        "boolean",
         "comment",
+        "text",
+        "other",
+        "size-in-bytes",
         "counter",
-        "cpe",
         "datetime",
+        "cpe",
+        "port",
         "float",
         "hex",
-        "other",
-        "pgp-private-key",
-        "pgp-public-key",
         "phone-number",
-        "port",
-        "size-in-bytes",
-        "text"
+        "boolean",
+        "anonymised",
+        "pgp-public-key",
+        "pgp-private-key"
       ],
       "Payload delivery": [
-        "AS",
-        "anonymised",
-        "attachment",
+        "md5",
+        "sha1",
+        "sha224",
+        "sha256",
+        "sha384",
+        "sha512",
+        "sha512/224",
+        "sha512/256",
+        "sha3-224",
+        "sha3-256",
+        "sha3-384",
+        "sha3-512",
+        "ssdeep",
+        "imphash",
+        "telfhash",
+        "impfuzzy",
         "authentihash",
+        "vhash",
+        "pehash",
+        "tlsh",
         "cdhash",
-        "chrome-extension-id",
-        "comment",
-        "cpe",
-        "domain",
-        "email",
-        "email-attachment",
-        "email-body",
-        "email-dst",
-        "email-dst-display-name",
-        "email-header",
-        "email-message-id",
-        "email-mime-boundary",
-        "email-reply-to",
-        "email-src",
-        "email-src-display-name",
-        "email-subject",
-        "email-thread-index",
-        "email-x-mailer",
         "filename",
-        "filename-pattern",
-        "filename|authentihash",
-        "filename|impfuzzy",
-        "filename|imphash",
         "filename|md5",
-        "filename|pehash",
         "filename|sha1",
         "filename|sha224",
         "filename|sha256",
-        "filename|sha3-224",
-        "filename|sha3-256",
-        "filename|sha3-384",
-        "filename|sha3-512",
         "filename|sha384",
         "filename|sha512",
         "filename|sha512/224",
         "filename|sha512/256",
+        "filename|sha3-224",
+        "filename|sha3-256",
+        "filename|sha3-384",
+        "filename|sha3-512",
+        "filename|authentihash",
+        "filename|vhash",
         "filename|ssdeep",
         "filename|tlsh",
-        "filename|vhash",
-        "hassh-md5",
-        "hasshserver-md5",
-        "hex",
-        "hostname",
-        "hostname|port",
-        "impfuzzy",
-        "imphash",
-        "ip-dst",
-        "ip-dst|port",
-        "ip-src",
-        "ip-src|port",
-        "ja3-fingerprint-md5",
-        "jarm-fingerprint",
-        "link",
+        "filename|imphash",
+        "filename|impfuzzy",
+        "filename|pehash",
         "mac-address",
         "mac-eui-64",
-        "malware-sample",
-        "malware-type",
-        "md5",
-        "mime-type",
-        "mobile-application-id",
-        "other",
+        "ip-src",
+        "ip-dst",
+        "ip-dst|port",
+        "ip-src|port",
+        "hostname",
+        "domain",
+        "email",
+        "email-src",
+        "email-dst",
+        "email-subject",
+        "email-attachment",
+        "email-body",
+        "url",
+        "user-agent",
+        "AS",
         "pattern-in-file",
         "pattern-in-traffic",
-        "pehash",
+        "filename-pattern",
+        "stix2-pattern",
+        "yara",
+        "sigma",
+        "mime-type",
+        "attachment",
+        "malware-sample",
+        "link",
+        "malware-type",
+        "comment",
+        "text",
+        "hex",
+        "vulnerability",
+        "cpe",
+        "weakness",
+        "x509-fingerprint-sha1",
+        "x509-fingerprint-md5",
+        "x509-fingerprint-sha256",
+        "ja3-fingerprint-md5",
+        "jarm-fingerprint",
+        "hassh-md5",
+        "hasshserver-md5",
+        "other",
+        "hostname|port",
+        "email-dst-display-name",
+        "email-src-display-name",
+        "email-header",
+        "email-reply-to",
+        "email-x-mailer",
+        "email-mime-boundary",
+        "email-thread-index",
+        "email-message-id",
+        "mobile-application-id",
+        "chrome-extension-id",
+        "whois-registrant-email",
+        "anonymised"
+      ],
+      "Payload installation": [
+        "md5",
         "sha1",
         "sha224",
         "sha256",
-        "sha3-224",
-        "sha3-256",
-        "sha3-384",
-        "sha3-512",
         "sha384",
         "sha512",
         "sha512/224",
         "sha512/256",
-        "sigma",
+        "sha3-224",
+        "sha3-256",
+        "sha3-384",
+        "sha3-512",
         "ssdeep",
-        "stix2-pattern",
+        "imphash",
         "telfhash",
-        "text",
-        "tlsh",
-        "url",
-        "user-agent",
-        "vhash",
-        "vulnerability",
-        "weakness",
-        "whois-registrant-email",
-        "x509-fingerprint-md5",
-        "x509-fingerprint-sha1",
-        "x509-fingerprint-sha256",
-        "yara"
-      ],
-      "Payload installation": [
-        "anonymised",
-        "attachment",
+        "impfuzzy",
         "authentihash",
+        "vhash",
+        "pehash",
+        "tlsh",
         "cdhash",
-        "chrome-extension-id",
-        "comment",
-        "cpe",
         "filename",
-        "filename-pattern",
-        "filename|authentihash",
-        "filename|impfuzzy",
-        "filename|imphash",
         "filename|md5",
-        "filename|pehash",
         "filename|sha1",
         "filename|sha224",
         "filename|sha256",
-        "filename|sha3-224",
-        "filename|sha3-256",
-        "filename|sha3-384",
-        "filename|sha3-512",
         "filename|sha384",
         "filename|sha512",
         "filename|sha512/224",
         "filename|sha512/256",
+        "filename|sha3-224",
+        "filename|sha3-256",
+        "filename|sha3-384",
+        "filename|sha3-512",
+        "filename|authentihash",
+        "filename|vhash",
         "filename|ssdeep",
         "filename|tlsh",
-        "filename|vhash",
-        "hex",
-        "impfuzzy",
-        "imphash",
+        "filename|imphash",
+        "filename|impfuzzy",
+        "filename|pehash",
+        "pattern-in-file",
+        "pattern-in-traffic",
+        "pattern-in-memory",
+        "filename-pattern",
+        "stix2-pattern",
+        "yara",
+        "sigma",
+        "vulnerability",
+        "cpe",
+        "weakness",
+        "attachment",
         "malware-sample",
         "malware-type",
-        "md5",
-        "mime-type",
-        "mobile-application-id",
-        "other",
-        "pattern-in-file",
-        "pattern-in-memory",
-        "pattern-in-traffic",
-        "pehash",
-        "sha1",
-        "sha224",
-        "sha256",
-        "sha3-224",
-        "sha3-256",
-        "sha3-384",
-        "sha3-512",
-        "sha384",
-        "sha512",
-        "sha512/224",
-        "sha512/256",
-        "sigma",
-        "ssdeep",
-        "stix2-pattern",
-        "telfhash",
+        "comment",
         "text",
-        "tlsh",
-        "vhash",
-        "vulnerability",
-        "weakness",
-        "x509-fingerprint-md5",
+        "hex",
         "x509-fingerprint-sha1",
+        "x509-fingerprint-md5",
         "x509-fingerprint-sha256",
-        "yara"
+        "mobile-application-id",
+        "chrome-extension-id",
+        "other",
+        "mime-type",
+        "anonymised"
       ],
       "Payload type": [
-        "anonymised",
         "comment",
+        "text",
         "other",
-        "text"
+        "anonymised"
       ],
       "Persistence mechanism": [
-        "anonymised",
-        "comment",
         "filename",
-        "hex",
-        "other",
         "regkey",
         "regkey|value",
-        "text"
+        "comment",
+        "text",
+        "other",
+        "hex",
+        "anonymised"
       ],
       "Person": [
-        "anonymised",
-        "comment",
-        "country-of-residence",
-        "date-of-birth",
-        "email",
         "first-name",
-        "frequent-flyer-number",
-        "gender",
-        "identity-card-number",
-        "issue-date-of-the-visa",
-        "last-name",
         "middle-name",
-        "nationality",
-        "other",
-        "passenger-name-record-locator-number",
+        "last-name",
+        "date-of-birth",
+        "place-of-birth",
+        "gender",
+        "passport-number",
         "passport-country",
         "passport-expiration",
-        "passport-number",
+        "redress-number",
+        "nationality",
+        "visa-number",
+        "issue-date-of-the-visa",
+        "primary-residence",
+        "country-of-residence",
+        "special-service-request",
+        "frequent-flyer-number",
+        "travel-details",
         "payment-details",
-        "pgp-private-key",
-        "pgp-public-key",
-        "phone-number",
-        "place-of-birth",
+        "place-port-of-original-embarkation",
         "place-port-of-clearance",
         "place-port-of-onward-foreign-destination",
-        "place-port-of-original-embarkation",
-        "primary-residence",
-        "redress-number",
-        "special-service-request",
+        "passenger-name-record-locator-number",
+        "comment",
         "text",
-        "travel-details",
-        "visa-number"
+        "other",
+        "phone-number",
+        "identity-card-number",
+        "anonymised",
+        "email",
+        "pgp-public-key",
+        "pgp-private-key"
       ],
       "Social network": [
-        "anonymised",
-        "comment",
-        "email",
-        "email-dst",
-        "email-src",
-        "eppn",
-        "github-organisation",
-        "github-repository",
         "github-username",
+        "github-repository",
+        "github-organisation",
         "jabber-id",
-        "other",
-        "pgp-private-key",
-        "pgp-public-key",
-        "text",
         "twitter-id",
-        "whois-registrant-email"
+        "email",
+        "email-src",
+        "email-dst",
+        "eppn",
+        "comment",
+        "text",
+        "other",
+        "whois-registrant-email",
+        "anonymised",
+        "pgp-public-key",
+        "pgp-private-key"
       ],
       "Support Tool": [
-        "anonymised",
+        "link",
+        "text",
         "attachment",
         "comment",
-        "hex",
-        "link",
         "other",
-        "text"
+        "hex",
+        "anonymised"
       ],
       "Targeting data": [
-        "anonymised",
-        "comment",
+        "target-user",
         "target-email",
-        "target-external",
-        "target-location",
         "target-machine",
         "target-org",
-        "target-user"
+        "target-location",
+        "target-external",
+        "comment",
+        "anonymised"
       ]
     },
     "sane_defaults": {
@@ -626,6 +628,14 @@
         "default_category": "Other",
         "to_ids": 0
       },
+      "dkim": {
+        "default_category": "Network activity",
+        "to_ids": 0
+      },
+      "dkim-signature": {
+        "default_category": "Network activity",
+        "to_ids": 0
+      },
       "dns-soa-email": {
         "default_category": "Attribution",
         "to_ids": 0
@@ -1256,189 +1266,191 @@
       }
     },
     "types": [
-      "AS",
-      "aba-rtn",
-      "anonymised",
-      "attachment",
-      "authentihash",
-      "bank-account-nr",
-      "bic",
-      "bin",
-      "boolean",
-      "bro",
-      "btc",
-      "campaign-id",
-      "campaign-name",
-      "cc-number",
-      "cdhash",
-      "chrome-extension-id",
-      "comment",
-      "community-id",
-      "cookie",
-      "cortex",
-      "counter",
-      "country-of-residence",
-      "cpe",
-      "dash",
-      "date-of-birth",
-      "datetime",
-      "dns-soa-email",
+      "md5",
+      "sha1",
+      "sha256",
+      "filename",
+      "pdb",
+      "filename|md5",
+      "filename|sha1",
+      "filename|sha256",
+      "ip-src",
+      "ip-dst",
+      "hostname",
       "domain",
       "domain|ip",
       "email",
+      "email-src",
+      "eppn",
+      "email-dst",
+      "email-subject",
       "email-attachment",
       "email-body",
-      "email-dst",
-      "email-dst-display-name",
-      "email-header",
-      "email-message-id",
-      "email-mime-boundary",
-      "email-reply-to",
-      "email-src",
-      "email-src-display-name",
-      "email-subject",
-      "email-thread-index",
-      "email-x-mailer",
-      "eppn",
-      "favicon-mmh3",
-      "filename",
-      "filename|authentihash",
-      "filename|impfuzzy",
-      "filename|imphash",
-      "filename|md5",
-      "filename|pehash",
-      "filename|sha1",
-      "filename|sha224",
-      "filename|sha256",
-      "filename|sha3-224",
-      "filename|sha3-256",
-      "filename|sha3-384",
-      "filename|sha3-512",
-      "filename|sha384",
-      "filename|sha512",
-      "filename|sha512/224",
-      "filename|sha512/256",
-      "filename|ssdeep",
-      "filename|tlsh",
-      "filename|vhash",
-      "first-name",
       "float",
-      "frequent-flyer-number",
-      "gender",
-      "gene",
       "git-commit-id",
-      "github-organisation",
-      "github-repository",
-      "github-username",
+      "url",
+      "http-method",
+      "user-agent",
+      "ja3-fingerprint-md5",
+      "jarm-fingerprint",
+      "favicon-mmh3",
       "hassh-md5",
       "hasshserver-md5",
-      "hex",
-      "hostname",
-      "hostname|port",
-      "http-method",
-      "iban",
-      "identity-card-number",
-      "impfuzzy",
-      "imphash",
-      "ip-dst",
-      "ip-dst|port",
-      "ip-src",
-      "ip-src|port",
-      "issue-date-of-the-visa",
-      "ja3-fingerprint-md5",
-      "jabber-id",
-      "jarm-fingerprint",
-      "kusto-query",
-      "last-name",
-      "link",
-      "mac-address",
-      "mac-eui-64",
-      "malware-sample",
-      "malware-type",
-      "md5",
-      "middle-name",
-      "mime-type",
-      "mobile-application-id",
-      "mutex",
-      "named pipe",
-      "nationality",
-      "other",
-      "passenger-name-record-locator-number",
-      "passport-country",
-      "passport-expiration",
-      "passport-number",
-      "pattern-filename",
-      "pattern-in-file",
-      "pattern-in-memory",
-      "pattern-in-traffic",
-      "payment-details",
-      "pdb",
-      "pehash",
-      "pgp-private-key",
-      "pgp-public-key",
-      "phone-number",
-      "place-of-birth",
-      "place-port-of-clearance",
-      "place-port-of-onward-foreign-destination",
-      "place-port-of-original-embarkation",
-      "port",
-      "primary-residence",
-      "process-state",
-      "prtn",
-      "redress-number",
       "regkey",
       "regkey|value",
-      "sha1",
+      "AS",
+      "snort",
+      "bro",
+      "zeek",
+      "community-id",
+      "pattern-in-file",
+      "pattern-in-traffic",
+      "pattern-in-memory",
+      "pattern-filename",
+      "pgp-public-key",
+      "pgp-private-key",
+      "yara",
+      "stix2-pattern",
+      "sigma",
+      "gene",
+      "kusto-query",
+      "mime-type",
+      "identity-card-number",
+      "cookie",
+      "vulnerability",
+      "cpe",
+      "weakness",
+      "attachment",
+      "malware-sample",
+      "link",
+      "comment",
+      "text",
+      "hex",
+      "other",
+      "named pipe",
+      "mutex",
+      "process-state",
+      "target-user",
+      "target-email",
+      "target-machine",
+      "target-org",
+      "target-location",
+      "target-external",
+      "btc",
+      "dash",
+      "xmr",
+      "iban",
+      "bic",
+      "bank-account-nr",
+      "aba-rtn",
+      "bin",
+      "cc-number",
+      "prtn",
+      "phone-number",
+      "threat-actor",
+      "campaign-name",
+      "campaign-id",
+      "malware-type",
+      "uri",
+      "authentihash",
+      "vhash",
+      "ssdeep",
+      "imphash",
+      "telfhash",
+      "pehash",
+      "impfuzzy",
       "sha224",
-      "sha256",
-      "sha3-224",
-      "sha3-256",
-      "sha3-384",
-      "sha3-512",
       "sha384",
       "sha512",
       "sha512/224",
       "sha512/256",
-      "sigma",
-      "size-in-bytes",
-      "snort",
-      "special-service-request",
-      "ssdeep",
-      "stix2-pattern",
-      "target-email",
-      "target-external",
-      "target-location",
-      "target-machine",
-      "target-org",
-      "target-user",
-      "telfhash",
-      "text",
-      "threat-actor",
+      "sha3-224",
+      "sha3-256",
+      "sha3-384",
+      "sha3-512",
       "tlsh",
-      "travel-details",
-      "twitter-id",
-      "uri",
-      "url",
-      "user-agent",
-      "vhash",
-      "visa-number",
-      "vulnerability",
-      "weakness",
-      "whois-creation-date",
+      "cdhash",
+      "filename|authentihash",
+      "filename|vhash",
+      "filename|ssdeep",
+      "filename|imphash",
+      "filename|impfuzzy",
+      "filename|pehash",
+      "filename|sha224",
+      "filename|sha384",
+      "filename|sha512",
+      "filename|sha512/224",
+      "filename|sha512/256",
+      "filename|sha3-224",
+      "filename|sha3-256",
+      "filename|sha3-384",
+      "filename|sha3-512",
+      "filename|tlsh",
+      "windows-scheduled-task",
+      "windows-service-name",
+      "windows-service-displayname",
       "whois-registrant-email",
+      "whois-registrant-phone",
       "whois-registrant-name",
       "whois-registrant-org",
-      "whois-registrant-phone",
       "whois-registrar",
-      "windows-scheduled-task",
-      "windows-service-displayname",
-      "windows-service-name",
-      "x509-fingerprint-md5",
+      "whois-creation-date",
       "x509-fingerprint-sha1",
+      "x509-fingerprint-md5",
       "x509-fingerprint-sha256",
-      "xmr",
-      "yara",
-      "zeek"
+      "dns-soa-email",
+      "size-in-bytes",
+      "counter",
+      "datetime",
+      "port",
+      "ip-dst|port",
+      "ip-src|port",
+      "hostname|port",
+      "mac-address",
+      "mac-eui-64",
+      "email-dst-display-name",
+      "email-src-display-name",
+      "email-header",
+      "email-reply-to",
+      "email-x-mailer",
+      "email-mime-boundary",
+      "email-thread-index",
+      "email-message-id",
+      "github-username",
+      "github-repository",
+      "github-organisation",
+      "jabber-id",
+      "twitter-id",
+      "dkim",
+      "dkim-signature",
+      "first-name",
+      "middle-name",
+      "last-name",
+      "date-of-birth",
+      "place-of-birth",
+      "gender",
+      "passport-number",
+      "passport-country",
+      "passport-expiration",
+      "redress-number",
+      "nationality",
+      "visa-number",
+      "issue-date-of-the-visa",
+      "primary-residence",
+      "country-of-residence",
+      "special-service-request",
+      "frequent-flyer-number",
+      "travel-details",
+      "payment-details",
+      "place-port-of-original-embarkation",
+      "place-port-of-clearance",
+      "place-port-of-onward-foreign-destination",
+      "passenger-name-record-locator-number",
+      "mobile-application-id",
+      "chrome-extension-id",
+      "cortex",
+      "boolean",
+      "anonymised"
     ]
   }
 }