From 7e0d91af2ba3dd454d135a50e375eff7c328d097 Mon Sep 17 00:00:00 2001
From: Alexandre Dulaunoy <a@foo.be>
Date: Tue, 28 Aug 2018 21:07:40 +0200
Subject: [PATCH] fix: format of the describeTypes

---
 pymisp/data/describeTypes.json | 1974 ++++++++++++++++----------------
 1 file changed, 987 insertions(+), 987 deletions(-)

diff --git a/pymisp/data/describeTypes.json b/pymisp/data/describeTypes.json
index d226bb8..497c44b 100644
--- a/pymisp/data/describeTypes.json
+++ b/pymisp/data/describeTypes.json
@@ -1,804 +1,24 @@
 {
   "result": {
-    "sane_defaults": {
-      "md5": {
-        "default_category": "Payload delivery",
-        "to_ids": 1
-      },
-      "sha1": {
-        "default_category": "Payload delivery",
-        "to_ids": 1
-      },
-      "sha256": {
-        "default_category": "Payload delivery",
-        "to_ids": 1
-      },
-      "filename": {
-        "default_category": "Payload delivery",
-        "to_ids": 1
-      },
-      "pdb": {
-        "default_category": "Artifacts dropped",
-        "to_ids": 0
-      },
-      "filename|md5": {
-        "default_category": "Payload delivery",
-        "to_ids": 1
-      },
-      "filename|sha1": {
-        "default_category": "Payload delivery",
-        "to_ids": 1
-      },
-      "filename|sha256": {
-        "default_category": "Payload delivery",
-        "to_ids": 1
-      },
-      "ip-src": {
-        "default_category": "Network activity",
-        "to_ids": 1
-      },
-      "ip-dst": {
-        "default_category": "Network activity",
-        "to_ids": 1
-      },
-      "hostname": {
-        "default_category": "Network activity",
-        "to_ids": 1
-      },
-      "domain": {
-        "default_category": "Network activity",
-        "to_ids": 1
-      },
-      "domain|ip": {
-        "default_category": "Network activity",
-        "to_ids": 1
-      },
-      "email-src": {
-        "default_category": "Payload delivery",
-        "to_ids": 1
-      },
-      "email-dst": {
-        "default_category": "Network activity",
-        "to_ids": 1
-      },
-      "email-subject": {
-        "default_category": "Payload delivery",
-        "to_ids": 0
-      },
-      "email-attachment": {
-        "default_category": "Payload delivery",
-        "to_ids": 1
-      },
-      "email-body": {
-        "default_category": "Payload delivery",
-        "to_ids": 0
-      },
-      "float": {
-        "default_category": "Other",
-        "to_ids": 0
-      },
-      "url": {
-        "default_category": "Network activity",
-        "to_ids": 1
-      },
-      "http-method": {
-        "default_category": "Network activity",
-        "to_ids": 0
-      },
-      "user-agent": {
-        "default_category": "Network activity",
-        "to_ids": 0
-      },
-      "regkey": {
-        "default_category": "Persistence mechanism",
-        "to_ids": 1
-      },
-      "regkey|value": {
-        "default_category": "Persistence mechanism",
-        "to_ids": 1
-      },
-      "AS": {
-        "default_category": "Network activity",
-        "to_ids": 0
-      },
-      "snort": {
-        "default_category": "Network activity",
-        "to_ids": 1
-      },
-      "bro": {
-        "default_category": "Network activity",
-        "to_ids": 1
-      },
-      "pattern-in-file": {
-        "default_category": "Payload installation",
-        "to_ids": 1
-      },
-      "pattern-in-traffic": {
-        "default_category": "Network activity",
-        "to_ids": 1
-      },
-      "pattern-in-memory": {
-        "default_category": "Payload installation",
-        "to_ids": 1
-      },
-      "yara": {
-        "default_category": "Payload installation",
-        "to_ids": 1
-      },
-      "stix2-pattern": {
-        "default_category": "Payload installation",
-        "to_ids": 1
-      },
-      "sigma": {
-        "default_category": "Payload installation",
-        "to_ids": 1
-      },
-      "gene": {
-        "default_category": "Artifacts dropped",
-        "to_ids": 0
-      },
-      "mime-type": {
-        "default_category": "Artifacts dropped",
-        "to_ids": 0
-      },
-      "identity-card-number": {
-        "default_category": "Person",
-        "to_ids": 0
-      },
-      "cookie": {
-        "default_category": "Network activity",
-        "to_ids": 0
-      },
-      "vulnerability": {
-        "default_category": "External analysis",
-        "to_ids": 0
-      },
-      "attachment": {
-        "default_category": "External analysis",
-        "to_ids": 0
-      },
-      "malware-sample": {
-        "default_category": "Payload delivery",
-        "to_ids": 1
-      },
-      "link": {
-        "default_category": "External analysis",
-        "to_ids": 0
-      },
-      "comment": {
-        "default_category": "Other",
-        "to_ids": 0
-      },
-      "text": {
-        "default_category": "Other",
-        "to_ids": 0
-      },
-      "hex": {
-        "default_category": "Other",
-        "to_ids": 0
-      },
-      "other": {
-        "default_category": "Other",
-        "to_ids": 0
-      },
-      "named pipe": {
-        "default_category": "Artifacts dropped",
-        "to_ids": 0
-      },
-      "mutex": {
-        "default_category": "Artifacts dropped",
-        "to_ids": 1
-      },
-      "target-user": {
-        "default_category": "Targeting data",
-        "to_ids": 0
-      },
-      "target-email": {
-        "default_category": "Targeting data",
-        "to_ids": 0
-      },
-      "target-machine": {
-        "default_category": "Targeting data",
-        "to_ids": 0
-      },
-      "target-org": {
-        "default_category": "Targeting data",
-        "to_ids": 0
-      },
-      "target-location": {
-        "default_category": "Targeting data",
-        "to_ids": 0
-      },
-      "target-external": {
-        "default_category": "Targeting data",
-        "to_ids": 0
-      },
-      "btc": {
-        "default_category": "Financial fraud",
-        "to_ids": 1
-      },
-      "xmr": {
-        "default_category": "Financial fraud",
-        "to_ids": 1
-      },
-      "iban": {
-        "default_category": "Financial fraud",
-        "to_ids": 1
-      },
-      "bic": {
-        "default_category": "Financial fraud",
-        "to_ids": 1
-      },
-      "bank-account-nr": {
-        "default_category": "Financial fraud",
-        "to_ids": 1
-      },
-      "aba-rtn": {
-        "default_category": "Financial fraud",
-        "to_ids": 1
-      },
-      "bin": {
-        "default_category": "Financial fraud",
-        "to_ids": 1
-      },
-      "cc-number": {
-        "default_category": "Financial fraud",
-        "to_ids": 1
-      },
-      "prtn": {
-        "default_category": "Financial fraud",
-        "to_ids": 1
-      },
-      "phone-number": {
-        "default_category": "Person",
-        "to_ids": 0
-      },
-      "threat-actor": {
-        "default_category": "Attribution",
-        "to_ids": 0
-      },
-      "campaign-name": {
-        "default_category": "Attribution",
-        "to_ids": 0
-      },
-      "campaign-id": {
-        "default_category": "Attribution",
-        "to_ids": 0
-      },
-      "malware-type": {
-        "default_category": "Payload delivery",
-        "to_ids": 0
-      },
-      "uri": {
-        "default_category": "Network activity",
-        "to_ids": 1
-      },
-      "authentihash": {
-        "default_category": "Payload delivery",
-        "to_ids": 1
-      },
-      "ssdeep": {
-        "default_category": "Payload delivery",
-        "to_ids": 1
-      },
-      "imphash": {
-        "default_category": "Payload delivery",
-        "to_ids": 1
-      },
-      "pehash": {
-        "default_category": "Payload delivery",
-        "to_ids": 1
-      },
-      "impfuzzy": {
-        "default_category": "Payload delivery",
-        "to_ids": 1
-      },
-      "sha224": {
-        "default_category": "Payload delivery",
-        "to_ids": 1
-      },
-      "sha384": {
-        "default_category": "Payload delivery",
-        "to_ids": 1
-      },
-      "sha512": {
-        "default_category": "Payload delivery",
-        "to_ids": 1
-      },
-      "sha512/224": {
-        "default_category": "Payload delivery",
-        "to_ids": 1
-      },
-      "sha512/256": {
-        "default_category": "Payload delivery",
-        "to_ids": 1
-      },
-      "tlsh": {
-        "default_category": "Payload delivery",
-        "to_ids": 1
-      },
-      "filename|authentihash": {
-        "default_category": "Payload delivery",
-        "to_ids": 1
-      },
-      "filename|ssdeep": {
-        "default_category": "Payload delivery",
-        "to_ids": 1
-      },
-      "filename|imphash": {
-        "default_category": "Payload delivery",
-        "to_ids": 1
-      },
-      "filename|impfuzzy": {
-        "default_category": "Payload delivery",
-        "to_ids": 1
-      },
-      "filename|pehash": {
-        "default_category": "Payload delivery",
-        "to_ids": 1
-      },
-      "filename|sha224": {
-        "default_category": "Payload delivery",
-        "to_ids": 1
-      },
-      "filename|sha384": {
-        "default_category": "Payload delivery",
-        "to_ids": 1
-      },
-      "filename|sha512": {
-        "default_category": "Payload delivery",
-        "to_ids": 1
-      },
-      "filename|sha512/224": {
-        "default_category": "Payload delivery",
-        "to_ids": 1
-      },
-      "filename|sha512/256": {
-        "default_category": "Payload delivery",
-        "to_ids": 1
-      },
-      "filename|tlsh": {
-        "default_category": "Payload delivery",
-        "to_ids": 1
-      },
-      "windows-scheduled-task": {
-        "default_category": "Artifacts dropped",
-        "to_ids": 0
-      },
-      "windows-service-name": {
-        "default_category": "Artifacts dropped",
-        "to_ids": 0
-      },
-      "windows-service-displayname": {
-        "default_category": "Artifacts dropped",
-        "to_ids": 0
-      },
-      "whois-registrant-email": {
-        "default_category": "Attribution",
-        "to_ids": 0
-      },
-      "whois-registrant-phone": {
-        "default_category": "Attribution",
-        "to_ids": 0
-      },
-      "whois-registrant-name": {
-        "default_category": "Attribution",
-        "to_ids": 0
-      },
-      "whois-registrant-org": {
-        "default_category": "Attribution",
-        "to_ids": 0
-      },
-      "whois-registrar": {
-        "default_category": "Attribution",
-        "to_ids": 0
-      },
-      "whois-creation-date": {
-        "default_category": "Attribution",
-        "to_ids": 0
-      },
-      "x509-fingerprint-sha1": {
-        "default_category": "Network activity",
-        "to_ids": 1
-      },
-      "x509-fingerprint-md5": {
-        "default_category": "Network activity",
-        "to_ids": 1
-      },
-      "x509-fingerprint-sha256": {
-        "default_category": "Network activity",
-        "to_ids": 1
-      },
-      "dns-soa-email": {
-        "default_category": "Attribution",
-        "to_ids": 0
-      },
-      "size-in-bytes": {
-        "default_category": "Other",
-        "to_ids": 0
-      },
-      "counter": {
-        "default_category": "Other",
-        "to_ids": 0
-      },
-      "datetime": {
-        "default_category": "Other",
-        "to_ids": 0
-      },
-      "cpe": {
-        "default_category": "Other",
-        "to_ids": 0
-      },
-      "port": {
-        "default_category": "Network activity",
-        "to_ids": 0
-      },
-      "ip-dst|port": {
-        "default_category": "Network activity",
-        "to_ids": 1
-      },
-      "ip-src|port": {
-        "default_category": "Network activity",
-        "to_ids": 1
-      },
-      "hostname|port": {
-        "default_category": "Network activity",
-        "to_ids": 1
-      },
-      "mac-address": {
-        "default_category": "Network activity",
-        "to_ids": 0
-      },
-      "mac-eui-64": {
-        "default_category": "Network activity",
-        "to_ids": 0
-      },
-      "email-dst-display-name": {
-        "default_category": "Payload delivery",
-        "to_ids": 0
-      },
-      "email-src-display-name": {
-        "default_category": "Payload delivery",
-        "to_ids": 0
-      },
-      "email-header": {
-        "default_category": "Payload delivery",
-        "to_ids": 0
-      },
-      "email-reply-to": {
-        "default_category": "Payload delivery",
-        "to_ids": 0
-      },
-      "email-x-mailer": {
-        "default_category": "Payload delivery",
-        "to_ids": 0
-      },
-      "email-mime-boundary": {
-        "default_category": "Payload delivery",
-        "to_ids": 0
-      },
-      "email-thread-index": {
-        "default_category": "Payload delivery",
-        "to_ids": 0
-      },
-      "email-message-id": {
-        "default_category": "Payload delivery",
-        "to_ids": 0
-      },
-      "github-username": {
-        "default_category": "Social network",
-        "to_ids": 0
-      },
-      "github-repository": {
-        "default_category": "Social network",
-        "to_ids": 0
-      },
-      "github-organisation": {
-        "default_category": "Social network",
-        "to_ids": 0
-      },
-      "jabber-id": {
-        "default_category": "Social network",
-        "to_ids": 0
-      },
-      "twitter-id": {
-        "default_category": "Social network",
-        "to_ids": 0
-      },
-      "first-name": {
-        "default_category": "Person",
-        "to_ids": 0
-      },
-      "middle-name": {
-        "default_category": "Person",
-        "to_ids": 0
-      },
-      "last-name": {
-        "default_category": "Person",
-        "to_ids": 0
-      },
-      "date-of-birth": {
-        "default_category": "Person",
-        "to_ids": 0
-      },
-      "place-of-birth": {
-        "default_category": "Person",
-        "to_ids": 0
-      },
-      "gender": {
-        "default_category": "Person",
-        "to_ids": 0
-      },
-      "passport-number": {
-        "default_category": "Person",
-        "to_ids": 0
-      },
-      "passport-country": {
-        "default_category": "Person",
-        "to_ids": 0
-      },
-      "passport-expiration": {
-        "default_category": "Person",
-        "to_ids": 0
-      },
-      "redress-number": {
-        "default_category": "Person",
-        "to_ids": 0
-      },
-      "nationality": {
-        "default_category": "Person",
-        "to_ids": 0
-      },
-      "visa-number": {
-        "default_category": "Person",
-        "to_ids": 0
-      },
-      "issue-date-of-the-visa": {
-        "default_category": "Person",
-        "to_ids": 0
-      },
-      "primary-residence": {
-        "default_category": "Person",
-        "to_ids": 0
-      },
-      "country-of-residence": {
-        "default_category": "Person",
-        "to_ids": 0
-      },
-      "special-service-request": {
-        "default_category": "Person",
-        "to_ids": 0
-      },
-      "frequent-flyer-number": {
-        "default_category": "Person",
-        "to_ids": 0
-      },
-      "travel-details": {
-        "default_category": "Person",
-        "to_ids": 0
-      },
-      "payment-details": {
-        "default_category": "Person",
-        "to_ids": 0
-      },
-      "place-port-of-original-embarkation": {
-        "default_category": "Person",
-        "to_ids": 0
-      },
-      "place-port-of-clearance": {
-        "default_category": "Person",
-        "to_ids": 0
-      },
-      "place-port-of-onward-foreign-destination": {
-        "default_category": "Person",
-        "to_ids": 0
-      },
-      "passenger-name-record-locator-number": {
-        "default_category": "Person",
-        "to_ids": 0
-      },
-      "mobile-application-id": {
-        "default_category": "Payload delivery",
-        "to_ids": 1
-      },
-      "cortex": {
-        "default_category": "External analysis",
-        "to_ids": 0
-      },
-      "boolean": {
-        "default_category": "Other",
-        "to_ids": 0
-      }
-    },
-    "types": [
-      "md5",
-      "sha1",
-      "sha256",
-      "filename",
-      "pdb",
-      "filename|md5",
-      "filename|sha1",
-      "filename|sha256",
-      "ip-src",
-      "ip-dst",
-      "hostname",
-      "domain",
-      "domain|ip",
-      "email-src",
-      "email-dst",
-      "email-subject",
-      "email-attachment",
-      "email-body",
-      "float",
-      "url",
-      "http-method",
-      "user-agent",
-      "regkey",
-      "regkey|value",
-      "AS",
-      "snort",
-      "bro",
-      "pattern-in-file",
-      "pattern-in-traffic",
-      "pattern-in-memory",
-      "yara",
-      "stix2-pattern",
-      "sigma",
-      "gene",
-      "mime-type",
-      "identity-card-number",
-      "cookie",
-      "vulnerability",
-      "attachment",
-      "malware-sample",
-      "link",
-      "comment",
-      "text",
-      "hex",
-      "other",
-      "named pipe",
-      "mutex",
-      "target-user",
-      "target-email",
-      "target-machine",
-      "target-org",
-      "target-location",
-      "target-external",
-      "btc",
-      "xmr",
-      "iban",
-      "bic",
-      "bank-account-nr",
-      "aba-rtn",
-      "bin",
-      "cc-number",
-      "prtn",
-      "phone-number",
-      "threat-actor",
-      "campaign-name",
-      "campaign-id",
-      "malware-type",
-      "uri",
-      "authentihash",
-      "ssdeep",
-      "imphash",
-      "pehash",
-      "impfuzzy",
-      "sha224",
-      "sha384",
-      "sha512",
-      "sha512/224",
-      "sha512/256",
-      "tlsh",
-      "filename|authentihash",
-      "filename|ssdeep",
-      "filename|imphash",
-      "filename|impfuzzy",
-      "filename|pehash",
-      "filename|sha224",
-      "filename|sha384",
-      "filename|sha512",
-      "filename|sha512/224",
-      "filename|sha512/256",
-      "filename|tlsh",
-      "windows-scheduled-task",
-      "windows-service-name",
-      "windows-service-displayname",
-      "whois-registrant-email",
-      "whois-registrant-phone",
-      "whois-registrant-name",
-      "whois-registrant-org",
-      "whois-registrar",
-      "whois-creation-date",
-      "x509-fingerprint-sha1",
-      "x509-fingerprint-md5",
-      "x509-fingerprint-sha256",
-      "dns-soa-email",
-      "size-in-bytes",
-      "counter",
-      "datetime",
-      "cpe",
-      "port",
-      "ip-dst|port",
-      "ip-src|port",
-      "hostname|port",
-      "mac-address",
-      "mac-eui-64",
-      "email-dst-display-name",
-      "email-src-display-name",
-      "email-header",
-      "email-reply-to",
-      "email-x-mailer",
-      "email-mime-boundary",
-      "email-thread-index",
-      "email-message-id",
-      "github-username",
-      "github-repository",
-      "github-organisation",
-      "jabber-id",
-      "twitter-id",
-      "first-name",
-      "middle-name",
-      "last-name",
-      "date-of-birth",
-      "place-of-birth",
-      "gender",
-      "passport-number",
-      "passport-country",
-      "passport-expiration",
-      "redress-number",
-      "nationality",
-      "visa-number",
-      "issue-date-of-the-visa",
-      "primary-residence",
-      "country-of-residence",
-      "special-service-request",
-      "frequent-flyer-number",
-      "travel-details",
-      "payment-details",
-      "place-port-of-original-embarkation",
-      "place-port-of-clearance",
-      "place-port-of-onward-foreign-destination",
-      "passenger-name-record-locator-number",
-      "mobile-application-id",
-      "cortex",
-      "boolean"
-    ],
     "categories": [
-      "Internal reference",
-      "Targeting data",
       "Antivirus detection",
-      "Payload delivery",
       "Artifacts dropped",
-      "Payload installation",
-      "Persistence mechanism",
-      "Network activity",
-      "Payload type",
       "Attribution",
       "External analysis",
       "Financial fraud",
-      "Support Tool",
-      "Social network",
+      "Internal reference",
+      "Network activity",
+      "Other",
+      "Payload delivery",
+      "Payload installation",
+      "Payload type",
+      "Persistence mechanism",
       "Person",
-      "Other"
+      "Social network",
+      "Support Tool",
+      "Targeting data"
     ],
     "category_type_mappings": {
-      "Internal reference": [
-        "text",
-        "link",
-        "comment",
-        "other",
-        "hex"
-      ],
-      "Targeting data": [
-        "target-user",
-        "target-email",
-        "target-machine",
-        "target-org",
-        "target-location",
-        "target-external",
-        "comment"
-      ],
       "Antivirus detection": [
         "link",
         "comment",
@@ -807,6 +27,186 @@
         "attachment",
         "other"
       ],
+      "Artifacts dropped": [
+        "md5",
+        "sha1",
+        "sha224",
+        "sha256",
+        "sha384",
+        "sha512",
+        "sha512/224",
+        "sha512/256",
+        "ssdeep",
+        "imphash",
+        "impfuzzy",
+        "authentihash",
+        "filename",
+        "filename|md5",
+        "filename|sha1",
+        "filename|sha224",
+        "filename|sha256",
+        "filename|sha384",
+        "filename|sha512",
+        "filename|sha512/224",
+        "filename|sha512/256",
+        "filename|authentihash",
+        "filename|ssdeep",
+        "filename|tlsh",
+        "filename|imphash",
+        "filename|impfuzzy",
+        "filename|pehash",
+        "regkey",
+        "regkey|value",
+        "pattern-in-file",
+        "pattern-in-memory",
+        "pdb",
+        "stix2-pattern",
+        "yara",
+        "sigma",
+        "attachment",
+        "malware-sample",
+        "named pipe",
+        "mutex",
+        "windows-scheduled-task",
+        "windows-service-name",
+        "windows-service-displayname",
+        "comment",
+        "text",
+        "hex",
+        "x509-fingerprint-sha1",
+        "x509-fingerprint-md5",
+        "x509-fingerprint-sha256",
+        "other",
+        "cookie",
+        "gene",
+        "mime-type"
+      ],
+      "Attribution": [
+        "threat-actor",
+        "campaign-name",
+        "campaign-id",
+        "whois-registrant-phone",
+        "whois-registrant-email",
+        "whois-registrant-name",
+        "whois-registrant-org",
+        "whois-registrar",
+        "whois-creation-date",
+        "comment",
+        "text",
+        "x509-fingerprint-sha1",
+        "x509-fingerprint-md5",
+        "x509-fingerprint-sha256",
+        "other",
+        "dns-soa-email"
+      ],
+      "External analysis": [
+        "md5",
+        "sha1",
+        "sha256",
+        "filename",
+        "filename|md5",
+        "filename|sha1",
+        "filename|sha256",
+        "ip-src",
+        "ip-dst",
+        "ip-dst|port",
+        "ip-src|port",
+        "mac-address",
+        "mac-eui-64",
+        "hostname",
+        "domain",
+        "domain|ip",
+        "url",
+        "user-agent",
+        "regkey",
+        "regkey|value",
+        "AS",
+        "snort",
+        "bro",
+        "pattern-in-file",
+        "pattern-in-traffic",
+        "pattern-in-memory",
+        "vulnerability",
+        "attachment",
+        "malware-sample",
+        "link",
+        "comment",
+        "text",
+        "x509-fingerprint-sha1",
+        "x509-fingerprint-md5",
+        "x509-fingerprint-sha256",
+        "github-repository",
+        "other",
+        "cortex"
+      ],
+      "Financial fraud": [
+        "btc",
+        "xmr",
+        "iban",
+        "bic",
+        "bank-account-nr",
+        "aba-rtn",
+        "bin",
+        "cc-number",
+        "prtn",
+        "phone-number",
+        "comment",
+        "text",
+        "other",
+        "hex"
+      ],
+      "Internal reference": [
+        "text",
+        "link",
+        "comment",
+        "other",
+        "hex"
+      ],
+      "Network activity": [
+        "ip-src",
+        "ip-dst",
+        "ip-dst|port",
+        "ip-src|port",
+        "port",
+        "hostname",
+        "domain",
+        "domain|ip",
+        "mac-address",
+        "mac-eui-64",
+        "email-dst",
+        "url",
+        "uri",
+        "user-agent",
+        "http-method",
+        "AS",
+        "snort",
+        "pattern-in-file",
+        "stix2-pattern",
+        "pattern-in-traffic",
+        "attachment",
+        "comment",
+        "text",
+        "x509-fingerprint-sha1",
+        "other",
+        "hex",
+        "cookie",
+        "hostname|port",
+        "bro"
+      ],
+      "Other": [
+        "comment",
+        "text",
+        "other",
+        "size-in-bytes",
+        "counter",
+        "datetime",
+        "cpe",
+        "port",
+        "float",
+        "hex",
+        "phone-number",
+        "boolean"
+      ],
       "Payload delivery": [
         "md5",
         "sha1",
@@ -883,60 +283,6 @@
         "mobile-application-id",
         "whois-registrant-email"
       ],
-      "Artifacts dropped": [
-        "md5",
-        "sha1",
-        "sha224",
-        "sha256",
-        "sha384",
-        "sha512",
-        "sha512/224",
-        "sha512/256",
-        "ssdeep",
-        "imphash",
-        "impfuzzy",
-        "authentihash",
-        "filename",
-        "filename|md5",
-        "filename|sha1",
-        "filename|sha224",
-        "filename|sha256",
-        "filename|sha384",
-        "filename|sha512",
-        "filename|sha512/224",
-        "filename|sha512/256",
-        "filename|authentihash",
-        "filename|ssdeep",
-        "filename|tlsh",
-        "filename|imphash",
-        "filename|impfuzzy",
-        "filename|pehash",
-        "regkey",
-        "regkey|value",
-        "pattern-in-file",
-        "pattern-in-memory",
-        "pdb",
-        "stix2-pattern",
-        "yara",
-        "sigma",
-        "attachment",
-        "malware-sample",
-        "named pipe",
-        "mutex",
-        "windows-scheduled-task",
-        "windows-service-name",
-        "windows-service-displayname",
-        "comment",
-        "text",
-        "hex",
-        "x509-fingerprint-sha1",
-        "x509-fingerprint-md5",
-        "x509-fingerprint-sha256",
-        "other",
-        "cookie",
-        "gene",
-        "mime-type"
-      ],
       "Payload installation": [
         "md5",
         "sha1",
@@ -987,6 +333,11 @@
         "other",
         "mime-type"
       ],
+      "Payload type": [
+        "comment",
+        "text",
+        "other"
+      ],
       "Persistence mechanism": [
         "filename",
         "regkey",
@@ -996,137 +347,6 @@
         "other",
         "hex"
       ],
-      "Network activity": [
-        "ip-src",
-        "ip-dst",
-        "ip-dst|port",
-        "ip-src|port",
-        "port",
-        "hostname",
-        "domain",
-        "domain|ip",
-        "mac-address",
-        "mac-eui-64",
-        "email-dst",
-        "url",
-        "uri",
-        "user-agent",
-        "http-method",
-        "AS",
-        "snort",
-        "pattern-in-file",
-        "stix2-pattern",
-        "pattern-in-traffic",
-        "attachment",
-        "comment",
-        "text",
-        "x509-fingerprint-sha1",
-        "other",
-        "hex",
-        "cookie",
-        "hostname|port",
-        "bro"
-      ],
-      "Payload type": [
-        "comment",
-        "text",
-        "other"
-      ],
-      "Attribution": [
-        "threat-actor",
-        "campaign-name",
-        "campaign-id",
-        "whois-registrant-phone",
-        "whois-registrant-email",
-        "whois-registrant-name",
-        "whois-registrant-org",
-        "whois-registrar",
-        "whois-creation-date",
-        "comment",
-        "text",
-        "x509-fingerprint-sha1",
-        "x509-fingerprint-md5",
-        "x509-fingerprint-sha256",
-        "other",
-        "dns-soa-email"
-      ],
-      "External analysis": [
-        "md5",
-        "sha1",
-        "sha256",
-        "filename",
-        "filename|md5",
-        "filename|sha1",
-        "filename|sha256",
-        "ip-src",
-        "ip-dst",
-        "ip-dst|port",
-        "ip-src|port",
-        "mac-address",
-        "mac-eui-64",
-        "hostname",
-        "domain",
-        "domain|ip",
-        "url",
-        "user-agent",
-        "regkey",
-        "regkey|value",
-        "AS",
-        "snort",
-        "bro",
-        "pattern-in-file",
-        "pattern-in-traffic",
-        "pattern-in-memory",
-        "vulnerability",
-        "attachment",
-        "malware-sample",
-        "link",
-        "comment",
-        "text",
-        "x509-fingerprint-sha1",
-        "x509-fingerprint-md5",
-        "x509-fingerprint-sha256",
-        "github-repository",
-        "other",
-        "cortex"
-      ],
-      "Financial fraud": [
-        "btc",
-        "xmr",
-        "iban",
-        "bic",
-        "bank-account-nr",
-        "aba-rtn",
-        "bin",
-        "cc-number",
-        "prtn",
-        "phone-number",
-        "comment",
-        "text",
-        "other",
-        "hex"
-      ],
-      "Support Tool": [
-        "link",
-        "text",
-        "attachment",
-        "comment",
-        "other",
-        "hex"
-      ],
-      "Social network": [
-        "github-username",
-        "github-repository",
-        "github-organisation",
-        "jabber-id",
-        "twitter-id",
-        "email-src",
-        "email-dst",
-        "comment",
-        "text",
-        "other",
-        "whois-registrant-email"
-      ],
       "Person": [
         "first-name",
         "middle-name",
@@ -1157,20 +377,800 @@
         "phone-number",
         "identity-card-number"
       ],
-      "Other": [
+      "Social network": [
+        "github-username",
+        "github-repository",
+        "github-organisation",
+        "jabber-id",
+        "twitter-id",
+        "email-src",
+        "email-dst",
         "comment",
         "text",
         "other",
-        "size-in-bytes",
-        "counter",
-        "datetime",
-        "cpe",
-        "port",
-        "float",
-        "hex",
-        "phone-number",
-        "boolean"
+        "whois-registrant-email"
+      ],
+      "Support Tool": [
+        "link",
+        "text",
+        "attachment",
+        "comment",
+        "other",
+        "hex"
+      ],
+      "Targeting data": [
+        "target-user",
+        "target-email",
+        "target-machine",
+        "target-org",
+        "target-location",
+        "target-external",
+        "comment"
       ]
-    }
+    },
+    "sane_defaults": {
+      "AS": {
+        "default_category": "Network activity",
+        "to_ids": 0
+      },
+      "aba-rtn": {
+        "default_category": "Financial fraud",
+        "to_ids": 1
+      },
+      "attachment": {
+        "default_category": "External analysis",
+        "to_ids": 0
+      },
+      "authentihash": {
+        "default_category": "Payload delivery",
+        "to_ids": 1
+      },
+      "bank-account-nr": {
+        "default_category": "Financial fraud",
+        "to_ids": 1
+      },
+      "bic": {
+        "default_category": "Financial fraud",
+        "to_ids": 1
+      },
+      "bin": {
+        "default_category": "Financial fraud",
+        "to_ids": 1
+      },
+      "boolean": {
+        "default_category": "Other",
+        "to_ids": 0
+      },
+      "bro": {
+        "default_category": "Network activity",
+        "to_ids": 1
+      },
+      "btc": {
+        "default_category": "Financial fraud",
+        "to_ids": 1
+      },
+      "campaign-id": {
+        "default_category": "Attribution",
+        "to_ids": 0
+      },
+      "campaign-name": {
+        "default_category": "Attribution",
+        "to_ids": 0
+      },
+      "cc-number": {
+        "default_category": "Financial fraud",
+        "to_ids": 1
+      },
+      "comment": {
+        "default_category": "Other",
+        "to_ids": 0
+      },
+      "cookie": {
+        "default_category": "Network activity",
+        "to_ids": 0
+      },
+      "cortex": {
+        "default_category": "External analysis",
+        "to_ids": 0
+      },
+      "counter": {
+        "default_category": "Other",
+        "to_ids": 0
+      },
+      "country-of-residence": {
+        "default_category": "Person",
+        "to_ids": 0
+      },
+      "cpe": {
+        "default_category": "Other",
+        "to_ids": 0
+      },
+      "date-of-birth": {
+        "default_category": "Person",
+        "to_ids": 0
+      },
+      "datetime": {
+        "default_category": "Other",
+        "to_ids": 0
+      },
+      "dns-soa-email": {
+        "default_category": "Attribution",
+        "to_ids": 0
+      },
+      "domain": {
+        "default_category": "Network activity",
+        "to_ids": 1
+      },
+      "domain|ip": {
+        "default_category": "Network activity",
+        "to_ids": 1
+      },
+      "email-attachment": {
+        "default_category": "Payload delivery",
+        "to_ids": 1
+      },
+      "email-body": {
+        "default_category": "Payload delivery",
+        "to_ids": 0
+      },
+      "email-dst": {
+        "default_category": "Network activity",
+        "to_ids": 1
+      },
+      "email-dst-display-name": {
+        "default_category": "Payload delivery",
+        "to_ids": 0
+      },
+      "email-header": {
+        "default_category": "Payload delivery",
+        "to_ids": 0
+      },
+      "email-message-id": {
+        "default_category": "Payload delivery",
+        "to_ids": 0
+      },
+      "email-mime-boundary": {
+        "default_category": "Payload delivery",
+        "to_ids": 0
+      },
+      "email-reply-to": {
+        "default_category": "Payload delivery",
+        "to_ids": 0
+      },
+      "email-src": {
+        "default_category": "Payload delivery",
+        "to_ids": 1
+      },
+      "email-src-display-name": {
+        "default_category": "Payload delivery",
+        "to_ids": 0
+      },
+      "email-subject": {
+        "default_category": "Payload delivery",
+        "to_ids": 0
+      },
+      "email-thread-index": {
+        "default_category": "Payload delivery",
+        "to_ids": 0
+      },
+      "email-x-mailer": {
+        "default_category": "Payload delivery",
+        "to_ids": 0
+      },
+      "filename": {
+        "default_category": "Payload delivery",
+        "to_ids": 1
+      },
+      "filename|authentihash": {
+        "default_category": "Payload delivery",
+        "to_ids": 1
+      },
+      "filename|impfuzzy": {
+        "default_category": "Payload delivery",
+        "to_ids": 1
+      },
+      "filename|imphash": {
+        "default_category": "Payload delivery",
+        "to_ids": 1
+      },
+      "filename|md5": {
+        "default_category": "Payload delivery",
+        "to_ids": 1
+      },
+      "filename|pehash": {
+        "default_category": "Payload delivery",
+        "to_ids": 1
+      },
+      "filename|sha1": {
+        "default_category": "Payload delivery",
+        "to_ids": 1
+      },
+      "filename|sha224": {
+        "default_category": "Payload delivery",
+        "to_ids": 1
+      },
+      "filename|sha256": {
+        "default_category": "Payload delivery",
+        "to_ids": 1
+      },
+      "filename|sha384": {
+        "default_category": "Payload delivery",
+        "to_ids": 1
+      },
+      "filename|sha512": {
+        "default_category": "Payload delivery",
+        "to_ids": 1
+      },
+      "filename|sha512/224": {
+        "default_category": "Payload delivery",
+        "to_ids": 1
+      },
+      "filename|sha512/256": {
+        "default_category": "Payload delivery",
+        "to_ids": 1
+      },
+      "filename|ssdeep": {
+        "default_category": "Payload delivery",
+        "to_ids": 1
+      },
+      "filename|tlsh": {
+        "default_category": "Payload delivery",
+        "to_ids": 1
+      },
+      "first-name": {
+        "default_category": "Person",
+        "to_ids": 0
+      },
+      "float": {
+        "default_category": "Other",
+        "to_ids": 0
+      },
+      "frequent-flyer-number": {
+        "default_category": "Person",
+        "to_ids": 0
+      },
+      "gender": {
+        "default_category": "Person",
+        "to_ids": 0
+      },
+      "gene": {
+        "default_category": "Artifacts dropped",
+        "to_ids": 0
+      },
+      "github-organisation": {
+        "default_category": "Social network",
+        "to_ids": 0
+      },
+      "github-repository": {
+        "default_category": "Social network",
+        "to_ids": 0
+      },
+      "github-username": {
+        "default_category": "Social network",
+        "to_ids": 0
+      },
+      "hex": {
+        "default_category": "Other",
+        "to_ids": 0
+      },
+      "hostname": {
+        "default_category": "Network activity",
+        "to_ids": 1
+      },
+      "hostname|port": {
+        "default_category": "Network activity",
+        "to_ids": 1
+      },
+      "http-method": {
+        "default_category": "Network activity",
+        "to_ids": 0
+      },
+      "iban": {
+        "default_category": "Financial fraud",
+        "to_ids": 1
+      },
+      "identity-card-number": {
+        "default_category": "Person",
+        "to_ids": 0
+      },
+      "impfuzzy": {
+        "default_category": "Payload delivery",
+        "to_ids": 1
+      },
+      "imphash": {
+        "default_category": "Payload delivery",
+        "to_ids": 1
+      },
+      "ip-dst": {
+        "default_category": "Network activity",
+        "to_ids": 1
+      },
+      "ip-dst|port": {
+        "default_category": "Network activity",
+        "to_ids": 1
+      },
+      "ip-src": {
+        "default_category": "Network activity",
+        "to_ids": 1
+      },
+      "ip-src|port": {
+        "default_category": "Network activity",
+        "to_ids": 1
+      },
+      "issue-date-of-the-visa": {
+        "default_category": "Person",
+        "to_ids": 0
+      },
+      "jabber-id": {
+        "default_category": "Social network",
+        "to_ids": 0
+      },
+      "last-name": {
+        "default_category": "Person",
+        "to_ids": 0
+      },
+      "link": {
+        "default_category": "External analysis",
+        "to_ids": 0
+      },
+      "mac-address": {
+        "default_category": "Network activity",
+        "to_ids": 0
+      },
+      "mac-eui-64": {
+        "default_category": "Network activity",
+        "to_ids": 0
+      },
+      "malware-sample": {
+        "default_category": "Payload delivery",
+        "to_ids": 1
+      },
+      "malware-type": {
+        "default_category": "Payload delivery",
+        "to_ids": 0
+      },
+      "md5": {
+        "default_category": "Payload delivery",
+        "to_ids": 1
+      },
+      "middle-name": {
+        "default_category": "Person",
+        "to_ids": 0
+      },
+      "mime-type": {
+        "default_category": "Artifacts dropped",
+        "to_ids": 0
+      },
+      "mobile-application-id": {
+        "default_category": "Payload delivery",
+        "to_ids": 1
+      },
+      "mutex": {
+        "default_category": "Artifacts dropped",
+        "to_ids": 1
+      },
+      "named pipe": {
+        "default_category": "Artifacts dropped",
+        "to_ids": 0
+      },
+      "nationality": {
+        "default_category": "Person",
+        "to_ids": 0
+      },
+      "other": {
+        "default_category": "Other",
+        "to_ids": 0
+      },
+      "passenger-name-record-locator-number": {
+        "default_category": "Person",
+        "to_ids": 0
+      },
+      "passport-country": {
+        "default_category": "Person",
+        "to_ids": 0
+      },
+      "passport-expiration": {
+        "default_category": "Person",
+        "to_ids": 0
+      },
+      "passport-number": {
+        "default_category": "Person",
+        "to_ids": 0
+      },
+      "pattern-in-file": {
+        "default_category": "Payload installation",
+        "to_ids": 1
+      },
+      "pattern-in-memory": {
+        "default_category": "Payload installation",
+        "to_ids": 1
+      },
+      "pattern-in-traffic": {
+        "default_category": "Network activity",
+        "to_ids": 1
+      },
+      "payment-details": {
+        "default_category": "Person",
+        "to_ids": 0
+      },
+      "pdb": {
+        "default_category": "Artifacts dropped",
+        "to_ids": 0
+      },
+      "pehash": {
+        "default_category": "Payload delivery",
+        "to_ids": 1
+      },
+      "phone-number": {
+        "default_category": "Person",
+        "to_ids": 0
+      },
+      "place-of-birth": {
+        "default_category": "Person",
+        "to_ids": 0
+      },
+      "place-port-of-clearance": {
+        "default_category": "Person",
+        "to_ids": 0
+      },
+      "place-port-of-onward-foreign-destination": {
+        "default_category": "Person",
+        "to_ids": 0
+      },
+      "place-port-of-original-embarkation": {
+        "default_category": "Person",
+        "to_ids": 0
+      },
+      "port": {
+        "default_category": "Network activity",
+        "to_ids": 0
+      },
+      "primary-residence": {
+        "default_category": "Person",
+        "to_ids": 0
+      },
+      "prtn": {
+        "default_category": "Financial fraud",
+        "to_ids": 1
+      },
+      "redress-number": {
+        "default_category": "Person",
+        "to_ids": 0
+      },
+      "regkey": {
+        "default_category": "Persistence mechanism",
+        "to_ids": 1
+      },
+      "regkey|value": {
+        "default_category": "Persistence mechanism",
+        "to_ids": 1
+      },
+      "sha1": {
+        "default_category": "Payload delivery",
+        "to_ids": 1
+      },
+      "sha224": {
+        "default_category": "Payload delivery",
+        "to_ids": 1
+      },
+      "sha256": {
+        "default_category": "Payload delivery",
+        "to_ids": 1
+      },
+      "sha384": {
+        "default_category": "Payload delivery",
+        "to_ids": 1
+      },
+      "sha512": {
+        "default_category": "Payload delivery",
+        "to_ids": 1
+      },
+      "sha512/224": {
+        "default_category": "Payload delivery",
+        "to_ids": 1
+      },
+      "sha512/256": {
+        "default_category": "Payload delivery",
+        "to_ids": 1
+      },
+      "sigma": {
+        "default_category": "Payload installation",
+        "to_ids": 1
+      },
+      "size-in-bytes": {
+        "default_category": "Other",
+        "to_ids": 0
+      },
+      "snort": {
+        "default_category": "Network activity",
+        "to_ids": 1
+      },
+      "special-service-request": {
+        "default_category": "Person",
+        "to_ids": 0
+      },
+      "ssdeep": {
+        "default_category": "Payload delivery",
+        "to_ids": 1
+      },
+      "stix2-pattern": {
+        "default_category": "Payload installation",
+        "to_ids": 1
+      },
+      "target-email": {
+        "default_category": "Targeting data",
+        "to_ids": 0
+      },
+      "target-external": {
+        "default_category": "Targeting data",
+        "to_ids": 0
+      },
+      "target-location": {
+        "default_category": "Targeting data",
+        "to_ids": 0
+      },
+      "target-machine": {
+        "default_category": "Targeting data",
+        "to_ids": 0
+      },
+      "target-org": {
+        "default_category": "Targeting data",
+        "to_ids": 0
+      },
+      "target-user": {
+        "default_category": "Targeting data",
+        "to_ids": 0
+      },
+      "text": {
+        "default_category": "Other",
+        "to_ids": 0
+      },
+      "threat-actor": {
+        "default_category": "Attribution",
+        "to_ids": 0
+      },
+      "tlsh": {
+        "default_category": "Payload delivery",
+        "to_ids": 1
+      },
+      "travel-details": {
+        "default_category": "Person",
+        "to_ids": 0
+      },
+      "twitter-id": {
+        "default_category": "Social network",
+        "to_ids": 0
+      },
+      "uri": {
+        "default_category": "Network activity",
+        "to_ids": 1
+      },
+      "url": {
+        "default_category": "Network activity",
+        "to_ids": 1
+      },
+      "user-agent": {
+        "default_category": "Network activity",
+        "to_ids": 0
+      },
+      "visa-number": {
+        "default_category": "Person",
+        "to_ids": 0
+      },
+      "vulnerability": {
+        "default_category": "External analysis",
+        "to_ids": 0
+      },
+      "whois-creation-date": {
+        "default_category": "Attribution",
+        "to_ids": 0
+      },
+      "whois-registrant-email": {
+        "default_category": "Attribution",
+        "to_ids": 0
+      },
+      "whois-registrant-name": {
+        "default_category": "Attribution",
+        "to_ids": 0
+      },
+      "whois-registrant-org": {
+        "default_category": "Attribution",
+        "to_ids": 0
+      },
+      "whois-registrant-phone": {
+        "default_category": "Attribution",
+        "to_ids": 0
+      },
+      "whois-registrar": {
+        "default_category": "Attribution",
+        "to_ids": 0
+      },
+      "windows-scheduled-task": {
+        "default_category": "Artifacts dropped",
+        "to_ids": 0
+      },
+      "windows-service-displayname": {
+        "default_category": "Artifacts dropped",
+        "to_ids": 0
+      },
+      "windows-service-name": {
+        "default_category": "Artifacts dropped",
+        "to_ids": 0
+      },
+      "x509-fingerprint-md5": {
+        "default_category": "Network activity",
+        "to_ids": 1
+      },
+      "x509-fingerprint-sha1": {
+        "default_category": "Network activity",
+        "to_ids": 1
+      },
+      "x509-fingerprint-sha256": {
+        "default_category": "Network activity",
+        "to_ids": 1
+      },
+      "xmr": {
+        "default_category": "Financial fraud",
+        "to_ids": 1
+      },
+      "yara": {
+        "default_category": "Payload installation",
+        "to_ids": 1
+      }
+    },
+    "types": [
+      "AS",
+      "aba-rtn",
+      "attachment",
+      "authentihash",
+      "bank-account-nr",
+      "bic",
+      "bin",
+      "boolean",
+      "bro",
+      "btc",
+      "campaign-id",
+      "campaign-name",
+      "cc-number",
+      "comment",
+      "cookie",
+      "cortex",
+      "counter",
+      "country-of-residence",
+      "cpe",
+      "date-of-birth",
+      "datetime",
+      "dns-soa-email",
+      "domain",
+      "domain|ip",
+      "email-attachment",
+      "email-body",
+      "email-dst",
+      "email-dst-display-name",
+      "email-header",
+      "email-message-id",
+      "email-mime-boundary",
+      "email-reply-to",
+      "email-src",
+      "email-src-display-name",
+      "email-subject",
+      "email-thread-index",
+      "email-x-mailer",
+      "filename",
+      "filename|authentihash",
+      "filename|impfuzzy",
+      "filename|imphash",
+      "filename|md5",
+      "filename|pehash",
+      "filename|sha1",
+      "filename|sha224",
+      "filename|sha256",
+      "filename|sha384",
+      "filename|sha512",
+      "filename|sha512/224",
+      "filename|sha512/256",
+      "filename|ssdeep",
+      "filename|tlsh",
+      "first-name",
+      "float",
+      "frequent-flyer-number",
+      "gender",
+      "gene",
+      "github-organisation",
+      "github-repository",
+      "github-username",
+      "hex",
+      "hostname",
+      "hostname|port",
+      "http-method",
+      "iban",
+      "identity-card-number",
+      "impfuzzy",
+      "imphash",
+      "ip-dst",
+      "ip-dst|port",
+      "ip-src",
+      "ip-src|port",
+      "issue-date-of-the-visa",
+      "jabber-id",
+      "last-name",
+      "link",
+      "mac-address",
+      "mac-eui-64",
+      "malware-sample",
+      "malware-type",
+      "md5",
+      "middle-name",
+      "mime-type",
+      "mobile-application-id",
+      "mutex",
+      "named pipe",
+      "nationality",
+      "other",
+      "passenger-name-record-locator-number",
+      "passport-country",
+      "passport-expiration",
+      "passport-number",
+      "pattern-in-file",
+      "pattern-in-memory",
+      "pattern-in-traffic",
+      "payment-details",
+      "pdb",
+      "pehash",
+      "phone-number",
+      "place-of-birth",
+      "place-port-of-clearance",
+      "place-port-of-onward-foreign-destination",
+      "place-port-of-original-embarkation",
+      "port",
+      "primary-residence",
+      "prtn",
+      "redress-number",
+      "regkey",
+      "regkey|value",
+      "sha1",
+      "sha224",
+      "sha256",
+      "sha384",
+      "sha512",
+      "sha512/224",
+      "sha512/256",
+      "sigma",
+      "size-in-bytes",
+      "snort",
+      "special-service-request",
+      "ssdeep",
+      "stix2-pattern",
+      "target-email",
+      "target-external",
+      "target-location",
+      "target-machine",
+      "target-org",
+      "target-user",
+      "text",
+      "threat-actor",
+      "tlsh",
+      "travel-details",
+      "twitter-id",
+      "uri",
+      "url",
+      "user-agent",
+      "visa-number",
+      "vulnerability",
+      "whois-creation-date",
+      "whois-registrant-email",
+      "whois-registrant-name",
+      "whois-registrant-org",
+      "whois-registrant-phone",
+      "whois-registrar",
+      "windows-scheduled-task",
+      "windows-service-displayname",
+      "windows-service-name",
+      "x509-fingerprint-md5",
+      "x509-fingerprint-sha1",
+      "x509-fingerprint-sha256",
+      "xmr",
+      "yara"
+    ]
   }
-}
+}
\ No newline at end of file