diff --git a/taxonomy/README.md b/taxonomy/README.md index ee97975..a4a6a79 100644 --- a/taxonomy/README.md +++ b/taxonomy/README.md @@ -85,7 +85,7 @@ Tagging is a simple way to attach a classification to an event. In the early ver Taxonomy is a classification of informations. Taxonomies are implemented in a simple JSON format. Anyone can create their own taxonomy or reuse an existing one. -Taxonomies are in an [independent git repository](https://github.com/MISP/misp-taxonomies). +Taxonomies are in an [independent git repository](https://github.com/MISP/misp-taxonomies). These can be **freely reused** and **integrated** in other threat intel tools. @@ -193,7 +193,7 @@ Applying rules for distribution based on tags: admiralty-scale:source-reliability="b" admiralty-scale:source-reliability="c" admiralty-scale:source-reliability="d" - admiralty-scale:source-reliability="e" + admiralty-scale:source-reliability="e" admiralty-scale:source-reliability="f" admiralty-scale:information-credibility="1" admiralty-scale:information-credibility="2" @@ -216,6 +216,36 @@ Tags can be used to: * Enrich IDS export with tags to fit your NIDS deployment. +## More options to configure taxonomies. + +For MISP users and organisations, it's important to show the important contextualised information and especially the taxonomies which are important to your use-case. +Once a taxonomy is enabled and available for use in MISP, there are two more options a admin can be set to encourage the use of particular taxonomies. Both are found in Event Actions > List Taxonomies menu. + +![taxonomies-list](./figures/taxonomy-list.png) + +### Setting a taxonomy as "Highlighted" + +If a taxonomy is highlighted, its namespace will appear in a visible box, even if it is not set in the event. + +![highlight-event](./figures/highlight-event.png) + +Tags are also hilighted in the event list. + +![highlight-list-event](./figures/highlight-list-event.png) + +It is also easier to add an highlighted tag to an event. + +![tag-box](./figures/tag-box.png) + +### Setting a taxonomy as "Required" +If taxonomies are set as required, a message will be visible on the tag list of the event, enumerating the missing required taxonomies still missing. + +![missing-taxo](./figures/missing-taxo.png) + +An event will not be published if it is not tagged with at least one of tag of each required taxonomy. + +![publishing-without-required](./figures/publishing-without-required.png) + ## Future functionalities related to MISP taxonomies - Sighting support (thanks to NCSC-NL) is integrated in MISP allowing to auto expire IOC based on user detection. diff --git a/taxonomy/figures/highlight-event.png b/taxonomy/figures/highlight-event.png new file mode 100644 index 0000000..240ed90 Binary files /dev/null and b/taxonomy/figures/highlight-event.png differ diff --git a/taxonomy/figures/highlight-list-event.png b/taxonomy/figures/highlight-list-event.png new file mode 100644 index 0000000..b6d63bf Binary files /dev/null and b/taxonomy/figures/highlight-list-event.png differ diff --git a/taxonomy/figures/missing-taxo.png b/taxonomy/figures/missing-taxo.png new file mode 100644 index 0000000..73ab578 Binary files /dev/null and b/taxonomy/figures/missing-taxo.png differ diff --git a/taxonomy/figures/publishing-without-required.png b/taxonomy/figures/publishing-without-required.png new file mode 100644 index 0000000..9615f46 Binary files /dev/null and b/taxonomy/figures/publishing-without-required.png differ diff --git a/taxonomy/figures/tag-box.png b/taxonomy/figures/tag-box.png new file mode 100644 index 0000000..527bbe2 Binary files /dev/null and b/taxonomy/figures/tag-box.png differ diff --git a/taxonomy/figures/taxonomy-list.png b/taxonomy/figures/taxonomy-list.png new file mode 100644 index 0000000..350465a Binary files /dev/null and b/taxonomy/figures/taxonomy-list.png differ