From a90a428983b6d734e41ac6b81850ac70245273a7 Mon Sep 17 00:00:00 2001 From: Alexandre Dulaunoy Date: Tue, 12 Dec 2017 15:51:59 +0100 Subject: [PATCH] Various updates following pull-request 78 --- taxonomy/README.md | 23 ++++++++++++++--------- 1 file changed, 14 insertions(+), 9 deletions(-) diff --git a/taxonomy/README.md b/taxonomy/README.md index 040918d..14c50e4 100644 --- a/taxonomy/README.md +++ b/taxonomy/README.md @@ -6,6 +6,9 @@ In MISP 2.4.X, a flexible mechanism has been introduced to support various [taxo You can access the taxonomy by going into 'Event Actions' and select 'List Taxonomies'. For fresh install, make sure to click 'Update Taxonomies' to view available taxonomies. +A [complete list of the available taxonomies](https://www.misp-project.org/taxonomies.html) [PDF](https://www.misp-project.org/taxonomies.pdf) are available on the MISP project website. + + ![MISP Taxonomy index](./figures/taxonomies-index.png) The following taxonomies can be used in MISP (as local or distributed tags) or in other tools willing to share common taxonomies among security information sharing tools. @@ -138,30 +141,30 @@ Create a JSON file describing your taxonomy as triple tags. ~~~~ shell For example : -mkdir jirafields +mkdir sample vim machinetag.json ~~~~ -Sample JSON with triple tags. You can use JSON validator to ame sure there is no syntax error. +Sample JSON with triple tags. You can use the JSON validator to be sure that there is no syntax error. ~~~~ shell { - "namespace": "jirafields", + "namespace": "sample", "description": "Some descriptive words", "version": 1, "predicates": [ { - "value": "xxxxxxx", - "expanded": "xxxxxxx" + "value": "my-predicate", + "expanded": "my-predicate" } ], "values": [ { - "predicate": "xxxxxx", + "predicate": "my-predicate", "entry": [ { - "value": "xxxxx", - "expanded": "xxxxxx" + "value": "a-value", + "expanded": "A value" } ] } @@ -179,7 +182,7 @@ Applying rules for distribution based on tags: ### MISP Taxonomies - tools -[machinetag.py](https://github.com/MISP/misp-taxonomies/blob/master/tools/machinetag.py) is a parsing tool to dump taxonomies expressed in Machine Tags (Triple Tags) and list all valid tags from a specific taxonomy. +- [machinetag.py](https://github.com/MISP/misp-taxonomies/blob/master/tools/machinetag.py) is a parsing tool to dump taxonomies expressed in Machine Tags (Triple Tags) and list all valid tags from a specific taxonomy. ~~~~shell % cd tools @@ -199,6 +202,8 @@ Applying rules for distribution based on tags: ... ~~~~ +- [PyTaxonomies](https://github.com/MISP/PyTaxonomies) - Python module to use the MISP Taxonomies + ### Other use cases using MISP taxonomies Tags can be used to set events for further processing by external tools (e.g. VirusTotal auto-expansion using Viper).