misp-book/taxonomy

Taxonomies

In MISP 2.4, a flexible mechanism has been introduced to support various taxonomy of classification.

You can access the taxonomy by going into 'Event Actions' and select 'List Taxonomies'.

8 default taxonomies are available:

• Admiralty Scale
• CIRCL Taxonomy - Schemes of Classification in Incident Response and Detection
• eCSIRT and IntelMQ incident classification
• EUCI - EU classified information marking
• Information Security Marking Metadata from DNI (Director of National Intelligence - US)
• TLP - Traffic Light Protocol
• Vocabulary for Event Recording and Incident Sharing VERIS

A taxonomy contains a series of tags that can use as normal tags in your MISP instance. The advantage is that you even set a specific tag as being exportable. This means that you can export your classification with other MISP instance and share the same taxonomies.

If you want to enable a specific taxonomy, you can click on the cross to enable it. Then you can even cherry-pick the tags you want to use on the system. If you want to use the whole taxonomy, select all and then click on the cross in the top left.