misp-objects/objects/file/definition.json

{
  "name": "file",
  "uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
  "meta-category": "file",
  "description": "File object describing a file with meta-information",
  "version": 1,
  "attributes": {
    "text": {
      "misp-attribute": "text",
      "misp-usage-frequency": 1,
      "disable_correlation": true
    },
    "size-in-bytes": {
      "misp-attribute": "size-in-bytes",
      "misp-usage-frequency": 0,
      "disable_correlation": true
    },
    "authentihash": {
      "misp-attribute": "authentihash",
      "misp-usage-frequency": 0
    },
    "ssdeep": {
      "misp-attribute": "ssdeep",
      "misp-usage-frequency": 0
    },
    "sha224": {
      "misp-attribute": "sha224",
      "misp-usage-frequency": 0
    },
    "sha384": {
      "misp-attribute": "sha384",
      "misp-usage-frequency": 0
    },
    "sha512": {
      "misp-attribute": "sha512",
      "misp-usage-frequency": 0
    },
    "sha512/224": {
      "misp-attribute": "sha512/224",
      "misp-usage-frequency": 0
    },
    "malware-sample": {
      "misp-attribute": "malware-sample",
      "misp-usage-frequency": 1
    },
    "filename": {
      "misp-attribute": "filename",
      "misp-usage-frequency": 1,
      "categories": [
        "Payload delivery",
        "Artifacts dropped",
        "Payload installation",
        "External analysis"
      ]
    },
    "sha512/256": {
      "misp-attribute": "sha512/256",
      "misp-usage-frequency": 0
    },
    "tlsh": {
      "misp-attribute": "tlsh",
      "misp-usage-frequency": 0
    },
    "md5": {
      "misp-attribute": "md5",
      "misp-usage-frequency": 1
    },
    "sha1": {
      "misp-attribute": "sha1",
      "misp-usage-frequency": 1
    },
    "sha256": {
      "misp-attribute": "sha256",
      "misp-usage-frequency": 1
    },
    "entropy": {
      "misp-attribute": "float",
      "misp-usage-frequency": 1,
      "disable_correlation": true
    },
    "pattern-in-file": {
      "misp-attribute": "pattern-in-file",
      "misp-usage-frequency": 1,
      "categories": [
        "Artifacts dropped",
        "Payload installation",
        "External analysis"
      ]
    }
  },
  "requiredOneOf": [
    "filename",
    "size-in-bytes",
    "authentihash",
    "ssdeep",
    "imphash",
    "pehash",
    "sha224",
    "sha384",
    "sha512",
    "sha512/224",
    "sha512/256",
    "tlsh",
    "md5",
    "sha1",
    "sha256",
    "pattern-in-file"
  ]
}