2018-05-08 07:53:58 +02:00
|
|
|
{
|
|
|
|
|
"name": "network-socket",
|
|
|
|
|
"uuid": "48bbfd72-ef8e-4649-b14d-41b4b5a0eba2",
|
|
|
|
|
"meta-category": "network",
|
|
|
|
|
"description": "Network socket object describes a local or remote network connections based on the socket data structure.",
|
|
|
|
|
"version": 1,
|
|
|
|
|
"attributes": {
|
|
|
|
|
"ip-src": {
|
|
|
|
|
"description": "Source (local) IP address of the network socket connection.",
|
|
|
|
|
"ui-priority": 1,
|
|
|
|
|
"categories": [
|
|
|
|
|
"Network activity",
|
|
|
|
|
"External analysis"
|
|
|
|
|
],
|
|
|
|
|
"misp-attribute": "ip-src"
|
|
|
|
|
},
|
|
|
|
|
"hostname-src": {
|
|
|
|
|
"description": "Source (local) hostname of the network socket connection.",
|
|
|
|
|
"ui-priority": 1,
|
|
|
|
|
"misp-attribute": "hostname"
|
|
|
|
|
},
|
|
|
|
|
"ip-dst": {
|
|
|
|
|
"description": "Destination IP address of the network socket connection.",
|
|
|
|
|
"ui-priority": 1,
|
|
|
|
|
"categories": [
|
|
|
|
|
"Network activity",
|
|
|
|
|
"External analysis"
|
|
|
|
|
],
|
|
|
|
|
"misp-attribute": "ip-dst"
|
|
|
|
|
},
|
|
|
|
|
"hostname-dst": {
|
|
|
|
|
"description": "Destination hostname of the network socket connection.",
|
|
|
|
|
"ui-priority": 1,
|
|
|
|
|
"misp-attribute": "hostname"
|
|
|
|
|
},
|
|
|
|
|
"src-port": {
|
|
|
|
|
"description": "Source (local) port of the network socket connection.",
|
|
|
|
|
"ui-priority": 1,
|
|
|
|
|
"categories": [
|
|
|
|
|
"Network activity",
|
|
|
|
|
"External analysis"
|
|
|
|
|
],
|
|
|
|
|
"misp-attribute": "port"
|
|
|
|
|
},
|
|
|
|
|
"dst-port": {
|
|
|
|
|
"description": "Destination port of the network socket connection.",
|
|
|
|
|
"ui-priority": 1,
|
|
|
|
|
"categories": [
|
|
|
|
|
"Network activity",
|
|
|
|
|
"External analysis"
|
|
|
|
|
],
|
|
|
|
|
"misp-attribute": "port"
|
|
|
|
|
},
|
2018-05-08 09:26:24 +02:00
|
|
|
"protocol": {
|
|
|
|
|
"misp-attribute": "text",
|
|
|
|
|
"ui-priority": 0,
|
|
|
|
|
"values_list": [
|
|
|
|
|
"TCP",
|
|
|
|
|
"UDP",
|
|
|
|
|
"ICMP",
|
|
|
|
|
"IP"
|
|
|
|
|
],
|
|
|
|
|
"description": "Protocol used by the network socket."
|
|
|
|
|
},
|
2018-05-08 07:53:58 +02:00
|
|
|
"address-family": {
|
|
|
|
|
"description": "Address family who specifies the address family type (AF_*) of the socket connection.",
|
|
|
|
|
"ui-priority": 1,
|
|
|
|
|
"sane_default": [
|
|
|
|
|
"AF_UNSPEC",
|
|
|
|
|
"AF_LOCAL",
|
|
|
|
|
"AF_UNIX",
|
|
|
|
|
"AF_FILE",
|
|
|
|
|
"AF_INET",
|
|
|
|
|
"AF_AX25",
|
|
|
|
|
"AF_IPX",
|
|
|
|
|
"AF_APPLETALK",
|
|
|
|
|
"AF_NETROM",
|
|
|
|
|
"AF_BRIDGE",
|
|
|
|
|
"AF_ATMPVC",
|
|
|
|
|
"AF_X25",
|
|
|
|
|
"AF_INET6",
|
|
|
|
|
"AF_ROSE",
|
|
|
|
|
"AF_DECnet",
|
|
|
|
|
"AF_NETBEUI",
|
|
|
|
|
"AF_SECURITY",
|
|
|
|
|
"AF_KEY",
|
|
|
|
|
"AF_NETLINK",
|
|
|
|
|
"AF_ROUTE",
|
|
|
|
|
"AF_PACKET",
|
|
|
|
|
"AF_ASH",
|
|
|
|
|
"AF_ECONET",
|
|
|
|
|
"AF_ATMSVC",
|
|
|
|
|
"AF_RDS",
|
|
|
|
|
"AF_SNA",
|
|
|
|
|
"AF_IRDA",
|
|
|
|
|
"AF_PPPOX",
|
|
|
|
|
"AF_WANPIPE",
|
|
|
|
|
"AF_LLC",
|
|
|
|
|
"AF_IB",
|
|
|
|
|
"AF_MPLS",
|
|
|
|
|
"AF_CAN",
|
|
|
|
|
"AF_TIPC",
|
|
|
|
|
"AF_BLUETOOTH",
|
|
|
|
|
"AF_IUCV",
|
|
|
|
|
"AF_RXRPC",
|
|
|
|
|
"AF_ISDN",
|
|
|
|
|
"AF_PHONET",
|
|
|
|
|
"AF_IEEE802154",
|
|
|
|
|
"AF_CAIF",
|
|
|
|
|
"AF_ALG",
|
|
|
|
|
"AF_NFC",
|
|
|
|
|
"AF_VSOCK",
|
|
|
|
|
"AF_KCM",
|
|
|
|
|
"AF_MAX"
|
|
|
|
|
],
|
|
|
|
|
"misp-attribute": "text"
|
|
|
|
|
},
|
|
|
|
|
"domain-family": {
|
|
|
|
|
"description": "Domain family who specifies the communication domain (PF_*) of the socket connection.",
|
|
|
|
|
"ui-priority": 1,
|
|
|
|
|
"sane_default": [
|
|
|
|
|
"PF_UNSPEC",
|
|
|
|
|
"PF_LOCAL",
|
|
|
|
|
"PF_UNIX",
|
|
|
|
|
"PF_FILE",
|
|
|
|
|
"PF_INET",
|
|
|
|
|
"PF_AX25",
|
|
|
|
|
"PF_IPX",
|
|
|
|
|
"PF_APPLETALK",
|
|
|
|
|
"PF_NETROM",
|
|
|
|
|
"PF_BRIDGE",
|
|
|
|
|
"PF_ATMPVC",
|
|
|
|
|
"PF_X25",
|
|
|
|
|
"PF_INET6",
|
|
|
|
|
"PF_ROSE",
|
|
|
|
|
"PF_DECnet",
|
|
|
|
|
"PF_NETBEUI",
|
|
|
|
|
"PF_SECURITY",
|
|
|
|
|
"PF_KEY",
|
|
|
|
|
"PF_NETLINK",
|
|
|
|
|
"PF_ROUTE",
|
|
|
|
|
"PF_PACKET",
|
|
|
|
|
"PF_ASH",
|
|
|
|
|
"PF_ECONET",
|
|
|
|
|
"PF_ATMSVC",
|
|
|
|
|
"PF_RDS",
|
|
|
|
|
"PF_SNA",
|
|
|
|
|
"PF_IRDA",
|
|
|
|
|
"PF_PPPOX",
|
|
|
|
|
"PF_WANPIPE",
|
|
|
|
|
"PF_LLC",
|
|
|
|
|
"PF_IB",
|
|
|
|
|
"PF_MPLS",
|
|
|
|
|
"PF_CAN",
|
|
|
|
|
"PF_TIPC",
|
|
|
|
|
"PF_BLUETOOTH",
|
|
|
|
|
"PF_IUCV",
|
|
|
|
|
"PF_RXRPC",
|
|
|
|
|
"PF_ISDN",
|
|
|
|
|
"PF_PHONET",
|
|
|
|
|
"PF_IEEE802154",
|
|
|
|
|
"PF_CAIF",
|
|
|
|
|
"PF_ALG",
|
|
|
|
|
"PF_NFC",
|
|
|
|
|
"PF_VSOCK",
|
|
|
|
|
"PF_KCM",
|
|
|
|
|
"PF_MAX"
|
|
|
|
|
],
|
|
|
|
|
"misp-attribute": "text"
|
|
|
|
|
},
|
|
|
|
|
"state": {
|
|
|
|
|
"description": "State of the socket connection.",
|
|
|
|
|
"multiple": true,
|
|
|
|
|
"sane_default": [
|
|
|
|
|
"blocking",
|
|
|
|
|
"listening"
|
|
|
|
|
],
|
|
|
|
|
"misp-attribute": "text",
|
|
|
|
|
"ui-priority": 1
|
|
|
|
|
},
|
|
|
|
|
"option": {
|
|
|
|
|
"description": "Option on the socket connection.",
|
|
|
|
|
"multiple": true,
|
|
|
|
|
"misp-attribute": "text",
|
|
|
|
|
"ui-priority": 1
|
|
|
|
|
}
|
|
|
|
|
},
|
|
|
|
|
"requiredOneOf": [
|
|
|
|
|
"ip-src",
|
|
|
|
|
"ip-dst",
|
|
|
|
|
"src-port",
|
|
|
|
|
"dst-port"
|
|
|
|
|
]
|
|
|
|
|
}
|
