misp-objects/objects/cowrie/definition.json

131 lines
3.5 KiB
JSON
Raw Normal View History

2018-02-28 17:41:29 +01:00
{
"attributes": {
"compCS": {
"description": "SSH compression algorithm supported in the session",
2018-02-28 17:41:29 +01:00
"disable_correlation": true,
"misp-attribute": "text",
"multiple": true,
"ui-priority": 1
2018-02-28 17:41:29 +01:00
},
"dst_ip": {
"description": "Destination IP address of the session",
2018-02-28 17:41:29 +01:00
"disable_correlation": true,
"misp-attribute": "ip-dst",
"ui-priority": 1
2018-02-28 17:41:29 +01:00
},
"dst_port": {
"description": "Destination port of the session",
"disable_correlation": true,
"misp-attribute": "port",
"ui-priority": 1
2018-02-28 17:41:29 +01:00
},
"encCS": {
"description": "SSH symmetric encryption algorithm supported in the session",
"disable_correlation": true,
"misp-attribute": "text",
2018-02-28 17:41:29 +01:00
"multiple": true,
"ui-priority": 1
2018-02-28 17:41:29 +01:00
},
"eventid": {
"description": "Eventid of the session in the cowrie honeypot",
"disable_correlation": true,
"misp-attribute": "text",
"ui-priority": 1
2018-02-28 17:41:29 +01:00
},
"hassh": {
"description": "HASSH of the client SSH session following Salesforce algorithm",
"misp-attribute": "hassh-md5",
"ui-priority": 1
},
"input": {
"description": "Input of the session",
"misp-attribute": "text",
"ui-priority": 1
},
"isError": {
"description": "isError",
"disable_correlation": true,
"misp-attribute": "text",
"ui-priority": 1
},
"keyAlgs": {
"description": "SSH public-key algorithm supported in the session",
"disable_correlation": true,
"misp-attribute": "text",
"multiple": true,
"ui-priority": 1
},
"macCS": {
"description": "SSH MAC supported in the sesssion",
"disable_correlation": true,
"misp-attribute": "text",
"multiple": true,
"ui-priority": 1
2018-02-28 17:41:29 +01:00
},
"message": {
"description": "Message of the cowrie honeypot",
"disable_correlation": true,
2018-02-28 17:41:29 +01:00
"misp-attribute": "text",
"ui-priority": 1
},
"password": {
"description": "Password",
"misp-attribute": "text",
"multiple": true,
"ui-priority": 1
2018-02-28 17:41:29 +01:00
},
"protocol": {
"description": "Protocol used in the cowrie honeypot",
"disable_correlation": true,
2018-02-28 17:41:29 +01:00
"misp-attribute": "text",
"ui-priority": 1
2018-02-28 17:41:29 +01:00
},
"sensor": {
"description": "Cowrie sensor name",
"disable_correlation": true,
"misp-attribute": "text",
"ui-priority": 1
},
"session": {
"description": "Session id",
2018-02-28 17:41:29 +01:00
"misp-attribute": "text",
"ui-priority": 1
2018-02-28 17:41:29 +01:00
},
"src_ip": {
"description": "Source IP address of the session",
"misp-attribute": "ip-src",
"ui-priority": 1
2018-02-28 17:41:29 +01:00
},
"src_port": {
"description": "Source port of the session",
"disable_correlation": true,
"misp-attribute": "port",
"ui-priority": 1
},
"system": {
"description": "System origin in cowrie honeypot",
"disable_correlation": true,
"misp-attribute": "text",
"ui-priority": 1
},
"timestamp": {
"description": "When the event happened",
"disable_correlation": true,
"misp-attribute": "datetime",
"ui-priority": 1
},
"username": {
"description": "Username related to the password(s)",
"misp-attribute": "text",
"ui-priority": 1
2018-02-28 17:41:29 +01:00
}
},
"description": "Cowrie honeypot object template",
"meta-category": "network",
"name": "cowrie",
"requiredOneOf": [
"session"
],
2018-02-28 17:41:29 +01:00
"uuid": "ae085d32-6534-4d52-b3eb-063fccb753e7",
"version": 3
}