misp-objects/objects/email/definition.json

203 lines
4.9 KiB
JSON
Raw Normal View History

2016-12-07 16:06:52 +01:00
{
2017-02-13 11:18:42 +01:00
"name": "email",
"uuid": "a0c666e0-fc65-4be8-b48f-3423d788b552",
2017-06-28 11:18:10 +02:00
"meta-category": "network",
2017-02-13 11:18:42 +01:00
"description": "Email object describing an email with meta-information",
"version": 13,
2017-02-13 11:18:42 +01:00
"attributes": {
2017-03-15 07:42:14 +01:00
"reply-to": {
2017-08-29 18:36:46 +02:00
"description": "Email address the reply will be sent to",
2017-03-15 07:42:14 +01:00
"misp-attribute": "email-reply-to",
2017-07-03 16:42:40 +02:00
"ui-priority": 1,
2017-02-13 11:18:42 +01:00
"categories": [
"Payload delivery"
]
},
2017-03-15 07:42:14 +01:00
"message-id": {
2017-08-29 18:36:46 +02:00
"description": "Message ID",
2017-03-15 07:42:14 +01:00
"misp-attribute": "email-message-id",
2018-05-03 20:49:48 +02:00
"disable_correlation": true,
2017-07-03 16:42:40 +02:00
"ui-priority": 0,
2017-02-13 11:18:42 +01:00
"categories": [
"Payload delivery"
]
},
"to": {
2017-08-29 18:36:46 +02:00
"description": "Destination email address",
2017-02-13 11:18:42 +01:00
"misp-attribute": "email-dst",
2018-05-03 20:49:48 +02:00
"disable_correlation": true,
2017-07-03 16:42:40 +02:00
"ui-priority": 1,
2017-02-13 11:18:42 +01:00
"categories": [
"Payload delivery"
],
"multiple": true
},
2017-09-27 16:43:21 +02:00
"cc": {
"description": "Carbon copy",
"misp-attribute": "email-dst",
2018-05-03 20:49:48 +02:00
"disable_correlation": true,
2017-09-27 16:43:21 +02:00
"ui-priority": 1,
"categories": [
"Payload delivery"
],
"multiple": true
},
2017-02-13 11:18:42 +01:00
"to-display-name": {
2017-08-29 18:36:46 +02:00
"description": "Display name of the receiver",
2017-02-13 11:18:42 +01:00
"misp-attribute": "email-dst-display-name",
2017-07-03 16:42:40 +02:00
"ui-priority": 1,
2017-02-13 11:18:42 +01:00
"categories": [
"Payload delivery"
],
"multiple": true
},
"subject": {
2017-08-29 18:36:46 +02:00
"description": "Subject",
2017-02-13 11:18:42 +01:00
"misp-attribute": "email-subject",
2017-07-03 16:42:40 +02:00
"ui-priority": 1,
2017-02-13 11:18:42 +01:00
"categories": [
"Payload delivery"
]
},
"screenshot": {
"description": "Screenshot of email",
"misp-attribute": "attachment",
2018-05-03 20:49:48 +02:00
"disable_correlation": true,
"ui-priority": 1,
"categories": [
"External analysis"
]
},
2017-02-13 11:18:42 +01:00
"attachment": {
2017-08-29 18:36:46 +02:00
"description": "Attachment",
2017-02-13 11:18:42 +01:00
"misp-attribute": "email-attachment",
2017-07-03 16:42:40 +02:00
"ui-priority": 0,
2017-02-13 11:18:42 +01:00
"categories": [
"Payload delivery"
],
"multiple": true
},
"received-header-ip": {
"description": "Extracted IP address from parsed headers",
"misp-attribute": "ip-src",
"ui-priority": 0,
"multiple": true
},
"received-header-hostname": {
"description": "Extracted hostname from parsed headers",
"misp-attribute": "hostname",
"ui-priority": 0,
"multiple": true
},
2017-03-15 07:42:14 +01:00
"x-mailer": {
2017-08-29 18:36:46 +02:00
"description": "X-Mailer generally tells the program that was used to draft and send the original email",
2017-07-03 11:59:25 +02:00
"misp-attribute": "email-x-mailer",
2018-05-03 20:49:48 +02:00
"disable_correlation": true,
2017-07-03 16:42:40 +02:00
"ui-priority": 0,
2017-02-13 11:18:42 +01:00
"categories": [
"Payload delivery"
]
},
2017-03-15 07:42:14 +01:00
"header": {
2017-08-29 18:36:46 +02:00
"description": "Full headers",
2017-03-15 07:42:14 +01:00
"misp-attribute": "email-header",
2018-05-03 20:49:48 +02:00
"disable_correlation": true,
2017-07-03 16:42:40 +02:00
"ui-priority": 0,
2017-02-13 11:18:42 +01:00
"categories": [
"Payload delivery"
2017-03-15 07:42:14 +01:00
],
"multiple": true
2017-02-13 11:18:42 +01:00
},
"send-date": {
2017-08-29 18:36:46 +02:00
"description": "Date the email has been sent",
2017-02-13 11:18:42 +01:00
"misp-attribute": "datetime",
2017-07-03 16:42:40 +02:00
"ui-priority": 0,
2017-03-15 07:42:14 +01:00
"disable_correlation": true,
2017-02-13 11:18:42 +01:00
"categories": [
"Other"
]
},
"mime-boundary": {
2017-08-29 18:36:46 +02:00
"description": "MIME Boundary",
2017-02-13 11:18:42 +01:00
"misp-attribute": "email-mime-boundary",
2018-05-03 20:49:48 +02:00
"disable_correlation": true,
2017-07-03 16:42:40 +02:00
"ui-priority": 0,
2017-02-13 11:18:42 +01:00
"categories": [
"Payload delivery"
]
},
"thread-index": {
2017-08-29 18:36:46 +02:00
"description": "Identifies a particular conversation thread",
2017-02-13 11:18:42 +01:00
"misp-attribute": "email-thread-index",
2018-05-03 20:49:48 +02:00
"disable_correlation": true,
2017-07-03 16:42:40 +02:00
"ui-priority": 0,
2017-02-13 11:18:42 +01:00
"categories": [
"Payload delivery"
]
},
2017-03-15 07:42:14 +01:00
"from": {
2017-08-29 18:36:46 +02:00
"description": "Sender email address",
2017-03-15 07:42:14 +01:00
"misp-attribute": "email-src",
2017-07-03 16:42:40 +02:00
"ui-priority": 1,
2017-02-13 11:18:42 +01:00
"categories": [
"Payload delivery"
2017-03-15 07:42:14 +01:00
]
2017-02-13 11:18:42 +01:00
},
2017-09-25 20:37:02 +02:00
"return-path": {
"description": "Message return path",
2018-05-03 20:49:48 +02:00
"misp-attribute": "email-src",
2017-09-25 20:37:02 +02:00
"ui-priority": 1,
"categories": [
"Payload delivery"
]
},
2017-03-15 07:42:14 +01:00
"from-display-name": {
2017-08-29 18:36:46 +02:00
"description": "Display name of the sender",
2017-03-15 07:42:14 +01:00
"misp-attribute": "email-src-display-name",
2017-07-03 16:42:40 +02:00
"ui-priority": 1,
2017-02-13 11:18:42 +01:00
"categories": [
"Payload delivery"
]
},
"email-body": {
"description": "Body of the email",
"misp-attribute": "email-body",
2018-05-03 20:49:48 +02:00
"disable_correlation": true,
"ui-priority": 1,
"categories": [
"Payload delivery"
]
2018-04-27 14:20:10 +02:00
},
2018-05-03 20:49:48 +02:00
"user-agent": {
"description": "User Agent of the sender",
"misp-attribute": "text",
"ui-priority": 0,
"disable_correlation": true
},
2018-04-27 14:20:10 +02:00
"eml": {
"description": "Full EML",
"misp-attribute": "attachment",
2018-05-03 20:49:48 +02:00
"disable_correlation": true,
2018-04-27 14:20:10 +02:00
"ui-priority": 1
2017-02-13 11:18:42 +01:00
}
},
"requiredOneOf": [
"from",
"from-display-name",
"to",
"to-display-name",
"subject",
"attachment",
"message-id",
"reply-to",
2017-02-13 11:18:42 +01:00
"send-date",
"mime-boundary",
"thread-index",
"header",
2017-09-25 20:37:02 +02:00
"x-mailer",
"return-path",
2018-04-27 14:20:10 +02:00
"email-body",
"eml"
2017-02-13 11:18:42 +01:00
]
2016-12-07 16:06:52 +01:00
}