misp-objects/objects/paloalto-threat-event/definition.json

{
  "attributes": {
    "app": {
      "description": "The application identified (e.g. vnc, ssh, sip, irc, http or smtp).",
      "disable_correlation": true,
      "misp-attribute": "text",
      "ui-priority": 1
    },
    "direction": {
      "description": "The Direction of the Event.",
      "disable_correlation": true,
      "misp-attribute": "text",
      "ui-priority": 1
    },
    "dport": {
      "description": "The port to which the connection headed.",
      "disable_correlation": true,
      "misp-attribute": "counter",
      "ui-priority": 1
    },
    "dst": {
      "description": "The Destination IP which is the target of the observed connections.",
      "misp-attribute": "ip-dst",
      "ui-priority": 1
    },
    "dstloc": {
      "description": "The Destination Location of the event.",
      "disable_correlation": true,
      "misp-attribute": "text",
      "ui-priority": 1
    },
    "proto": {
      "description": "The transport protocol (e.g. tcp, udp, icmp).",
      "disable_correlation": true,
      "misp-attribute": "text",
      "ui-priority": 1
    },
    "sport": {
      "description": "The port from which the connection originated.",
      "disable_correlation": true,
      "misp-attribute": "counter",
      "ui-priority": 1
    },
    "src": {
      "description": "The ip observed to initiate the connection",
      "misp-attribute": "ip-src",
      "ui-priority": 1
    },
    "srcloc": {
      "description": "The Source Location of the event.",
      "disable_correlation": true,
      "misp-attribute": "text",
      "ui-priority": 1
    },
    "subtype": {
      "description": "The subtype of the Log Event.",
      "disable_correlation": true,
      "misp-attribute": "text",
      "ui-priority": 1
    },
    "thr_category": {
      "description": "The Threat Category.",
      "disable_correlation": true,
      "misp-attribute": "text",
      "ui-priority": 1
    },
    "threatid": {
      "description": "The Threat ID.",
      "disable_correlation": true,
      "misp-attribute": "text",
      "ui-priority": 1
    },
    "time_generated": {
      "description": "The datetime of the event.",
      "disable_correlation": true,
      "misp-attribute": "datetime",
      "ui-priority": 1
    },
    "type": {
      "description": "The type of the Log Event",
      "disable_correlation": true,
      "misp-attribute": "text",
      "ui-priority": 1
    }
  },
  "description": "Palo Alto Threat Log Event",
  "meta-category": "network",
  "name": "paloalto-threat-event",
  "uuid": "e6fa7a87-1173-43d6-86c2-b4d02af5fc74",
  "version": 6
}