misp-objects/objects/diamond/definition.json

106 lines
2.8 KiB
JSON
Raw Normal View History

2023-06-13 10:47:28 +02:00
{
2023-06-13 19:15:23 +02:00
"attributes": {
"Advesary": {
"description": "The advesary who attacks the victim",
2023-06-14 13:54:46 +02:00
"misp-attribute": "text",
"ui-priority": 0
2023-06-13 19:15:23 +02:00
},
"Capability": {
"description": "The capability used to attack the victim",
2023-06-14 13:54:46 +02:00
"misp-attribute": "text",
"ui-priority": 0
},
"Description": {
"description": "Further context to the event",
"misp-attribute": "text",
"ui-priority": 0
},
"Direction": {
"description": "The network-based direction of the event",
"misp-attribute": "text",
2023-06-13 19:15:23 +02:00
"ui-priority": 0,
2023-06-14 13:54:46 +02:00
"values_list": [
"Victim-to-Infrastructure",
"Infrastructure-to-Victim",
"Infrastructure-to-Infrastructure",
"Adversary-to-Infrastructure",
"Infrastructure-to-Adversary",
"Bidirectional",
"Unknown"
]
},
"EventID": {
"description": "Id of the event",
"misp-attribute": "integer",
2023-06-14 13:54:46 +02:00
"ui-priority": 0
2023-06-13 19:15:23 +02:00
},
"Infrastructure": {
"description": "The infrastructure used in the attack",
2023-06-14 13:54:46 +02:00
"misp-attribute": "text",
"ui-priority": 0
2023-06-13 19:15:23 +02:00
},
2023-06-14 13:54:46 +02:00
"Methodology": {
"description": "Mitre-Attack mapping of the event",
"misp-attribute": "text",
"ui-priority": 0
2023-06-13 19:15:23 +02:00
},
"Phase": {
"description": "The event mapped to a phase of the killchain",
"misp-attribute": "text",
2023-06-14 13:54:46 +02:00
"ui-priority": 0,
2023-06-13 19:15:23 +02:00
"values_list": [
"Reconnaissance",
"Weaponization",
"Delivery",
"Exploitation",
"Installation",
"C2",
"Action on Objectives"
]
},
2023-06-14 13:54:46 +02:00
"Resources": {
"description": "The resources the attacker needed for the event to succeed",
"misp-attribute": "text",
"ui-priority": 0
},
2023-06-13 19:15:23 +02:00
"Result": {
"description": "The result of the event",
"misp-attribute": "text",
2023-06-14 13:54:46 +02:00
"ui-priority": 0
2023-06-13 19:15:23 +02:00
},
2023-06-14 13:54:46 +02:00
"Timestamp": {
"description": "Timestamp when the event happened",
"misp-attribute": "datetime",
"ui-priority": 0
2023-06-13 19:15:23 +02:00
},
2023-06-14 13:54:46 +02:00
"Victim": {
"description": "The attacked victim",
"misp-attribute": "text",
"ui-priority": 0
2023-06-13 19:15:23 +02:00
},
"ioc": {
"description": "Generic IOC",
2023-06-14 13:54:46 +02:00
"misp-attribute": "text",
2023-06-13 19:15:23 +02:00
"multiple": true,
2023-06-14 13:54:46 +02:00
"ui-priority": 0
2023-06-13 19:15:23 +02:00
},
"textfield": {
"description": "Generic textfield",
2023-06-14 13:54:46 +02:00
"misp-attribute": "text",
2023-06-13 19:15:23 +02:00
"multiple": true,
2023-06-14 13:54:46 +02:00
"ui-priority": 0
2023-06-13 10:47:28 +02:00
}
2023-06-14 13:54:46 +02:00
},
"description": "A diamond model event object consisting of the four diamond features advesary, infrastructure, capability and victim, several meta-features and ioc attributes.",
"meta-category": "internal",
"name": "diamond-event",
"required": [
"EventID",
"Advesary",
"Capability",
"Infrastructure",
"Victim"
],
"uuid": "a9618450-694d-4c73-9f76-35ea0150c19e",
"version": 1
2023-06-13 19:15:23 +02:00
}