MISP
/
misp-objects
mirror of https://github.com/MISP/misp-objects
2
0
Fork 0
Code Issues Releases Wiki Activity

First proposal of a DDoS object in MISP

pull/7/head
Alexandre Dulaunoy 2017-03-05 13:01:02 +01:00
parent 4409445360
commit 1ec1761307
1 changed files with 68 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

68
objects/ddos/definition.json Normal file
View File

@ -0,0 +1,68 @@
{
"name": "ddos",
"meta-category": "network",
"description": "DDoS object describes a current DDoS activity from a specific or/and to a specific target. Type of DDoS can be attached to the object as a taxonomy",
"version": 1,
"attributes": {
"ip-src": {
"misp-attribute": "ip-src",
"misp-usage-frequency": 1,
"categories": [
"Network activity",
"External analysis"
]
},
"ip-dst": {
"misp-attribute": "ip-dst",
"misp-usage-frequency": 1,
"categories": [
"Network activity",
"External analysis"
]
},
"src-port": {
"misp-attribute": "text",
"misp-usage-frequency": 0,
"categories": [
"Network activity",
"External analysis"
]
},
"dst-port": {
"misp-attribute": "text",
"misp-usage-frequency": 0,
"categories": [
"Network activity",
"External analysis"
]
},
"protocol": {
"misp-attribute": "text",
"misp-usage-frequency": 0
},
"first-seen": {
"misp-attribute": "datetime",
"misp-usage-frequency": 0
},
"last-seen": {
"misp-attribute": "datetime",
"misp-usage-frequency": 0
},
"total-pps": {
"misp-attribute": "counter",
"misp-usage-frequency": 0
},
"total-bps": {
"misp-attribute": "counter",
"misp-usage-frequency": 0
},
"text": {
"misp-attribute": "text",
"misp-usage-frequency": 0
}
},
"requiredOneOf": [
"ip-dst",
"ip-src"
]
}