MISP
/
misp-objects
mirror of https://github.com/MISP/misp-objects
2
0
Fork 0
Code Issues Releases Wiki Activity

new: Fail2ban object

pull/86/head
Raphaël Vinot 2018-03-26 10:54:44 +02:00
parent 333f9a46e4
commit 1f8a26fa3e
1 changed files with 44 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

44
objects/fail2ban/definition.json Normal file
View File

@ -0,0 +1,44 @@
{
"required":[
"banned-ip",
"processing-timestamp",
"attack-type"
],
"attributes": {
"banned-ip": {
"description": "IP Address banned by fail2ban",
"ui-priority": 1,
"misp-attribute": "ipsrc"
},
"timestamp": {
"description": "Timestamp of the report",
"ui-priority": 1,
"misp-attribute": "datetime"
},
"attack-type": {
"description": "Type of the attack",
"ui-priority": 1,
"misp-attribute": "text"
},
"failures": {
"description": "Amount of failures that lead to the ban.",
"ui-priority": 1,
"misp-attribute": "counter"
},
"sensor": {
"description": "Identifier of the sensor",
"ui-priority": 1,
"misp-attribute": "text"
},
"victim": {
"description": "Identifier of the victim",
"ui-priority": 1,
"misp-attribute": "text"
}
},
"version": 1,
"description": "Fail2ban event",
"meta-category": "network",
"uuid": "8be2271-7326-41a5-a0dd-9b4bec88e1ba",
"name": "fail2ban"
}