Ran jq_all_the_things.sh

objects/edr-report/definition.json

@@ -1,60 +1,10 @@
 {
   "attributes": {
-        "id": {
+    "additional-file": {
-            "description": "Report unique identifier",
+      "description": "Additional file involved in detection",
-            "misp-attribute": "text",
-            "ui-priority": 1
-        },
-        "product": {
-            "description": "EDR product name",
-            "disable_correlation": true,
-            "misp-attribute": "text",
-            "ui-priority": 1
-        },
-        "endpoint-id": {
-            "description": "Unique identifier of the endpoint concerned by the report",
-            "misp-attribute": "text",
-            "ui-priority": 1
-        },
-        "hostname": {
-            "description": "Endpoint hostname",
-            "misp-attribute": "text",
-            "ui-priority": 1
-        },
-        "ip": {
-            "description": "Endpoint IP address",
-            "disable_correlation": true,
-            "misp-attribute": "ip-src",
-            "ui-priority": 1
-        },
-        "event": {
-            "description": "Raw EDR event which triggered reporting",
-            "disable_correlation": true,
-            "misp-attribute": "attachment",
-            "ui-priority": 1
-        },
-        "comment": {
-            "description": "Any valuable comment about the report",
-            "disable_correlation": true,
-            "misp-attribute": "text",
-            "ui-priority": 0
-        },
-        "processes": {
-            "description": "JSON file containing metadata about running processes at the time of detection",
-            "disable_correlation": true,
-            "misp-attribute": "attachment",
-            "ui-priority": 0
-        },
-        "modules": {
-            "description": "JSON file containing metadata about modules loaded on the system",
-            "disable_correlation": true,
-            "misp-attribute": "attachment",
-            "ui-priority": 0
-        },
-        "drivers": {
-            "description": "JSON file containing metadata about drivers loaded on the system",
       "disable_correlation": true,
       "misp-attribute": "attachment",
+      "multiple": true,
       "ui-priority": 0
     },
     "command": {
@@ -64,6 +14,29 @@
       "multiple": true,
       "ui-priority": 0
     },
+    "comment": {
+      "description": "Any valuable comment about the report",
+      "disable_correlation": true,
+      "misp-attribute": "text",
+      "ui-priority": 0
+    },
+    "drivers": {
+      "description": "JSON file containing metadata about drivers loaded on the system",
+      "disable_correlation": true,
+      "misp-attribute": "attachment",
+      "ui-priority": 0
+    },
+    "endpoint-id": {
+      "description": "Unique identifier of the endpoint concerned by the report",
+      "misp-attribute": "text",
+      "ui-priority": 1
+    },
+    "event": {
+      "description": "Raw EDR event which triggered reporting",
+      "disable_correlation": true,
+      "misp-attribute": "attachment",
+      "ui-priority": 1
+    },
     "executable": {
       "description": "Executable file involved in detection",
       "disable_correlation": true,
@@ -71,12 +44,39 @@
       "multiple": true,
       "ui-priority": 0
     },
-        "additional-file": {
+    "hostname": {
-            "description": "Additional file involved in detection",
+      "description": "Endpoint hostname",
+      "misp-attribute": "text",
+      "ui-priority": 1
+    },
+    "id": {
+      "description": "Report unique identifier",
+      "misp-attribute": "text",
+      "ui-priority": 1
+    },
+    "ip": {
+      "description": "Endpoint IP address",
+      "disable_correlation": true,
+      "misp-attribute": "ip-src",
+      "ui-priority": 1
+    },
+    "modules": {
+      "description": "JSON file containing metadata about modules loaded on the system",
       "disable_correlation": true,
       "misp-attribute": "attachment",
-            "multiple": true,
       "ui-priority": 0
+    },
+    "processes": {
+      "description": "JSON file containing metadata about running processes at the time of detection",
+      "disable_correlation": true,
+      "misp-attribute": "attachment",
+      "ui-priority": 0
+    },
+    "product": {
+      "description": "EDR product name",
+      "disable_correlation": true,
+      "misp-attribute": "text",
+      "ui-priority": 1
     }
   },
   "description": "An Object Template to encode an EDR detection report",