A first experimental description of a MISP combined object

2016-02-08 15:09:46 +01:00 · 2016-02-08 15:09:46 +01:00 · 39c570824a
commit 39c570824a
1 changed files with 27 additions and 0 deletions
--- a/objects/domain-ip/definition.json
+++ b/objects/domain-ip/definition.json
@ -0,0 +1,27 @@
+{
+        "name": "domain|ip",
+        "description": "A domain and IP address seen as a tuple in a specific time frame.",
+        "version": 1,
+        "properties" :
+        {
+                "ip": {
+                        "misp-object": "ip-dst",
+                        "misp-usage-frequency": 1
+                },
+                "domain": {
+                        "misp-object": "domain",
+                        "misp-usage-frequency": 1
+                },
+                "first-seen": {
+                        "misp-object": "datetime",
+                        "misp-usage-frequency": 0
+                },
+                "last-seen": {
+                        "misp-object": "datetime",
+                        "misp-usage-frequency": 0
+                }
+
+        },
+        "default-logical-operator": "AND"
+
+}