From ad83a3a56f0c9f31de8fb0ff6b6b639de00a595c Mon Sep 17 00:00:00 2001 From: chrisr3d Date: Thu, 1 Aug 2019 14:34:30 +0200 Subject: [PATCH 001/155] new: Weakness & attack-pattern objects to describe CWE & CAPEC related to a CVE - The attack-pattern object is using a new attribute type called weakness to describe CWE id, which will link to its own information as described in https://cve.circl.lu --- objects/attack-pattern/definition.json | 45 ++++++++++++++++++++++ objects/weakness/definition.json | 52 ++++++++++++++++++++++++++ 2 files changed, 97 insertions(+) create mode 100644 objects/attack-pattern/definition.json create mode 100644 objects/weakness/definition.json diff --git a/objects/attack-pattern/definition.json b/objects/attack-pattern/definition.json new file mode 100644 index 0000000..5426519 --- /dev/null +++ b/objects/attack-pattern/definition.json @@ -0,0 +1,45 @@ +{ + "requiredOneOf": [ + "name", + "id" + ], + "attributes": { + "id": { + "description": "CAPEC ID.", + "ui-priority": 0, + "disable_correlation": true, + "misp-attribute": "text" + }, + "name": { + "description": "Name of the attack pattern.", + "ui-priority": 0, + "misp-attribute": "text" + }, + "summary": { + "description": "Summary description of the attack pattern.", + "ui-priority": 0, + "misp-attribute": "text" + }, + "prerequisites": { + "description": "Prerequisites for the attack pattern to succeed.", + "ui-priority": 0, + "misp-attribute": "text" + }, + "solutions": { + "description": "Solutions for the attack pattern to be countered.", + "ui-priority": 0, + "misp-attribute": "text" + }, + "related-weakness": { + "description": "Weakness related to the attack pattern.", + "ui-priority": 0, + "multiple": true, + "misp-attribute": "weakness" + } + }, + "version": 1, + "description": "Attack pattern describing a common attack pattern enumeration and classification.", + "meta-category": "vulnerability", + "uuid": "35928348-56be-4d7f-9752-a80927936351", + "name": "attack-pattern" +} diff --git a/objects/weakness/definition.json b/objects/weakness/definition.json new file mode 100644 index 0000000..0413fb3 --- /dev/null +++ b/objects/weakness/definition.json @@ -0,0 +1,52 @@ +{ + "requiredOneOf": [ + "id", + "name", + "description" + ], + "attributes": { + "id": { + "description": "Weakness ID (generally CWE).", + "ui-priority": 0, + "misp-attribute": "text" + }, + "description": { + "description": "Description of the weakness.", + "ui-priority": 0, + "misp-attribute": "text" + }, + "name": { + "description": "Name of the weakness.", + "ui-priority": 0, + "misp-attribute": "text" + }, + "status": { + "description": "Status of the weakness.", + "ui-priority": 0, + "sane_default": [ + "Incomplete", + "Deprecated", + "Draft", + "Usable" + ], + "disable_correlation": true, + "misp-attribute": "text" + }, + "weakness-abs": { + "description": "Abstraction of the weakness.", + "ui-priority": 0, + "sane_default": [ + "Class", + "Base", + "Variant" + ], + "disable_correlation": true, + "misp-attribute": "text" + } + }, + "version": 1, + "description": "Weakness object describing a common weakness enumeration which can describe usable, incomplete, draft or deprecated weakness for software, equipment of hardware.", + "meta-category": "vulnerability", + "uuid": "b8713fc0-d7a2-4b27-a182-38ed47966802", + "name": "weakness" +} From 29febb2de0240876e840ab4e2c3d25c393c97dab Mon Sep 17 00:00:00 2001 From: chrisr3d Date: Thu, 1 Aug 2019 15:50:29 +0200 Subject: [PATCH 002/155] fix: JQed all the things --- objects/attack-pattern/definition.json | 84 +++++++++++----------- objects/weakness/definition.json | 98 +++++++++++++------------- 2 files changed, 91 insertions(+), 91 deletions(-) diff --git a/objects/attack-pattern/definition.json b/objects/attack-pattern/definition.json index 5426519..322555b 100644 --- a/objects/attack-pattern/definition.json +++ b/objects/attack-pattern/definition.json @@ -1,45 +1,45 @@ { - "requiredOneOf": [ - "name", - "id" - ], - "attributes": { - "id": { - "description": "CAPEC ID.", - "ui-priority": 0, - "disable_correlation": true, - "misp-attribute": "text" - }, - "name": { - "description": "Name of the attack pattern.", - "ui-priority": 0, - "misp-attribute": "text" - }, - "summary": { - "description": "Summary description of the attack pattern.", - "ui-priority": 0, - "misp-attribute": "text" - }, - "prerequisites": { - "description": "Prerequisites for the attack pattern to succeed.", - "ui-priority": 0, - "misp-attribute": "text" - }, - "solutions": { - "description": "Solutions for the attack pattern to be countered.", - "ui-priority": 0, - "misp-attribute": "text" - }, - "related-weakness": { - "description": "Weakness related to the attack pattern.", - "ui-priority": 0, - "multiple": true, - "misp-attribute": "weakness" - } + "requiredOneOf": [ + "name", + "id" + ], + "attributes": { + "id": { + "description": "CAPEC ID.", + "ui-priority": 0, + "disable_correlation": true, + "misp-attribute": "text" }, - "version": 1, - "description": "Attack pattern describing a common attack pattern enumeration and classification.", - "meta-category": "vulnerability", - "uuid": "35928348-56be-4d7f-9752-a80927936351", - "name": "attack-pattern" + "name": { + "description": "Name of the attack pattern.", + "ui-priority": 0, + "misp-attribute": "text" + }, + "summary": { + "description": "Summary description of the attack pattern.", + "ui-priority": 0, + "misp-attribute": "text" + }, + "prerequisites": { + "description": "Prerequisites for the attack pattern to succeed.", + "ui-priority": 0, + "misp-attribute": "text" + }, + "solutions": { + "description": "Solutions for the attack pattern to be countered.", + "ui-priority": 0, + "misp-attribute": "text" + }, + "related-weakness": { + "description": "Weakness related to the attack pattern.", + "ui-priority": 0, + "multiple": true, + "misp-attribute": "weakness" + } + }, + "version": 1, + "description": "Attack pattern describing a common attack pattern enumeration and classification.", + "meta-category": "vulnerability", + "uuid": "35928348-56be-4d7f-9752-a80927936351", + "name": "attack-pattern" } diff --git a/objects/weakness/definition.json b/objects/weakness/definition.json index 0413fb3..cc0c881 100644 --- a/objects/weakness/definition.json +++ b/objects/weakness/definition.json @@ -1,52 +1,52 @@ { - "requiredOneOf": [ - "id", - "name", - "description" - ], - "attributes": { - "id": { - "description": "Weakness ID (generally CWE).", - "ui-priority": 0, - "misp-attribute": "text" - }, - "description": { - "description": "Description of the weakness.", - "ui-priority": 0, - "misp-attribute": "text" - }, - "name": { - "description": "Name of the weakness.", - "ui-priority": 0, - "misp-attribute": "text" - }, - "status": { - "description": "Status of the weakness.", - "ui-priority": 0, - "sane_default": [ - "Incomplete", - "Deprecated", - "Draft", - "Usable" - ], - "disable_correlation": true, - "misp-attribute": "text" - }, - "weakness-abs": { - "description": "Abstraction of the weakness.", - "ui-priority": 0, - "sane_default": [ - "Class", - "Base", - "Variant" - ], - "disable_correlation": true, - "misp-attribute": "text" - } + "requiredOneOf": [ + "id", + "name", + "description" + ], + "attributes": { + "id": { + "description": "Weakness ID (generally CWE).", + "ui-priority": 0, + "misp-attribute": "text" }, - "version": 1, - "description": "Weakness object describing a common weakness enumeration which can describe usable, incomplete, draft or deprecated weakness for software, equipment of hardware.", - "meta-category": "vulnerability", - "uuid": "b8713fc0-d7a2-4b27-a182-38ed47966802", - "name": "weakness" + "description": { + "description": "Description of the weakness.", + "ui-priority": 0, + "misp-attribute": "text" + }, + "name": { + "description": "Name of the weakness.", + "ui-priority": 0, + "misp-attribute": "text" + }, + "status": { + "description": "Status of the weakness.", + "ui-priority": 0, + "sane_default": [ + "Incomplete", + "Deprecated", + "Draft", + "Usable" + ], + "disable_correlation": true, + "misp-attribute": "text" + }, + "weakness-abs": { + "description": "Abstraction of the weakness.", + "ui-priority": 0, + "sane_default": [ + "Class", + "Base", + "Variant" + ], + "disable_correlation": true, + "misp-attribute": "text" + } + }, + "version": 1, + "description": "Weakness object describing a common weakness enumeration which can describe usable, incomplete, draft or deprecated weakness for software, equipment of hardware.", + "meta-category": "vulnerability", + "uuid": "b8713fc0-d7a2-4b27-a182-38ed47966802", + "name": "weakness" } From fc182be371e08cdb0278326166c1eddf4baff088 Mon Sep 17 00:00:00 2001 From: Pierre-Jean Grenier Date: Fri, 2 Aug 2019 14:37:08 +0200 Subject: [PATCH 003/155] Change undefined category to "External analysis" --- objects/sb-signature/definition.json | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/objects/sb-signature/definition.json b/objects/sb-signature/definition.json index 481d02d..2ee7cde 100644 --- a/objects/sb-signature/definition.json +++ b/objects/sb-signature/definition.json @@ -8,7 +8,7 @@ "description": "Name of Sandbox software", "disable_correlation": true, "categories": [ - "Sandbox detection" + "External analysis" ], "ui-priority": 1, "misp-attribute": "text" @@ -16,7 +16,7 @@ "signature": { "description": "Name of detection signature - set the description of the detection signature as a comment", "categories": [ - "Sandbox detection" + "External analysis" ], "ui-priority": 2, "misp-attribute": "text", @@ -41,7 +41,7 @@ "misp-attribute": "datetime" } }, - "version": 1, + "version": 2, "description": "Sandbox detection signature", "meta-category": "misc", "uuid": "984c5c39-be7f-4e1e-b034-d3213bac51cb", From 005b6027daba050f70f6d83f589742ca8ecd6a1e Mon Sep 17 00:00:00 2001 From: Deborah Servili Date: Mon, 5 Aug 2019 16:25:21 +0200 Subject: [PATCH 004/155] add injects-into and injected-into relationships --- relationships/definition.json | 16 +++++++++++++++- 1 file changed, 15 insertions(+), 1 deletion(-) diff --git a/relationships/definition.json b/relationships/definition.json index 6b12f4a..8262441 100644 --- a/relationships/definition.json +++ b/relationships/definition.json @@ -1,5 +1,5 @@ { - "version": 14, + "version": 15, "values": [ { "name": "derived-from", @@ -927,6 +927,20 @@ "format": [ "misp" ] + }, + { + "name": "injects-into", + "description": "Represents an object injecting something into something", + "format": [ + "misp" + ] + }, + { + "name": "injected-into", + "description": "Represents an object which is injected something into something", + "format": [ + "misp" + ] } ], "description": "Default type of relationships in MISP objects.", From df8b3c5983fd1943f41a6083eed36438b7d230e1 Mon Sep 17 00:00:00 2001 From: chrisr3d Date: Tue, 6 Aug 2019 09:48:53 +0200 Subject: [PATCH 005/155] add: Updated readme with the latest objects added --- README.md | 2 ++ 1 file changed, 2 insertions(+) diff --git a/README.md b/README.md index 2636538..9c83ff0 100644 --- a/README.md +++ b/README.md @@ -70,6 +70,7 @@ for a specific attribute. An optional **to_ids** boolean field to disable the ID * [objects/ais-info](objects/ais-info/definition.json) - Object describing Automated Indicator Sharing (AIS) information source markings. * [objects/android-permission](objects/android-permission/definition.json) - A set of android permissions - one or more permission(s) which can be linked to other objects (e.g. file). * [objects/asn](objects/asn/definition.json) - Autonomous system object describing a BGP autonomous system which can include one or more network operators management an entity (e.g. ISP) along with their routing policy, routing prefixes or alike. +* [objects/attack-pattern](objects/attack-pattern/definition.json) - Attack Pattern object describing a common attack pattern enumeration and classification. * [objects/authenticode-signerinfo](objects/authenticode-signerinfo/definition.json) - Authenticode signer info. * [objects/av-signature](objects/av-signature/definition.json) - Antivirus detection signature. * [objects/bank-account](objects/bank-account/definition.json) - Object describing bank account information based on account description from goAML 4.0. @@ -161,6 +162,7 @@ for a specific attribute. An optional **to_ids** boolean field to disable the ID * [objects/victim](objects/victim/definition.json) - a victim object to describe the organisation being targeted or abused. * [objects/virustotal-report](objects/virustotal-report/definition.json) - VirusTotal report. * [objects/vulnerability](objects/vulnerability/definition.json) - Vulnerability object to describe software or hardware vulnerability as described in a CVE. +* [objects/weakness](objects/weakness/definition.json) - Weakness object as described in a CWE. * [objects/whois](objects/whois/definition.json) - Whois records information for a domain name. * [objects/x509](objects/x509/definition.json) - x509 object describing a X.509 certificate. * [objects/yabin](objects/yabin/definition.json) - yabin.py generates Yara rules from function prologs, for matching and hunting binaries. ref: [yabin](https://github.com/AlienVault-OTX/yabin). From 006e79282989ecbce8afbf952a44d60129f618a3 Mon Sep 17 00:00:00 2001 From: Pierre-Jean Grenier Date: Tue, 6 Aug 2019 10:39:43 +0200 Subject: [PATCH 006/155] fix: [process] change undefined attributes misp-attributes 'uuid' and 'src-port' do not exist, change those to something else so that we can use this object properly --- objects/process/definition.json | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/objects/process/definition.json b/objects/process/definition.json index 2d51789..9e3146b 100644 --- a/objects/process/definition.json +++ b/objects/process/definition.json @@ -3,7 +3,7 @@ "uuid": "02aeef94-ac23-455c-addb-731757ceafb5", "meta-category": "misc", "description": "Object describing a system process.", - "version": 6, + "version": 7, "attributes": { "creation-time": { "description": "Local date/time at which the process was created", @@ -37,7 +37,7 @@ "guid": { "description": "The globally unique identifier of the assigned by the vendor product", "ui-priority": 1, - "misp-attribute": "uuid" + "misp-attribute": "text" }, "parent-pid": { "description": "Process ID of the parent process", @@ -48,7 +48,7 @@ "parent-guid": { "description": "The globally unique idenifier of the parent process assigned by the vendor product", "ui-priority": 1, - "misp-attribute": "uuid" + "misp-attribute": "text" }, "child-pid": { "description": "Process ID of the child(ren) process", @@ -60,7 +60,7 @@ "port": { "description": "Port(s) owned by the process", "ui-priority": 1, - "misp-attribute": "src-port", + "misp-attribute": "port", "multiple": true, "disable_correlation": true }, From 5f7f4b8e50eb5325ba6f681d562a7b561c25acf9 Mon Sep 17 00:00:00 2001 From: Christophe Vandeplas Date: Thu, 8 Aug 2019 11:30:47 +0200 Subject: [PATCH 007/155] sort schema_objects --- schema_objects.json | 120 ++++++++++++++++++++++---------------------- 1 file changed, 60 insertions(+), 60 deletions(-) diff --git a/schema_objects.json b/schema_objects.json index 9c1e073..0df52de 100644 --- a/schema_objects.json +++ b/schema_objects.json @@ -1,67 +1,74 @@ { "$schema": "http://json-schema.org/schema#", - "title": "Validator for misp-objects", - "id": "https://www.github.com/MISP/misp-objects/schema.json", + "additionalProperties": false, "defs": { "attribute": { - "type": "object", "additionalProperties": false, "properties": { - "misp-attribute": { - "type": "string" - }, - "ui-priority": { - "type": "number" - }, "categories": { - "type": "array", - "uniqueItems": true, "items": { "type": "string" - } - }, - "values_list": { + }, "type": "array", - "uniqueItems": true, - "items": { - "type": "string" - } + "uniqueItems": true }, - "sane_default": { - "type": "array", - "uniqueItems": true, - "items": { - "type": "string" - } - }, - "multiple": { - "type": "boolean" + "description": { + "type": "string" }, "disable_correlation": { "type": "boolean" }, - "to_ids": { + "misp-attribute": { + "type": "string" + }, + "multiple": { "type": "boolean" }, "recommended": { "type": "boolean" }, - "description": { - "type": "string" + "sane_default": { + "items": { + "type": "string" + }, + "type": "array", + "uniqueItems": true + }, + "to_ids": { + "type": "boolean" + }, + "ui-priority": { + "type": "number" + }, + "values_list": { + "items": { + "type": "string" + }, + "type": "array", + "uniqueItems": true } }, "required": [ "misp-attribute", "ui-priority", "description" - ] + ], + "type": "object" } }, - "type": "object", - "additionalProperties": false, + "id": "https://www.github.com/MISP/misp-objects/schema.json", "properties": { + "attributes": { + "additionalProperties": { + "$ref": "#/defs/attribute", + "type": "object" + }, + "type": "object" + }, + "description": { + "type": "string" + }, "meta-category": { - "type": "string", "enum": [ "file", "network", @@ -70,40 +77,31 @@ "internal", "vulnerability", "climate" - ] + ], + "type": "string" }, "name": { "type": "string" }, - "description": { - "type": "string" + "required": { + "items": { + "type": "string" + }, + "type": "array", + "uniqueItems": true }, - "version": { - "type": "integer" + "requiredOneOf": { + "items": { + "type": "string" + }, + "type": "array", + "uniqueItems": true }, "uuid": { "type": "string" }, - "attributes": { - "type": "object", - "additionalProperties": { - "type": "object", - "$ref": "#/defs/attribute" - } - }, - "requiredOneOf": { - "type": "array", - "uniqueItems": true, - "items": { - "type": "string" - } - }, - "required": { - "type": "array", - "uniqueItems": true, - "items": { - "type": "string" - } + "version": { + "type": "integer" } }, "required": [ @@ -113,5 +111,7 @@ "meta-category", "name", "uuid" - ] + ], + "title": "Validator for misp-objects", + "type": "object" } From 6a852e49e8d35c2f5723b0d3cdafb747421dcc17 Mon Sep 17 00:00:00 2001 From: Christophe Vandeplas Date: Thu, 8 Aug 2019 11:45:29 +0200 Subject: [PATCH 008/155] chg: [validation] improve validation script --- validate_all.sh | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/validate_all.sh b/validate_all.sh index 1ed700c..0d8b9d1 100755 --- a/validate_all.sh +++ b/validate_all.sh @@ -8,7 +8,7 @@ set -x diffs=`git status --porcelain | wc -l` if ! [ $diffs -eq 0 ]; then - echo "Please make sure you run ./jq_all_the_things.sh before commiting." + echo "ERROR: Please make sure you run ./jq_all_the_things.sh before doing a PR." exit 1 fi @@ -18,7 +18,7 @@ find -name "*.json" -exec chmod -x "{}" \; diffs=`git status --porcelain | wc -l` if ! [ $diffs -eq 0 ]; then - echo "Please make sure you run remove the executable flag on the json files before commiting: find -name "*.json" -exec chmod -x \"{}\" \\;" + echo "ERROR: Please make sure you run remove the executable flag on the json files before doing a PR: find -name "*.json" -exec chmod -x \"{}\" \\;" exit 1 fi @@ -33,3 +33,5 @@ done jsonschema -i relationships/definition.json schema_relationships.json ./unique_uuid.py + +echo "Success: All is fine, please go ahead.". From 7dc65e5fe07100dec815d7c15c3ad3a0068f7ddb Mon Sep 17 00:00:00 2001 From: Christophe Vandeplas Date: Thu, 8 Aug 2019 11:46:54 +0200 Subject: [PATCH 009/155] chg: [validation] complement schema with categories/types --- schema_objects.json | 180 ++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 180 insertions(+) diff --git a/schema_objects.json b/schema_objects.json index 0df52de..916bc58 100644 --- a/schema_objects.json +++ b/schema_objects.json @@ -7,6 +7,24 @@ "properties": { "categories": { "items": { + "enum": [ + "Antivirus detection", + "Artifacts dropped", + "Attribution", + "External analysis", + "Financial fraud", + "Internal reference", + "Network activity", + "Other", + "Payload delivery", + "Payload installation", + "Payload type", + "Persistence mechanism", + "Person", + "Social network", + "Support Tool", + "Targeting data" + ], "type": "string" }, "type": "array", @@ -19,6 +37,168 @@ "type": "boolean" }, "misp-attribute": { + "enum": [ + "AS", + "aba-rtn", + "anonymised", + "attachment", + "authentihash", + "bank-account-nr", + "bic", + "bin", + "boolean", + "bro", + "btc", + "campaign-id", + "campaign-name", + "cc-number", + "cdhash", + "comment", + "community-id", + "cookie", + "cortex", + "counter", + "country-of-residence", + "cpe", + "date-of-birth", + "datetime", + "dns-soa-email", + "domain", + "domain|ip", + "email-attachment", + "email-body", + "email-dst", + "email-dst-display-name", + "email-header", + "email-message-id", + "email-mime-boundary", + "email-reply-to", + "email-src", + "email-src-display-name", + "email-subject", + "email-thread-index", + "email-x-mailer", + "filename", + "filename|authentihash", + "filename|impfuzzy", + "filename|imphash", + "filename|md5", + "filename|pehash", + "filename|sha1", + "filename|sha224", + "filename|sha256", + "filename|sha384", + "filename|sha512", + "filename|sha512/224", + "filename|sha512/256", + "filename|ssdeep", + "filename|tlsh", + "first-name", + "float", + "frequent-flyer-number", + "gender", + "gene", + "github-organisation", + "github-repository", + "github-username", + "hassh-md5", + "hasshserver-md5", + "hex", + "hostname", + "hostname|port", + "http-method", + "iban", + "identity-card-number", + "impfuzzy", + "imphash", + "ip-dst", + "ip-dst|port", + "ip-src", + "ip-src|port", + "issue-date-of-the-visa", + "ja3-fingerprint-md5", + "jabber-id", + "last-name", + "link", + "mac-address", + "mac-eui-64", + "malware-sample", + "malware-type", + "md5", + "middle-name", + "mime-type", + "mobile-application-id", + "mutex", + "named pipe", + "nationality", + "other", + "passenger-name-record-locator-number", + "passport-country", + "passport-expiration", + "passport-number", + "pattern-in-file", + "pattern-in-memory", + "pattern-in-traffic", + "payment-details", + "pdb", + "pehash", + "phone-number", + "place-of-birth", + "place-port-of-clearance", + "place-port-of-onward-foreign-destination", + "place-port-of-original-embarkation", + "port", + "primary-residence", + "prtn", + "redress-number", + "regkey", + "regkey|value", + "sha1", + "sha224", + "sha256", + "sha384", + "sha512", + "sha512/224", + "sha512/256", + "sigma", + "size-in-bytes", + "snort", + "special-service-request", + "ssdeep", + "stix2-pattern", + "target-email", + "target-external", + "target-location", + "target-machine", + "target-org", + "target-user", + "text", + "threat-actor", + "tlsh", + "travel-details", + "twitter-id", + "uri", + "url", + "user-agent", + "visa-number", + "vulnerability", + "weakness", + "whois-creation-date", + "whois-registrant-email", + "whois-registrant-name", + "whois-registrant-org", + "whois-registrant-phone", + "whois-registrar", + "windows-scheduled-task", + "windows-service-displayname", + "windows-service-name", + "x509-fingerprint-md5", + "x509-fingerprint-sha1", + "x509-fingerprint-sha256", + "xmr", + "yara", + "zeek" + ], "type": "string" }, "multiple": { From 7c3ee740fa95b7f378ac5fb4b7930df42a47d242 Mon Sep 17 00:00:00 2001 From: Christophe Vandeplas Date: Thu, 8 Aug 2019 12:11:13 +0200 Subject: [PATCH 010/155] fix: [timesketch] fix incorrect attribute type --- objects/timesketch-timeline/definition.json | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/objects/timesketch-timeline/definition.json b/objects/timesketch-timeline/definition.json index 994015f..02d76bd 100644 --- a/objects/timesketch-timeline/definition.json +++ b/objects/timesketch-timeline/definition.json @@ -12,7 +12,7 @@ "timestamp": { "description": "When the log entry was seen in microseconds since Unix epoch", "ui-priority": 0, - "misp-attribute": "timestamp-microsec" + "misp-attribute": "text" }, "timestamp_desc": { "description": "Text explaining what type of timestamp is it", @@ -25,7 +25,7 @@ "misp-attribute": "datetime" } }, - "version": 2, + "version": 3, "description": "A timesketch timeline object based on mandatory field in timesketch to describe a log entry.", "meta-category": "misc", "uuid": "06db0221-cbc0-4ffc-ad98-7f34549310f1", From a347aa78fea21c70f6679ad67c0a5a62774de2cb Mon Sep 17 00:00:00 2001 From: Christophe Vandeplas Date: Thu, 8 Aug 2019 14:01:09 +0200 Subject: [PATCH 011/155] fix: [virustotal] corrected typo in category --- objects/virustotal-report/definition.json | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/objects/virustotal-report/definition.json b/objects/virustotal-report/definition.json index be0dc3e..bc07cca 100644 --- a/objects/virustotal-report/definition.json +++ b/objects/virustotal-report/definition.json @@ -48,14 +48,14 @@ "comment": { "description": "Comment related to this hash", "categories": [ - "Exernal analysis" + "External analysis" ], "misp-attribute": "text", "ui-priority": 2, "multiple": true } }, - "version": 2, + "version": 3, "description": "VirusTotal report", "meta-category": "misc", "uuid": "d7dd0154-e04f-4c34-a2fb-79f3a3a52aa4", From 56dddf2f9f61899063cf91112249f2edeae966f9 Mon Sep 17 00:00:00 2001 From: Alexandre Dulaunoy Date: Thu, 22 Aug 2019 11:25:37 +0200 Subject: [PATCH 012/155] chg: [relationships] new relationship added is-author-of - fix #183 --- relationships/definition.json | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/relationships/definition.json b/relationships/definition.json index a4bcef0..53a4dcd 100644 --- a/relationships/definition.json +++ b/relationships/definition.json @@ -1,5 +1,5 @@ { - "version": 15, + "version": 16, "values": [ { "name": "derived-from", @@ -243,6 +243,13 @@ "misp" ] }, + { + "name": "is-author-of", + "description": "This relationship describes an object being author by someone.", + "format": [ + "misp" + ] + }, { "name": "located", "description": "This relationship describes the location (of any type) of a specific object.", From 0d40f64815e3cbd401880e231c688c5075e35991 Mon Sep 17 00:00:00 2001 From: Deborah Servili Date: Mon, 9 Sep 2019 16:36:16 +0200 Subject: [PATCH 013/155] add impersonation object --- objects/impersonation/definition.json | 73 +++++++++++++++++++++++++++ 1 file changed, 73 insertions(+) create mode 100644 objects/impersonation/definition.json diff --git a/objects/impersonation/definition.json b/objects/impersonation/definition.json new file mode 100644 index 0000000..da174db --- /dev/null +++ b/objects/impersonation/definition.json @@ -0,0 +1,73 @@ +{ + "attributes": { + "type-of-account": { + "description": "Type of the impersonated account", + "ui-priority": 1, + "misp-attribute": "text", + "disable_correlation": true, + "sane_default": [ + "Twitter", + "Facebook", + "LinkedIn", + "Reddit", + "Google+", + "Instagram", + "Forum", + "Other" + ] + }, + "account-url": { + "description": "url of the impersonating account", + "ui-priority": 1, + "misp-attribute": "url" + }, + "account-name": { + "description": "Name of the impersonating account", + "ui-priority": 1, + "misp-attribute": "text" + }, + "impersonated-account-url": { + "description": "url of the impersonated account", + "ui-priority": 1, + "misp-attribute": "link" + }, + "impersonated-account-name": { + "description": "Name of the impersonated account", + "ui-priority": 1, + "misp-attribute": "text" + }, + "real-name": { + "description": "Real name of the impersonated person or entity", + "ui-priority": 1, + "misp-attribute": "text" + }, + "type": { + "description": "", + "ui-priority": 1, + "misp-attribute": "text", + "disable_correlation": true, + "sane_default": [ + "Person", + "Association", + "Enterprise", + "Other" + ] + }, + "objective": { + "description": "Objective of the impersonation", + "ui-priority": 1, + "misp-attribute": "text", + "disable_correlation": true, + "multiple": true, + "sane_default": [ + "Infomation stealing", + "Other" + ] + } + }, + "version": 1, + "description": "Represent an impersonating account", + "meta-category": "misc", + "uuid": "01833a92-d2ff-11e9-8016-d3b988153702", + "name": "impersonation" +} From b9d16a38ad7ee2f904d7eb4812b28de86495bf95 Mon Sep 17 00:00:00 2001 From: Deborah Servili Date: Tue, 10 Sep 2019 16:15:40 +0200 Subject: [PATCH 014/155] draft command object --- objects/command-line/definition.json | 20 ++++++++++++++++++++ objects/command/definition.json | 19 +++++++++++++++++++ 2 files changed, 39 insertions(+) create mode 100644 objects/command-line/definition.json create mode 100644 objects/command/definition.json diff --git a/objects/command-line/definition.json b/objects/command-line/definition.json new file mode 100644 index 0000000..0b11d92 --- /dev/null +++ b/objects/command-line/definition.json @@ -0,0 +1,20 @@ +{ + "attributes": { + "value": { + "description": "", + "ui-priority": 1, + "misp-attribute": "text", + "multiple": true + }, + "description": { + "description": "description of the command", + "ui-priority": 1, + "misp-attribute": "text" + } + }, + "version": 1, + "description": "", + "meta-category": "misc", + "uuid": "88ebe222-d3cc-11e9-875d-7f13f460adaf", + "name": "command-line" +} diff --git a/objects/command/definition.json b/objects/command/definition.json new file mode 100644 index 0000000..6cbb5c7 --- /dev/null +++ b/objects/command/definition.json @@ -0,0 +1,19 @@ +{ + "attributes": { + "command-name": { + "description": "Text used to call the command", + "ui-priority": 1, + "misp-attribute": "text" + }, + "functionality": { + "description": "Functionality of the command", + "ui-priority": 1, + "misp-attribute": "text" + } + }, + "version": 1, + "description": "Command", + "meta-category": "misc", + "uuid": "21ad70d8-d397-11e9-9ea7-43b2d5f6a6e3", + "name": "command" +} From 951abf10fea019580c5decbb7879a35ef713b9f3 Mon Sep 17 00:00:00 2001 From: Alexandre Dulaunoy Date: Wed, 11 Sep 2019 09:11:28 +0200 Subject: [PATCH 015/155] chg: [new object templates] various updates --- objects/command-line/definition.json | 16 +++++++------- objects/command/definition.json | 30 +++++++++++++++++++++------ objects/impersonation/definition.json | 8 +++++-- 3 files changed, 38 insertions(+), 16 deletions(-) diff --git a/objects/command-line/definition.json b/objects/command-line/definition.json index 0b11d92..02c21ae 100644 --- a/objects/command-line/definition.json +++ b/objects/command-line/definition.json @@ -1,19 +1,19 @@ { "attributes": { "value": { - "description": "", + "description": "command code", "ui-priority": 1, "misp-attribute": "text", "multiple": true - }, - "description": { - "description": "description of the command", - "ui-priority": 1, - "misp-attribute": "text" - } + }, + "description": { + "description": "description of the command", + "ui-priority": 1, + "misp-attribute": "text" + } }, "version": 1, - "description": "", + "description": "Command line and option related to a software malicious or not to execute specific commands.", "meta-category": "misc", "uuid": "88ebe222-d3cc-11e9-875d-7f13f460adaf", "name": "command-line" diff --git a/objects/command/definition.json b/objects/command/definition.json index 6cbb5c7..cb1b7b6 100644 --- a/objects/command/definition.json +++ b/objects/command/definition.json @@ -1,18 +1,36 @@ { "attributes": { - "command-name": { - "description": "Text used to call the command", + "location": { + "description": "Location of the command functionality", "ui-priority": 1, - "misp-attribute": "text" + "misp-attribute": "text", + "disable_correlation": true, + "sane_default": [ + "Bundled", + "Module", + "Libraries", + "Unknown" + ] }, - "functionality": { - "description": "Functionality of the command", + "trigger": { + "description": "How the commands are triggered", + "ui-priority": 1, + "misp-attribute": "text", + "disable_correlation": true, + "sane_default": [ + "Local", + "Network", + "Unknown" + ] + }, + "description": { + "description": "Description of the command functionalities", "ui-priority": 1, "misp-attribute": "text" } }, "version": 1, - "description": "Command", + "description": "Command functionalities related to a software malicious or not to execute specific commands. Command-line are attached to this object for the related commands.", "meta-category": "misc", "uuid": "21ad70d8-d397-11e9-9ea7-43b2d5f6a6e3", "name": "command" diff --git a/objects/impersonation/definition.json b/objects/impersonation/definition.json index da174db..78a35b5 100644 --- a/objects/impersonation/definition.json +++ b/objects/impersonation/definition.json @@ -42,7 +42,7 @@ "misp-attribute": "text" }, "type": { - "description": "", + "description": "Type of the account", "ui-priority": 1, "misp-attribute": "text", "disable_correlation": true, @@ -60,7 +60,11 @@ "disable_correlation": true, "multiple": true, "sane_default": [ - "Infomation stealing", + "Information stealing", + "Disinformation", + "Distrusting", + "Advertising", + "Parody", "Other" ] } From 0910f0b15fc611e73ddfe285764b4b11d50e22a2 Mon Sep 17 00:00:00 2001 From: Alexandre Dulaunoy Date: Wed, 11 Sep 2019 10:27:27 +0200 Subject: [PATCH 016/155] chg: [credential] adding disable correlation when required --- objects/credential/definition.json | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/objects/credential/definition.json b/objects/credential/definition.json index 0a4f7a9..b1b90fd 100644 --- a/objects/credential/definition.json +++ b/objects/credential/definition.json @@ -25,6 +25,7 @@ "description": "Type of password(s)", "ui-priority": 1, "misp-attribute": "text", + "disable_correlation": true, "values_list": [ "password", "api-key", @@ -36,6 +37,7 @@ "description": "Origin of the credential(s)", "ui-priority": 1, "misp-attribute": "text", + "disable_correlation": true, "sane_default": [ "bruteforce-scanning", "malware-analysis", @@ -49,6 +51,7 @@ "description": "Format of the password(s)", "ui-priority": 1, "misp-attribute": "text", + "disable_correlation": true, "values_list": [ "clear-text", "hashed", @@ -60,6 +63,7 @@ "description": "Mention of any notification(s) towards the potential owner(s) of the credential(s)", "ui-priority": 1, "misp-attribute": "text", + "disable_correlation": true, "multiple": true, "values_list": [ "victim-notified", @@ -68,7 +72,7 @@ ] } }, - "version": 3, + "version": 4, "description": "Credential describes one or more credential(s) including password(s), api key(s) or decryption key(s).", "meta-category": "misc", "uuid": "a27e98c9-9b0e-414c-8076-d201e039ca09", From a98631d5336872c5984d86d43a9b2c1bc5e5b37b Mon Sep 17 00:00:00 2001 From: Saad Kadhi Date: Wed, 11 Sep 2019 21:59:37 +0200 Subject: [PATCH 017/155] Better wording --- objects/command/definition.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/objects/command/definition.json b/objects/command/definition.json index cb1b7b6..651d7d8 100644 --- a/objects/command/definition.json +++ b/objects/command/definition.json @@ -30,7 +30,7 @@ } }, "version": 1, - "description": "Command functionalities related to a software malicious or not to execute specific commands. Command-line are attached to this object for the related commands.", + "description": "Command functionalities related to specific commands executed by a program, whether it is malicious or not. Command-line are attached to this object for the related commands.", "meta-category": "misc", "uuid": "21ad70d8-d397-11e9-9ea7-43b2d5f6a6e3", "name": "command" From 0f76563ffc9991c0e4bf0c5a152ec0924ad46868 Mon Sep 17 00:00:00 2001 From: Saad Kadhi Date: Wed, 11 Sep 2019 22:02:48 +0200 Subject: [PATCH 018/155] Better wording --- objects/command-line/definition.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/objects/command-line/definition.json b/objects/command-line/definition.json index 02c21ae..f48dcbd 100644 --- a/objects/command-line/definition.json +++ b/objects/command-line/definition.json @@ -13,7 +13,7 @@ } }, "version": 1, - "description": "Command line and option related to a software malicious or not to execute specific commands.", + "description": "Command line and options related to a specific command executed by a program, whether it is malicious or not.", "meta-category": "misc", "uuid": "88ebe222-d3cc-11e9-875d-7f13f460adaf", "name": "command-line" From ca70c9ca9b62481d80ee4a1cc7a2e1dbc34d86aa Mon Sep 17 00:00:00 2001 From: Deborah Servili Date: Tue, 17 Sep 2019 14:59:34 +0200 Subject: [PATCH 019/155] update microblog object - use link for non malicious link of the microblog post and embedded-link forlink into the microblog post --- objects/microblog/definition.json | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-) diff --git a/objects/microblog/definition.json b/objects/microblog/definition.json index 877226b..18198ec 100644 --- a/objects/microblog/definition.json +++ b/objects/microblog/definition.json @@ -9,10 +9,16 @@ "misp-attribute": "text" }, "url": { - "description": "Original URL location of the microblog post", + "description": "Original URL location of the microblog post (potentially malicious)", "ui-priority": 1, "misp-attribute": "url" }, + "link": { + "description": "Original link into the microblog post (Supposed harmless)", + "ui-priority": 0, + "misp-attribute": "link", + "multiple": true + }, "type": { "description": "Type of the microblog post", "ui-priority": 1, @@ -55,7 +61,7 @@ "ui-priority": 0, "misp-attribute": "datetime" }, - "link": { + "embedded-link": { "description": "Link into the microblog post", "ui-priority": 0, "misp-attribute": "url", @@ -73,7 +79,7 @@ "misp-attribute": "text" } }, - "version": 6, + "version": 7, "description": "Microblog post like a Twitter tweet or a post on a Facebook wall.", "meta-category": "misc", "uuid": "8ec8c911-ddbe-4f5b-895b-fbff70c42a60", From a210cb049069756e8805e2e4a1803884b5010879 Mon Sep 17 00:00:00 2001 From: Deborah Servili Date: Thu, 19 Sep 2019 13:33:45 +0200 Subject: [PATCH 020/155] add hashtag attribute in microblog object --- objects/microblog/definition.json | 13 +++++++++---- 1 file changed, 9 insertions(+), 4 deletions(-) diff --git a/objects/microblog/definition.json b/objects/microblog/definition.json index 18198ec..2281173 100644 --- a/objects/microblog/definition.json +++ b/objects/microblog/definition.json @@ -15,9 +15,8 @@ }, "link": { "description": "Original link into the microblog post (Supposed harmless)", - "ui-priority": 0, + "ui-priority": 1, "misp-attribute": "link", - "multiple": true }, "type": { "description": "Type of the microblog post", @@ -77,9 +76,15 @@ "ui-priority": 0, "multiple": true, "misp-attribute": "text" - } + }, + "hashtag": { + "description": "Hashtag into the microblog post", + "ui-priority": 0, + "misp-attribute": "text", + "multiple": true + }, }, - "version": 7, + "version": 8, "description": "Microblog post like a Twitter tweet or a post on a Facebook wall.", "meta-category": "misc", "uuid": "8ec8c911-ddbe-4f5b-895b-fbff70c42a60", From 2721d103e5a353adf7a778595aafbf6c0d8b1d96 Mon Sep 17 00:00:00 2001 From: Deborah Servili Date: Thu, 19 Sep 2019 16:14:48 +0200 Subject: [PATCH 021/155] add translation object --- objects/translation/definition.json | 34 +++++++++++++++++++++++++++++ 1 file changed, 34 insertions(+) create mode 100644 objects/translation/definition.json diff --git a/objects/translation/definition.json b/objects/translation/definition.json new file mode 100644 index 0000000..17f834f --- /dev/null +++ b/objects/translation/definition.json @@ -0,0 +1,34 @@ +{ + "attributes": { + "original-text": { + "description": "Original text", + "ui-priority": 1, + "misp-attribute": "text" + }, + "translated-text": { + "description": "Text after translation", + "ui-priority": 1, + "misp-attribute": "text" + }, + "original-language": { + "description": "Language of the original text", + "ui-priority": 1, + "misp-attribute": "text" + }, + "translation-language": { + "description": "Language of translation", + "ui-priority": 1, + "misp-attribute": "text" + }, + "translation-service": { + "description": "translation service used for the translation", + "ui-priority": 1, + "misp-attribute": "text" + } + }, + "version": 1, + "description": "Used to keep a text and its translation", + "meta-category": "misc", + "uuid": "a43b54fa-dac9-11e9-9b0d-97296aceae1a", + "name": "translation" +} From 4081dc8f8fa000f85ccbc5f2412089713ec79a50 Mon Sep 17 00:00:00 2001 From: Deborah Servili Date: Thu, 19 Sep 2019 16:26:41 +0200 Subject: [PATCH 022/155] jq --- objects/microblog/definition.json | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/objects/microblog/definition.json b/objects/microblog/definition.json index 2281173..cf261f9 100644 --- a/objects/microblog/definition.json +++ b/objects/microblog/definition.json @@ -16,7 +16,7 @@ "link": { "description": "Original link into the microblog post (Supposed harmless)", "ui-priority": 1, - "misp-attribute": "link", + "misp-attribute": "link" }, "type": { "description": "Type of the microblog post", @@ -82,7 +82,7 @@ "ui-priority": 0, "misp-attribute": "text", "multiple": true - }, + } }, "version": 8, "description": "Microblog post like a Twitter tweet or a post on a Facebook wall.", From 52e8f9e98bbd2e41cb6fc72d995a7ed4562d5ed6 Mon Sep 17 00:00:00 2001 From: Alexandre Dulaunoy Date: Fri, 20 Sep 2019 07:30:30 +0200 Subject: [PATCH 023/155] chg: [translation] list of sane default for the languages + type of translation --- objects/translation/definition.json | 216 +++++++++++++++++++++++++++- 1 file changed, 213 insertions(+), 3 deletions(-) diff --git a/objects/translation/definition.json b/objects/translation/definition.json index 17f834f..c393b51 100644 --- a/objects/translation/definition.json +++ b/objects/translation/definition.json @@ -1,4 +1,12 @@ { + "requiredOneOf": [ + "original-text", + "translated-text", + "original-text", + "original-language", + "translation-language", + "translation-type" + ], "attributes": { "original-text": { "description": "Original text", @@ -13,17 +21,219 @@ "original-language": { "description": "Language of the original text", "ui-priority": 1, - "misp-attribute": "text" + "misp-attribute": "text", + "sane_default": [ + "Mandarin (language family)", + "Spanish", + "English", + "Hindi", + "Bengali", + "Portuguese", + "Russian", + "Japanese", + "Western Punjabi", + "Marathi", + "Telugu", + "Wu (language family)", + "Turkish", + "Korean", + "French", + "German", + "Vietnamese", + "Tamil", + "Yue (language family)", + "Urdu", + "Javanese", + "Italian", + "Egyptian Arabic", + "Gujarati", + "Iranian Persian", + "Bhojpuri", + "Min Nan (language family)", + "Hakka", + "Jinyu", + "Hausa", + "Kannada", + "Indonesian (Indonesian Malay)", + "Polish", + "Yoruba", + "Xiang Chinese (language family)", + "Malayalam", + "Odia", + "Maithili", + "Burmese", + "Eastern Punjabi", + "Sunda", + "Sudanese Arabic", + "Algerian Arabic", + "Moroccan Arabic", + "Ukrainian", + "Igbo", + "Northern Uzbek", + "Sindhi", + "North Levantine Arabic", + "Romanian", + "Tagalog", + "Dutch", + "Saʽidi Arabic", + "Gan", + "Amharic", + "Northern Pashto", + "Magahi", + "Thai", + "Saraiki", + "Khmer", + "Chhattisgarhi", + "Somali", + "Malay (Malaysian Malay)", + "Cebuano", + "Nepali", + "Mesopotamian Arabic", + "Assamese", + "Sinhala", + "Northern Kurdish", + "Hejazi Arabic", + "Nigerian Fulfulde", + "South Azerbaijani", + "Greek", + "Chittagonian", + "Kazakh", + "Deccan", + "Hungarian", + "Kinyarwanda", + "Zulu", + "South Levantine Arabic", + "Tunisian Arabic", + "Sanaani Spoken Arabic", + "Min Bei Chinese (language family)", + "Southern Pashto", + "Rundi", + "Czech", + "Taʽizzi-Adeni Arabic", + "Uyghur", + "Min Dong Chinese (language family)", + "Sylheti " + ] }, "translation-language": { "description": "Language of translation", "ui-priority": 1, - "misp-attribute": "text" + "misp-attribute": "text", + "sane_default": [ + "Mandarin (language family)", + "Spanish", + "English", + "Hindi", + "Bengali", + "Portuguese", + "Russian", + "Japanese", + "Western Punjabi", + "Marathi", + "Telugu", + "Wu (language family)", + "Turkish", + "Korean", + "French", + "German", + "Vietnamese", + "Tamil", + "Yue (language family)", + "Urdu", + "Javanese", + "Italian", + "Egyptian Arabic", + "Gujarati", + "Iranian Persian", + "Bhojpuri", + "Min Nan (language family)", + "Hakka", + "Jinyu", + "Hausa", + "Kannada", + "Indonesian (Indonesian Malay)", + "Polish", + "Yoruba", + "Xiang Chinese (language family)", + "Malayalam", + "Odia", + "Maithili", + "Burmese", + "Eastern Punjabi", + "Sunda", + "Sudanese Arabic", + "Algerian Arabic", + "Moroccan Arabic", + "Ukrainian", + "Igbo", + "Northern Uzbek", + "Sindhi", + "North Levantine Arabic", + "Romanian", + "Tagalog", + "Dutch", + "Saʽidi Arabic", + "Gan", + "Amharic", + "Northern Pashto", + "Magahi", + "Thai", + "Saraiki", + "Khmer", + "Chhattisgarhi", + "Somali", + "Malay (Malaysian Malay)", + "Cebuano", + "Nepali", + "Mesopotamian Arabic", + "Assamese", + "Sinhala", + "Northern Kurdish", + "Hejazi Arabic", + "Nigerian Fulfulde", + "South Azerbaijani", + "Greek", + "Chittagonian", + "Kazakh", + "Deccan", + "Hungarian", + "Kinyarwanda", + "Zulu", + "South Levantine Arabic", + "Tunisian Arabic", + "Sanaani Spoken Arabic", + "Min Bei Chinese (language family)", + "Southern Pashto", + "Rundi", + "Czech", + "Taʽizzi-Adeni Arabic", + "Uyghur", + "Min Dong Chinese (language family)", + "Sylheti " + ] }, "translation-service": { "description": "translation service used for the translation", "ui-priority": 1, - "misp-attribute": "text" + "misp-attribute": "text", + "sane_default": [ + "Google Translate", + "Microsoft Translator", + "Babelfish", + "Reverso", + "Dict.cc", + "Linguee", + "unknown" + ] + }, + "translation-type": { + "description": "type of translation", + "ui-priority": 1, + "misp-attribute": "text", + "sane_default": [ + "Automated translation", + "Manual translation" + ] } }, "version": 1, From 4ab14e785a9d4a696a092495c4d8954fd9fb0e9c Mon Sep 17 00:00:00 2001 From: Alexandre Dulaunoy Date: Fri, 20 Sep 2019 09:05:49 +0200 Subject: [PATCH 024/155] chg: [translation] double entry fixed in requiredOneOf Signed-off by: By de leaduh of JavaScript and decayin' indicatawhs --- objects/translation/definition.json | 1 - 1 file changed, 1 deletion(-) diff --git a/objects/translation/definition.json b/objects/translation/definition.json index c393b51..3733c09 100644 --- a/objects/translation/definition.json +++ b/objects/translation/definition.json @@ -2,7 +2,6 @@ "requiredOneOf": [ "original-text", "translated-text", - "original-text", "original-language", "translation-language", "translation-type" From d116b7e4b26c2f7b37d038b99028a3633fa633d4 Mon Sep 17 00:00:00 2001 From: Deborah Servili Date: Mon, 23 Sep 2019 09:54:41 +0200 Subject: [PATCH 025/155] Update version of paste object --- objects/paste/definition.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/objects/paste/definition.json b/objects/paste/definition.json index 7eace76..e78808f 100644 --- a/objects/paste/definition.json +++ b/objects/paste/definition.json @@ -61,7 +61,7 @@ "misp-attribute": "datetime" } }, - "version": 4, + "version": 5, "description": "Paste or similar post from a website allowing to share privately or publicly posts.", "meta-category": "misc", "uuid": "cedc055c-78aa-49a4-bfd7-4cc30cecef12", From 6622083a2bd7cc5072b2e63e5655b28f3d087eb8 Mon Sep 17 00:00:00 2001 From: Deborah Servili Date: Mon, 23 Sep 2019 12:57:09 +0200 Subject: [PATCH 026/155] rename object misc to organization + update version --- objects/organization/definition.json | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/objects/organization/definition.json b/objects/organization/definition.json index f575479..dfb2744 100644 --- a/objects/organization/definition.json +++ b/objects/organization/definition.json @@ -67,9 +67,9 @@ "disable_correlation": true } }, - "version": 1, + "version": 2, "description": "An object which describes an organization.", "meta-category": "misc", "uuid": "f750e12b-127a-432c-b022-b3f9153c4e2a", - "name": "misc" + "name": "organization" } From ffc120106c4ba9ed3b2fd5ae18d41f730e61b3ab Mon Sep 17 00:00:00 2001 From: Alexandre Dulaunoy Date: Wed, 25 Sep 2019 12:15:04 +0200 Subject: [PATCH 027/155] Update definition.json Following discussion during MISP training - new language seen in a malware campaign. --- objects/script/definition.json | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/objects/script/definition.json b/objects/script/definition.json index c7eb0f6..972d64e 100644 --- a/objects/script/definition.json +++ b/objects/script/definition.json @@ -32,7 +32,8 @@ "Ruby", "Winbatch", "AutoIt", - "PHP" + "PHP", + "Nim" ] }, "filename": { @@ -56,7 +57,7 @@ ] } }, - "version": 4, + "version": 5, "description": "Object describing a computer program written to be run in a special run-time environment. The script or shell script can be used for malicious activities but also as support tools for threat analysts.", "meta-category": "misc", "uuid": "6bce7d01-dbec-4054-b3c2-3655a19382e2", From 0802ed07f993b30152ae466a4cfb9dc51ba55d41 Mon Sep 17 00:00:00 2001 From: Alexandre Dulaunoy Date: Tue, 1 Oct 2019 20:14:51 +0200 Subject: [PATCH 028/155] chg: [schema] updated to the latest version --- schema_objects.json | 1 + 1 file changed, 1 insertion(+) diff --git a/schema_objects.json b/schema_objects.json index 916bc58..84dedeb 100644 --- a/schema_objects.json +++ b/schema_objects.json @@ -60,6 +60,7 @@ "counter", "country-of-residence", "cpe", + "dash", "date-of-birth", "datetime", "dns-soa-email", From 49e6c989d518e71cb299e1dd9d8dfba3d092d412 Mon Sep 17 00:00:00 2001 From: Alexandre Dulaunoy Date: Tue, 1 Oct 2019 20:17:44 +0200 Subject: [PATCH 029/155] chg: [coin-address] DASH cryptocurrency address added --- objects/coin-address/definition.json | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/objects/coin-address/definition.json b/objects/coin-address/definition.json index 47b1805..52f7a98 100644 --- a/objects/coin-address/definition.json +++ b/objects/coin-address/definition.json @@ -45,7 +45,8 @@ "STRAT", "WAVES", "PPT", - "ETN" + "ETN", + "DASH" ] }, "last-seen": { @@ -102,7 +103,7 @@ "recommended": false } }, - "version": 4, + "version": 5, "description": "An address used in a cryptocurrency", "meta-category": "financial", "uuid": "d0e6997e-78da-4815-a6a1-cfc1c1cb8a46", From 2cd5329b003f4421860756921c9003ce5379bbb1 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Rapha=C3=ABl=20Vinot?= Date: Tue, 1 Oct 2019 13:21:28 -0700 Subject: [PATCH 030/155] fix: duplicate in coin-address --- objects/coin-address/definition.json | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/objects/coin-address/definition.json b/objects/coin-address/definition.json index 52f7a98..659b59d 100644 --- a/objects/coin-address/definition.json +++ b/objects/coin-address/definition.json @@ -45,8 +45,7 @@ "STRAT", "WAVES", "PPT", - "ETN", - "DASH" + "ETN" ] }, "last-seen": { From edf8b59af7682f58b2900b10d92284021be8e58f Mon Sep 17 00:00:00 2001 From: Alexandre Dulaunoy Date: Sat, 5 Oct 2019 10:05:26 +0200 Subject: [PATCH 031/155] chg: [cowrie] to add HASSH of the client SSH session following Salesforce algorithm As mentioned in #84 --- objects/cowrie/definition.json | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/objects/cowrie/definition.json b/objects/cowrie/definition.json index d3926d1..a29410f 100644 --- a/objects/cowrie/definition.json +++ b/objects/cowrie/definition.json @@ -116,9 +116,14 @@ "ui-priority": 1, "misp-attribute": "text", "disable_correlation": true + }, + "hassh": { + "description": "HASSH of the client SSH session following Salesforce algorithm", + "misp-attribute": "hassh-md5", + "ui-priority": 1 } }, - "version": 2, + "version": 3, "description": "Cowrie honeypot object template", "meta-category": "network", "uuid": "ae085d32-6534-4d52-b3eb-063fccb753e7", From 0859a97535103c0a712fb821dc45d817f7301331 Mon Sep 17 00:00:00 2001 From: Alexandre Dulaunoy Date: Thu, 17 Oct 2019 14:48:21 +0200 Subject: [PATCH 032/155] chg: [x509] to map with D4 project snakeoil database --- objects/x509/definition.json | 28 ++++++++++++++++++++++++++-- 1 file changed, 26 insertions(+), 2 deletions(-) diff --git a/objects/x509/definition.json b/objects/x509/definition.json index cf9fe39..b9bd092 100644 --- a/objects/x509/definition.json +++ b/objects/x509/definition.json @@ -108,7 +108,31 @@ "disable_correlation": true }, "dns_names": { - "description": "DNS names", + "description": "Subject Alternative Name - DNS names", + "multiple": true, + "misp-attribute": "text", + "ui-priority": 0 + }, + "email": { + "description": "Subject Alternative Name - emails", + "multiple": true, + "misp-attribute": "text", + "ui-priority": 0 + }, + "ip": { + "description": "Subject Alternative Name - IP", + "multiple": true, + "misp-attribute": "text", + "ui-priority": 0 + }, + "uri": { + "description": "Subject Alternative Name - URI", + "multiple": true, + "misp-attribute": "text", + "ui-priority": 0 + }, + "rid": { + "description": "Subject Alternative Name - RID", "multiple": true, "misp-attribute": "text", "ui-priority": 0 @@ -124,7 +148,7 @@ ] } }, - "version": 9, + "version": 10, "description": "x509 object describing a X.509 certificate", "meta-category": "network", "uuid": "d1ab756a-26b5-4349-9f43-765630f0911c", From 58d6722f5e276a0ec5889e6e67316b7401960542 Mon Sep 17 00:00:00 2001 From: Alexandre Dulaunoy Date: Thu, 17 Oct 2019 15:41:01 +0200 Subject: [PATCH 033/155] chg: [crypto-material] new object to described key materials (public and private) --- objects/crypto-material/definition.json | 148 ++++++++++++++++++++++++ 1 file changed, 148 insertions(+) create mode 100644 objects/crypto-material/definition.json diff --git a/objects/crypto-material/definition.json b/objects/crypto-material/definition.json new file mode 100644 index 0000000..6d54370 --- /dev/null +++ b/objects/crypto-material/definition.json @@ -0,0 +1,148 @@ +{ + "requiredOneOf": [ + "text", + "private", + "p", + "q" + ], + "attributes": { + "text": { + "description": "A description of the cryptographic materials.", + "disable_correlation": true, + "ui-priority": 1, + "misp-attribute": "text" + }, + "rsa-modulus-size": { + "description": "RSA modulus size in bits", + "disable_correlation": true, + "ui-priority": 1, + "misp-attribute": "text" + }, + "p": { + "description": "Prime Parameter - P in decimal", + "disable_correlation": true, + "ui-priority": 1, + "misp-attribute": "text" + }, + "q": { + "description": "Prime Parameter - Q in decimal", + "disable_correlation": true, + "ui-priority": 1, + "misp-attribute": "text" + }, + "g": { + "description": "Curve Parameter - G in decimal", + "disable_correlation": true, + "ui-priority": 1, + "misp-attribute": "text" + }, + "y": { + "description": "Curve Parameter - Y in decimal", + "disable_correlation": true, + "ui-priority": 1, + "misp-attribute": "text" + }, + "x": { + "description": "Curve Parameter - X in decimal", + "disable_correlation": true, + "ui-priority": 1, + "misp-attribute": "text" + }, + "n": { + "description": "Curve Parameter - N in decimal", + "disable_correlation": true, + "ui-priority": 1, + "misp-attribute": "text" + }, + "b": { + "description": "Curve Parameter - B in decimal", + "disable_correlation": true, + "ui-priority": 1, + "misp-attribute": "text" + }, + "curve-length": { + "description": "Length of the Curve in bits", + "disable_correlation": true, + "ui-priority": 1, + "misp-attribute": "text" + }, + "Gx": { + "description": "Curve Parameter - Gx in decimal", + "disable_correlation": true, + "ui-priority": 1, + "misp-attribute": "text" + }, + "Gy": { + "description": "Curve Parameter - Gy in decimal", + "disable_correlation": true, + "ui-priority": 1, + "misp-attribute": "text" + }, + "private": { + "description": "Private part of the cryptographic materials in PEM format", + "ui-priority": 1, + "misp-attribute": "text" + }, + "type": { + "description": "Type of crytographic materials", + "ui-priority": 1, + "misp-attribute": "text", + "disable_correlation": true, + "values_list": [ + "RSA", + "DSA", + "ECDSA", + "unknown" + ] + }, + "ecdsa-type": { + "description": "Curve type of the ECDSA cryptographic materials", + "ui-priority": 1, + "misp-attribute": "text", + "disable_correlation": true, + "values_list": [ + "Anomalous", + "M-221", + "E-222", + "NIST P-224", + "Curve1174", + "Curve25519", + "BN(2,254)", + "brainpoolP256t1", + "ANSSI FRP256v1", + "NIST P-256", + "secp256k1", + "E-382", + "M-383", + "Curve383187", + "brainpoolP384t1", + "NIST P-384", + "Curve41417", + "Ed448-Goldilocks", + "M-511", + "E-521" + ] + }, + "origin": { + "description": "Origin of the cryptographic materials", + "ui-priority": 1, + "misp-attribute": "text", + "disable_correlation": true, + "sane_default": [ + "mathematical-attack", + "exhaustive-search", + "bruteforce-attack", + "malware-extraction", + "memory-interception", + "network-interception", + "leak", + "unknown" + ] + } + }, + "version": 1, + "description": "Cryptographic materials such as public or/and private keys.", + "meta-category": "misc", + "uuid": "50677f82-ec9c-4484-bb29-2519cfe56823", + "name": "crypto-material" +} From 7b2e5061bbe263491a4d1973d4be65b30673108a Mon Sep 17 00:00:00 2001 From: Jean-Louis Huynen Date: Thu, 31 Oct 2019 10:09:11 +0100 Subject: [PATCH 034/155] chg: [x509, crypto-material] several changes: - enables correlation on n, p, q; - allows for only providing modulus for crypto material; - specifies the expected data format of several fields. --- objects/crypto-material/definition.json | 15 +++++++++++---- objects/x509/definition.json | 8 ++++---- 2 files changed, 15 insertions(+), 8 deletions(-) diff --git a/objects/crypto-material/definition.json b/objects/crypto-material/definition.json index 6d54370..c49b16e 100644 --- a/objects/crypto-material/definition.json +++ b/objects/crypto-material/definition.json @@ -3,7 +3,8 @@ "text", "private", "p", - "q" + "q", + "modulus" ], "attributes": { "text": { @@ -18,15 +19,21 @@ "ui-priority": 1, "misp-attribute": "text" }, + "modulus": { + "description": "Modulus Parameter - in hexadecimal - no 0x, no :", + "disable_correlation": false, + "ui-priority": 1, + "misp-attribute": "text" + }, "p": { "description": "Prime Parameter - P in decimal", - "disable_correlation": true, + "disable_correlation": false, "ui-priority": 1, "misp-attribute": "text" }, "q": { "description": "Prime Parameter - Q in decimal", - "disable_correlation": true, + "disable_correlation": false, "ui-priority": 1, "misp-attribute": "text" }, @@ -140,7 +147,7 @@ ] } }, - "version": 1, + "version": 2, "description": "Cryptographic materials such as public or/and private keys.", "meta-category": "misc", "uuid": "50677f82-ec9c-4484-bb29-2519cfe56823", diff --git a/objects/x509/definition.json b/objects/x509/definition.json index b9bd092..21097c4 100644 --- a/objects/x509/definition.json +++ b/objects/x509/definition.json @@ -19,18 +19,18 @@ "disable_correlation": true }, "pubkey-info-size": { - "description": "Length of the public key (in bits)", + "description": "Length of the public key (in bits expressed in decimal: eg. 256 bits)", "ui-priority": 0, "misp-attribute": "text", "disable_correlation": true }, "pubkey-info-exponent": { - "description": "Exponent of the public key", + "description": "Exponent of the public key - in decimal", "ui-priority": 0, "misp-attribute": "text" }, "pubkey-info-modulus": { - "description": "Modulus of the public key", + "description": "Modulus of the public key - in Hexadecimal - no 0x, no :", "ui-priority": 0, "misp-attribute": "text" }, @@ -148,7 +148,7 @@ ] } }, - "version": 10, + "version": 11, "description": "x509 object describing a X.509 certificate", "meta-category": "network", "uuid": "d1ab756a-26b5-4349-9f43-765630f0911c", From bdad48d587be1f6a0fdad25db5444190e558518b Mon Sep 17 00:00:00 2001 From: Deborah Servili Date: Fri, 8 Nov 2019 15:35:14 +0100 Subject: [PATCH 035/155] switch requiredOneOf list to required since it contains only one element --- objects/shell-commands/definition.json | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/objects/shell-commands/definition.json b/objects/shell-commands/definition.json index 8600073..895eb24 100644 --- a/objects/shell-commands/definition.json +++ b/objects/shell-commands/definition.json @@ -1,5 +1,5 @@ { - "requiredOneOf": [ + "required": [ "shell-command" ], "attributes": { @@ -54,7 +54,7 @@ ] } }, - "version": 1, + "version": 2, "description": "Object describing a series of shell commands executed. This object can be linked with malicious files in order to describe a specific execution of shell commands.", "meta-category": "misc", "uuid": "fee65efa-eb64-4516-8611-1db76c589f79", From 4b76b30061e03e3717747e9c87c45d8c3ce5d21a Mon Sep 17 00:00:00 2001 From: Alexandre Dulaunoy Date: Sat, 16 Nov 2019 21:13:10 +0100 Subject: [PATCH 036/155] chg: [microblog] verified field added to add the state of the username --- objects/microblog/definition.json | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-) diff --git a/objects/microblog/definition.json b/objects/microblog/definition.json index cf261f9..858774c 100644 --- a/objects/microblog/definition.json +++ b/objects/microblog/definition.json @@ -50,6 +50,16 @@ "ui-priority": 0, "misp-attribute": "text" }, + "verified-username": { + "description": "Is the username account verified by the operator of the microblog platform", + "ui-priority": 0, + "misp-attribute": "text", + "values_list": [ + "Verified", + "Unverified", + "Unknown" + ] + }, "creation-date": { "description": "Initial creation of the microblog post", "ui-priority": 0, @@ -84,7 +94,7 @@ "multiple": true } }, - "version": 8, + "version": 9, "description": "Microblog post like a Twitter tweet or a post on a Facebook wall.", "meta-category": "misc", "uuid": "8ec8c911-ddbe-4f5b-895b-fbff70c42a60", From 3d7b09e9c47929a437c10b77b8525ed5fc16def6 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Rapha=C3=ABl=20Vinot?= Date: Mon, 18 Nov 2019 18:03:01 +0100 Subject: [PATCH 037/155] chg: Update crypto-material and url --- objects/crypto-material/definition.json | 8 +++++++- objects/url/definition.json | 7 ++++++- 2 files changed, 13 insertions(+), 2 deletions(-) diff --git a/objects/crypto-material/definition.json b/objects/crypto-material/definition.json index c49b16e..3c28827 100644 --- a/objects/crypto-material/definition.json +++ b/objects/crypto-material/definition.json @@ -25,6 +25,12 @@ "ui-priority": 1, "misp-attribute": "text" }, + "e": { + "description": "RSA public exponent", + "disable_correlation": false, + "ui-priority": 1, + "misp-attribute": "text" + }, "p": { "description": "Prime Parameter - P in decimal", "disable_correlation": false, @@ -147,7 +153,7 @@ ] } }, - "version": 2, + "version": 3, "description": "Cryptographic materials such as public or/and private keys.", "meta-category": "misc", "uuid": "50677f82-ec9c-4484-bb29-2519cfe56823", diff --git a/objects/url/definition.json b/objects/url/definition.json index 8248ed6..29f8f40 100644 --- a/objects/url/definition.json +++ b/objects/url/definition.json @@ -90,13 +90,18 @@ "ui-priority": 0, "misp-attribute": "datetime" }, + "ip": { + "description": "Better type when the host is an IP.", + "ui-priority": 0, + "misp-attribute": "ip-dst" + }, "host": { "description": "Full hostname", "ui-priority": 0, "misp-attribute": "hostname" } }, - "version": 7, + "version": 8, "description": "url object describes an url along with its normalized field (like extracted using faup parsing library) and its metadata.", "meta-category": "network", "uuid": "60efb77b-40b5-4c46-871b-ed1ed999fce5", From 2fe41c1c4618439473357b487f9ca228488dc632 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Rapha=C3=ABl=20Vinot?= Date: Mon, 25 Nov 2019 14:43:28 +0100 Subject: [PATCH 038/155] new: IntelQM objects --- objects/intelmq_event/definition.json | 337 +++++++++++++++++++++++++ objects/intelmq_report/definition.json | 49 ++++ 2 files changed, 386 insertions(+) create mode 100644 objects/intelmq_event/definition.json create mode 100644 objects/intelmq_report/definition.json diff --git a/objects/intelmq_event/definition.json b/objects/intelmq_event/definition.json new file mode 100644 index 0000000..845fd22 --- /dev/null +++ b/objects/intelmq_event/definition.json @@ -0,0 +1,337 @@ +{ + "attributes": { + "classification.identifier": { + "description": "The lowercase identifier defines the actual software or service (e.g. 'heartbleed' or 'ntp_version') or standardized malware name (e.g. 'zeus'). Note that you MAY overwrite this field during processing for your individual setup. This field is not standardized across IntelMQ setups/users.", + "misp-attribute": "text" + }, + "classification.taxonomy": { + "description": "We recognize the need for the CSIRT teams to apply a static (incident) taxonomy to abuse data. With this goal in mind the type IOC will serve as a basis for this activity. Each value of the dynamic type mapping translates to a an element in the static taxonomy. The European CSIRT teams for example have decided to apply the eCSIRT.net incident classification. The value of the taxonomy key is thus a derivative of the dynamic type above. For more information about check [ENISA taxonomies](http://www.enisa.europa.eu/activities/cert/support/incident-management/browsable/incident-handling-process/incident-taxonomy/existing-taxonomies).", + "misp-attribute": "text" + }, + "classification.type": { + "description": "The abuse type IOC is one of the most crucial pieces of information for any given abuse event. The main idea of dynamic typing is to keep our ontology flexible, since we need to evolve with the evolving threatscape of abuse data. In contrast with the static taxonomy below, the dynamic typing is used to perform business decisions in the abuse handling pipeline. Furthermore, the value data set should be kept as minimal as possible to avoid \u201ctype explosion\u201d, which in turn dilutes the business value of the dynamic typing. In general, we normally have two types of abuse type IOC: ones referring to a compromised resource or ones referring to pieces of the criminal infrastructure, such as a command and control servers for example.", + "misp-attribute": "text" + }, + "comment": { + "description": "Free text commentary about the abuse event inserted by an analyst.", + "misp-attribute": "text" + }, + "destination.abuse_contact": { + "description": "Abuse contact for destination address. A comma separated list.", + "misp-attribute": "text" + }, + "destination.account": { + "description": "An account name or email address, which has been identified to relate to the destination of an abuse event.", + "misp-attribute": "text" + }, + "destination.allocated": { + "description": "Allocation date corresponding to BGP prefix.", + "misp-attribute": "datetime" + }, + "destination.as_name": { + "description": "The autonomous system name to which the connection headed.", + "misp-attribute": "text" + }, + "destination.asn": { + "description": "The autonomous system number to which the connection headed.", + "misp-attribute": "asn" + }, + "destination.domain_suffix": { + "description": "The suffix of the domain from the public suffix list.", + "misp-attribute": "text" + }, + "destination.fqdn": { + "description": "A DNS name related to the host from which the connection originated. DNS allows even binary data in DNS, so we have to allow everything. A final point is stripped, string is converted to lower case characters.", + "misp-attribute": "text" + }, + "destination.geolocation.cc": { + "description": "Country-Code according to ISO3166-1 alpha-2 for the destination IP.", + "misp-attribute": "text" + }, + "destination.geolocation.city": { + "description": "Some geolocation services refer to city-level geolocation.", + "misp-attribute": "text" + }, + "destination.geolocation.country": { + "description": "The country name derived from the ISO3166 country code (assigned to cc field).", + "misp-attribute": "text" + }, + "destination.geolocation.latitude": { + "description": "Latitude coordinates derived from a geolocation service, such as MaxMind geoip db.", + "misp-attribute": "float" + }, + "destination.geolocation.longitude": { + "description": "Longitude coordinates derived from a geolocation service, such as MaxMind geoip db.", + "misp-attribute": "float" + }, + "destination.geolocation.region": { + "description": "Some geolocation services refer to region-level geolocation.", + "misp-attribute": "text" + }, + "destination.geolocation.state": { + "description": "Some geolocation services refer to state-level geolocation.", + "misp-attribute": "text" + }, + "destination.ip": { + "description": "The IP which is the target of the observed connections.", + "misp-attribute": "ip-dst" + }, + "destination.local_hostname": { + "description": "Some sources report a internal hostname within a NAT related to the name configured for a compromized system", + "misp-attribute": "text" + }, + "destination.local_ip": { + "description": "Some sources report a internal (NATed) IP address related a compromized system. N.B. RFC1918 IPs are OK here.", + "misp-attribute": "ip-dst" + }, + "destination.network": { + "description": "CIDR for an autonomous system. Also known as BGP prefix. If multiple values are possible, select the most specific.", + "misp-attribute": "ip-dst" + }, + "destination.port": { + "description": "The port to which the connection headed.", + "misp-attribute": "counter" + }, + "destination.registry": { + "description": "The IP registry a given ip address is allocated by.", + "misp-attribute": "text" + }, + "destination.reverse_dns": { + "description": "Reverse DNS name acquired through a reverse DNS query on an IP address. N.B. Record types other than PTR records may also appear in the reverse DNS tree. Furthermore, unfortunately, there is no rule prohibiting people from writing anything in a PTR record. Even JavaScript will work. A final point is stripped, string is converted to lower case characters.", + "misp-attribute": "text" + }, + "destination.tor_node": { + "description": "If the destination IP was a known tor node.", + "misp-attribute": "boolean" + }, + "destination.url": { + "description": "A URL denotes on IOC, which refers to a malicious resource, whose interpretation is defined by the abuse type. A URL with the abuse type phishing refers to a phishing resource.", + "misp-attribute": "url" + }, + "destination.urlpath": { + "description": "The path portion of an HTTP or related network request.", + "misp-attribute": "text" + }, + "event_description.target": { + "description": "Some sources denominate the target (organization) of a an attack.", + "misp-attribute": "text" + }, + "event_description.text": { + "description": "A free-form textual description of an abuse event.", + "misp-attribute": "text" + }, + "event_description.url": { + "description": "A description URL is a link to a further description of the the abuse event in question.", + "misp-attribute": "url" + }, + "event_hash": { + "description": "Computed event hash with specific keys and values that identify a unique event. At present, the hash should default to using the SHA1 function. Please note that for an event hash to be able to match more than one event (deduplication) the receiver of an event should calculate it based on a minimal set of keys and values present in the event. Using for example the observation time in the calculation will most likely render the checksum useless for deduplication purposes.", + "misp-attribute": "text" + }, + "extra": { + "description": "All anecdotal information, which cannot be parsed into the data harmonization elements. E.g. os.name, os.version, etc. **Note**: this is only intended for mapping any fields which can not map naturally into the data harmonization. It is not intended for extending the data harmonization with your own fields.", + "misp-attribute": "text" + }, + "feed.accuracy": { + "description": "A float between 0 and 100 that represents how accurate the data in the feed is", + "misp-attribute": "float" + }, + "feed.code": { + "description": "Code name for the feed, e.g. DFGS, HSDAG etc.", + "misp-attribute": "text" + }, + "feed.documentation": { + "description": "A URL or hint where to find the documentation of this feed.", + "misp-attribute": "text" + }, + "feed.name": { + "description": "Name for the feed, usually found in collector bot configuration.", + "misp-attribute": "text" + }, + "feed.provider": { + "description": "Name for the provider of the feed, usually found in collector bot configuration.", + "misp-attribute": "text" + }, + "feed.url": { + "description": "The URL of a given abuse feed, where applicable", + "misp-attribute": "url" + }, + "malware.hash.md5": { + "description": "A string depicting an MD5 checksum for a file, be it a malware sample for example.", + "misp-attribute": "text" + }, + "malware.hash.sha1": { + "description": "A string depicting a SHA1 checksum for a file, be it a malware sample for example.", + "misp-attribute": "text" + }, + "malware.hash.sha256": { + "description": "A string depicting a SHA256 checksum for a file, be it a malware sample for example.", + "misp-attribute": "text" + }, + "malware.name": { + "description": "The malware name in lower case.", + "misp-attribute": "text" + }, + "malware.version": { + "description": "A version string for an identified artifact generation, e.g. a crime-ware kit.", + "misp-attribute": "text" + }, + "misp.attribute_uuid": { + "description": "MISP - Malware Information Sharing Platform & Threat Sharing UUID of an attribute.", + "misp-attribute": "text" + }, + "misp.event_uuid": { + "description": "MISP - Malware Information Sharing Platform & Threat Sharing UUID.", + "misp-attribute": "text" + }, + "output": { + "description": "Event data converted into foreign format, intended to be exported by output plugin.", + "misp-attribute": "text" + }, + "protocol.application": { + "description": "e.g. vnc, ssh, sip, irc, http or smtp.", + "misp-attribute": "text" + }, + "protocol.transport": { + "description": "e.g. tcp, udp, icmp.", + "misp-attribute": "text" + }, + "raw": { + "description": "The original line of the event from encoded in base64.", + "misp-attribute": "text" + }, + "rtir_id": { + "description": "Request Tracker Incident Response ticket id.", + "misp-attribute": "counter" + }, + "screenshot_url": { + "description": "Some source may report URLs related to a an image generated of a resource without any metadata. Or an URL pointing to resource, which has been rendered into a webshot, e.g. a PNG image and the relevant metadata related to its retrieval/generation.", + "misp-attribute": "url" + }, + "source.abuse_contact": { + "description": "Abuse contact for source address. A comma separated list.", + "misp-attribute": "text" + }, + "source.account": { + "description": "An account name or email address, which has been identified to relate to the source of an abuse event.", + "misp-attribute": "text" + }, + "source.allocated": { + "description": "Allocation date corresponding to BGP prefix.", + "misp-attribute": "datetime" + }, + "source.as_name": { + "description": "The autonomous system name from which the connection originated.", + "misp-attribute": "text" + }, + "source.asn": { + "description": "The autonomous system number from which originated the connection.", + "misp-attribute": "asn" + }, + "source.domain_suffix": { + "description": "The suffix of the domain from the public suffix list.", + "misp-attribute": "text" + }, + "source.fqdn": { + "description": "A DNS name related to the host from which the connection originated. DNS allows even binary data in DNS, so we have to allow everything. A final point is stripped, string is converted to lower case characters.", + "misp-attribute": "text" + }, + "source.geolocation.cc": { + "description": "Country-Code according to ISO3166-1 alpha-2 for the source IP.", + "misp-attribute": "text" + }, + "source.geolocation.city": { + "description": "Some geolocation services refer to city-level geolocation.", + "misp-attribute": "text" + }, + "source.geolocation.country": { + "description": "The country name derived from the ISO3166 country code (assigned to cc field).", + "misp-attribute": "text" + }, + "source.geolocation.cymru_cc": { + "description": "The country code denoted for the ip by the Team Cymru asn to ip mapping service.", + "misp-attribute": "text" + }, + "source.geolocation.geoip_cc": { + "description": "MaxMind Country Code (ISO3166-1 alpha-2).", + "misp-attribute": "text" + }, + "source.geolocation.latitude": { + "description": "Latitude coordinates derived from a geolocation service, such as MaxMind geoip db.", + "misp-attribute": "float" + }, + "source.geolocation.longitude": { + "description": "Longitude coordinates derived from a geolocation service, such as MaxMind geoip db.", + "misp-attribute": "float" + }, + "source.geolocation.region": { + "description": "Some geolocation services refer to region-level geolocation.", + "misp-attribute": "text" + }, + "source.geolocation.state": { + "description": "Some geolocation services refer to state-level geolocation.", + "misp-attribute": "text" + }, + "source.ip": { + "description": "The ip observed to initiate the connection", + "misp-attribute": "ip-src" + }, + "source.local_hostname": { + "description": "Some sources report a internal hostname within a NAT related to the name configured for a compromised system", + "misp-attribute": "text" + }, + "source.local_ip": { + "description": "Some sources report a internal (NATed) IP address related a compromised system. N.B. RFC1918 IPs are OK here.", + "misp-attribute": "ip-src" + }, + "source.network": { + "description": "CIDR for an autonomous system. Also known as BGP prefix. If multiple values are possible, select the most specific.", + "misp-attribute": "ip-src" + }, + "source.port": { + "description": "The port from which the connection originated.", + "misp-attribute": "counter" + }, + "source.registry": { + "description": "The IP registry a given ip address is allocated by.", + "misp-attribute": "text" + }, + "source.reverse_dns": { + "description": "Reverse DNS name acquired through a reverse DNS query on an IP address. N.B. Record types other than PTR records may also appear in the reverse DNS tree. Furthermore, unfortunately, there is no rule prohibiting people from writing anything in a PTR record. Even JavaScript will work. A final point is stripped, string is converted to lower case characters.", + "misp-attribute": "text" + }, + "source.tor_node": { + "description": "If the source IP was a known tor node.", + "misp-attribute": "boolean" + }, + "source.url": { + "description": "A URL denotes an IOC, which refers to a malicious resource, whose interpretation is defined by the abuse type. A URL with the abuse type phishing refers to a phishing resource.", + "misp-attribute": "url" + }, + "source.urlpath": { + "description": "The path portion of an HTTP or related network request.", + "misp-attribute": "text" + }, + "status": { + "description": "Status of the malicious resource (phishing, dropzone, etc), e.g. online, offline.", + "misp-attribute": "text" + }, + "time.observation": { + "description": "The time the collector of the local instance processed (observed) the event.", + "misp-attribute": "datetime" + }, + "time.source": { + "description": "The time of occurence of the event as reported the feed (source).", + "misp-attribute": "datetime" + }, + "tlp": { + "description": "Traffic Light Protocol level of the event.", + "misp-attribute": "text" + } + }, + "description": "IntelMQ Event", + "meta-category": "network", + "name": "intelmq_event", + "uuid": "491ac7d2-25a1-4078-8246-b04a132d003d", + "version": 1 +} \ No newline at end of file diff --git a/objects/intelmq_report/definition.json b/objects/intelmq_report/definition.json new file mode 100644 index 0000000..35e889e --- /dev/null +++ b/objects/intelmq_report/definition.json @@ -0,0 +1,49 @@ +{ + "attributes": { + "extra": { + "description": "All anecdotal information of the report, which cannot be parsed into the data harmonization elements. E.g. subject of mails, etc. This is data is not automatically propagated to the events.", + "misp-attribute": "text" + }, + "feed.accuracy": { + "description": "A float between 0 and 100 that represents how accurate the data in the feed is", + "misp-attribute": "float" + }, + "feed.code": { + "description": "Code name for the feed, e.g. DFGS, HSDAG etc.", + "misp-attribute": "text" + }, + "feed.documentation": { + "description": "A URL or hint where to find the documentation of this feed.", + "misp-attribute": "text" + }, + "feed.name": { + "description": "Name for the feed, usually found in collector bot configuration.", + "misp-attribute": "text" + }, + "feed.provider": { + "description": "Name for the provider of the feed, usually found in collector bot configuration.", + "misp-attribute": "text" + }, + "feed.url": { + "description": "The URL of a given abuse feed, where applicable", + "misp-attribute": "url" + }, + "raw": { + "description": "The original raw and unparsed data encoded in base64.", + "misp-attribute": "text" + }, + "rtir_id": { + "description": "Request Tracker Incident Response ticket id.", + "misp-attribute": "counter" + }, + "time.observation": { + "description": "The time the collector of the local instance processed (observed) the event.", + "misp-attribute": "datetime" + } + }, + "description": "IntelMQ Report", + "meta-category": "network", + "name": "intelmq_report", + "uuid": "c3d34be1-904b-455b-bceb-509418392110", + "version": 1 +} \ No newline at end of file From 185fae4a6101f37053c29b6278ad71315ce68cba Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Rapha=C3=ABl=20Vinot?= Date: Mon, 25 Nov 2019 14:48:51 +0100 Subject: [PATCH 039/155] fix: Make jq happy --- objects/intelmq_event/definition.json | 4 ++-- objects/intelmq_report/definition.json | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/objects/intelmq_event/definition.json b/objects/intelmq_event/definition.json index 845fd22..e6df291 100644 --- a/objects/intelmq_event/definition.json +++ b/objects/intelmq_event/definition.json @@ -9,7 +9,7 @@ "misp-attribute": "text" }, "classification.type": { - "description": "The abuse type IOC is one of the most crucial pieces of information for any given abuse event. The main idea of dynamic typing is to keep our ontology flexible, since we need to evolve with the evolving threatscape of abuse data. In contrast with the static taxonomy below, the dynamic typing is used to perform business decisions in the abuse handling pipeline. Furthermore, the value data set should be kept as minimal as possible to avoid \u201ctype explosion\u201d, which in turn dilutes the business value of the dynamic typing. In general, we normally have two types of abuse type IOC: ones referring to a compromised resource or ones referring to pieces of the criminal infrastructure, such as a command and control servers for example.", + "description": "The abuse type IOC is one of the most crucial pieces of information for any given abuse event. The main idea of dynamic typing is to keep our ontology flexible, since we need to evolve with the evolving threatscape of abuse data. In contrast with the static taxonomy below, the dynamic typing is used to perform business decisions in the abuse handling pipeline. Furthermore, the value data set should be kept as minimal as possible to avoid “type explosion”, which in turn dilutes the business value of the dynamic typing. In general, we normally have two types of abuse type IOC: ones referring to a compromised resource or ones referring to pieces of the criminal infrastructure, such as a command and control servers for example.", "misp-attribute": "text" }, "comment": { @@ -334,4 +334,4 @@ "name": "intelmq_event", "uuid": "491ac7d2-25a1-4078-8246-b04a132d003d", "version": 1 -} \ No newline at end of file +} diff --git a/objects/intelmq_report/definition.json b/objects/intelmq_report/definition.json index 35e889e..b6f563e 100644 --- a/objects/intelmq_report/definition.json +++ b/objects/intelmq_report/definition.json @@ -46,4 +46,4 @@ "name": "intelmq_report", "uuid": "c3d34be1-904b-455b-bceb-509418392110", "version": 1 -} \ No newline at end of file +} From 2ce87945284377c70df65c8521eedff0749cf22e Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Rapha=C3=ABl=20Vinot?= Date: Mon, 25 Nov 2019 16:21:19 +0100 Subject: [PATCH 040/155] fix: ui-priority is required in the object template --- objects/intelmq_event/definition.json | 248 ++++++++++++++++--------- objects/intelmq_report/definition.json | 32 ++-- 2 files changed, 186 insertions(+), 94 deletions(-) diff --git a/objects/intelmq_event/definition.json b/objects/intelmq_event/definition.json index e6df291..a8af1a8 100644 --- a/objects/intelmq_event/definition.json +++ b/objects/intelmq_event/definition.json @@ -2,336 +2,418 @@ "attributes": { "classification.identifier": { "description": "The lowercase identifier defines the actual software or service (e.g. 'heartbleed' or 'ntp_version') or standardized malware name (e.g. 'zeus'). Note that you MAY overwrite this field during processing for your individual setup. This field is not standardized across IntelMQ setups/users.", - "misp-attribute": "text" + "misp-attribute": "text", + "ui-priority": 1 }, "classification.taxonomy": { "description": "We recognize the need for the CSIRT teams to apply a static (incident) taxonomy to abuse data. With this goal in mind the type IOC will serve as a basis for this activity. Each value of the dynamic type mapping translates to a an element in the static taxonomy. The European CSIRT teams for example have decided to apply the eCSIRT.net incident classification. The value of the taxonomy key is thus a derivative of the dynamic type above. For more information about check [ENISA taxonomies](http://www.enisa.europa.eu/activities/cert/support/incident-management/browsable/incident-handling-process/incident-taxonomy/existing-taxonomies).", - "misp-attribute": "text" + "misp-attribute": "text", + "ui-priority": 1 }, "classification.type": { "description": "The abuse type IOC is one of the most crucial pieces of information for any given abuse event. The main idea of dynamic typing is to keep our ontology flexible, since we need to evolve with the evolving threatscape of abuse data. In contrast with the static taxonomy below, the dynamic typing is used to perform business decisions in the abuse handling pipeline. Furthermore, the value data set should be kept as minimal as possible to avoid “type explosion”, which in turn dilutes the business value of the dynamic typing. In general, we normally have two types of abuse type IOC: ones referring to a compromised resource or ones referring to pieces of the criminal infrastructure, such as a command and control servers for example.", - "misp-attribute": "text" + "misp-attribute": "text", + "ui-priority": 1 }, "comment": { "description": "Free text commentary about the abuse event inserted by an analyst.", - "misp-attribute": "text" + "misp-attribute": "text", + "ui-priority": 1 }, "destination.abuse_contact": { "description": "Abuse contact for destination address. A comma separated list.", - "misp-attribute": "text" + "misp-attribute": "text", + "ui-priority": 1 }, "destination.account": { "description": "An account name or email address, which has been identified to relate to the destination of an abuse event.", - "misp-attribute": "text" + "misp-attribute": "text", + "ui-priority": 1 }, "destination.allocated": { "description": "Allocation date corresponding to BGP prefix.", - "misp-attribute": "datetime" + "misp-attribute": "datetime", + "ui-priority": 1 }, "destination.as_name": { "description": "The autonomous system name to which the connection headed.", - "misp-attribute": "text" + "misp-attribute": "text", + "ui-priority": 1 }, "destination.asn": { "description": "The autonomous system number to which the connection headed.", - "misp-attribute": "asn" + "misp-attribute": "asn", + "ui-priority": 1 }, "destination.domain_suffix": { "description": "The suffix of the domain from the public suffix list.", - "misp-attribute": "text" + "misp-attribute": "text", + "ui-priority": 1 }, "destination.fqdn": { "description": "A DNS name related to the host from which the connection originated. DNS allows even binary data in DNS, so we have to allow everything. A final point is stripped, string is converted to lower case characters.", - "misp-attribute": "text" + "misp-attribute": "text", + "ui-priority": 1 }, "destination.geolocation.cc": { "description": "Country-Code according to ISO3166-1 alpha-2 for the destination IP.", - "misp-attribute": "text" + "misp-attribute": "text", + "ui-priority": 1 }, "destination.geolocation.city": { "description": "Some geolocation services refer to city-level geolocation.", - "misp-attribute": "text" + "misp-attribute": "text", + "ui-priority": 1 }, "destination.geolocation.country": { "description": "The country name derived from the ISO3166 country code (assigned to cc field).", - "misp-attribute": "text" + "misp-attribute": "text", + "ui-priority": 1 }, "destination.geolocation.latitude": { "description": "Latitude coordinates derived from a geolocation service, such as MaxMind geoip db.", - "misp-attribute": "float" + "misp-attribute": "float", + "ui-priority": 1 }, "destination.geolocation.longitude": { "description": "Longitude coordinates derived from a geolocation service, such as MaxMind geoip db.", - "misp-attribute": "float" + "misp-attribute": "float", + "ui-priority": 1 }, "destination.geolocation.region": { "description": "Some geolocation services refer to region-level geolocation.", - "misp-attribute": "text" + "misp-attribute": "text", + "ui-priority": 1 }, "destination.geolocation.state": { "description": "Some geolocation services refer to state-level geolocation.", - "misp-attribute": "text" + "misp-attribute": "text", + "ui-priority": 1 }, "destination.ip": { "description": "The IP which is the target of the observed connections.", - "misp-attribute": "ip-dst" + "misp-attribute": "ip-dst", + "ui-priority": 1 }, "destination.local_hostname": { "description": "Some sources report a internal hostname within a NAT related to the name configured for a compromized system", - "misp-attribute": "text" + "misp-attribute": "text", + "ui-priority": 1 }, "destination.local_ip": { "description": "Some sources report a internal (NATed) IP address related a compromized system. N.B. RFC1918 IPs are OK here.", - "misp-attribute": "ip-dst" + "misp-attribute": "ip-dst", + "ui-priority": 1 }, "destination.network": { "description": "CIDR for an autonomous system. Also known as BGP prefix. If multiple values are possible, select the most specific.", - "misp-attribute": "ip-dst" + "misp-attribute": "ip-dst", + "ui-priority": 1 }, "destination.port": { "description": "The port to which the connection headed.", - "misp-attribute": "counter" + "misp-attribute": "counter", + "ui-priority": 1 }, "destination.registry": { "description": "The IP registry a given ip address is allocated by.", - "misp-attribute": "text" + "misp-attribute": "text", + "ui-priority": 1 }, "destination.reverse_dns": { "description": "Reverse DNS name acquired through a reverse DNS query on an IP address. N.B. Record types other than PTR records may also appear in the reverse DNS tree. Furthermore, unfortunately, there is no rule prohibiting people from writing anything in a PTR record. Even JavaScript will work. A final point is stripped, string is converted to lower case characters.", - "misp-attribute": "text" + "misp-attribute": "text", + "ui-priority": 1 }, "destination.tor_node": { "description": "If the destination IP was a known tor node.", - "misp-attribute": "boolean" + "misp-attribute": "boolean", + "ui-priority": 1 }, "destination.url": { "description": "A URL denotes on IOC, which refers to a malicious resource, whose interpretation is defined by the abuse type. A URL with the abuse type phishing refers to a phishing resource.", - "misp-attribute": "url" + "misp-attribute": "url", + "ui-priority": 1 }, "destination.urlpath": { "description": "The path portion of an HTTP or related network request.", - "misp-attribute": "text" + "misp-attribute": "text", + "ui-priority": 1 }, "event_description.target": { "description": "Some sources denominate the target (organization) of a an attack.", - "misp-attribute": "text" + "misp-attribute": "text", + "ui-priority": 1 }, "event_description.text": { "description": "A free-form textual description of an abuse event.", - "misp-attribute": "text" + "misp-attribute": "text", + "ui-priority": 1 }, "event_description.url": { "description": "A description URL is a link to a further description of the the abuse event in question.", - "misp-attribute": "url" + "misp-attribute": "url", + "ui-priority": 1 }, "event_hash": { "description": "Computed event hash with specific keys and values that identify a unique event. At present, the hash should default to using the SHA1 function. Please note that for an event hash to be able to match more than one event (deduplication) the receiver of an event should calculate it based on a minimal set of keys and values present in the event. Using for example the observation time in the calculation will most likely render the checksum useless for deduplication purposes.", - "misp-attribute": "text" + "misp-attribute": "text", + "ui-priority": 1 }, "extra": { "description": "All anecdotal information, which cannot be parsed into the data harmonization elements. E.g. os.name, os.version, etc. **Note**: this is only intended for mapping any fields which can not map naturally into the data harmonization. It is not intended for extending the data harmonization with your own fields.", - "misp-attribute": "text" + "misp-attribute": "text", + "ui-priority": 1 }, "feed.accuracy": { "description": "A float between 0 and 100 that represents how accurate the data in the feed is", - "misp-attribute": "float" + "misp-attribute": "float", + "ui-priority": 1 }, "feed.code": { "description": "Code name for the feed, e.g. DFGS, HSDAG etc.", - "misp-attribute": "text" + "misp-attribute": "text", + "ui-priority": 1 }, "feed.documentation": { "description": "A URL or hint where to find the documentation of this feed.", - "misp-attribute": "text" + "misp-attribute": "text", + "ui-priority": 1 }, "feed.name": { "description": "Name for the feed, usually found in collector bot configuration.", - "misp-attribute": "text" + "misp-attribute": "text", + "ui-priority": 1 }, "feed.provider": { "description": "Name for the provider of the feed, usually found in collector bot configuration.", - "misp-attribute": "text" + "misp-attribute": "text", + "ui-priority": 1 }, "feed.url": { "description": "The URL of a given abuse feed, where applicable", - "misp-attribute": "url" + "misp-attribute": "url", + "ui-priority": 1 }, "malware.hash.md5": { "description": "A string depicting an MD5 checksum for a file, be it a malware sample for example.", - "misp-attribute": "text" + "misp-attribute": "text", + "ui-priority": 1 }, "malware.hash.sha1": { "description": "A string depicting a SHA1 checksum for a file, be it a malware sample for example.", - "misp-attribute": "text" + "misp-attribute": "text", + "ui-priority": 1 }, "malware.hash.sha256": { "description": "A string depicting a SHA256 checksum for a file, be it a malware sample for example.", - "misp-attribute": "text" + "misp-attribute": "text", + "ui-priority": 1 }, "malware.name": { "description": "The malware name in lower case.", - "misp-attribute": "text" + "misp-attribute": "text", + "ui-priority": 1 }, "malware.version": { "description": "A version string for an identified artifact generation, e.g. a crime-ware kit.", - "misp-attribute": "text" + "misp-attribute": "text", + "ui-priority": 1 }, "misp.attribute_uuid": { "description": "MISP - Malware Information Sharing Platform & Threat Sharing UUID of an attribute.", - "misp-attribute": "text" + "misp-attribute": "text", + "ui-priority": 1 }, "misp.event_uuid": { "description": "MISP - Malware Information Sharing Platform & Threat Sharing UUID.", - "misp-attribute": "text" + "misp-attribute": "text", + "ui-priority": 1 }, "output": { "description": "Event data converted into foreign format, intended to be exported by output plugin.", - "misp-attribute": "text" + "misp-attribute": "text", + "ui-priority": 1 }, "protocol.application": { "description": "e.g. vnc, ssh, sip, irc, http or smtp.", - "misp-attribute": "text" + "misp-attribute": "text", + "ui-priority": 1 }, "protocol.transport": { "description": "e.g. tcp, udp, icmp.", - "misp-attribute": "text" + "misp-attribute": "text", + "ui-priority": 1 }, "raw": { "description": "The original line of the event from encoded in base64.", - "misp-attribute": "text" + "misp-attribute": "text", + "ui-priority": 1 }, "rtir_id": { "description": "Request Tracker Incident Response ticket id.", - "misp-attribute": "counter" + "misp-attribute": "counter", + "ui-priority": 1 }, "screenshot_url": { "description": "Some source may report URLs related to a an image generated of a resource without any metadata. Or an URL pointing to resource, which has been rendered into a webshot, e.g. a PNG image and the relevant metadata related to its retrieval/generation.", - "misp-attribute": "url" + "misp-attribute": "url", + "ui-priority": 1 }, "source.abuse_contact": { "description": "Abuse contact for source address. A comma separated list.", - "misp-attribute": "text" + "misp-attribute": "text", + "ui-priority": 1 }, "source.account": { "description": "An account name or email address, which has been identified to relate to the source of an abuse event.", - "misp-attribute": "text" + "misp-attribute": "text", + "ui-priority": 1 }, "source.allocated": { "description": "Allocation date corresponding to BGP prefix.", - "misp-attribute": "datetime" + "misp-attribute": "datetime", + "ui-priority": 1 }, "source.as_name": { "description": "The autonomous system name from which the connection originated.", - "misp-attribute": "text" + "misp-attribute": "text", + "ui-priority": 1 }, "source.asn": { "description": "The autonomous system number from which originated the connection.", - "misp-attribute": "asn" + "misp-attribute": "asn", + "ui-priority": 1 }, "source.domain_suffix": { "description": "The suffix of the domain from the public suffix list.", - "misp-attribute": "text" + "misp-attribute": "text", + "ui-priority": 1 }, "source.fqdn": { "description": "A DNS name related to the host from which the connection originated. DNS allows even binary data in DNS, so we have to allow everything. A final point is stripped, string is converted to lower case characters.", - "misp-attribute": "text" + "misp-attribute": "text", + "ui-priority": 1 }, "source.geolocation.cc": { "description": "Country-Code according to ISO3166-1 alpha-2 for the source IP.", - "misp-attribute": "text" + "misp-attribute": "text", + "ui-priority": 1 }, "source.geolocation.city": { "description": "Some geolocation services refer to city-level geolocation.", - "misp-attribute": "text" + "misp-attribute": "text", + "ui-priority": 1 }, "source.geolocation.country": { "description": "The country name derived from the ISO3166 country code (assigned to cc field).", - "misp-attribute": "text" + "misp-attribute": "text", + "ui-priority": 1 }, "source.geolocation.cymru_cc": { "description": "The country code denoted for the ip by the Team Cymru asn to ip mapping service.", - "misp-attribute": "text" + "misp-attribute": "text", + "ui-priority": 1 }, "source.geolocation.geoip_cc": { "description": "MaxMind Country Code (ISO3166-1 alpha-2).", - "misp-attribute": "text" + "misp-attribute": "text", + "ui-priority": 1 }, "source.geolocation.latitude": { "description": "Latitude coordinates derived from a geolocation service, such as MaxMind geoip db.", - "misp-attribute": "float" + "misp-attribute": "float", + "ui-priority": 1 }, "source.geolocation.longitude": { "description": "Longitude coordinates derived from a geolocation service, such as MaxMind geoip db.", - "misp-attribute": "float" + "misp-attribute": "float", + "ui-priority": 1 }, "source.geolocation.region": { "description": "Some geolocation services refer to region-level geolocation.", - "misp-attribute": "text" + "misp-attribute": "text", + "ui-priority": 1 }, "source.geolocation.state": { "description": "Some geolocation services refer to state-level geolocation.", - "misp-attribute": "text" + "misp-attribute": "text", + "ui-priority": 1 }, "source.ip": { "description": "The ip observed to initiate the connection", - "misp-attribute": "ip-src" + "misp-attribute": "ip-src", + "ui-priority": 1 }, "source.local_hostname": { "description": "Some sources report a internal hostname within a NAT related to the name configured for a compromised system", - "misp-attribute": "text" + "misp-attribute": "text", + "ui-priority": 1 }, "source.local_ip": { "description": "Some sources report a internal (NATed) IP address related a compromised system. N.B. RFC1918 IPs are OK here.", - "misp-attribute": "ip-src" + "misp-attribute": "ip-src", + "ui-priority": 1 }, "source.network": { "description": "CIDR for an autonomous system. Also known as BGP prefix. If multiple values are possible, select the most specific.", - "misp-attribute": "ip-src" + "misp-attribute": "ip-src", + "ui-priority": 1 }, "source.port": { "description": "The port from which the connection originated.", - "misp-attribute": "counter" + "misp-attribute": "counter", + "ui-priority": 1 }, "source.registry": { "description": "The IP registry a given ip address is allocated by.", - "misp-attribute": "text" + "misp-attribute": "text", + "ui-priority": 1 }, "source.reverse_dns": { "description": "Reverse DNS name acquired through a reverse DNS query on an IP address. N.B. Record types other than PTR records may also appear in the reverse DNS tree. Furthermore, unfortunately, there is no rule prohibiting people from writing anything in a PTR record. Even JavaScript will work. A final point is stripped, string is converted to lower case characters.", - "misp-attribute": "text" + "misp-attribute": "text", + "ui-priority": 1 }, "source.tor_node": { "description": "If the source IP was a known tor node.", - "misp-attribute": "boolean" + "misp-attribute": "boolean", + "ui-priority": 1 }, "source.url": { "description": "A URL denotes an IOC, which refers to a malicious resource, whose interpretation is defined by the abuse type. A URL with the abuse type phishing refers to a phishing resource.", - "misp-attribute": "url" + "misp-attribute": "url", + "ui-priority": 1 }, "source.urlpath": { "description": "The path portion of an HTTP or related network request.", - "misp-attribute": "text" + "misp-attribute": "text", + "ui-priority": 1 }, "status": { "description": "Status of the malicious resource (phishing, dropzone, etc), e.g. online, offline.", - "misp-attribute": "text" + "misp-attribute": "text", + "ui-priority": 1 }, "time.observation": { "description": "The time the collector of the local instance processed (observed) the event.", - "misp-attribute": "datetime" + "misp-attribute": "datetime", + "ui-priority": 1 }, "time.source": { "description": "The time of occurence of the event as reported the feed (source).", - "misp-attribute": "datetime" + "misp-attribute": "datetime", + "ui-priority": 1 }, "tlp": { "description": "Traffic Light Protocol level of the event.", - "misp-attribute": "text" + "misp-attribute": "text", + "ui-priority": 1 } }, "description": "IntelMQ Event", "meta-category": "network", "name": "intelmq_event", "uuid": "491ac7d2-25a1-4078-8246-b04a132d003d", - "version": 1 + "version": 2 } diff --git a/objects/intelmq_report/definition.json b/objects/intelmq_report/definition.json index b6f563e..32ea0d1 100644 --- a/objects/intelmq_report/definition.json +++ b/objects/intelmq_report/definition.json @@ -2,48 +2,58 @@ "attributes": { "extra": { "description": "All anecdotal information of the report, which cannot be parsed into the data harmonization elements. E.g. subject of mails, etc. This is data is not automatically propagated to the events.", - "misp-attribute": "text" + "misp-attribute": "text", + "ui-priority": 1 }, "feed.accuracy": { "description": "A float between 0 and 100 that represents how accurate the data in the feed is", - "misp-attribute": "float" + "misp-attribute": "float", + "ui-priority": 1 }, "feed.code": { "description": "Code name for the feed, e.g. DFGS, HSDAG etc.", - "misp-attribute": "text" + "misp-attribute": "text", + "ui-priority": 1 }, "feed.documentation": { "description": "A URL or hint where to find the documentation of this feed.", - "misp-attribute": "text" + "misp-attribute": "text", + "ui-priority": 1 }, "feed.name": { "description": "Name for the feed, usually found in collector bot configuration.", - "misp-attribute": "text" + "misp-attribute": "text", + "ui-priority": 1 }, "feed.provider": { "description": "Name for the provider of the feed, usually found in collector bot configuration.", - "misp-attribute": "text" + "misp-attribute": "text", + "ui-priority": 1 }, "feed.url": { "description": "The URL of a given abuse feed, where applicable", - "misp-attribute": "url" + "misp-attribute": "url", + "ui-priority": 1 }, "raw": { "description": "The original raw and unparsed data encoded in base64.", - "misp-attribute": "text" + "misp-attribute": "text", + "ui-priority": 1 }, "rtir_id": { "description": "Request Tracker Incident Response ticket id.", - "misp-attribute": "counter" + "misp-attribute": "counter", + "ui-priority": 1 }, "time.observation": { "description": "The time the collector of the local instance processed (observed) the event.", - "misp-attribute": "datetime" + "misp-attribute": "datetime", + "ui-priority": 1 } }, "description": "IntelMQ Report", "meta-category": "network", "name": "intelmq_report", "uuid": "c3d34be1-904b-455b-bceb-509418392110", - "version": 1 + "version": 2 } From 68d61d25d9fabd43acd3430e7be196863317233d Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Rapha=C3=ABl=20Vinot?= Date: Mon, 25 Nov 2019 16:23:42 +0100 Subject: [PATCH 041/155] fix: Type asn -> AS --- objects/intelmq_event/definition.json | 6 +++--- objects/intelmq_report/definition.json | 2 +- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/objects/intelmq_event/definition.json b/objects/intelmq_event/definition.json index a8af1a8..966ea2b 100644 --- a/objects/intelmq_event/definition.json +++ b/objects/intelmq_event/definition.json @@ -42,7 +42,7 @@ }, "destination.asn": { "description": "The autonomous system number to which the connection headed.", - "misp-attribute": "asn", + "misp-attribute": "AS", "ui-priority": 1 }, "destination.domain_suffix": { @@ -282,7 +282,7 @@ }, "source.asn": { "description": "The autonomous system number from which originated the connection.", - "misp-attribute": "asn", + "misp-attribute": "AS", "ui-priority": 1 }, "source.domain_suffix": { @@ -415,5 +415,5 @@ "meta-category": "network", "name": "intelmq_event", "uuid": "491ac7d2-25a1-4078-8246-b04a132d003d", - "version": 2 + "version": 3 } diff --git a/objects/intelmq_report/definition.json b/objects/intelmq_report/definition.json index 32ea0d1..2b07893 100644 --- a/objects/intelmq_report/definition.json +++ b/objects/intelmq_report/definition.json @@ -55,5 +55,5 @@ "meta-category": "network", "name": "intelmq_report", "uuid": "c3d34be1-904b-455b-bceb-509418392110", - "version": 2 + "version": 3 } From cd08dc32a02cee7a7f1e0a6fc200baff72968502 Mon Sep 17 00:00:00 2001 From: m4tze Date: Fri, 29 Nov 2019 08:56:55 +0100 Subject: [PATCH 042/155] added "type" to "requiredOneOf" --- objects/pe/definition.json | 1 + 1 file changed, 1 insertion(+) diff --git a/objects/pe/definition.json b/objects/pe/definition.json index 86f37b5..c7356d1 100644 --- a/objects/pe/definition.json +++ b/objects/pe/definition.json @@ -1,6 +1,7 @@ { "requiredOneOf": [ "text", + "type", "original-filename", "internal-filename", "entrypoint-address" From 33a75fe4f295dc8f2dee7fe5e11d279b7b212d47 Mon Sep 17 00:00:00 2001 From: m4tze Date: Fri, 29 Nov 2019 09:09:30 +0100 Subject: [PATCH 043/155] updated "version" to 4 --- objects/pe/definition.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/objects/pe/definition.json b/objects/pe/definition.json index c7356d1..1188c48 100644 --- a/objects/pe/definition.json +++ b/objects/pe/definition.json @@ -119,7 +119,7 @@ "misp-attribute": "text" } }, - "version": 3, + "version": 4, "description": "Object describing a Portable Executable", "meta-category": "file", "uuid": "cf7adecc-d4f0-4e88-9d90-f978ee151a07", From 34ac927065150611203c9d9dd89ff4c42c9527ac Mon Sep 17 00:00:00 2001 From: Alexandre Dulaunoy Date: Tue, 3 Dec 2019 07:33:33 +0100 Subject: [PATCH 044/155] new: [virustotal-graph] VirusTotal graph object added Based on the discussion with VT, virustotal-graph object has been added which will be used with the expansion modules and also to trigger the specific quick-tab in MISP to display the VT graph result in an iframe if this object is present. --- README.md | 1 + objects/virustotal-graph/definition.json | 52 ++++++++++++++++++++++++ 2 files changed, 53 insertions(+) create mode 100644 objects/virustotal-graph/definition.json diff --git a/README.md b/README.md index 9c83ff0..a6107ee 100644 --- a/README.md +++ b/README.md @@ -160,6 +160,7 @@ for a specific attribute. An optional **to_ids** boolean field to disable the ID * [objects/user-account](objects/user-account/definition.json) - Object describing a user account (UNIX, Windows, etc). * [objects/vehicle](objects/vehicle/definition.json) - Vehicle object template to describe a vehicle information and registration. * [objects/victim](objects/victim/definition.json) - a victim object to describe the organisation being targeted or abused. +* [objects/virustotal-graph](objects/virustotal-graph/definition.json) - VirusTotal graph. * [objects/virustotal-report](objects/virustotal-report/definition.json) - VirusTotal report. * [objects/vulnerability](objects/vulnerability/definition.json) - Vulnerability object to describe software or hardware vulnerability as described in a CVE. * [objects/weakness](objects/weakness/definition.json) - Weakness object as described in a CWE. diff --git a/objects/virustotal-graph/definition.json b/objects/virustotal-graph/definition.json new file mode 100644 index 0000000..22ed6a5 --- /dev/null +++ b/objects/virustotal-graph/definition.json @@ -0,0 +1,52 @@ +{ + "required": [ + "permalink" + ], + "attributes": { + "access": { + "description": "Access to the VirusTotal graph", + "disable_correlation": true, + "categories": [ + "External analysis" + ], + "ui-priority": 1, + "misp-attribute": "text", + "values_list": [ + "Private", + "Public" + ] + }, + "permalink": { + "description": "Permalink Reference to the VirusTotal graph", + "categories": [ + "External analysis" + ], + "ui-priority": 2, + "misp-attribute": "link" + }, + "comment": { + "description": "Comment related to this VirusTotal graph", + "categories": [ + "External analysis" + ], + "misp-attribute": "text", + "ui-priority": 2, + "multiple": true, + "disable_correlation": true + }, + "screenshot": { + "description": "Screenshot of the VirusTotal graph", + "misp-attribute": "attachment", + "disable_correlation": true, + "ui-priority": 1, + "categories": [ + "External analysis" + ] + } + }, + "version": 1, + "description": "VirusTotal graph", + "meta-category": "misc", + "uuid": "9b421055-b1bb-4c33-9ead-7fa3f39e2232", + "name": "virustotal-graph" +} From 330d979982a992f2e3e2758b6d838d084586fd86 Mon Sep 17 00:00:00 2001 From: Alexandre Dulaunoy Date: Tue, 3 Dec 2019 07:47:01 +0100 Subject: [PATCH 045/155] new [tools] simple tool to dump list of objects with their descriptions --- tools/list_of_objects.py | 50 ++++++++++++++++++++++++++++++++++++++++ 1 file changed, 50 insertions(+) create mode 100644 tools/list_of_objects.py diff --git a/tools/list_of_objects.py b/tools/list_of_objects.py new file mode 100644 index 0000000..47dfd07 --- /dev/null +++ b/tools/list_of_objects.py @@ -0,0 +1,50 @@ +#!/usr/bin/env python3 +# -*- coding: utf-8 -*- +# +# +# A simple converter of MISP objects to asciidoctor format +# Copyright (C) 2017-2019 Alexandre Dulaunoy +# +# This program is free software: you can redistribute it and/or modify +# it under the terms of the GNU Affero General Public License as +# published by the Free Software Foundation, either version 3 of the +# License, or (at your option) any later version. +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU Affero General Public License for more details. +# +# You should have received a copy of the GNU Affero General Public License +# along with this program. If not, see . + + +import os +import json +import argparse + +thisDir = os.path.dirname(__file__) + +objects = [] + +pathObjects = os.path.join(thisDir, '../objects') + +for f in os.listdir(pathObjects): + objectName = f + objects.append(objectName) + +objects.sort() + +argParser = argparse.ArgumentParser(description='Generate list of MISP object templates', epilog='Available objects are {0}'.format(objects)) +argParser.add_argument('-v', action='store_true', help='Verbose mode') +args = argParser.parse_args() + + +for mispobject in objects: + fullPathClusters = os.path.join(pathObjects, '{}/{}'.format(mispobject, 'definition.json')) + with open(fullPathClusters) as fp: + c = json.load(fp) + if not c['description'].endswith('.'): + c['description'] = c['description']+"." + v = "- [objects/{}](objects/{}/definition.json) - {}".format(c['name'], c['name'],c['description']) + print(v) From b69657b7b1c42709e51678d5b2bb4aea7b65d109 Mon Sep 17 00:00:00 2001 From: Jean-Louis Huynen Date: Tue, 3 Dec 2019 16:23:54 +0100 Subject: [PATCH 046/155] add: [dark-pattern] new object to share dark-patterns --- objects/dark-pattern/definition.json | 63 ++++++++++++++++++++++++++++ 1 file changed, 63 insertions(+) create mode 100644 objects/dark-pattern/definition.json diff --git a/objects/dark-pattern/definition.json b/objects/dark-pattern/definition.json new file mode 100644 index 0000000..fe3970b --- /dev/null +++ b/objects/dark-pattern/definition.json @@ -0,0 +1,63 @@ +{ + "requiredOneOf": [ + "location", + "screenshot" + ], + "attributes": { + "location": { + "description": "Location where to find the item", + "ui-priority": 0, + "disable_correlation": true, + "multiple": true, + "misp-attribute": "text" + }, + "time": { + "description": "Date and time of first-seen", + "ui-priority": 0, + "disable_correlation": true, + "misp-attribute": "datetime" + }, + "implementer": { + "description": "Who is the vendor / holder of the item", + "ui-priority": 0, + "disable_correlation": true, + "misp-attribute": "text" + }, + "user": { + "description": "who are the user of the item", + "ui-priority": 0, + "disable_correlation": true, + "misp-attribute": "text" + }, + "comment": { + "description": "textual comment about the item", + "ui-priority": 0, + "disable_correlation": true, + "misp-attribute": "text" + }, + "gain": { + "description": "What is the implementer is gaining by deceiving the user", + "ui-priority": 0, + "misp-attribute": "text", + "values_list": [ + "registration", + "personal data", + "money", + "contacts", + "audience" + ], + "disable_correlation": true + }, + "screenshot": { + "description": "A screencapture or a screengrab of the item at work", + "ui-priority": 1, + "disable_correlation": true, + "misp-attribute": "attachment" + } + }, + "version": 1, + "description": "An Iten whose User Interface implements a dark pattern.", + "meta-category": "misc", + "uuid": "05755e29-8f5f-464d-bcff-2b4686472769", + "name": "dark-pattern-item" +} From 4185e2b8e271cb111e906574b813b84ab8b1d674 Mon Sep 17 00:00:00 2001 From: Alexandre Dulaunoy Date: Wed, 4 Dec 2019 13:41:08 +0100 Subject: [PATCH 047/155] chg: [script] attachment field added --- objects/script/definition.json | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/objects/script/definition.json b/objects/script/definition.json index 972d64e..42d3201 100644 --- a/objects/script/definition.json +++ b/objects/script/definition.json @@ -1,7 +1,8 @@ { "requiredOneOf": [ "script", - "filename" + "filename", + "attachment" ], "attributes": { "script": { @@ -9,6 +10,11 @@ "ui-priority": 10, "misp-attribute": "text" }, + "script-as-attachment": { + "description": "Attachment of the script.", + "ui-priority": 10, + "misp-attribute": "attachment" + }, "comment": { "description": "Comment associated to the script.", "ui-priority": 1, @@ -57,7 +63,7 @@ ] } }, - "version": 5, + "version": 6, "description": "Object describing a computer program written to be run in a special run-time environment. The script or shell script can be used for malicious activities but also as support tools for threat analysts.", "meta-category": "misc", "uuid": "6bce7d01-dbec-4054-b3c2-3655a19382e2", From 0fd9ff6670a3b21f28d75e0d13abd8852ce8f56f Mon Sep 17 00:00:00 2001 From: Jean-Louis Huynen Date: Wed, 4 Dec 2019 16:17:45 +0100 Subject: [PATCH 048/155] chg: [dark-pattern] typos --- objects/dark-pattern/definition.json | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/objects/dark-pattern/definition.json b/objects/dark-pattern/definition.json index fe3970b..fb0c75c 100644 --- a/objects/dark-pattern/definition.json +++ b/objects/dark-pattern/definition.json @@ -12,7 +12,7 @@ "misp-attribute": "text" }, "time": { - "description": "Date and time of first-seen", + "description": "Date and time when first-seen", "ui-priority": 0, "disable_correlation": true, "misp-attribute": "datetime" @@ -55,8 +55,8 @@ "misp-attribute": "attachment" } }, - "version": 1, - "description": "An Iten whose User Interface implements a dark pattern.", + "version": 2, + "description": "An Item whose User Interface implements a dark pattern.", "meta-category": "misc", "uuid": "05755e29-8f5f-464d-bcff-2b4686472769", "name": "dark-pattern-item" From 356071b1dce2d8e8a3d613f91482b9f42866e84a Mon Sep 17 00:00:00 2001 From: Alexandre Dulaunoy Date: Thu, 5 Dec 2019 19:21:49 +0100 Subject: [PATCH 049/155] chg: [types] updated --- schema_objects.json | 1 + 1 file changed, 1 insertion(+) diff --git a/schema_objects.json b/schema_objects.json index 84dedeb..1d2146f 100644 --- a/schema_objects.json +++ b/schema_objects.json @@ -79,6 +79,7 @@ "email-subject", "email-thread-index", "email-x-mailer", + "eppn", "filename", "filename|authentihash", "filename|impfuzzy", From ab484998ffdd0a716d12ba45c9692254ea5f7d16 Mon Sep 17 00:00:00 2001 From: Alexandre Dulaunoy Date: Fri, 6 Dec 2019 14:59:12 +0100 Subject: [PATCH 050/155] chg: [microblog] add the ability to have non-malicious links Fix #215 --- objects/microblog/definition.json | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/objects/microblog/definition.json b/objects/microblog/definition.json index 858774c..35b9da2 100644 --- a/objects/microblog/definition.json +++ b/objects/microblog/definition.json @@ -76,6 +76,12 @@ "misp-attribute": "url", "multiple": true }, + "embedded-safe-link": { + "description": "Safe link into the microblog post", + "ui-priority": 0, + "misp-attribute": "link", + "multiple": true + }, "removal-date": { "description": "When the microblog post was removed", "ui-priority": 0, @@ -94,7 +100,7 @@ "multiple": true } }, - "version": 9, + "version": 10, "description": "Microblog post like a Twitter tweet or a post on a Facebook wall.", "meta-category": "misc", "uuid": "8ec8c911-ddbe-4f5b-895b-fbff70c42a60", From 3b49d83426efd4621bb91c3132adf805bb71c354 Mon Sep 17 00:00:00 2001 From: Alexandre Dulaunoy Date: Fri, 6 Dec 2019 15:05:20 +0100 Subject: [PATCH 051/155] chg: [relationships] mentions relationship has been added Fix #214 --- relationships/definition.json | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/relationships/definition.json b/relationships/definition.json index 53a4dcd..fae3795 100644 --- a/relationships/definition.json +++ b/relationships/definition.json @@ -1,5 +1,5 @@ { - "version": 16, + "version": 17, "values": [ { "name": "derived-from", @@ -204,6 +204,13 @@ "stix-2.0" ] }, + { + "name": "mentions", + "description": "This relationship describes that the source object mentions the target object.", + "format": [ + "misp" + ] + }, { "name": "mitigates", "description": "This relationship describes a source object which mitigates the target object.", From c0877cfd7cb33e270e530e0204069b36e51a9519 Mon Sep 17 00:00:00 2001 From: Deborah Servili Date: Tue, 10 Dec 2019 12:19:29 +0100 Subject: [PATCH 052/155] add imphash in file object --- objects/file/definition.json | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/objects/file/definition.json b/objects/file/definition.json index 944834c..fe2ee99 100644 --- a/objects/file/definition.json +++ b/objects/file/definition.json @@ -440,9 +440,14 @@ "Windows-31J", "windows-874" ] + }, + "imphash": { + "description": "Hash (md5) calculated from the import table", + "ui-priority": 0, + "misp-attribute": "imphash" } }, - "version": 17, + "version": 18, "description": "File object describing a file with meta-information", "meta-category": "file", "uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", From e832f5ce6428fb1ca7ed4cabfdd2a0f675c0e5eb Mon Sep 17 00:00:00 2001 From: Alexandre Dulaunoy Date: Tue, 17 Dec 2019 14:59:00 +0100 Subject: [PATCH 053/155] chg: [organization] VAT - TAX-ID added in the template --- objects/organization/definition.json | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/objects/organization/definition.json b/objects/organization/definition.json index dfb2744..67bb5a6 100644 --- a/objects/organization/definition.json +++ b/objects/organization/definition.json @@ -65,9 +65,15 @@ "Target" ], "disable_correlation": true + }, + "VAT": { + "description": "VAT or TAX-ID of the organization", + "ui-priority": 0, + "misp-attribute": "text", + "multiple": true } }, - "version": 2, + "version": 3, "description": "An object which describes an organization.", "meta-category": "misc", "uuid": "f750e12b-127a-432c-b022-b3f9153c4e2a", From 5f1e6c5fec0a1a7a1a4e5ae0a89c3fc128b1086c Mon Sep 17 00:00:00 2001 From: N1col4s5742 <46679349+N1col4s5742@users.noreply.github.com> Date: Fri, 20 Dec 2019 14:14:49 +0100 Subject: [PATCH 054/155] Add vehicle state --- objects/vehicle/definition.json | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-) diff --git a/objects/vehicle/definition.json b/objects/vehicle/definition.json index c558a46..36e55e5 100644 --- a/objects/vehicle/definition.json +++ b/objects/vehicle/definition.json @@ -9,7 +9,8 @@ "date-first-registration", "image-url", "gearbox", - "indicative-value" + "indicative-value", + "state", ], "attributes": { "description": { @@ -70,7 +71,13 @@ "ui-priority": 0, "misp-attribute": "text", "multiple": true - } + }, + "state": { + "description": "State of the vehicle", + "ui-priority": 0, + "misp-attribute": "text", + "disable_correlation": true + }, }, "version": 2, "description": "Vehicle object template to describe a vehicle information and registration", From 59027ddc6ac86d6d88d1865a70cd477a1337b342 Mon Sep 17 00:00:00 2001 From: N1col4s5742 <46679349+N1col4s5742@users.noreply.github.com> Date: Fri, 20 Dec 2019 14:18:10 +0100 Subject: [PATCH 055/155] Bump version --- objects/vehicle/definition.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/objects/vehicle/definition.json b/objects/vehicle/definition.json index 36e55e5..433d863 100644 --- a/objects/vehicle/definition.json +++ b/objects/vehicle/definition.json @@ -79,7 +79,7 @@ "disable_correlation": true }, }, - "version": 2, + "version": 3, "description": "Vehicle object template to describe a vehicle information and registration", "meta-category": "misc", "uuid": "683c076c-f695-4ff2-8efa-e98a418049f4", From c611736e35d62754d42b259f126d38822f3c83f7 Mon Sep 17 00:00:00 2001 From: N1col4s5742 <46679349+N1col4s5742@users.noreply.github.com> Date: Fri, 20 Dec 2019 14:20:08 +0100 Subject: [PATCH 056/155] Vehicle state --- objects/vehicle/definition.json | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/objects/vehicle/definition.json b/objects/vehicle/definition.json index 433d863..929fcfa 100644 --- a/objects/vehicle/definition.json +++ b/objects/vehicle/definition.json @@ -10,7 +10,7 @@ "image-url", "gearbox", "indicative-value", - "state", + "state" ], "attributes": { "description": { @@ -77,7 +77,7 @@ "ui-priority": 0, "misp-attribute": "text", "disable_correlation": true - }, + } }, "version": 3, "description": "Vehicle object template to describe a vehicle information and registration", From faf2b075991bf3bf87ae661818de7642b1b00aa1 Mon Sep 17 00:00:00 2001 From: Alexandre Dulaunoy Date: Thu, 26 Dec 2019 18:29:57 +0100 Subject: [PATCH 057/155] chg: [annotation] 'full report' type added --- objects/annotation/definition.json | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/objects/annotation/definition.json b/objects/annotation/definition.json index cfadfc1..b64ee94 100644 --- a/objects/annotation/definition.json +++ b/objects/annotation/definition.json @@ -30,7 +30,8 @@ "Other", "Copyright", "Authors", - "Logo" + "Logo", + "Full Report" ] }, "format": { @@ -69,7 +70,7 @@ "multiple": true } }, - "version": 2, + "version": 3, "description": "An annotation object allowing analysts to add annotations, comments, executive summary to a MISP event, objects or attributes.", "meta-category": "misc", "uuid": "5d8dc046-15a1-4ca3-a09f-ed4ede7c4487", From ce80fb6384d6a369d4327db045255bd35bc25dbb Mon Sep 17 00:00:00 2001 From: Alexandre Dulaunoy Date: Fri, 27 Dec 2019 11:27:53 +0100 Subject: [PATCH 058/155] chg: [microblog] disable correlation for the verified-username state --- objects/microblog/definition.json | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/objects/microblog/definition.json b/objects/microblog/definition.json index 35b9da2..52641d5 100644 --- a/objects/microblog/definition.json +++ b/objects/microblog/definition.json @@ -54,6 +54,7 @@ "description": "Is the username account verified by the operator of the microblog platform", "ui-priority": 0, "misp-attribute": "text", + "disable_correlation": true, "values_list": [ "Verified", "Unverified", @@ -100,7 +101,7 @@ "multiple": true } }, - "version": 10, + "version": 11, "description": "Microblog post like a Twitter tweet or a post on a Facebook wall.", "meta-category": "misc", "uuid": "8ec8c911-ddbe-4f5b-895b-fbff70c42a60", From 9ce275dcf0ac0ff7891a3c8f4954159bfbbf6f03 Mon Sep 17 00:00:00 2001 From: Alexandre Dulaunoy Date: Sat, 28 Dec 2019 15:31:09 +0100 Subject: [PATCH 059/155] new: [attribute type] kusto-query attribute type Kusto query is the query language for the Kusto services in Azure used to search large dataset. It's used in Windows Defender ATP Hunting-Queries and also Azure Sentinel (Cloud-native SIEM). --- schema_objects.json | 1 + 1 file changed, 1 insertion(+) diff --git a/schema_objects.json b/schema_objects.json index 1d2146f..0cfe939 100644 --- a/schema_objects.json +++ b/schema_objects.json @@ -120,6 +120,7 @@ "issue-date-of-the-visa", "ja3-fingerprint-md5", "jabber-id", + "kusto-query", "last-name", "link", "mac-address", From 1e096535ef3c4fe5eb5c42c12192e10cdce699f1 Mon Sep 17 00:00:00 2001 From: StefanKelm Date: Fri, 10 Jan 2020 15:00:19 +0100 Subject: [PATCH 060/155] Update definition.json Add compilation timestamp (similar to pe object) --- objects/file/definition.json | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/objects/file/definition.json b/objects/file/definition.json index fe2ee99..937d407 100644 --- a/objects/file/definition.json +++ b/objects/file/definition.json @@ -445,9 +445,14 @@ "description": "Hash (md5) calculated from the import table", "ui-priority": 0, "misp-attribute": "imphash" + }, + "compilation-timestamp": { + "description": "Compilation timestamp", + "ui-priority": 0, + "misp-attribute": "datetime" } }, - "version": 18, + "version": 19, "description": "File object describing a file with meta-information", "meta-category": "file", "uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", From 92ebb542c24c307705d67e41f82664057e827323 Mon Sep 17 00:00:00 2001 From: Andras Iklody Date: Thu, 16 Jan 2020 10:44:51 +0100 Subject: [PATCH 061/155] fix: [microblog] to_ids changes --- objects/microblog/definition.json | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/objects/microblog/definition.json b/objects/microblog/definition.json index 52641d5..2a63b1c 100644 --- a/objects/microblog/definition.json +++ b/objects/microblog/definition.json @@ -16,7 +16,8 @@ "link": { "description": "Original link into the microblog post (Supposed harmless)", "ui-priority": 1, - "misp-attribute": "link" + "misp-attribute": "link", + "to_ids": 0 }, "type": { "description": "Type of the microblog post", @@ -81,7 +82,8 @@ "description": "Safe link into the microblog post", "ui-priority": 0, "misp-attribute": "link", - "multiple": true + "multiple": true, + "to_ids": 0 }, "removal-date": { "description": "When the microblog post was removed", @@ -101,7 +103,7 @@ "multiple": true } }, - "version": 11, + "version": 12, "description": "Microblog post like a Twitter tweet or a post on a Facebook wall.", "meta-category": "misc", "uuid": "8ec8c911-ddbe-4f5b-895b-fbff70c42a60", From fa634803911d211f993049242d41eebaf342a9c4 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Rapha=C3=ABl=20Vinot?= Date: Thu, 16 Jan 2020 13:46:53 +0100 Subject: [PATCH 062/155] fix: to_ids must be a bool --- objects/microblog/definition.json | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/objects/microblog/definition.json b/objects/microblog/definition.json index 2a63b1c..309c11e 100644 --- a/objects/microblog/definition.json +++ b/objects/microblog/definition.json @@ -17,7 +17,7 @@ "description": "Original link into the microblog post (Supposed harmless)", "ui-priority": 1, "misp-attribute": "link", - "to_ids": 0 + "to_ids": false }, "type": { "description": "Type of the microblog post", @@ -83,7 +83,7 @@ "ui-priority": 0, "misp-attribute": "link", "multiple": true, - "to_ids": 0 + "to_ids": false }, "removal-date": { "description": "When the microblog post was removed", From 6944680dac8429574c555547527e47eb7807c162 Mon Sep 17 00:00:00 2001 From: Alexandre Dulaunoy Date: Tue, 21 Jan 2020 09:47:13 +0100 Subject: [PATCH 063/155] new: [attributes] chrome-extension-id added --- schema_objects.json | 1 + 1 file changed, 1 insertion(+) diff --git a/schema_objects.json b/schema_objects.json index 0cfe939..91d1d47 100644 --- a/schema_objects.json +++ b/schema_objects.json @@ -53,6 +53,7 @@ "campaign-name", "cc-number", "cdhash", + "chrome-extension-id", "comment", "community-id", "cookie", From 6cc3f4a51c766da8a6df30481fc5d357dc0ba9a5 Mon Sep 17 00:00:00 2001 From: Nicolas Date: Fri, 24 Jan 2020 10:25:32 +0100 Subject: [PATCH 064/155] change definition.json for vehicle --- objects/vehicle/definition.json | 40 +++++++++++++++++++++++++-------- 1 file changed, 31 insertions(+), 9 deletions(-) diff --git a/objects/vehicle/definition.json b/objects/vehicle/definition.json index 929fcfa..d4ff30c 100644 --- a/objects/vehicle/definition.json +++ b/objects/vehicle/definition.json @@ -9,8 +9,11 @@ "date-first-registration", "image-url", "gearbox", - "indicative-value", - "state" + "exterior color", + "interior color", + "type", + "state", + "indicative-value" ], "attributes": { "description": { @@ -19,6 +22,30 @@ "misp-attribute": "text", "disable_correlation": true }, + "exterior color": { + "description": "Exterior color of the vehicule", + "ui-priority": 0, + "misp-attribute": "text", + "disable_correlation": true + }, + "state": { + "description": "State of the vehicule (stolen or recovered)", + "ui-priority": 0, + "misp-attribute": "text", + "disable_correlation": true + }, + "interior color": { + "description": "Interior color of the vehicule", + "ui-priority": 0, + "misp-attribute": "text", + "disable_correlation": true + }, + "type": { + "description": "Type of the vehicule", + "ui-priority": 0, + "misp-attribute": "text", + "disable_correlation": true + }, "make": { "description": "Manufacturer of the vehicle", "ui-priority": 0, @@ -71,17 +98,12 @@ "ui-priority": 0, "misp-attribute": "text", "multiple": true - }, - "state": { - "description": "State of the vehicle", - "ui-priority": 0, - "misp-attribute": "text", - "disable_correlation": true } }, - "version": 3, + "version": 2, "description": "Vehicle object template to describe a vehicle information and registration", "meta-category": "misc", "uuid": "683c076c-f695-4ff2-8efa-e98a418049f4", "name": "vehicle" } + From 6fd7dfc896fbff9f48390e3707dfa3f520f46d0f Mon Sep 17 00:00:00 2001 From: Nicolas Date: Fri, 24 Jan 2020 10:30:22 +0100 Subject: [PATCH 065/155] change definition.json for vehicle and geolocation --- objects/geolocation/definition.json | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/objects/geolocation/definition.json b/objects/geolocation/definition.json index 1189994..f0d2a33 100644 --- a/objects/geolocation/definition.json +++ b/objects/geolocation/definition.json @@ -49,6 +49,11 @@ "misp-attribute": "text", "ui-priority": 1 }, + "neighborhood": { + "description": "Neighborhood.", + "misp-attribute": "text", + "ui-priority": 1 + }, "zipcode": { "description": "Zip Code.", "misp-attribute": "text", From e8583c5e1332f61e9620e308d24f9546f7b8bff2 Mon Sep 17 00:00:00 2001 From: Nicolas Date: Fri, 24 Jan 2020 10:40:50 +0100 Subject: [PATCH 066/155] change definition.json for vehicle and geolocation with verification sponge --- objects/vehicle/definition.json | 1 - 1 file changed, 1 deletion(-) diff --git a/objects/vehicle/definition.json b/objects/vehicle/definition.json index d4ff30c..31650be 100644 --- a/objects/vehicle/definition.json +++ b/objects/vehicle/definition.json @@ -106,4 +106,3 @@ "uuid": "683c076c-f695-4ff2-8efa-e98a418049f4", "name": "vehicle" } - From e6659c7c7ebdd8dd90af3a3e32c7ce002842f40b Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Rapha=C3=ABl=20Vinot?= Date: Fri, 24 Jan 2020 12:58:28 +0100 Subject: [PATCH 067/155] new: TruStar report object --- objects/trustar_report/definition.json | 81 ++++++++++++++++++++++++++ 1 file changed, 81 insertions(+) create mode 100644 objects/trustar_report/definition.json diff --git a/objects/trustar_report/definition.json b/objects/trustar_report/definition.json new file mode 100644 index 0000000..a8dd5bb --- /dev/null +++ b/objects/trustar_report/definition.json @@ -0,0 +1,81 @@ +{ + "attributes": { + "BITCOIN_ADDRESS": { + "description": "A bitcoin address is an identifier of 26-35 alphanumeric characters, beginning with the number 1 or 3, that represents a possible destination for a bitcoin payment.", + "misp-attribute": "btc", + "multiple": true, + "ui-priority": 1 + }, + "CIDR_BLOCK": { + "description": "CIDR (Classless Inter-Domain Routing) identifies a range of IP addresses, and was introduced as a way to allow more flexible allocation of Internet Protocol (IP) addresses than was possible with the original system of IP address classes.", + "misp-attribute": "ip-src", + "multiple": true, + "ui-priority": 1 + }, + "CVE": { + "description": "The Common Vulnerabilities and Exposures (CVE) system provides a reference-method for publicly known information-security vulnerabilities and exposures.", + "misp-attribute": "vulnerability", + "multiple": true, + "ui-priority": 1 + }, + "EMAIL_ADDRESS": { + "description": "An email address is a unique identifier for an email account.", + "misp-attribute": "email-src", + "multiple": true, + "ui-priority": 1 + }, + "IP": { + "description": "An Internet Protocol address (IP address) is a numerical label assigned to each device participating in a computer network that uses the Internet Protocol for communication.", + "misp-attribute": "ip-dst", + "multiple": true, + "ui-priority": 1 + }, + "MALWARE": { + "description": "Names of software that are intended to damage or disable computers and computer systems.", + "misp-attribute": "malware-type", + "multiple": true, + "ui-priority": 1 + }, + "MD5": { + "description": "The MD5 algorithm is a widely used hash function producing a 128-bit hash value.", + "misp-attribute": "md5", + "multiple": true, + "ui-priority": 1 + }, + "REGISTRY_KEY": { + "description": "The registry is a hierarchical database that contains data that is critical for the operation of Windows and the applications and services that run on Windows.", + "misp-attribute": "regkey", + "multiple": true, + "ui-priority": 1 + }, + "SHA1": { + "description": "SHA-1 (Secure Hash Algorithm 1) is a cryptographic hash function which takes an input and produces a 160-bit (20-byte) hash value known as a message digest - typically rendered as a hexadecimal number, 40 digits long. SHA-1 is prone to length extension attacks.", + "misp-attribute": "sha1", + "multiple": true, + "ui-priority": 1 + }, + "SHA256": { + "description": "SHA-256 is a member of the SHA-2 cryptographic hash functions designed by the NSA, which are the successors to SHA-1. It is represented as a 64-character hexadecimal string.", + "misp-attribute": "sha256", + "multiple": true, + "ui-priority": 1 + }, + "SOFTWARE": { + "description": "The name of a file on a filesystem.", + "misp-attribute": "filename", + "multiple": true, + "ui-priority": 1 + }, + "URL": { + "description": "A Uniform Resource Locator (URL) is a reference to a web resource that specifies its location on a computer network and a mechanism for retrieving it.", + "misp-attribute": "url", + "multiple": true, + "ui-priority": 1 + } + }, + "description": "TruStar Report", + "meta-category": "network", + "name": "trustar_report", + "uuid": "8ff46cf1-db04-4453-ba46-d004e1ef6b7a", + "version": 1 +} From cdc463ef1a04583df02c5c57ce3cbc67d2fa2751 Mon Sep 17 00:00:00 2001 From: Alexandre Dulaunoy Date: Fri, 24 Jan 2020 15:46:06 +0100 Subject: [PATCH 068/155] chg: [domain-ip] port added (required by AIL crawling) --- objects/domain-ip/definition.json | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-) diff --git a/objects/domain-ip/definition.json b/objects/domain-ip/definition.json index fe12939..f5fc64a 100644 --- a/objects/domain-ip/definition.json +++ b/objects/domain-ip/definition.json @@ -48,9 +48,19 @@ "ui-priority": 1, "misp-attribute": "ip-dst", "multiple": true + }, + "port": { + "description": "Associated TCP port with the domain", + "categories": [ + "Network activity", + "External analysis" + ], + "ui-priority": 1, + "misp-attribute": "port", + "multiple": true } }, - "version": 6, + "version": 8, "description": "A domain and IP address seen as a tuple in a specific time frame.", "meta-category": "network", "uuid": "43b3b146-77eb-4931-b4cc-b66c60f28734", From fb878a6901777fe1612c984427d0ea8ddf19f048 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Rapha=C3=ABl=20Vinot?= Date: Tue, 28 Jan 2020 10:47:18 +0100 Subject: [PATCH 069/155] fix: Wrong name in requiredOneOf --- objects/script/definition.json | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/objects/script/definition.json b/objects/script/definition.json index 42d3201..0b35fa8 100644 --- a/objects/script/definition.json +++ b/objects/script/definition.json @@ -2,7 +2,7 @@ "requiredOneOf": [ "script", "filename", - "attachment" + "script-as-attachment" ], "attributes": { "script": { @@ -63,7 +63,7 @@ ] } }, - "version": 6, + "version": 7, "description": "Object describing a computer program written to be run in a special run-time environment. The script or shell script can be used for malicious activities but also as support tools for threat analysts.", "meta-category": "misc", "uuid": "6bce7d01-dbec-4054-b3c2-3655a19382e2", From 84909f1ff26e303c7a28bfe14c0e5b27ddf7fa34 Mon Sep 17 00:00:00 2001 From: VVX7 Date: Tue, 28 Jan 2020 21:24:04 -0500 Subject: [PATCH 070/155] new: [objects] blog, forged-document, leaked-document, meme-image --- objects/blog/definition.json | 91 ++++++++++++++++++++ objects/forged-document/definition.json | 100 ++++++++++++++++++++++ objects/leaked-document/definition.json | 106 ++++++++++++++++++++++++ objects/meme-image/definition.json | 100 ++++++++++++++++++++++ 4 files changed, 397 insertions(+) create mode 100644 objects/blog/definition.json create mode 100644 objects/forged-document/definition.json create mode 100644 objects/leaked-document/definition.json create mode 100644 objects/meme-image/definition.json diff --git a/objects/blog/definition.json b/objects/blog/definition.json new file mode 100644 index 0000000..474274b --- /dev/null +++ b/objects/blog/definition.json @@ -0,0 +1,91 @@ +{ + "requiredOneOf": [ + "post" + ], + "attributes": { + "post": { + "description": "Raw post.", + "ui-priority": 1, + "misp-attribute": "text" + }, + "url": { + "description": "Original URL location of the blog post (potentially malicious).", + "ui-priority": 1, + "misp-attribute": "url" + }, + "link": { + "description": "Original link into the blog post (Supposed harmless).", + "ui-priority": 1, + "misp-attribute": "link" + }, + "type": { + "description": "Type of blog post.", + "ui-priority": 1, + "misp-attribute": "text", + "disable_correlation": true, + "sane_default": [ + "Medium", + "WordPress", + "Blogger", + "Tumbler", + "LiveJournal", + "Forum", + "Other" + ] + }, + "username": { + "description": "Username who posted the blog post.", + "ui-priority": 0, + "misp-attribute": "text" + }, + "verified-username": { + "description": "Is the username account verified by the operator of the blog platform.", + "ui-priority": 0, + "misp-attribute": "text", + "disable_correlation": true, + "values_list": [ + "Verified", + "Unverified", + "Unknown" + ] + }, + "creation-date": { + "description": "Initial creation of the blog post.", + "ui-priority": 0, + "misp-attribute": "datetime" + }, + "modification-date": { + "description": "Last update of the blog post.", + "ui-priority": 0, + "misp-attribute": "datetime" + }, + "embedded-link": { + "description": "Site linked by the blog post.", + "ui-priority": 0, + "misp-attribute": "url", + "multiple": true + }, + "embedded-safe-link": { + "description": "Safe site linked by the blog post.", + "ui-priority": 0, + "misp-attribute": "link", + "multiple": true + }, + "removal-date": { + "description": "When the blog post was removed.", + "ui-priority": 0, + "misp-attribute": "datetime" + }, + "username-quoted": { + "description": "Username who are quoted into the blog post.", + "ui-priority": 0, + "multiple": true, + "misp-attribute": "text" + } + }, + "version": 11, + "description": "Blog post like Medium or WordPress.", + "meta-category": "misc", + "uuid": "1f165fc0-b158-498f-8bc8-6dc3d2822bb1", + "name": "blog" +} diff --git a/objects/forged-document/definition.json b/objects/forged-document/definition.json new file mode 100644 index 0000000..5ed512e --- /dev/null +++ b/objects/forged-document/definition.json @@ -0,0 +1,100 @@ +{ + "requiredOneOf": [ + "document-name", + "attachment", + "document-text" + ], + "attributes": { + "purpose-of-document": { + "description": "What the document is used for.", + "ui-priority": 1, + "misp-attribute": "text", + "disable_correlation": true, + "multiple": true, + "sane_default": [ + "Identification", + "Travel", + "Health", + "Legal", + "Financial", + "Government", + "Military", + "Media", + "Communication", + "Other" + ] + }, + "document-type": { + "description": "The type of document (not the file type).", + "ui-priority": 1, + "misp-attribute": "text", + "disable_correlation": true, + "sane_default": [ + "email", + "letterhead", + "speech", + "literature", + "photo", + "audio", + "invoice", + "receipt", + "other" + ] + }, + "attachment": { + "description": "The forged document file.", + "ui-priority": 1, + "misp-attribute": "attachment" + }, + "document-name": { + "misp-attribute": "text", + "ui-priority": 0, + "description": "Title of the document." + }, + "document-text": { + "description": "Raw text of document", + "ui-priority": 1, + "misp-attribute": "text" + }, + "url": { + "description": "Original URL location of the document (potentially malicious)", + "ui-priority": 1, + "misp-attribute": "url" + }, + "link": { + "description": "Original link into the document (Supposed harmless)", + "ui-priority": 1, + "misp-attribute": "link" + }, + "objective": { + "description": "Objective of the forged document.", + "ui-priority": 1, + "misp-attribute": "text", + "disable_correlation": true, + "multiple": true, + "sane_default": [ + "Disinformation", + "Advertising", + "Parody", + "Other" + ] + }, + "last-seen": { + "description": "When the document has been accessible or seen for the last time.", + "disable_correlation": true, + "ui-priority": 0, + "misp-attribute": "datetime" + }, + "first-seen": { + "description": "When the document has been accessible or seen for the first time.", + "disable_correlation": true, + "ui-priority": 0, + "misp-attribute": "datetime" + } + }, + "version": 5, + "description": "Object describing a forged document.", + "meta-category": "file", + "uuid": "7e927620-b97c-4b00-98c0-8c0184d83d21", + "name": "forged-document" +} diff --git a/objects/leaked-document/definition.json b/objects/leaked-document/definition.json new file mode 100644 index 0000000..ad6f178 --- /dev/null +++ b/objects/leaked-document/definition.json @@ -0,0 +1,106 @@ +{ + "requiredOneOf": [ + "document-name", + "attachment", + "document-text" + ], + "attributes": { + "origin": { + "description": "Original source of leaked document.", + "ui-priority": 1, + "misp-attribute": "text" + }, + "purpose-of-document": { + "description": "What the document is used for.", + "ui-priority": 1, + "misp-attribute": "text", + "disable_correlation": true, + "multiple": true, + "sane_default": [ + "Identification", + "Travel", + "Health", + "Legal", + "Financial", + "Government", + "Military", + "Media", + "Communication", + "Other" + ] + }, + "document-type": { + "description": "The type of document (not the file type).", + "ui-priority": 1, + "misp-attribute": "text", + "disable_correlation": true, + "sane_default": [ + "email", + "letterhead", + "speech", + "literature", + "photo", + "audio", + "invoice", + "receipt", + "other" + ] + }, + "attachment": { + "description": "The leaked document file.", + "ui-priority": 1, + "misp-attribute": "attachment" + }, + "document-name": { + "misp-attribute": "text", + "ui-priority": 0, + "description": "Title of the document." + }, + "document-text": { + "description": "Raw text of document", + "ui-priority": 1, + "misp-attribute": "text" + }, + "url": { + "description": "Original URL location of the document (potentially malicious)", + "ui-priority": 1, + "misp-attribute": "url" + }, + "link": { + "description": "Original link into the document (Supposed harmless)", + "ui-priority": 1, + "misp-attribute": "link" + }, + "objective": { + "description": "Reason for leaking the document.", + "ui-priority": 1, + "misp-attribute": "text", + "disable_correlation": true, + "multiple": true, + "sane_default": [ + "Disinformation", + "Influence", + "Whistleblowing", + "Extortion", + "Other" + ] + }, + "last-seen": { + "description": "When the document has been accessible or seen for the last time.", + "disable_correlation": true, + "ui-priority": 0, + "misp-attribute": "datetime" + }, + "first-seen": { + "description": "When the document has been accessible or seen for the first time.", + "disable_correlation": true, + "ui-priority": 0, + "misp-attribute": "datetime" + } + }, + "version": 5, + "description": "Object describing a leaked document.", + "meta-category": "file", + "uuid": "ea145ecd-b3c2-4f57-ac11-c16e883c4247", + "name": "leaked-document" +} diff --git a/objects/meme-image/definition.json b/objects/meme-image/definition.json new file mode 100644 index 0000000..122c7c8 --- /dev/null +++ b/objects/meme-image/definition.json @@ -0,0 +1,100 @@ +{ + "requiredOneOf": [ + "attachment", + "document-text" + ], + "attributes": { + "username": { + "description": "Username who posted the meme.", + "ui-priority": 0, + "misp-attribute": "text" + }, + "5Ds-of-propaganda": { + "description": "5 D's of propaganda are tactics of rebuttal used to defend against criticism and adversarial narratives.", + "ui-priority": 1, + "misp-attribute": "text", + "disable_correlation": true, + "multiple": true, + "values_list": [ + "dismiss", + "distort", + "distract", + "dismay", + "divide" + ] + }, + "attachment": { + "description": "The image file.", + "ui-priority": 1, + "misp-attribute": "attachment" + }, + "document-text": { + "description": "Raw text of meme", + "ui-priority": 1, + "misp-attribute": "text" + }, + "meme-reference": { + "description": "A link to know-your-meme or similar reference material.", + "ui-priority": 1, + "misp-attribute": "link" + }, + "a/b-test": { + "description": "A flag to define if this meme is part of an a/b test. If set to true, it is part of an a/b test set.", + "disable_correlation": true, + "ui-priority": 0, + "misp-attribute": "boolean" + }, + "crosspost": { + "description": "Safe site where the meme has been posted.", + "ui-priority": 0, + "misp-attribute": "link", + "multiple": true + }, + "crosspost-unsafe": { + "description": "Unsafe site where the meme has been posted.", + "ui-priority": 0, + "misp-attribute": "url", + "multiple": true + }, + "url": { + "description": "Original URL location of the meme (potentially malicious)", + "ui-priority": 1, + "misp-attribute": "url" + }, + "link": { + "description": "Original link into the meme (Supposed harmless)", + "ui-priority": 1, + "misp-attribute": "link" + }, + "objective": { + "description": "Objective of the meme.", + "ui-priority": 1, + "misp-attribute": "text", + "disable_correlation": true, + "multiple": true, + "sane_default": [ + "Disinformation", + "Advertising", + "Parody", + "Other" + ] + }, + "last-seen": { + "description": "When the meme has been accessible or seen for the last time.", + "disable_correlation": true, + "ui-priority": 0, + "misp-attribute": "datetime" + }, + "first-seen": { + "description": "When the meme has been accessible or seen for the first time.", + "disable_correlation": true, + "ui-priority": 0, + "misp-attribute": "datetime" + } + }, + "version": 5, + "description": "Object describing a meme (image).", + "meta-category": "file", + "uuid": "7e927620-b97c-4b00-98c0-8c0184d83d21", + "name": "forged-document" +} From acf22d496c0727758d8bb1b4fd0c319db3b139b5 Mon Sep 17 00:00:00 2001 From: VVX7 Date: Tue, 28 Jan 2020 22:08:45 -0500 Subject: [PATCH 071/155] chg: [meme-image] uuid and name duplicate --- objects/leaked-document/definition.json | 2 +- objects/meme-image/definition.json | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/objects/leaked-document/definition.json b/objects/leaked-document/definition.json index ad6f178..88fc133 100644 --- a/objects/leaked-document/definition.json +++ b/objects/leaked-document/definition.json @@ -46,7 +46,7 @@ "other" ] }, - "attachment": { + "attachment": { "description": "The leaked document file.", "ui-priority": 1, "misp-attribute": "attachment" diff --git a/objects/meme-image/definition.json b/objects/meme-image/definition.json index 122c7c8..eb59d9f 100644 --- a/objects/meme-image/definition.json +++ b/objects/meme-image/definition.json @@ -95,6 +95,6 @@ "version": 5, "description": "Object describing a meme (image).", "meta-category": "file", - "uuid": "7e927620-b97c-4b00-98c0-8c0184d83d21", - "name": "forged-document" + "uuid": "6f6c3b61-f085-475e-93df-2e2d9c2fb0f6", + "name": "meme-image" } From 0b5c9bde2964299b5f50cb53fc2e937b7d0c9907 Mon Sep 17 00:00:00 2001 From: VVX7 Date: Wed, 29 Jan 2020 21:55:26 -0500 Subject: [PATCH 072/155] chg: [blog] add title field to object --- objects/blog/definition.json | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/objects/blog/definition.json b/objects/blog/definition.json index 474274b..b471525 100644 --- a/objects/blog/definition.json +++ b/objects/blog/definition.json @@ -8,6 +8,11 @@ "ui-priority": 1, "misp-attribute": "text" }, + "title": { + "description": "Raw post.", + "ui-priority": 1, + "misp-attribute": "text" + }, "url": { "description": "Original URL location of the blog post (potentially malicious).", "ui-priority": 1, @@ -83,7 +88,7 @@ "misp-attribute": "text" } }, - "version": 11, + "version": 12, "description": "Blog post like Medium or WordPress.", "meta-category": "misc", "uuid": "1f165fc0-b158-498f-8bc8-6dc3d2822bb1", From 620ac3600c79b4a10a40f47318f020b662179d21 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Rapha=C3=ABl=20Vinot?= Date: Thu, 30 Jan 2020 11:38:56 +0100 Subject: [PATCH 073/155] fic: Make pep8 happy --- tools/adoc_objects.py | 28 ++++++++++++++++------------ 1 file changed, 16 insertions(+), 12 deletions(-) diff --git a/tools/adoc_objects.py b/tools/adoc_objects.py index 0b77c40..bdccfbf 100755 --- a/tools/adoc_objects.py +++ b/tools/adoc_objects.py @@ -39,6 +39,7 @@ argParser = argparse.ArgumentParser(description='Generate documentation from MIS argParser.add_argument('-v', action='store_true', help='Verbose mode') args = argParser.parse_args() + def header(adoc=False): if adoc is False: return False @@ -66,25 +67,26 @@ def header(adoc=False): doc = doc + "= MISP objects\n" return doc -def asciidoc(content=False, adoc=None, t='title',title=''): + +def asciidoc(content=False, adoc=None, t='title', title=''): adoc = adoc + "\n" output = "" if t == 'title': output = '== ' + content elif t == 'info': - content = content.rstrip('\.') - output = "\n{}.\n\n{} {} {}{}/definition.json[*this location*] {}.\n".format(content, 'NOTE: ', title, 'is a MISP object available in JSON format at https://github.com/MISP/misp-objects/blob/master/objects/',title.lower(),' The JSON format can be freely reused in your application or automatically enabled in https://www.github.com/MISP/MISP[MISP]') + content = content.rstrip('.') + output = "\n{}.\n\n{} {} {}{}/definition.json[*this location*] {}.\n".format(content, 'NOTE: ', title, 'is a MISP object available in JSON format at https://github.com/MISP/misp-objects/blob/master/objects/', title.lower(), ' The JSON format can be freely reused in your application or automatically enabled in https://www.github.com/MISP/MISP[MISP]') elif t == 'author': output = '\nauthors:: {}\n'.format(' - '.join(content)) elif t == 'value': output = '=== ' + content elif t == 'description': - content = content.rstrip('\.') + content = content.rstrip('.') output = '\n{}\n'.format(content) elif t == 'attributes': - #output = '\n{}\n'.format - #output = '[cols=\",a\"]\n' + # output = '\n{}\n'.format + # output = '[cols=\",a\"]\n' output = output + '|===\n' output = output + '|Object attribute | MISP attribute type | Description | Disable correlation | Multiple\n' adoc = adoc + output @@ -103,21 +105,22 @@ def asciidoc(content=False, adoc=None, t='title',title=''): description = '{}'.format(content['attributes'][v]['description']) if 'values_list' in content['attributes'][v]: values = content['attributes'][v]['values_list'] - description = '{} {}'.format(content['attributes'][v]['description'],values) + description = '{} {}'.format(content['attributes'][v]['description'], values) if 'sane_default' in content['attributes'][v]: values = content['attributes'][v]['sane_default'] - description = '{} {}'.format(content['attributes'][v]['description'],values) - output = '\n| {} | {} a| {} a| {} a| {}\n'.format(v, content['attributes'][v]['misp-attribute'], description ,disableCorrelation, multiple) + description = '{} {}'.format(content['attributes'][v]['description'], values) + output = '\n| {} | {} a| {} a| {} a| {}\n'.format(v, content['attributes'][v]['misp-attribute'], description, disableCorrelation, multiple) adoc = adoc + output output = '\n|===\n' adoc = adoc + output return adoc + adoc = "" -print (header(adoc=adoc)) +print(header(adoc=adoc)) for mispobject in objects: - fullPathClusters = os.path.join(pathObjects, '{}/{}'.format(mispobject,'definition.json')) + fullPathClusters = os.path.join(pathObjects, '{}/{}'.format(mispobject, 'definition.json')) with open(fullPathClusters) as fp: c = json.load(fp) title = c['name'] @@ -138,4 +141,5 @@ with open('../relationships/definition.json') as filerelationships: output = output + '\n|===\n' adoc = adoc + output -print (adoc) + +print(adoc) From a521f9008ee4666de174589b80ea73c233a1dd5d Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Rapha=C3=ABl=20Vinot?= Date: Thu, 30 Jan 2020 11:39:44 +0100 Subject: [PATCH 074/155] fix: Missing pep8 check --- tools/list_of_objects.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/tools/list_of_objects.py b/tools/list_of_objects.py index 47dfd07..631b3de 100644 --- a/tools/list_of_objects.py +++ b/tools/list_of_objects.py @@ -45,6 +45,6 @@ for mispobject in objects: with open(fullPathClusters) as fp: c = json.load(fp) if not c['description'].endswith('.'): - c['description'] = c['description']+"." - v = "- [objects/{}](objects/{}/definition.json) - {}".format(c['name'], c['name'],c['description']) + c['description'] = c['description'] + "." + v = "- [objects/{}](objects/{}/definition.json) - {}".format(c['name'], c['name'], c['description']) print(v) From ce20ea05fe4aad4f670bc105fad0dfc6ff68d986 Mon Sep 17 00:00:00 2001 From: VVX7 Date: Thu, 30 Jan 2020 14:08:19 -0500 Subject: [PATCH 075/155] chg: [misinfosec objects] add archive (Internet Archive, Archive.is, etc) fields, change blog post title description --- objects/blog/definition.json | 10 ++++++++-- objects/forged-document/definition.json | 9 ++++++++- objects/leaked-document/definition.json | 9 ++++++++- objects/meme-image/definition.json | 8 +++++++- objects/microblog/definition.json | 8 +++++++- 5 files changed, 38 insertions(+), 6 deletions(-) diff --git a/objects/blog/definition.json b/objects/blog/definition.json index b471525..97980b6 100644 --- a/objects/blog/definition.json +++ b/objects/blog/definition.json @@ -9,7 +9,7 @@ "misp-attribute": "text" }, "title": { - "description": "Raw post.", + "description": "Title of blog post.", "ui-priority": 1, "misp-attribute": "text" }, @@ -23,6 +23,12 @@ "ui-priority": 1, "misp-attribute": "link" }, + "archive": { + "description": "Archive of the original document (Internet Archive, Archive.is, etc).", + "ui-priority": 1, + "multiple": true, + "misp-attribute": "link" + }, "type": { "description": "Type of blog post.", "ui-priority": 1, @@ -88,7 +94,7 @@ "misp-attribute": "text" } }, - "version": 12, + "version": 13, "description": "Blog post like Medium or WordPress.", "meta-category": "misc", "uuid": "1f165fc0-b158-498f-8bc8-6dc3d2822bb1", diff --git a/objects/forged-document/definition.json b/objects/forged-document/definition.json index 5ed512e..66edaad 100644 --- a/objects/forged-document/definition.json +++ b/objects/forged-document/definition.json @@ -29,6 +29,7 @@ "ui-priority": 1, "misp-attribute": "text", "disable_correlation": true, + "multiple": true, "sane_default": [ "email", "letterhead", @@ -66,6 +67,12 @@ "ui-priority": 1, "misp-attribute": "link" }, + "archive": { + "description": "Archive of the original document (Internet Archive, Archive.is, etc).", + "ui-priority": 1, + "multiple": true, + "misp-attribute": "link" + }, "objective": { "description": "Objective of the forged document.", "ui-priority": 1, @@ -92,7 +99,7 @@ "misp-attribute": "datetime" } }, - "version": 5, + "version": 6, "description": "Object describing a forged document.", "meta-category": "file", "uuid": "7e927620-b97c-4b00-98c0-8c0184d83d21", diff --git a/objects/leaked-document/definition.json b/objects/leaked-document/definition.json index 88fc133..6adf927 100644 --- a/objects/leaked-document/definition.json +++ b/objects/leaked-document/definition.json @@ -34,6 +34,7 @@ "ui-priority": 1, "misp-attribute": "text", "disable_correlation": true, + "multiple": true, "sane_default": [ "email", "letterhead", @@ -71,6 +72,12 @@ "ui-priority": 1, "misp-attribute": "link" }, + "archive": { + "description": "Archive of the original document (Internet Archive, Archive.is, etc).", + "ui-priority": 1, + "multiple": true, + "misp-attribute": "link" + }, "objective": { "description": "Reason for leaking the document.", "ui-priority": 1, @@ -98,7 +105,7 @@ "misp-attribute": "datetime" } }, - "version": 5, + "version": 6, "description": "Object describing a leaked document.", "meta-category": "file", "uuid": "ea145ecd-b3c2-4f57-ac11-c16e883c4247", diff --git a/objects/meme-image/definition.json b/objects/meme-image/definition.json index eb59d9f..edb88ec 100644 --- a/objects/meme-image/definition.json +++ b/objects/meme-image/definition.json @@ -66,6 +66,12 @@ "ui-priority": 1, "misp-attribute": "link" }, + "archive": { + "description": "Archive of the original document (Internet Archive, Archive.is, etc).", + "ui-priority": 1, + "multiple": true, + "misp-attribute": "link" + }, "objective": { "description": "Objective of the meme.", "ui-priority": 1, @@ -92,7 +98,7 @@ "misp-attribute": "datetime" } }, - "version": 5, + "version": 6, "description": "Object describing a meme (image).", "meta-category": "file", "uuid": "6f6c3b61-f085-475e-93df-2e2d9c2fb0f6", diff --git a/objects/microblog/definition.json b/objects/microblog/definition.json index 309c11e..c5e2f89 100644 --- a/objects/microblog/definition.json +++ b/objects/microblog/definition.json @@ -19,6 +19,12 @@ "misp-attribute": "link", "to_ids": false }, + "archive": { + "description": "Archive of the original document (Internet Archive, Archive.is, etc).", + "ui-priority": 1, + "multiple": true, + "misp-attribute": "link" + }, "type": { "description": "Type of the microblog post", "ui-priority": 1, @@ -103,7 +109,7 @@ "multiple": true } }, - "version": 12, + "version": 13, "description": "Microblog post like a Twitter tweet or a post on a Facebook wall.", "meta-category": "misc", "uuid": "8ec8c911-ddbe-4f5b-895b-fbff70c42a60", From 804e2116ce5283f76657eb466a8b2e7a03e9928f Mon Sep 17 00:00:00 2001 From: VVX7 Date: Thu, 30 Jan 2020 16:36:56 -0500 Subject: [PATCH 076/155] chg: [microblog] add attachment field for issue #186 --- objects/microblog/definition.json | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/objects/microblog/definition.json b/objects/microblog/definition.json index c5e2f89..4a636b1 100644 --- a/objects/microblog/definition.json +++ b/objects/microblog/definition.json @@ -25,6 +25,11 @@ "multiple": true, "misp-attribute": "link" }, + "attachment": { + "description": "The microblog post file or screen capture.", + "ui-priority": 1, + "misp-attribute": "attachment" + }, "type": { "description": "Type of the microblog post", "ui-priority": 1, @@ -109,7 +114,7 @@ "multiple": true } }, - "version": 13, + "version": 14, "description": "Microblog post like a Twitter tweet or a post on a Facebook wall.", "meta-category": "misc", "uuid": "8ec8c911-ddbe-4f5b-895b-fbff70c42a60", From 8fa0166b24d5c8ef2ff2d30980baa560f477758d Mon Sep 17 00:00:00 2001 From: VVX7 Date: Thu, 30 Jan 2020 16:41:40 -0500 Subject: [PATCH 077/155] chg: [microblog] allow multiple attachments per the enhancement request --- objects/microblog/definition.json | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/objects/microblog/definition.json b/objects/microblog/definition.json index 4a636b1..0fb5251 100644 --- a/objects/microblog/definition.json +++ b/objects/microblog/definition.json @@ -28,6 +28,7 @@ "attachment": { "description": "The microblog post file or screen capture.", "ui-priority": 1, + "multiple": true, "misp-attribute": "attachment" }, "type": { @@ -114,7 +115,7 @@ "multiple": true } }, - "version": 14, + "version": 15, "description": "Microblog post like a Twitter tweet or a post on a Facebook wall.", "meta-category": "misc", "uuid": "8ec8c911-ddbe-4f5b-895b-fbff70c42a60", From 4c4a3aabe5137582b8dd4110d1cfb71f39d8367c Mon Sep 17 00:00:00 2001 From: VVX7 Date: Thu, 30 Jan 2020 19:57:39 -0500 Subject: [PATCH 078/155] new: [objects] news-agency, news-media --- objects/news-agency/definition.json | 73 ++++++++++++++++ objects/news-media/definition.json | 127 ++++++++++++++++++++++++++++ 2 files changed, 200 insertions(+) create mode 100644 objects/news-agency/definition.json create mode 100644 objects/news-media/definition.json diff --git a/objects/news-agency/definition.json b/objects/news-agency/definition.json new file mode 100644 index 0000000..9df81c2 --- /dev/null +++ b/objects/news-agency/definition.json @@ -0,0 +1,73 @@ +{ + "requiredOneOf": [ + "name", + "alias" + ], + "attributes": { + "name": { + "description": "Name of the news agency.", + "disable_correlation": false, + "ui-priority": 100, + "misp-attribute": "text" + }, + "alias": { + "description": "Alias of the news agency.", + "ui-priority": 99, + "misp-attribute": "text", + "multiple": true + }, + "archive": { + "description": "Archive of the original document (Internet Archive, Archive.is, etc).", + "ui-priority": 1, + "multiple": true, + "misp-attribute": "link" + }, + "attachment": { + "description": "The news file, screen capture, audio, etc.", + "ui-priority": 1, + "multiple": true, + "misp-attribute": "attachment" + }, + "url": { + "description": "Original URL location of the news agency (potentially malicious).", + "ui-priority": 1, + "misp-attribute": "url", + "multiple": true + }, + "link": { + "description": "Original link to the news agency (Supposed harmless).", + "ui-priority": 1, + "misp-attribute": "link", + "multiple": true + }, + "phone-number": { + "description": "Phone number of the news agency.", + "ui-priority": 10, + "misp-attribute": "phone-number", + "multiple": true + }, + "fax-number": { + "description": "Fax number of the news agency.", + "ui-priority": 10, + "misp-attribute": "phone-number", + "multiple": true + }, + "address": { + "description": "Postal address of the news agency.", + "ui-priority": 10, + "misp-attribute": "text", + "multiple": true + }, + "e-mail": { + "description": "Email address of the organization.", + "ui-priority": 10, + "misp-attribute": "email-src", + "multiple": true + } + }, + "version": 1, + "description": "News agencies compile news and disseminate news in bulk.", + "meta-category": "misc", + "uuid": "92b3f7fd-c4bc-42af-a73b-033ace439622", + "name": "news-agency" +} diff --git a/objects/news-media/definition.json b/objects/news-media/definition.json new file mode 100644 index 0000000..10bd39d --- /dev/null +++ b/objects/news-media/definition.json @@ -0,0 +1,127 @@ +{ + "requiredOneOf": [ + "source", + "alias" + ], + "attributes": { + "source": { + "description": "Name of the news source.", + "disable_correlation": false, + "ui-priority": 100, + "misp-attribute": "text" + }, + "alias": { + "description": "Alias of the news source.", + "ui-priority": 99, + "misp-attribute": "text", + "multiple": true + }, + "content": { + "description": "Raw content of the news.", + "ui-priority": 1, + "misp-attribute": "text" + }, + "transcription": { + "description": "Transcribed audio/visual content.", + "ui-priority": 1, + "misp-attribute": "text" + }, + "title": { + "description": "Title of the post.", + "ui-priority": 1, + "misp-attribute": "text" + }, + "archive": { + "description": "Archive of the news (Internet Archive, Archive.is, etc).", + "ui-priority": 1, + "multiple": true, + "misp-attribute": "link" + }, + "attachment": { + "description": "The news file, screen capture, audio, etc.", + "ui-priority": 1, + "multiple": true, + "misp-attribute": "attachment" + }, + "type": { + "description": "Type of news media (newspaper, TV, podcast, etc).", + "ui-priority": 1, + "misp-attribute": "text", + "disable_correlation": true, + "multiple": true, + "sane_default": [ + "Newspaper", + "Newspaper (Online)", + "Magazine", + "Magazine (Online)", + "TV", + "Tube", + "Radio", + "Radio (Online)", + "Podcast", + "Alternative Media", + "Other" + ] + }, + "sub-type": { + "misp-attribute": "text", + "ui-priority": 0, + "description": "Format of the news post (business daily, local news, metasite, etc).", + "disable_correlation": true, + "values_list": [ + "Business Daily", + "Local News", + "State News", + "National News", + "Metasite", + "Political Commentary", + "Clipper", + "Pressure Group", + "Staging", + "Trade Site", + "Other" + ] + }, + "url": { + "description": "Original URL location of news (potentially malicious).", + "ui-priority": 1, + "misp-attribute": "url", + "multiple": true + }, + "link": { + "description": "Original link to news (Supposed harmless).", + "ui-priority": 1, + "misp-attribute": "link", + "multiple": true + }, + "phone-number": { + "description": "Phone number of the news source.", + "ui-priority": 10, + "misp-attribute": "phone-number", + "multiple": true + }, + "fax-number": { + "description": "Fax number of the news source.", + "ui-priority": 10, + "misp-attribute": "phone-number", + "multiple": true + }, + "address": { + "description": "Postal address of the news source.", + "ui-priority": 10, + "misp-attribute": "text", + "multiple": true + }, + "e-mail": { + "description": "Email address of the news source.", + "ui-priority": 10, + "misp-attribute": "email-src", + "multiple": true + } + }, + "version": 1, + "description": "News media are forms of mass media deliverings news to the general public.", + "meta-category": "misc", + "uuid": "691463c5-5302-4847-9bec-4c56ccfec677", + "name": "news-media" +} From 329d92162c85254de6ed0a4eda5835efc235fb96 Mon Sep 17 00:00:00 2001 From: VVX7 Date: Thu, 30 Jan 2020 21:31:06 -0500 Subject: [PATCH 079/155] chg: [object fields] add forged-document types, add microblog state --- objects/forged-document/definition.json | 4 +++- objects/microblog/definition.json | 4 +++- 2 files changed, 6 insertions(+), 2 deletions(-) diff --git a/objects/forged-document/definition.json b/objects/forged-document/definition.json index 66edaad..f8a8f7a 100644 --- a/objects/forged-document/definition.json +++ b/objects/forged-document/definition.json @@ -35,6 +35,8 @@ "letterhead", "speech", "literature", + "blog", + "microblog", "photo", "audio", "invoice", @@ -99,7 +101,7 @@ "misp-attribute": "datetime" } }, - "version": 6, + "version": 7, "description": "Object describing a forged document.", "meta-category": "file", "uuid": "7e927620-b97c-4b00-98c0-8c0184d83d21", diff --git a/objects/microblog/definition.json b/objects/microblog/definition.json index 0fb5251..cb825fe 100644 --- a/objects/microblog/definition.json +++ b/objects/microblog/definition.json @@ -55,6 +55,8 @@ "values_list": [ "Informative", "Malicious", + "Misinformation", + "Disinformation", "Unknown" ] }, @@ -115,7 +117,7 @@ "multiple": true } }, - "version": 15, + "version": 16, "description": "Microblog post like a Twitter tweet or a post on a Facebook wall.", "meta-category": "misc", "uuid": "8ec8c911-ddbe-4f5b-895b-fbff70c42a60", From e4d217172e98ab29f24d374ce5c731ee6e0e3444 Mon Sep 17 00:00:00 2001 From: VVX7 Date: Thu, 30 Jan 2020 21:51:56 -0500 Subject: [PATCH 080/155] chg: [object field] add link for user-account page --- objects/user-account/definition.json | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/objects/user-account/definition.json b/objects/user-account/definition.json index 203bb28..2f68dbb 100644 --- a/objects/user-account/definition.json +++ b/objects/user-account/definition.json @@ -3,7 +3,7 @@ "uuid": "49606b06-22f0-4ac8-8eee-2f12ad46f3d3", "meta-category": "misc", "description": "", - "version": 1, + "version": 2, "requiredOneOf": [ "password", "username", @@ -54,6 +54,11 @@ "windows-domain" ] }, + "link": { + "description": "Original link into the account page (Supposed harmless)", + "ui-priority": 1, + "misp-attribute": "link" + }, "is_service_account": { "description": "Specifies if the account is associated with a network service.", "disable_correlation": true, From 3bb42c766f6659ed81a724ef4ee8e45b9d5dd5b4 Mon Sep 17 00:00:00 2001 From: VVX7 Date: Fri, 31 Jan 2020 17:01:57 -0500 Subject: [PATCH 081/155] chg: [object field] add title to microblog --- objects/microblog/definition.json | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/objects/microblog/definition.json b/objects/microblog/definition.json index cb825fe..fd1d4f2 100644 --- a/objects/microblog/definition.json +++ b/objects/microblog/definition.json @@ -8,6 +8,11 @@ "ui-priority": 1, "misp-attribute": "text" }, + "title": { + "description": "Title of the post", + "ui-priority": 1, + "misp-attribute": "text" + }, "url": { "description": "Original URL location of the microblog post (potentially malicious)", "ui-priority": 1, @@ -117,7 +122,7 @@ "multiple": true } }, - "version": 16, + "version": 17, "description": "Microblog post like a Twitter tweet or a post on a Facebook wall.", "meta-category": "misc", "uuid": "8ec8c911-ddbe-4f5b-895b-fbff70c42a60", From ed8e72bdb43be88a933ad0a5903836123f27326f Mon Sep 17 00:00:00 2001 From: VVX7 Date: Fri, 31 Jan 2020 17:11:29 -0500 Subject: [PATCH 082/155] chg: [object field] enable multiple URL/link in microblog --- objects/microblog/definition.json | 2 ++ 1 file changed, 2 insertions(+) diff --git a/objects/microblog/definition.json b/objects/microblog/definition.json index fd1d4f2..9594586 100644 --- a/objects/microblog/definition.json +++ b/objects/microblog/definition.json @@ -16,12 +16,14 @@ "url": { "description": "Original URL location of the microblog post (potentially malicious)", "ui-priority": 1, + "multiple": true, "misp-attribute": "url" }, "link": { "description": "Original link into the microblog post (Supposed harmless)", "ui-priority": 1, "misp-attribute": "link", + "multiple": true, "to_ids": false }, "archive": { From bc052e17f4f6b1c48b45ecf5fcdf00e36fcc9bc2 Mon Sep 17 00:00:00 2001 From: VVX7 Date: Fri, 31 Jan 2020 18:27:42 -0500 Subject: [PATCH 083/155] chg: [object field] add profile picture to user-account --- objects/user-account/definition.json | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/objects/user-account/definition.json b/objects/user-account/definition.json index 2f68dbb..6f0e863 100644 --- a/objects/user-account/definition.json +++ b/objects/user-account/definition.json @@ -3,7 +3,7 @@ "uuid": "49606b06-22f0-4ac8-8eee-2f12ad46f3d3", "meta-category": "misc", "description": "", - "version": 2, + "version": 3, "requiredOneOf": [ "password", "username", @@ -26,6 +26,12 @@ "ui-priority": 1, "misp-attribute": "text" }, + "user-avatar": { + "description": "A user profile picture or avatar.", + "ui-priority": 1, + "multiple": true, + "misp-attribute": "attachment" + }, "password": { "description": "Password related to the username.", "ui-priority": 1, From bde68265e3059edb573bfa46f8816d3cb0632027 Mon Sep 17 00:00:00 2001 From: VVX7 Date: Sun, 2 Feb 2020 20:08:44 -0500 Subject: [PATCH 084/155] chg: [object fields] allow additional requiredOneOf fields in blog, microblog, meme-image objects. add attachment field to blog object. add username to news-media. --- objects/blog/definition.json | 8 ++++++-- objects/meme-image/definition.json | 3 ++- objects/microblog/definition.json | 8 ++++++-- objects/news-agency/definition.json | 11 +++++++--- objects/news-media/definition.json | 31 +++++++++++++++++++++++++---- 5 files changed, 49 insertions(+), 12 deletions(-) diff --git a/objects/blog/definition.json b/objects/blog/definition.json index 97980b6..88ccceb 100644 --- a/objects/blog/definition.json +++ b/objects/blog/definition.json @@ -1,6 +1,10 @@ { "requiredOneOf": [ - "post" + "post", + "archive", + "url", + "link", + "attachment" ], "attributes": { "post": { @@ -94,7 +98,7 @@ "misp-attribute": "text" } }, - "version": 13, + "version": 14, "description": "Blog post like Medium or WordPress.", "meta-category": "misc", "uuid": "1f165fc0-b158-498f-8bc8-6dc3d2822bb1", diff --git a/objects/meme-image/definition.json b/objects/meme-image/definition.json index edb88ec..06cb1a7 100644 --- a/objects/meme-image/definition.json +++ b/objects/meme-image/definition.json @@ -1,6 +1,7 @@ { "requiredOneOf": [ "attachment", + "archive", "document-text" ], "attributes": { @@ -98,7 +99,7 @@ "misp-attribute": "datetime" } }, - "version": 6, + "version": 7, "description": "Object describing a meme (image).", "meta-category": "file", "uuid": "6f6c3b61-f085-475e-93df-2e2d9c2fb0f6", diff --git a/objects/microblog/definition.json b/objects/microblog/definition.json index 9594586..226c5eb 100644 --- a/objects/microblog/definition.json +++ b/objects/microblog/definition.json @@ -1,6 +1,10 @@ { "requiredOneOf": [ - "post" + "post", + "archive", + "url", + "link", + "attachment" ], "attributes": { "post": { @@ -124,7 +128,7 @@ "multiple": true } }, - "version": 17, + "version": 18, "description": "Microblog post like a Twitter tweet or a post on a Facebook wall.", "meta-category": "misc", "uuid": "8ec8c911-ddbe-4f5b-895b-fbff70c42a60", diff --git a/objects/news-agency/definition.json b/objects/news-agency/definition.json index 9df81c2..438da8b 100644 --- a/objects/news-agency/definition.json +++ b/objects/news-agency/definition.json @@ -1,18 +1,23 @@ { "requiredOneOf": [ "name", - "alias" + "alias", + "archive", + "url", + "link", + "attachment" ], "attributes": { "name": { "description": "Name of the news agency.", - "disable_correlation": false, + "disable_correlation": true, "ui-priority": 100, "misp-attribute": "text" }, "alias": { "description": "Alias of the news agency.", "ui-priority": 99, + "disable_correlation": true, "misp-attribute": "text", "multiple": true }, @@ -65,7 +70,7 @@ "multiple": true } }, - "version": 1, + "version": 2, "description": "News agencies compile news and disseminate news in bulk.", "meta-category": "misc", "uuid": "92b3f7fd-c4bc-42af-a73b-033ace439622", diff --git a/objects/news-media/definition.json b/objects/news-media/definition.json index 10bd39d..8a46926 100644 --- a/objects/news-media/definition.json +++ b/objects/news-media/definition.json @@ -1,21 +1,32 @@ { "requiredOneOf": [ "source", - "alias" + "alias", + "archive", + "content", + "url", + "link", + "attachment" ], "attributes": { "source": { "description": "Name of the news source.", - "disable_correlation": false, + "disable_correlation": true, "ui-priority": 100, "misp-attribute": "text" }, "alias": { "description": "Alias of the news source.", "ui-priority": 99, + "disable_correlation": true, "misp-attribute": "text", "multiple": true }, + "username": { + "description": "Username who posted the blog post.", + "ui-priority": 0, + "misp-attribute": "text" + }, "content": { "description": "Raw content of the news.", "ui-priority": 1, @@ -112,6 +123,18 @@ "misp-attribute": "text", "multiple": true }, + "embedded-link": { + "description": "Site linked by the blog post.", + "ui-priority": 0, + "misp-attribute": "url", + "multiple": true + }, + "embedded-safe-link": { + "description": "Safe site linked by the blog post.", + "ui-priority": 0, + "misp-attribute": "link", + "multiple": true + }, "e-mail": { "description": "Email address of the news source.", "ui-priority": 10, @@ -119,8 +142,8 @@ "multiple": true } }, - "version": 1, - "description": "News media are forms of mass media deliverings news to the general public.", + "version": 2, + "description": "News media are forms of mass media delivering news to the general public.", "meta-category": "misc", "uuid": "691463c5-5302-4847-9bec-4c56ccfec677", "name": "news-media" From b036b52e36241d72aa1244c1ab78de8a8ad38e09 Mon Sep 17 00:00:00 2001 From: Terrtia Date: Mon, 3 Feb 2020 16:03:34 +0100 Subject: [PATCH 085/155] chg: [new object pgp-meta] Metadata extracted from a PGP keyblock, message or signature --- objects/pgp-meta/definition.json | 42 ++++++++++++++++++++++++++++++++ 1 file changed, 42 insertions(+) create mode 100644 objects/pgp-meta/definition.json diff --git a/objects/pgp-meta/definition.json b/objects/pgp-meta/definition.json new file mode 100644 index 0000000..b28461f --- /dev/null +++ b/objects/pgp-meta/definition.json @@ -0,0 +1,42 @@ +{ + "required": [ + "key" + ], + "attributes": { + "first-seen": { + "description": "First time the tuple has been seen", + "disable_correlation": true, + "ui-priority": 0, + "misp-attribute": "datetime" + }, + "last-seen": { + "description": "Last time the tuple has been seen", + "disable_correlation": true, + "ui-priority": 0, + "misp-attribute": "datetime" + }, + "key-id": { + "description": "key-id", + "ui-priority": 1, + "misp-attribute": "text", + "multiple": true + }, + "user-id-email": { + "description": "User ID packet, email address of the key holder", + "ui-priority": 1, + "misp-attribute": "email-subject", + "multiple": true + }, + "user-id-name": { + "description": "User ID packet, name of the key holder", + "ui-priority": 1, + "misp-attribute": "text", + "multiple": true + } + }, + "version": 1, + "description": "Metadata extracted from a PGP keyblock, message or signature", + "meta-category": "misc", + "uuid": "4c9134c4-b3e8-4d9f-b3c0-c683e70ec1dd", + "name": "pgp-meta" +} From ae11730a825c6c3919f06a735b08f0cbe06b7f40 Mon Sep 17 00:00:00 2001 From: Terrtia Date: Mon, 3 Feb 2020 16:45:28 +0100 Subject: [PATCH 086/155] fix: [new object pgp-meta] remove first seen/last seen + fix description --- objects/pgp-meta/definition.json | 20 ++++---------------- 1 file changed, 4 insertions(+), 16 deletions(-) diff --git a/objects/pgp-meta/definition.json b/objects/pgp-meta/definition.json index b28461f..c040538 100644 --- a/objects/pgp-meta/definition.json +++ b/objects/pgp-meta/definition.json @@ -1,30 +1,18 @@ { "required": [ - "key" + "key-id" ], "attributes": { - "first-seen": { - "description": "First time the tuple has been seen", - "disable_correlation": true, - "ui-priority": 0, - "misp-attribute": "datetime" - }, - "last-seen": { - "description": "Last time the tuple has been seen", - "disable_correlation": true, - "ui-priority": 0, - "misp-attribute": "datetime" - }, "key-id": { - "description": "key-id", + "description": "Key ID in hexadecimal", "ui-priority": 1, "misp-attribute": "text", "multiple": true }, "user-id-email": { - "description": "User ID packet, email address of the key holder", + "description": "User ID packet, email address of the key holder (UTF-8 text)", "ui-priority": 1, - "misp-attribute": "email-subject", + "misp-attribute": "text", "multiple": true }, "user-id-name": { From 195fc46a139dba2fdbdc46cb0d6e510738508366 Mon Sep 17 00:00:00 2001 From: Andras Iklody Date: Tue, 4 Feb 2020 11:46:24 +0100 Subject: [PATCH 087/155] fix: added iban as an alternative to bank account for the requirements - fixes https://github.com/MISP/MISP/issues/5358 --- objects/bank-account/definition.json | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/objects/bank-account/definition.json b/objects/bank-account/definition.json index 4952a7e..37d0527 100644 --- a/objects/bank-account/definition.json +++ b/objects/bank-account/definition.json @@ -1,6 +1,7 @@ { "requiredOneOf": [ - "account" + "account", + "iban" ], "attributes": { "text": { @@ -162,7 +163,7 @@ ] } }, - "version": 1, + "version": 2, "description": "An object describing bank account information based on account description from goAML 4.0.", "meta-category": "financial", "uuid": "b4712203-95a8-4883-80e9-b566f5df11c9", From ccc0f4dd1fb57f253e8eaeeb71a919215c232e22 Mon Sep 17 00:00:00 2001 From: Alexandre Dulaunoy Date: Wed, 5 Feb 2020 15:04:10 +0100 Subject: [PATCH 088/155] chg: [phone] add brand and model --- objects/phone/definition.json | 14 +++++++++++++- 1 file changed, 13 insertions(+), 1 deletion(-) diff --git a/objects/phone/definition.json b/objects/phone/definition.json index 2c1ae23..0f2c0d7 100644 --- a/objects/phone/definition.json +++ b/objects/phone/definition.json @@ -51,6 +51,18 @@ "ui-priority": 1, "misp-attribute": "text" }, + "brand": { + "description": "Brand of the phone.", + "disable_correlation": true, + "ui-priority": 1, + "misp-attribute": "text" + }, + "model": { + "description": "Model of the phone.", + "disable_correlation": true, + "ui-priority": 1, + "misp-attribute": "text" + }, "last-seen": { "description": "When the phone has been accessible or seen for the last time.", "disable_correlation": true, @@ -64,7 +76,7 @@ "misp-attribute": "datetime" } }, - "version": 2, + "version": 4, "description": "A phone or mobile phone object which describe a phone.", "meta-category": "misc", "uuid": "d7e4fbdd-b551-4862-bddb-a0b470a38509", From ab6d7c388597121653912535de0cba302f651289 Mon Sep 17 00:00:00 2001 From: Alexandre Dulaunoy Date: Wed, 5 Feb 2020 15:06:37 +0100 Subject: [PATCH 089/155] chg: [organization] typo fixed + description added --- objects/organization/definition.json | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/objects/organization/definition.json b/objects/organization/definition.json index 67bb5a6..4e39398 100644 --- a/objects/organization/definition.json +++ b/objects/organization/definition.json @@ -16,11 +16,16 @@ "misp-attribute": "text", "multiple": true }, - "type-of-organizarion": { + "type-of-organization": { "description": "Type of the organization", "ui-priority": 97, "misp-attribute": "text" }, + "description": { + "description": "Description of the organization", + "ui-priority": 96, + "misp-attribute": "text" + }, "date-of-inception": { "description": "Date of inception of the organization", "ui-priority": 0, @@ -73,7 +78,7 @@ "multiple": true } }, - "version": 3, + "version": 4, "description": "An object which describes an organization.", "meta-category": "misc", "uuid": "f750e12b-127a-432c-b022-b3f9153c4e2a", From 78fe4325b7961956d83ff7824103dab0f36abc13 Mon Sep 17 00:00:00 2001 From: Alexandre Dulaunoy Date: Wed, 5 Feb 2020 15:15:23 +0100 Subject: [PATCH 090/155] chg: [vehicule] image + type of vehicle added --- objects/vehicle/definition.json | 23 ++++++++++++++++++++++- 1 file changed, 22 insertions(+), 1 deletion(-) diff --git a/objects/vehicle/definition.json b/objects/vehicle/definition.json index 31650be..9a6d1fc 100644 --- a/objects/vehicle/definition.json +++ b/objects/vehicle/definition.json @@ -44,6 +44,21 @@ "description": "Type of the vehicule", "ui-priority": 0, "misp-attribute": "text", + "sane_default": [ + "car", + "bus", + "caravan", + "bicycle", + "boat", + "taxi", + "camper van", + "motorcycle", + "truck", + "scooter", + "tractor", + "trailer", + "van" + ], "disable_correlation": true }, "make": { @@ -87,6 +102,12 @@ "misp-attribute": "text", "multiple": true }, + "image": { + "description": "Image of the vehicle.", + "ui-priority": 0, + "misp-attribute": "attachment", + "multiple": true + }, "gearbox": { "description": "Gearbox", "ui-priority": 0, @@ -100,7 +121,7 @@ "multiple": true } }, - "version": 2, + "version": 3, "description": "Vehicle object template to describe a vehicle information and registration", "meta-category": "misc", "uuid": "683c076c-f695-4ff2-8efa-e98a418049f4", From 0c3aa141654a7d759e4add2344bdb0d414a5620c Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Rapha=C3=ABl=20Vinot?= Date: Thu, 6 Feb 2020 10:57:44 +0100 Subject: [PATCH 091/155] fix: attachment object relation does not exists. --- objects/blog/definition.json | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/objects/blog/definition.json b/objects/blog/definition.json index 88ccceb..7528174 100644 --- a/objects/blog/definition.json +++ b/objects/blog/definition.json @@ -3,8 +3,7 @@ "post", "archive", "url", - "link", - "attachment" + "link" ], "attributes": { "post": { From 3f9aca8e27290cbb859427aeb228bba62adb71e0 Mon Sep 17 00:00:00 2001 From: Alexandre Dulaunoy Date: Thu, 6 Feb 2020 11:03:33 +0100 Subject: [PATCH 092/155] chg: [email] ip-src added in the email object templated as requested by Norberto Chavez Ref: https://twitter.com/NORBERTOCHAVEZ/status/1225213457429127170 --- objects/email/definition.json | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/objects/email/definition.json b/objects/email/definition.json index fe3553e..d6d7142 100644 --- a/objects/email/definition.json +++ b/objects/email/definition.json @@ -3,7 +3,7 @@ "uuid": "a0c666e0-fc65-4be8-b48f-3423d788b552", "meta-category": "network", "description": "Email object describing an email with meta-information", - "version": 13, + "version": 14, "attributes": { "reply-to": { "description": "Email address the reply will be sent to", @@ -174,6 +174,12 @@ "ui-priority": 0, "disable_correlation": true }, + "ip-src": { + "description": "Source IP address of the email sender", + "misp-attribute": "ip-src", + "ui-priority": 0, + "multiple": true + }, "eml": { "description": "Full EML", "misp-attribute": "attachment", From c32c7f4155e96ed1dcd76e9734c1ce33af73a59d Mon Sep 17 00:00:00 2001 From: Alexandre Dulaunoy Date: Thu, 6 Feb 2020 11:36:13 +0100 Subject: [PATCH 093/155] chg: [sms] missing Cellebrite fields added --- objects/short-message-service/definition.json | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-) diff --git a/objects/short-message-service/definition.json b/objects/short-message-service/definition.json index 6ad1a92..e065795 100644 --- a/objects/short-message-service/definition.json +++ b/objects/short-message-service/definition.json @@ -37,9 +37,19 @@ "ui-priority": 0, "misp-attribute": "datetime", "disable_correlation": true + }, + "smsc": { + "description": "SMS Message Center", + "ui-priority": 0, + "misp-attribute": "text" + }, + "name": { + "description": "Sender name", + "ui-priority": 0, + "misp-attribute": "text" } }, - "version": 1, + "version": 2, "description": "Short Message Service (SMS) object template describing one or more SMS message. Restriction of the initial format 3GPP 23.038 GSM character set doesn't apply.", "meta-category": "misc", "uuid": "4851a3dc-e1a6-43ac-9d97-f0d13a099fd2", From 371788589cfca236da8984e1c2f4d2a23006e828 Mon Sep 17 00:00:00 2001 From: Alexandre Dulaunoy Date: Thu, 6 Feb 2020 11:55:27 +0100 Subject: [PATCH 094/155] chg: [rtir] disable correlation on incident state --- objects/rtir/definition.json | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/objects/rtir/definition.json b/objects/rtir/definition.json index 900bd59..c705b47 100644 --- a/objects/rtir/definition.json +++ b/objects/rtir/definition.json @@ -47,7 +47,8 @@ "resolved", "rejected", "deleted" - ] + ], + "disable_correlation": true }, "ticket-number": { "description": "ticket-number of the RTIR ticket", @@ -55,7 +56,7 @@ "misp-attribute": "text" } }, - "version": 1, + "version": 2, "description": "RTIR - Request Tracker for Incident Response", "meta-category": "misc", "uuid": "7534ee19-0a1f-4f46-a197-e6e73e457943", From 3ba77c9d2cfea5c27bc8935812d83be54c4f0fd4 Mon Sep 17 00:00:00 2001 From: Alexandre Dulaunoy Date: Thu, 6 Feb 2020 12:06:26 +0100 Subject: [PATCH 095/155] chg: [sms] the SMS center is a phone number --- objects/short-message-service/definition.json | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/objects/short-message-service/definition.json b/objects/short-message-service/definition.json index e065795..1475aa3 100644 --- a/objects/short-message-service/definition.json +++ b/objects/short-message-service/definition.json @@ -41,7 +41,7 @@ "smsc": { "description": "SMS Message Center", "ui-priority": 0, - "misp-attribute": "text" + "misp-attribute": "phone-number" }, "name": { "description": "Sender name", @@ -49,7 +49,7 @@ "misp-attribute": "text" } }, - "version": 2, + "version": 3, "description": "Short Message Service (SMS) object template describing one or more SMS message. Restriction of the initial format 3GPP 23.038 GSM character set doesn't apply.", "meta-category": "misc", "uuid": "4851a3dc-e1a6-43ac-9d97-f0d13a099fd2", From 1a40095f1ad58a515740038eee797d692d1cc8f5 Mon Sep 17 00:00:00 2001 From: VVX7 Date: Sun, 9 Feb 2020 11:39:36 -0500 Subject: [PATCH 096/155] new: [objects] add instant-message object. add instant-message-group object. --- objects/instant-message-group/definition.json | 80 +++++++++++++ objects/instant-message/definition.json | 113 ++++++++++++++++++ 2 files changed, 193 insertions(+) create mode 100644 objects/instant-message-group/definition.json create mode 100644 objects/instant-message/definition.json diff --git a/objects/instant-message-group/definition.json b/objects/instant-message-group/definition.json new file mode 100644 index 0000000..6232afb --- /dev/null +++ b/objects/instant-message-group/definition.json @@ -0,0 +1,80 @@ +{ + "requiredOneOf": [ + "group-name", + "group-alias", + "archive", + "attachment" + ], + "attributes": { + "group-name": { + "description": "The name of the group, channel or community.", + "ui-priority": 1, + "misp-attribute": "text" + }, + "group-alias": { + "description": "Aliases of group, channel or community.", + "ui-priority": 1, + "multiple": true, + "misp-attribute": "text" + }, + "app-used": { + "description": "The IM application used to send the message.", + "ui-priority": 1, + "misp-attribute": "text", + "disable_correlation": true, + "multiple": true, + "sane_default": [ + "WhatsApp", + "Google Hangouts", + "Facebook Messenger", + "Telegram", + "Signal", + "WeChat", + "BlackBerry Messenger", + "TeamSpeak", + "TorChat", + "RetroShare", + "Slack" + ] + }, + "username": { + "description": "A user account who is a member of the group.", + "ui-priority": 1, + "misp-attribute": "text", + "multiple": true + }, + "person-name": { + "description": "A person who is a member of the group.", + "ui-priority": 1, + "misp-attribute": "text", + "multiple": true + }, + "url": { + "description": "Original URL location of the group (potentially malicious).", + "ui-priority": 1, + "misp-attribute": "url" + }, + "link": { + "description": "Original link into the group (Supposed harmless).", + "ui-priority": 1, + "misp-attribute": "link" + }, + "archive": { + "description": "Archive of the original group (Internet Archive, Archive.is, etc).", + "ui-priority": 1, + "multiple": true, + "misp-attribute": "link" + }, + "attachment": { + "description": "A screen capture or exported list of contacts, group members, etc.", + "ui-priority": 1, + "multiple": true, + "misp-attribute": "attachment" + } + }, + "version": 1, + "description": "Instant Message (IM) group object template describing a public or private IM group, channel or conversation.", + "meta-category": "misc", + "uuid": "e26becca-2149-4bc0-b3fb-7090d43af28f", + "name": "instant-message-group" +} diff --git a/objects/instant-message/definition.json b/objects/instant-message/definition.json new file mode 100644 index 0000000..ecddaa2 --- /dev/null +++ b/objects/instant-message/definition.json @@ -0,0 +1,113 @@ +{ + "requiredOneOf": [ + "body", + "from", + "from-user" + ], + "attributes": { + "body": { + "description": "Message body of the IM.", + "ui-priority": 1, + "misp-attribute": "text" + }, + "from-number": { + "description": "Phone number used to send the message.", + "ui-priority": 1, + "misp-attribute": "phone-number", + "multiple": true + }, + "to-number": { + "description": "Phone number receiving the message.", + "ui-priority": 1, + "misp-attribute": "phone-number", + "multiple": true + }, + "from-user": { + "description": "User account that sent the message.", + "ui-priority": 1, + "misp-attribute": "text", + "multiple": true + }, + "to-user": { + "description": "User account that received the message.", + "ui-priority": 1, + "misp-attribute": "text", + "multiple": true + }, + "from-name": { + "description": "Name of the person that sent the message.", + "ui-priority": 1, + "misp-attribute": "text", + "multiple": true + }, + "to-name": { + "description": "Name of the person that received the message.", + "ui-priority": 1, + "misp-attribute": "text", + "multiple": true + }, + "subject": { + "description": "Subject of the message if any.", + "ui-priority": 0, + "misp-attribute": "text" + }, + "app-used": { + "description": "The IM application used to send the message.", + "ui-priority": 1, + "misp-attribute": "text", + "disable_correlation": true, + "sane_default": [ + "WhatsApp", + "Google Hangouts", + "Facebook Messenger", + "Telegram", + "Signal", + "WeChat", + "BlackBerry Messenger", + "TeamSpeak", + "TorChat", + "RetroShare", + "Slack" + ] + }, + "url": { + "description": "Original URL location of the message (potentially malicious).", + "ui-priority": 1, + "misp-attribute": "url" + }, + "link": { + "description": "Original link into the message (Supposed harmless).", + "ui-priority": 1, + "misp-attribute": "link" + }, + "archive": { + "description": "Archive of the original message (Internet Archive, Archive.is, etc).", + "ui-priority": 1, + "multiple": true, + "misp-attribute": "link" + }, + "attachment": { + "description": "The message file or screen capture.", + "ui-priority": 1, + "multiple": true, + "misp-attribute": "attachment" + }, + "sent-date": { + "description": "Initial sent date of the message.", + "ui-priority": 0, + "misp-attribute": "datetime", + "disable_correlation": true + }, + "received-date": { + "description": "Received date of the message.", + "ui-priority": 0, + "misp-attribute": "datetime", + "disable_correlation": true + } + }, + "version": 1, + "description": "Instant Message (IM) object template describing one or more IM message.", + "meta-category": "misc", + "uuid": "5fa51a24-f40f-4696-a77e-d31e26bab5fc", + "name": "instant-message" +} From f43c2c2c6e41d8e8f82a1616958561487f3d6a15 Mon Sep 17 00:00:00 2001 From: Alexandre Dulaunoy Date: Mon, 10 Feb 2020 11:15:17 +0100 Subject: [PATCH 097/155] chg: [relationships] 'knows' relationship added Request: via Twitter DM message --- relationships/definition.json | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/relationships/definition.json b/relationships/definition.json index fae3795..763274f 100644 --- a/relationships/definition.json +++ b/relationships/definition.json @@ -1,5 +1,5 @@ { - "version": 17, + "version": 18, "values": [ { "name": "derived-from", @@ -991,6 +991,13 @@ "format": [ "misp" ] + }, + { + "name": "knows", + "description": "Represents an object having the knowledge of another object.", + "format": [ + "misp" + ] } ], "description": "Default type of relationships in MISP objects.", From 2738648e813b8b5a3a155ce58389682de1abddf8 Mon Sep 17 00:00:00 2001 From: ater49 Date: Mon, 10 Feb 2020 14:59:35 +0100 Subject: [PATCH 098/155] Adding some parts from HAR format description (http://www.softwareishard.com/blog/har-12-spec/) (More to come) --- objects/cookie/definition.json | 26 +++++++++++++++++++++++++- objects/http-request/definition.json | 14 ++++++++++++-- 2 files changed, 37 insertions(+), 3 deletions(-) diff --git a/objects/cookie/definition.json b/objects/cookie/definition.json index dab118f..450e605 100644 --- a/objects/cookie/definition.json +++ b/objects/cookie/definition.json @@ -18,6 +18,30 @@ "ui-priority": 0, "misp-attribute": "text" }, + "path": { + "description": "Path defined in the cookie", + "ui-priority": 0, + "disable_correlation": true, + "misp-attribute": "text" + }, + "expires": { + "description": "Expiration date/time of the cookie", + "ui-priority": 0, + "disable_correlation": true, + "misp-attribute": "datetime" + }, + "http-only": { + "description": "True if send only through HTTP", + "ui-priority": 0, + "disable_correlation": true, + "misp-attribute": "boolean" + }, + "secure": { + "description": "True if cookie is sent over TLS", + "ui-priority": 0, + "disable_correlation": true, + "misp-attribute": "boolean" + }, "text": { "description": "A description of the cookie.", "disable_correlation": true, @@ -38,7 +62,7 @@ "misp-attribute": "text" } }, - "version": 2, + "version": 3, "description": "An HTTP cookie (web cookie, browser cookie) is a small piece of data that a server sends to the user's web browser. The browser may store it and send it back with the next request to the same server. Typically, it's used to tell if two requests came from the same browser — keeping a user logged-in, for example. It remembers stateful information for the stateless HTTP protocol. (as defined by the Mozilla foundation.", "meta-category": "network", "uuid": "7755ad19-55c7-4da4-805e-197cf81bbcb8", diff --git a/objects/http-request/definition.json b/objects/http-request/definition.json index 04c4e6e..32c119d 100644 --- a/objects/http-request/definition.json +++ b/objects/http-request/definition.json @@ -40,7 +40,17 @@ ], "description": "An HTTP cookie previously sent by the server with Set-Cookie", "ui-priority": 1, - "misp-attribute": "text" + "misp-attribute": "text", + "multiple": true + }, + "header": { + "categories": [ + "Network activity" + ], + "description": "An HTTP header sent during HTTP request", + "ui-priority": 1, + "misp-attribute": "text", + "multiple": true }, "host": { "categories": [ @@ -120,7 +130,7 @@ "misp-attribute": "user-agent" } }, - "version": 3, + "version": 4, "description": "A single HTTP request header", "meta-category": "network", "uuid": "b4a8d163-8110-4239-bfcf-e08f3a9fdf7b", From 6380007b10f7f2b146aca8a6e105b7df49a3db62 Mon Sep 17 00:00:00 2001 From: Deborah Servili Date: Thu, 13 Feb 2020 12:28:47 +0100 Subject: [PATCH 099/155] allow several subjects or sender for email objects --- objects/email/definition.json | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/objects/email/definition.json b/objects/email/definition.json index d6d7142..99122f4 100644 --- a/objects/email/definition.json +++ b/objects/email/definition.json @@ -57,7 +57,8 @@ "ui-priority": 1, "categories": [ "Payload delivery" - ] + ], + "multiple": true }, "screenshot": { "description": "Screenshot of email", @@ -141,7 +142,8 @@ "ui-priority": 1, "categories": [ "Payload delivery" - ] + ], + "multiple": true }, "return-path": { "description": "Message return path", @@ -157,7 +159,8 @@ "ui-priority": 1, "categories": [ "Payload delivery" - ] + ], + "multiple": true }, "email-body": { "description": "Body of the email", From fdc24a8df893e135ebf677345aba871ea75fd347 Mon Sep 17 00:00:00 2001 From: Deborah Servili Date: Thu, 13 Feb 2020 12:30:08 +0100 Subject: [PATCH 100/155] update version --- objects/email/definition.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/objects/email/definition.json b/objects/email/definition.json index 99122f4..f984e0a 100644 --- a/objects/email/definition.json +++ b/objects/email/definition.json @@ -3,7 +3,7 @@ "uuid": "a0c666e0-fc65-4be8-b48f-3423d788b552", "meta-category": "network", "description": "Email object describing an email with meta-information", - "version": 14, + "version": 15, "attributes": { "reply-to": { "description": "Email address the reply will be sent to", From 5c46a3aad422ee3a64c884e4359846cb003e7320 Mon Sep 17 00:00:00 2001 From: Terrtia Date: Fri, 14 Feb 2020 17:08:37 +0100 Subject: [PATCH 101/155] chg: add domain crawled object --- objects/crawled/definition.json | 39 +++++++++++++++++++++++++++++++++ 1 file changed, 39 insertions(+) create mode 100644 objects/crawled/definition.json diff --git a/objects/crawled/definition.json b/objects/crawled/definition.json new file mode 100644 index 0000000..9d255d0 --- /dev/null +++ b/objects/crawled/definition.json @@ -0,0 +1,39 @@ +{ + "required": [ + "domain" + ], + "attributes": { + "text": { + "description": "A description of the tuple", + "disable_correlation": true, + "ui-priority": 1, + "misp-attribute": "text", + "recommended": false + }, + "domain": { + "description": "Domain name", + "categories": [ + "Network activity", + "External analysis" + ], + "ui-priority": 1, + "misp-attribute": "domain", + "multiple": true + }, + "url": { + "description": "domain url", + "categories": [ + "Network activity", + "External analysis" + ], + "ui-priority": 1, + "misp-attribute": "url", + "multiple": true + } + }, + "version": 1, + "description": "A domain crawled over time", + "meta-category": "network", + "uuid": "bad4888d-c44e-4612-b08f-3d97c1e0014a", + "name": "crawled" +} From 42df9d2e2f14543e297e9c041ad41d63edb2e707 Mon Sep 17 00:00:00 2001 From: Terrtia Date: Fri, 14 Feb 2020 17:11:42 +0100 Subject: [PATCH 102/155] chg: [crawled domain] rename object --- objects/{crawled => domain-crawled}/definition.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) rename objects/{crawled => domain-crawled}/definition.json (96%) diff --git a/objects/crawled/definition.json b/objects/domain-crawled/definition.json similarity index 96% rename from objects/crawled/definition.json rename to objects/domain-crawled/definition.json index 9d255d0..9118600 100644 --- a/objects/crawled/definition.json +++ b/objects/domain-crawled/definition.json @@ -35,5 +35,5 @@ "description": "A domain crawled over time", "meta-category": "network", "uuid": "bad4888d-c44e-4612-b08f-3d97c1e0014a", - "name": "crawled" + "name": "domain-crawled" } From 1d0065e85255d6ebff5dd753d7e7ff3dfdd033a7 Mon Sep 17 00:00:00 2001 From: Alexandre Dulaunoy Date: Mon, 17 Feb 2020 07:46:58 +0100 Subject: [PATCH 103/155] new: [iot] a first version of the IoT object Ref: based on the workshop discussion in https://github.com/C00kie-/workshop-materials The idea is to have this root object when a new IoT device is documented and further objects will be connected such as firmware or even file object --- objects/iot-device/definition.json | 129 +++++++++++++++++++++++++++++ 1 file changed, 129 insertions(+) create mode 100644 objects/iot-device/definition.json diff --git a/objects/iot-device/definition.json b/objects/iot-device/definition.json new file mode 100644 index 0000000..9a20484 --- /dev/null +++ b/objects/iot-device/definition.json @@ -0,0 +1,129 @@ +{ + "requiredOneOf": [ + "model", + "vendor", + "architecture", + "boot-log", + "picture-pcb", + "picture-device" + ], + "attributes": { + "picture-pcb": { + "description": "Picture of the IoT device PCB", + "ui-priority": 10, + "misp-attribute": "attachment", + "multiple": true + }, + "picture-device": { + "description": "Picture of the IoT device", + "ui-priority": 10, + "misp-attribute": "attachment", + "multiple": true + }, + "fcc-id": { + "description": "FCC-ID of the IoT device", + "ui-priority": 10, + "misp-attribute": "text", + "multiple": true + }, + "boot-log": { + "description": "Boot log of the IoT device", + "ui-priority": 10, + "misp-attribute": "attachment", + "multiple": true + }, + "platform": { + "description": "Platform of of the IoT device", + "ui-priority": 10, + "misp-attribute": "text", + "sane_default": [ + "mach-aspeed", + "mach-at91", + "mach-bcm283x", + "mach-bcmstb", + "mach-cortina", + "mach-davinci", + "mach-exynos", + "mach-highbank", + "mach-imx", + "mach-integrator", + "mach-k3", + "mach-keystone", + "mach-kirkwood", + "mach-mediatek", + "mach-meson", + "mach-mvebu", + "mach-omap2", + "mach-orion5x", + "mach-owl", + "mach-qemu", + "mach-rmobile", + "mach-rockchip", + "mach-s5pc1xx", + "mach-snapdragon", + "mach-socfpga", + "mach-sti", + "mach-stm32", + "mach-stm32mp", + "mach-sunxi", + "mach-tegra", + "mach-u8500", + "mach-uniphier", + "mach-versal", + "mach-versatile", + "mach-zynq", + "mach-zynqmp", + "mach-zynqmp-r5", + "mcf5227x", + "mcf523x", + "mcf52x2", + "mcf530x", + "mcf532x", + "mcf5445x", + "mcf547x_8x", + "mach-ath79", + "mach-bmips", + "mach-jz47xx", + "mach-mscc", + "mach-mtmips", + "mach-pic32" + ] + }, + "architecture": { + "description": "architecture of the IoT device", + "ui-priority": 1, + "misp-attribute": "text", + "sane_default": [ + "ARC", + "ARM", + "M68000", + "MicroBlaze", + "MIPS", + "NSD32", + "Nios II", + "PowerPC", + "RISC-V", + "Sandbox", + "SH", + "x86", + "Xtensa" + ] + }, + "model": { + "description": "Model of the IoT device", + "ui-priority": 1, + "misp-attribute": "text", + "multiple": true + }, + "vendor": { + "description": "Vendor of the IoT device", + "ui-priority": 1, + "misp-attribute": "text" + } + }, + "version": 1, + "description": "An IoT device.", + "meta-category": "iot", + "uuid": "9f8cea74-16fe-4968-a2b4-026676949ac6", + "name": "iot-device" +} From e45c2df33adf9e6e20b75971812d6eb0e42f5654 Mon Sep 17 00:00:00 2001 From: Alexandre Dulaunoy Date: Mon, 17 Feb 2020 08:28:58 +0100 Subject: [PATCH 104/155] chg: [schema] iot category added --- schema_objects.json | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/schema_objects.json b/schema_objects.json index 91d1d47..98da752 100644 --- a/schema_objects.json +++ b/schema_objects.json @@ -260,7 +260,8 @@ "misc", "internal", "vulnerability", - "climate" + "climate", + "iot" ], "type": "string" }, From cf30efabc6c3940dfe1c21cbef07e9bba9f9c946 Mon Sep 17 00:00:00 2001 From: Alexandre Dulaunoy Date: Mon, 17 Feb 2020 08:33:51 +0100 Subject: [PATCH 105/155] chg: [iot] because reusing UUID is bad --- objects/iot-device/definition.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/objects/iot-device/definition.json b/objects/iot-device/definition.json index 9a20484..1a9e9bd 100644 --- a/objects/iot-device/definition.json +++ b/objects/iot-device/definition.json @@ -124,6 +124,6 @@ "version": 1, "description": "An IoT device.", "meta-category": "iot", - "uuid": "9f8cea74-16fe-4968-a2b4-026676949ac6", + "uuid": "3de3b92a-859b-431b-9c4f-1a81de1d9637", "name": "iot-device" } From 83073d8c65ba735208a64af13097be8ac07317db Mon Sep 17 00:00:00 2001 From: Alexandre Dulaunoy Date: Mon, 17 Feb 2020 08:55:47 +0100 Subject: [PATCH 106/155] chg: [iot] add SPI, Serial and JTAG status --- objects/iot-device/definition.json | 38 +++++++++++++++++++++++++++++- 1 file changed, 37 insertions(+), 1 deletion(-) diff --git a/objects/iot-device/definition.json b/objects/iot-device/definition.json index 1a9e9bd..defd997 100644 --- a/objects/iot-device/definition.json +++ b/objects/iot-device/definition.json @@ -119,9 +119,45 @@ "description": "Vendor of the IoT device", "ui-priority": 1, "misp-attribute": "text" + }, + "spi-interface": { + "description": "SPI interface of the IoT device", + "ui-priority": 1, + "misp-attribute": "text", + "disable_correlation": true, + "sane_default": [ + "Yes", + "No", + "Unknown", + "Disabled" + ] + }, + "serial-interface": { + "description": "Serial interface of the IoT device", + "ui-priority": 1, + "misp-attribute": "text", + "disable_correlation": true, + "sane_default": [ + "Yes", + "No", + "Unknown", + "Disabled" + ] + }, + "jtag-interface": { + "description": "JTAG interface of the IoT device", + "ui-priority": 1, + "misp-attribute": "text", + "disable_correlation": true, + "sane_default": [ + "Yes", + "No", + "Unknown", + "Disabled" + ] } }, - "version": 1, + "version": 2, "description": "An IoT device.", "meta-category": "iot", "uuid": "3de3b92a-859b-431b-9c4f-1a81de1d9637", From 566612302f2f17aaf0e4b67ee7502dcd00678965 Mon Sep 17 00:00:00 2001 From: Terrtia Date: Mon, 17 Feb 2020 10:00:21 +0100 Subject: [PATCH 107/155] chg: [domain-crawled] domain shouldn't be a multiple --- objects/domain-crawled/definition.json | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/objects/domain-crawled/definition.json b/objects/domain-crawled/definition.json index 9118600..4c89e6e 100644 --- a/objects/domain-crawled/definition.json +++ b/objects/domain-crawled/definition.json @@ -17,8 +17,7 @@ "External analysis" ], "ui-priority": 1, - "misp-attribute": "domain", - "multiple": true + "misp-attribute": "domain" }, "url": { "description": "domain url", @@ -31,7 +30,7 @@ "multiple": true } }, - "version": 1, + "version": 2, "description": "A domain crawled over time", "meta-category": "network", "uuid": "bad4888d-c44e-4612-b08f-3d97c1e0014a", From 36ae20bf02e1643f2fb2a7426017b0821ababab3 Mon Sep 17 00:00:00 2001 From: Alexandre Dulaunoy Date: Mon, 17 Feb 2020 14:27:05 +0100 Subject: [PATCH 108/155] chg: [pe] imphash and impfuzzy can be as key attribute --- objects/pe/definition.json | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/objects/pe/definition.json b/objects/pe/definition.json index 1188c48..5b0c0e4 100644 --- a/objects/pe/definition.json +++ b/objects/pe/definition.json @@ -4,7 +4,9 @@ "type", "original-filename", "internal-filename", - "entrypoint-address" + "entrypoint-address", + "imphash", + "impfuzzy" ], "attributes": { "pehash": { @@ -119,7 +121,7 @@ "misp-attribute": "text" } }, - "version": 4, + "version": 5, "description": "Object describing a Portable Executable", "meta-category": "file", "uuid": "cf7adecc-d4f0-4e88-9d90-f978ee151a07", From 8fa25f4f4705c566fcdf10e354af5b7f234be33d Mon Sep 17 00:00:00 2001 From: Alexandre Dulaunoy Date: Mon, 17 Feb 2020 14:29:30 +0100 Subject: [PATCH 109/155] chg: [file] imphash removed as it should be at PE level --- objects/file/definition.json | 7 +------ 1 file changed, 1 insertion(+), 6 deletions(-) diff --git a/objects/file/definition.json b/objects/file/definition.json index 937d407..07897ae 100644 --- a/objects/file/definition.json +++ b/objects/file/definition.json @@ -441,18 +441,13 @@ "windows-874" ] }, - "imphash": { - "description": "Hash (md5) calculated from the import table", - "ui-priority": 0, - "misp-attribute": "imphash" - }, "compilation-timestamp": { "description": "Compilation timestamp", "ui-priority": 0, "misp-attribute": "datetime" } }, - "version": 19, + "version": 20, "description": "File object describing a file with meta-information", "meta-category": "file", "uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", From 6ed76f49481e22b880744cf39f361f4ef51f32e5 Mon Sep 17 00:00:00 2001 From: Alexandre Dulaunoy Date: Mon, 17 Feb 2020 15:07:49 +0100 Subject: [PATCH 110/155] add: [iot-firmware] new object template to describe IoT firmware The relationship will be often between iot-device and iot-firmware. Ref: https://github.com/C00kie-/workshop-materials --- objects/iot-firmware/definition.json | 99 ++++++++++++++++++++++++++++ 1 file changed, 99 insertions(+) create mode 100644 objects/iot-firmware/definition.json diff --git a/objects/iot-firmware/definition.json b/objects/iot-firmware/definition.json new file mode 100644 index 0000000..4ba6e67 --- /dev/null +++ b/objects/iot-firmware/definition.json @@ -0,0 +1,99 @@ +{ + "requiredOneOf": [ + "firmware", + "filename", + "binwalk-output" + ], + "attributes": { + "firmware": { + "description": "Firmware of the IoT device", + "ui-priority": 10, + "misp-attribute": "attachment", + "multiple": true + }, + "version": { + "description": "Version of the firmware", + "ui-priority": 10, + "misp-attribute": "text", + "multiple": true + }, + "filename": { + "description": "Filename of the firmware", + "ui-priority": 10, + "misp-attribute": "text" + }, + "boot-log": { + "description": "Boot log of the IoT device for this firmware", + "ui-priority": 10, + "misp-attribute": "attachment", + "multiple": true + }, + "binwalk-output": { + "description": "Binwalk output of the firmware image", + "ui-priority": 10, + "misp-attribute": "attachment" + }, + "format": { + "description": "Format of the firmware", + "ui-priority": 10, + "misp-attribute": "text", + "sane_default": [ + "raw", + "Intel hex", + "Motorola S-Record", + "Unknown" + ] + }, + "md5": { + "description": "[Insecure] MD5 hash (128 bits)", + "ui-priority": 1, + "misp-attribute": "md5", + "recommended": false + }, + "sha1": { + "description": "[Insecure] Secure Hash Algorithm 1 (160 bits)", + "ui-priority": 1, + "misp-attribute": "sha1", + "recommended": false + }, + "sha224": { + "description": "Secure Hash Algorithm 2 (224 bits)", + "ui-priority": 0, + "misp-attribute": "sha224", + "recommended": false + }, + "sha256": { + "description": "Secure Hash Algorithm 2 (256 bits)", + "ui-priority": 1, + "misp-attribute": "sha256" + }, + "sha384": { + "description": "Secure Hash Algorithm 2 (384 bits)", + "ui-priority": 0, + "misp-attribute": "sha384", + "recommended": false + }, + "sha512": { + "description": "Secure Hash Algorithm 2 (512 bits)", + "ui-priority": 1, + "misp-attribute": "sha512" + }, + "size-in-bytes": { + "description": "Size of the file, in bytes", + "disable_correlation": true, + "ui-priority": 0, + "misp-attribute": "size-in-bytes" + }, + "binwalk-entropy-graph": { + "description": "Entropy graph of the firmware", + "disable_correlation": true, + "ui-priority": 0, + "misp-attribute": "attachment" + } + }, + "version": 1, + "description": "A firmware for an IoT device.", + "meta-category": "iot", + "uuid": "8bafb8fc-d986-4a58-b22b-6b8c7c0e8b70", + "name": "iot-firmware" +} From 8de8d85979e3ecf3c426c660f58400a48695e42e Mon Sep 17 00:00:00 2001 From: Alexandre Dulaunoy Date: Mon, 17 Feb 2020 23:12:09 +0100 Subject: [PATCH 111/155] chg: [iot-device] reference added --- objects/iot-device/definition.json | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/objects/iot-device/definition.json b/objects/iot-device/definition.json index defd997..0aac22f 100644 --- a/objects/iot-device/definition.json +++ b/objects/iot-device/definition.json @@ -120,6 +120,12 @@ "ui-priority": 1, "misp-attribute": "text" }, + "reference": { + "description": "Reference of the IoT device", + "ui-priority": 1, + "misp-attribute": "link", + "multiple": true + }, "spi-interface": { "description": "SPI interface of the IoT device", "ui-priority": 1, @@ -157,7 +163,7 @@ ] } }, - "version": 2, + "version": 3, "description": "An IoT device.", "meta-category": "iot", "uuid": "3de3b92a-859b-431b-9c4f-1a81de1d9637", From d110657604615be05759b290f106677c3c8db1c9 Mon Sep 17 00:00:00 2001 From: Alexandre Dulaunoy Date: Tue, 25 Feb 2020 10:53:17 +0100 Subject: [PATCH 112/155] chg: [vulnerability] remove underscore from the object --- objects/vulnerability/definition.json | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/objects/vulnerability/definition.json b/objects/vulnerability/definition.json index bc5513e..0849928 100644 --- a/objects/vulnerability/definition.json +++ b/objects/vulnerability/definition.json @@ -25,7 +25,7 @@ "ui-priority": 0, "misp-attribute": "text" }, - "vulnerable_configuration": { + "vulnerable-configuration": { "description": "The vulnerable configuration is described in CPE format", "multiple": true, "ui-priority": 0, @@ -90,7 +90,7 @@ "multiple": true } }, - "version": 5, + "version": 6, "description": "Vulnerability object describing a common vulnerability enumeration which can describe published, unpublished, under review or embargo vulnerability for software, equipments or hardware.", "meta-category": "vulnerability", "uuid": "81650945-f186-437b-8945-9f31715d32da", From d9226e0f5a535e253e1b7b5c3dc7b30441f819f4 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Rapha=C3=ABl=20Vinot?= Date: Wed, 26 Feb 2020 14:49:59 +0100 Subject: [PATCH 113/155] fix: Typo in requiredOneOf --- objects/vulnerability/definition.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/objects/vulnerability/definition.json b/objects/vulnerability/definition.json index 0849928..d381ffd 100644 --- a/objects/vulnerability/definition.json +++ b/objects/vulnerability/definition.json @@ -3,7 +3,7 @@ "published", "modified", "references", - "vulnerable_configuration", + "vulnerable-configuration", "summary", "description", "id" From 2f2315d4e23e7f66ea0faf1da02d4a7a4214ab1d Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Rapha=C3=ABl=20Vinot?= Date: Wed, 26 Feb 2020 14:52:06 +0100 Subject: [PATCH 114/155] fix: Typo in requiredOneOf --- objects/instant-message/definition.json | 1 - 1 file changed, 1 deletion(-) diff --git a/objects/instant-message/definition.json b/objects/instant-message/definition.json index ecddaa2..802b0a8 100644 --- a/objects/instant-message/definition.json +++ b/objects/instant-message/definition.json @@ -1,7 +1,6 @@ { "requiredOneOf": [ "body", - "from", "from-user" ], "attributes": { From 6f5cd0d9d338631a9fff212328a4a963ab14cd90 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Rapha=C3=ABl=20Vinot?= Date: Thu, 27 Feb 2020 10:50:47 +0100 Subject: [PATCH 115/155] chg: [IntelMQ Event] replace non-ascii double quote by single quote --- objects/intelmq_event/definition.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/objects/intelmq_event/definition.json b/objects/intelmq_event/definition.json index 966ea2b..ebc1b17 100644 --- a/objects/intelmq_event/definition.json +++ b/objects/intelmq_event/definition.json @@ -11,7 +11,7 @@ "ui-priority": 1 }, "classification.type": { - "description": "The abuse type IOC is one of the most crucial pieces of information for any given abuse event. The main idea of dynamic typing is to keep our ontology flexible, since we need to evolve with the evolving threatscape of abuse data. In contrast with the static taxonomy below, the dynamic typing is used to perform business decisions in the abuse handling pipeline. Furthermore, the value data set should be kept as minimal as possible to avoid “type explosion”, which in turn dilutes the business value of the dynamic typing. In general, we normally have two types of abuse type IOC: ones referring to a compromised resource or ones referring to pieces of the criminal infrastructure, such as a command and control servers for example.", + "description": "The abuse type IOC is one of the most crucial pieces of information for any given abuse event. The main idea of dynamic typing is to keep our ontology flexible, since we need to evolve with the evolving threatscape of abuse data. In contrast with the static taxonomy below, the dynamic typing is used to perform business decisions in the abuse handling pipeline. Furthermore, the value data set should be kept as minimal as possible to avoid 'type explosion', which in turn dilutes the business value of the dynamic typing. In general, we normally have two types of abuse type IOC: ones referring to a compromised resource or ones referring to pieces of the criminal infrastructure, such as a command and control servers for example.", "misp-attribute": "text", "ui-priority": 1 }, From 416820edc05f14aab013b8d88d8cae92c7e71618 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Rapha=C3=ABl=20Vinot?= Date: Thu, 27 Feb 2020 15:41:13 +0100 Subject: [PATCH 116/155] new: [crypto-material] add generic-symmetric-key --- objects/crypto-material/definition.json | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/objects/crypto-material/definition.json b/objects/crypto-material/definition.json index 3c28827..3283a62 100644 --- a/objects/crypto-material/definition.json +++ b/objects/crypto-material/definition.json @@ -1,5 +1,6 @@ { "requiredOneOf": [ + "generic-symmetric-key", "text", "private", "p", @@ -96,6 +97,11 @@ "ui-priority": 1, "misp-attribute": "text" }, + "generic-symmetric-key": { + "description": "Generic symmetric key (please precise the type)", + "ui-priority": 1, + "misp-attribute": "text" + }, "type": { "description": "Type of crytographic materials", "ui-priority": 1, @@ -105,6 +111,8 @@ "RSA", "DSA", "ECDSA", + "RC4", + "XOR", "unknown" ] }, From eabd0c1e5538e63ffee0328fa1768b7618105b44 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Rapha=C3=ABl=20Vinot?= Date: Sat, 29 Feb 2020 01:16:25 +0100 Subject: [PATCH 117/155] new: CSSE COVID-19 Dataset - Daily report Source: https://github.com/CSSEGISandData/COVID-19/tree/master/csse_covid_19_data --- .../covid19-csse-daily-report/definition.json | 49 +++++++++++++++++++ 1 file changed, 49 insertions(+) create mode 100644 objects/covid19-csse-daily-report/definition.json diff --git a/objects/covid19-csse-daily-report/definition.json b/objects/covid19-csse-daily-report/definition.json new file mode 100644 index 0000000..3be4188 --- /dev/null +++ b/objects/covid19-csse-daily-report/definition.json @@ -0,0 +1,49 @@ +{ + "required": [ + "country-region", + "update" + ], + "attributes": { + "province-state": { + "description": "province name; US/Canada/Australia/ - city name, state/province name; Others - name of the event (e.g., \"Diamond Princess\" cruise ship); other countries - blank.", + "ui-priority": 1, + "misp-attribute": "text", + "disable_correlation": true + }, + "country-region": { + "description": "country/region name conforming to WHO (will be updated).", + "ui-priority": 1, + "misp-attribute": "text", + "disable_correlation": true + }, + "update": { + "description": "Time of the last update that day (UTC)", + "ui-priority": 1, + "misp-attribute": "datetime", + "disable_correlation": true + }, + "confirmed": { + "description": "the number of confirmed cases. For Hubei Province: from Feb 13 (GMT +8), we report both clinically diagnosed and lab-confirmed cases. For lab-confirmed cases only (Before Feb 17), please refer to https://github.com/CSSEGISandData/COVID-19/tree/master/who_covid_19_situation_reports.", + "misp-attribute": "counter", + "disable_correlation": true, + "ui-priority": 1 + }, + "death": { + "description": "the number of deaths.", + "misp-attribute": "counter", + "disable_correlation": true, + "ui-priority": 1 + }, + "recovered": { + "description": "the number of recovered cases.", + "misp-attribute": "counter", + "disable_correlation": true, + "ui-priority": 1 + } + }, + "version": 1, + "description": "CSSE COVID-19 Daily report", + "meta-category": "health", + "uuid": "9458bf83-2e29-4ff3-9996-0564f2d954c8", + "name": "covid19-csse-daily-report" +} From 75028d3adf0619a2c4c3880dfd78ed18e59b50ad Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Rapha=C3=ABl=20Vinot?= Date: Sat, 29 Feb 2020 01:18:07 +0100 Subject: [PATCH 118/155] new: health object meta type --- schema_objects.json | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/schema_objects.json b/schema_objects.json index 98da752..6c2f32a 100644 --- a/schema_objects.json +++ b/schema_objects.json @@ -261,7 +261,8 @@ "internal", "vulnerability", "climate", - "iot" + "iot", + "health" ], "type": "string" }, From b29a360c0284935097ad3cdb222d47b19ad79e1a Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Rapha=C3=ABl=20Vinot?= Date: Mon, 2 Mar 2020 00:12:24 +0100 Subject: [PATCH 119/155] new: Add covid19 dxy live object --- objects/covid19-dxy-live-city/definition.json | 49 +++++++++++++++++ .../covid19-dxy-live-province/definition.json | 55 +++++++++++++++++++ 2 files changed, 104 insertions(+) create mode 100644 objects/covid19-dxy-live-city/definition.json create mode 100644 objects/covid19-dxy-live-province/definition.json diff --git a/objects/covid19-dxy-live-city/definition.json b/objects/covid19-dxy-live-city/definition.json new file mode 100644 index 0000000..1a665b1 --- /dev/null +++ b/objects/covid19-dxy-live-city/definition.json @@ -0,0 +1,49 @@ +{ + "required": [ + "city", + "update" + ], + "attributes": { + "city": { + "description": "Name of the Chinese city, in Chinese.", + "ui-priority": 1, + "misp-attribute": "text", + "disable_correlation": true + }, + "update": { + "description": "Approximate time of the update (~hour)", + "ui-priority": 1, + "misp-attribute": "datetime", + "disable_correlation": true + }, + "current-confirmed": { + "description": "Current number of confirmed cases", + "ui-priority": 1, + "misp-attribute": "counter", + "disable_correlation": true + }, + "total-confirmed": { + "description": "Total number of confirmed cases.", + "misp-attribute": "counter", + "disable_correlation": true, + "ui-priority": 1 + }, + "total-cured": { + "description": "Total number of cured cases.", + "misp-attribute": "counter", + "disable_correlation": true, + "ui-priority": 1 + }, + "total-death": { + "description": "Total number of deaths.", + "misp-attribute": "counter", + "disable_correlation": true, + "ui-priority": 1 + } + }, + "version": 1, + "description": "COVID 19 from dxy.cn - Aggregation by city", + "meta-category": "health", + "uuid": "9132452b-f60a-41ac-a3b9-62701b85621b", + "name": "covid19-dxy-live-city" +} diff --git a/objects/covid19-dxy-live-province/definition.json b/objects/covid19-dxy-live-province/definition.json new file mode 100644 index 0000000..3bb3cf8 --- /dev/null +++ b/objects/covid19-dxy-live-province/definition.json @@ -0,0 +1,55 @@ +{ + "required": [ + "province", + "update" + ], + "attributes": { + "province": { + "description": "Name of the Chinese province, in Chinese.", + "ui-priority": 1, + "misp-attribute": "text", + "disable_correlation": true + }, + "update": { + "description": "Approximate time of the update (~hour)", + "ui-priority": 1, + "misp-attribute": "datetime", + "disable_correlation": true + }, + "current-confirmed": { + "description": "Current number of confirmed cases", + "ui-priority": 1, + "misp-attribute": "counter", + "disable_correlation": true + }, + "total-confirmed": { + "description": "Total number of confirmed cases.", + "misp-attribute": "counter", + "disable_correlation": true, + "ui-priority": 1 + }, + "total-cured": { + "description": "Total number of cured cases.", + "misp-attribute": "counter", + "disable_correlation": true, + "ui-priority": 1 + }, + "total-death": { + "description": "Total number of deaths.", + "misp-attribute": "counter", + "disable_correlation": true, + "ui-priority": 1 + }, + "comment": { + "description": "Comment, in chinese", + "misp-attribute": "text", + "disable_correlation": true, + "ui-priority": 1 + } + }, + "version": 1, + "description": "COVID 19 from dxy.cn - Aggregation by province", + "meta-category": "health", + "uuid": "40b49502-088b-44a5-80a7-0e55653f3ed4", + "name": "covid19-dxy-live-province" +} From 1e5bb552f8a09cef9b3d9d399dc88265222a8ea6 Mon Sep 17 00:00:00 2001 From: Alexandre Dulaunoy Date: Wed, 4 Mar 2020 14:08:10 +0100 Subject: [PATCH 120/155] chg: [microblog] add Twitter-id reference --- objects/microblog/definition.json | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/objects/microblog/definition.json b/objects/microblog/definition.json index 226c5eb..ffc7798 100644 --- a/objects/microblog/definition.json +++ b/objects/microblog/definition.json @@ -121,6 +121,12 @@ "multiple": true, "misp-attribute": "text" }, + "twitter-id": { + "description": "Twitter id", + "ui-priority": 0, + "multiple": true, + "misp-attribute": "twitter-id" + }, "hashtag": { "description": "Hashtag into the microblog post", "ui-priority": 0, @@ -128,7 +134,7 @@ "multiple": true } }, - "version": 18, + "version": 19, "description": "Microblog post like a Twitter tweet or a post on a Facebook wall.", "meta-category": "misc", "uuid": "8ec8c911-ddbe-4f5b-895b-fbff70c42a60", From 3d57ee4fd2a78d3de6f210b16fd24ddf81c75d9a Mon Sep 17 00:00:00 2001 From: Alexandre Dulaunoy Date: Wed, 4 Mar 2020 14:25:26 +0100 Subject: [PATCH 121/155] chg: [network-socket] add filename to object template Reported-by: Belgian Defence - Tancred --- objects/network-socket/definition.json | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/objects/network-socket/definition.json b/objects/network-socket/definition.json index 5bbd1ff..94ecb53 100644 --- a/objects/network-socket/definition.json +++ b/objects/network-socket/definition.json @@ -3,7 +3,7 @@ "uuid": "48bbfd72-ef8e-4649-b14d-41b4b5a0eba2", "meta-category": "network", "description": "Network socket object describes a local or remote network connections based on the socket data structure.", - "version": 1, + "version": 2, "attributes": { "ip-src": { "description": "Source (local) IP address of the network socket connection.", @@ -14,6 +14,11 @@ ], "misp-attribute": "ip-src" }, + "filename": { + "description": "Socket using filename", + "ui-priority": 1, + "misp-attribute": "filename" + }, "hostname-src": { "description": "Source (local) hostname of the network socket connection.", "ui-priority": 1, From 2c6c44ccf8a22d2f1efcad2731177a1557f96a81 Mon Sep 17 00:00:00 2001 From: frpet Date: Thu, 5 Mar 2020 18:55:29 +0100 Subject: [PATCH 122/155] Use more explicit misp-attribute types Use the apropriate misp-attribute type for *local_hostname, *fqdn, *.md5|*.sha* --- objects/intelmq_event/definition.json | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/objects/intelmq_event/definition.json b/objects/intelmq_event/definition.json index ebc1b17..1f962c1 100644 --- a/objects/intelmq_event/definition.json +++ b/objects/intelmq_event/definition.json @@ -52,7 +52,7 @@ }, "destination.fqdn": { "description": "A DNS name related to the host from which the connection originated. DNS allows even binary data in DNS, so we have to allow everything. A final point is stripped, string is converted to lower case characters.", - "misp-attribute": "text", + "misp-attribute": "domain", "ui-priority": 1 }, "destination.geolocation.cc": { @@ -97,7 +97,7 @@ }, "destination.local_hostname": { "description": "Some sources report a internal hostname within a NAT related to the name configured for a compromized system", - "misp-attribute": "text", + "misp-attribute": "hostname", "ui-priority": 1 }, "destination.local_ip": { @@ -197,17 +197,17 @@ }, "malware.hash.md5": { "description": "A string depicting an MD5 checksum for a file, be it a malware sample for example.", - "misp-attribute": "text", + "misp-attribute": "md5", "ui-priority": 1 }, "malware.hash.sha1": { "description": "A string depicting a SHA1 checksum for a file, be it a malware sample for example.", - "misp-attribute": "text", + "misp-attribute": "sha1", "ui-priority": 1 }, "malware.hash.sha256": { "description": "A string depicting a SHA256 checksum for a file, be it a malware sample for example.", - "misp-attribute": "text", + "misp-attribute": "sha256", "ui-priority": 1 }, "malware.name": { @@ -292,7 +292,7 @@ }, "source.fqdn": { "description": "A DNS name related to the host from which the connection originated. DNS allows even binary data in DNS, so we have to allow everything. A final point is stripped, string is converted to lower case characters.", - "misp-attribute": "text", + "misp-attribute": "domain", "ui-priority": 1 }, "source.geolocation.cc": { @@ -347,7 +347,7 @@ }, "source.local_hostname": { "description": "Some sources report a internal hostname within a NAT related to the name configured for a compromised system", - "misp-attribute": "text", + "misp-attribute": "hostname", "ui-priority": 1 }, "source.local_ip": { From fa6fe463a9d03d680a06a42f5cf159664e4f40ea Mon Sep 17 00:00:00 2001 From: cbboggs <18554987+cbboggs@users.noreply.github.com> Date: Thu, 5 Mar 2020 12:24:14 -0600 Subject: [PATCH 123/155] Adding optional ip-src to http-request modified existing "ip" attribute to "ip-dst", and added attribute for ip-src. This allows http-request to be used in scenarios where observed connections are source specific, not destination specific. --- objects/http-request/definition.json | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-) diff --git a/objects/http-request/definition.json b/objects/http-request/definition.json index 32c119d..79d535c 100644 --- a/objects/http-request/definition.json +++ b/objects/http-request/definition.json @@ -61,7 +61,7 @@ "ui-priority": 1, "misp-attribute": "hostname" }, - "ip": { + "ip-dst": { "categories": [ "Network activity", "Payload delivery" @@ -70,6 +70,15 @@ "ui-priority": 1, "misp-attribute": "ip-dst" }, + "ip-src": { + "categories": [ + "Network activity", + "Payload delivery" + ], + "description": "The IP address of the client", + "ui-priority": 1, + "misp-attribute": "ip-src" + }, "method": { "categories": [ "Network activity" From 5fdec815307f6d44210c12a301cbe7436b0ee7a7 Mon Sep 17 00:00:00 2001 From: frpet Date: Fri, 6 Mar 2020 14:08:20 +0100 Subject: [PATCH 124/155] Update definition.json bump version --- objects/intelmq_event/definition.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/objects/intelmq_event/definition.json b/objects/intelmq_event/definition.json index 1f962c1..6bd7969 100644 --- a/objects/intelmq_event/definition.json +++ b/objects/intelmq_event/definition.json @@ -415,5 +415,5 @@ "meta-category": "network", "name": "intelmq_event", "uuid": "491ac7d2-25a1-4078-8246-b04a132d003d", - "version": 3 + "version": 4 } From 8bb88fceafe16ab5784a1284564ef42e030bdb0b Mon Sep 17 00:00:00 2001 From: Koen Van Impe Date: Sat, 7 Mar 2020 09:03:01 +0100 Subject: [PATCH 125/155] Objects for data coming from the Cytomic Orion API --- objects/cytomic_orion/definition.json | 65 +++++++++++ objects/cytomic_orion_machine/definition.json | 101 ++++++++++++++++++ 2 files changed, 166 insertions(+) create mode 100755 objects/cytomic_orion/definition.json create mode 100755 objects/cytomic_orion_machine/definition.json diff --git a/objects/cytomic_orion/definition.json b/objects/cytomic_orion/definition.json new file mode 100755 index 0000000..f5788ee --- /dev/null +++ b/objects/cytomic_orion/definition.json @@ -0,0 +1,65 @@ +{ + "required": [ + + ], + "attributes": { + "fileName": { + "description": "Original filename", + "ui-priority": 9, + "categories": [ + "Other" + ], + "misp-attribute": "filename" + }, + "fileSize": { + "description": "Size of the file", + "to_ids": false, + "ui-priority": 0, + "categories": [ + "Other" + ], + "misp-attribute": "size-in-bytes" + }, + "classification": { + "description": "File classification - number", + "to_ids": false, + "ui-priority": 2, + "categories": [ + "Other" + ], + "misp-attribute": "text" + }, + "classificationName": { + "description": "File classification", + "to_ids": false, + "ui-priority": 1, + "categories": [ + "Other" + ], + "misp-attribute": "text" + }, + "firstSeen": { + "description": "First seen timestamp of the file", + "to_ids": false, + "ui-priority": 3, + "categories": [ + "Other" + ], + "misp-attribute": "datetime" + }, + "lastSeen": { + "description": "Last seen timestamp of the file", + "to_ids": false, + "ui-priority": 4, + "categories": [ + "Other" + ], + "misp-attribute": "datetime" + } + }, + "version": 6, + "description": "Cytomic Orion File Detection", + "meta-category": "misc", + "uuid": "0ad86572-ba38-4baf-9fed-1926e9ecc916", + "name": "cytomic-orion-file" +} diff --git a/objects/cytomic_orion_machine/definition.json b/objects/cytomic_orion_machine/definition.json new file mode 100755 index 0000000..ab6098f --- /dev/null +++ b/objects/cytomic_orion_machine/definition.json @@ -0,0 +1,101 @@ +{ + "required": [ + "machineName" + ], + "attributes": { + "machineName": { + "description": "Machine name", + "ui-priority": 9, + "categories": [ + "Other" + ], + "misp-attribute": "target-machine" + }, + "machineMuid": { + "description": "Machine UID", + "to_ids": false, + "ui-priority": 0, + "categories": [ + "Other" + ], + "misp-attribute": "text" + }, + "clientName": { + "description": "Client name", + "to_ids": false, + "ui-priority": 0, + "categories": [ + "Other" + ], + "misp-attribute": "target-org" + }, + "clientId": { + "description": "Client id", + "to_ids": false, + "ui-priority": 0, + "categories": [ + "Other" + ], + "misp-attribute": "text" + }, + "machinePath": { + "description": "Path of observable", + "to_ids": false, + "ui-priority": 2, + "categories": [ + "Other" + ], + "misp-attribute": "text" + }, + "machineFirstSeen": { + "description": "First seen on machine", + "to_ids": false, + "ui-priority": 3, + "categories": [ + "Other" + ], + "misp-attribute": "datetime" + }, + "machineLastSeen": { + "description": "Last seen on machine", + "to_ids": false, + "ui-priority": 4, + "categories": [ + "Other" + ], + "misp-attribute": "datetime" + }, + "clientCreationDateUTC": { + "description": "Client creation date UTC", + "to_ids": false, + "ui-priority": 0, + "categories": [ + "Other" + ], + "misp-attribute": "datetime" + }, + "creationDate": { + "description": "Client creation date", + "to_ids": false, + "ui-priority": 0, + "categories": [ + "Other" + ], + "misp-attribute": "datetime" + }, + "lastSeenUtc": { + "description": "Client last seen UTC", + "to_ids": false, + "ui-priority": 0, + "categories": [ + "Other" + ], + "misp-attribute": "datetime" + } + }, + "version": 3, + "description": "Cytomic Orion File at Machine Detection", + "meta-category": "misc", + "uuid": "e0e46343-43fd-4ce7-b447-51381402c774", + "name": "cytomic-orion-machine" +} From bbac01aa1b73aae055999c56d7f29dc85616796f Mon Sep 17 00:00:00 2001 From: Koen Van Impe Date: Sat, 7 Mar 2020 09:24:51 +0100 Subject: [PATCH 126/155] Fix with jq_all_the_things --- objects/cytomic_orion/definition.json | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/objects/cytomic_orion/definition.json b/objects/cytomic_orion/definition.json index f5788ee..955933a 100755 --- a/objects/cytomic_orion/definition.json +++ b/objects/cytomic_orion/definition.json @@ -1,7 +1,5 @@ { - "required": [ - - ], + "required": [], "attributes": { "fileName": { "description": "Original filename", From bffae90c3dd056922ed69510ceb46f4f1bb52bf9 Mon Sep 17 00:00:00 2001 From: Koen Van Impe Date: Sat, 7 Mar 2020 09:28:43 +0100 Subject: [PATCH 127/155] Remove -x from JSON files --- objects/cytomic_orion/definition.json | 0 objects/cytomic_orion_machine/definition.json | 0 2 files changed, 0 insertions(+), 0 deletions(-) mode change 100755 => 100644 objects/cytomic_orion/definition.json mode change 100755 => 100644 objects/cytomic_orion_machine/definition.json diff --git a/objects/cytomic_orion/definition.json b/objects/cytomic_orion/definition.json old mode 100755 new mode 100644 diff --git a/objects/cytomic_orion_machine/definition.json b/objects/cytomic_orion_machine/definition.json old mode 100755 new mode 100644 From 65a51a586f7967d12e9faf8f119666522ed7996c Mon Sep 17 00:00:00 2001 From: Alexandre Dulaunoy Date: Mon, 9 Mar 2020 16:25:57 +0100 Subject: [PATCH 128/155] chg: [http-request] fixed --- objects/http-request/definition.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/objects/http-request/definition.json b/objects/http-request/definition.json index 79d535c..c538392 100644 --- a/objects/http-request/definition.json +++ b/objects/http-request/definition.json @@ -78,7 +78,7 @@ "description": "The IP address of the client", "ui-priority": 1, "misp-attribute": "ip-src" - }, + }, "method": { "categories": [ "Network activity" From a09f7f55a838423d66ab0650bee9fad436660995 Mon Sep 17 00:00:00 2001 From: Alexandre Dulaunoy Date: Mon, 9 Mar 2020 16:32:18 +0100 Subject: [PATCH 129/155] chg: [victim] add reference to case (as requested by law-enforcement - ENFORCE project) --- objects/victim/definition.json | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/objects/victim/definition.json b/objects/victim/definition.json index 2ef946c..668c5a6 100644 --- a/objects/victim/definition.json +++ b/objects/victim/definition.json @@ -22,6 +22,12 @@ "misp-attribute": "target-external", "multiple": true }, + "reference": { + "description": "External reference to the victim/case.", + "ui-priority": 1, + "misp-attribute": "text", + "multiple": true + }, "classification": { "description": "The type of entity being targeted.", "misp-attribute": "text", @@ -108,7 +114,7 @@ "multiple": true } }, - "version": 4, + "version": 5, "description": "Victim object describes the target of an attack or abuse.", "meta-category": "misc", "uuid": "a8806e40-39ad-435f-be02-ac2a13d6fc7d", From ecac7ea52a63d2c534714f73bca43ba73ed4b6e6 Mon Sep 17 00:00:00 2001 From: Koen Van Impe Date: Mon, 9 Mar 2020 23:26:25 +0100 Subject: [PATCH 130/155] Update object definition with first-|last- seen --- objects/cytomic_orion/definition.json | 10 ++++++---- objects/cytomic_orion_machine/definition.json | 6 +++--- 2 files changed, 9 insertions(+), 7 deletions(-) diff --git a/objects/cytomic_orion/definition.json b/objects/cytomic_orion/definition.json index 955933a..04527b3 100644 --- a/objects/cytomic_orion/definition.json +++ b/objects/cytomic_orion/definition.json @@ -1,5 +1,7 @@ { - "required": [], + "required": [ + + ], "attributes": { "fileName": { "description": "Original filename", @@ -36,7 +38,7 @@ ], "misp-attribute": "text" }, - "firstSeen": { + "first-seen": { "description": "First seen timestamp of the file", "to_ids": false, "ui-priority": 3, @@ -45,7 +47,7 @@ ], "misp-attribute": "datetime" }, - "lastSeen": { + "last-seen": { "description": "Last seen timestamp of the file", "to_ids": false, "ui-priority": 4, @@ -55,7 +57,7 @@ "misp-attribute": "datetime" } }, - "version": 6, + "version": 7, "description": "Cytomic Orion File Detection", "meta-category": "misc", "uuid": "0ad86572-ba38-4baf-9fed-1926e9ecc916", diff --git a/objects/cytomic_orion_machine/definition.json b/objects/cytomic_orion_machine/definition.json index ab6098f..5a25dd7 100644 --- a/objects/cytomic_orion_machine/definition.json +++ b/objects/cytomic_orion_machine/definition.json @@ -47,7 +47,7 @@ ], "misp-attribute": "text" }, - "machineFirstSeen": { + "first-seen": { "description": "First seen on machine", "to_ids": false, "ui-priority": 3, @@ -56,7 +56,7 @@ ], "misp-attribute": "datetime" }, - "machineLastSeen": { + "last-seen": { "description": "Last seen on machine", "to_ids": false, "ui-priority": 4, @@ -93,7 +93,7 @@ "misp-attribute": "datetime" } }, - "version": 3, + "version": 4, "description": "Cytomic Orion File at Machine Detection", "meta-category": "misc", "uuid": "e0e46343-43fd-4ce7-b447-51381402c774", From 2c584706542f5e84f73c58bf32deacd051bac978 Mon Sep 17 00:00:00 2001 From: Koen Van Impe Date: Mon, 9 Mar 2020 23:29:29 +0100 Subject: [PATCH 131/155] JQ-all-the-things --- objects/cytomic_orion/definition.json | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/objects/cytomic_orion/definition.json b/objects/cytomic_orion/definition.json index 04527b3..050506c 100644 --- a/objects/cytomic_orion/definition.json +++ b/objects/cytomic_orion/definition.json @@ -1,7 +1,5 @@ { - "required": [ - - ], + "required": [], "attributes": { "fileName": { "description": "Original filename", From fdfe7d2e4c9690fc1a64f10074206199fa0aba25 Mon Sep 17 00:00:00 2001 From: chrisr3d Date: Tue, 17 Mar 2020 10:03:33 +0100 Subject: [PATCH 132/155] add: External references attribute for attack-pattern object --- objects/attack-pattern/definition.json | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/objects/attack-pattern/definition.json b/objects/attack-pattern/definition.json index 322555b..e3aa6a4 100644 --- a/objects/attack-pattern/definition.json +++ b/objects/attack-pattern/definition.json @@ -35,6 +35,12 @@ "ui-priority": 0, "multiple": true, "misp-attribute": "weakness" + }, + "references": { + "description": "External references", + "ui-priority": 0, + "multiple": true, + "misp-attribute": "link" } }, "version": 1, From 9eedb854de18ecf6671a900bc02ebebc22885637 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Rapha=C3=ABl=20Vinot?= Date: Tue, 24 Mar 2020 13:24:31 +0100 Subject: [PATCH 133/155] chg: Bump CSSE COVID-19 Daily report to new version --- .../covid19-csse-daily-report/definition.json | 32 ++++++++++++++++++- 1 file changed, 31 insertions(+), 1 deletion(-) diff --git a/objects/covid19-csse-daily-report/definition.json b/objects/covid19-csse-daily-report/definition.json index 3be4188..dc261d0 100644 --- a/objects/covid19-csse-daily-report/definition.json +++ b/objects/covid19-csse-daily-report/definition.json @@ -4,6 +4,18 @@ "update" ], "attributes": { + "fips": { + "description": "Federal Information Processing Standard county code (US Only)", + "ui-priority": 0, + "misp-attribute": "counter", + "disable_correlation": true + }, + "county": { + "description": "US County (US Only)", + "ui-priority": 0, + "misp-attribute": "counter", + "disable_correlation": true + }, "province-state": { "description": "province name; US/Canada/Australia/ - city name, state/province name; Others - name of the event (e.g., \"Diamond Princess\" cruise ship); other countries - blank.", "ui-priority": 1, @@ -22,6 +34,18 @@ "misp-attribute": "datetime", "disable_correlation": true }, + "latitude": { + "description": "Approximate latitude of the entry", + "ui-priority": 0, + "misp-attribute": "float", + "disable_correlation": true + }, + "longitude": { + "description": "Approximate longitude of the entry", + "ui-priority": 0, + "misp-attribute": "float", + "disable_correlation": true + }, "confirmed": { "description": "the number of confirmed cases. For Hubei Province: from Feb 13 (GMT +8), we report both clinically diagnosed and lab-confirmed cases. For lab-confirmed cases only (Before Feb 17), please refer to https://github.com/CSSEGISandData/COVID-19/tree/master/who_covid_19_situation_reports.", "misp-attribute": "counter", @@ -39,9 +63,15 @@ "misp-attribute": "counter", "disable_correlation": true, "ui-priority": 1 + }, + "active": { + "description": "the number of active cases.", + "misp-attribute": "counter", + "disable_correlation": true, + "ui-priority": 1 } }, - "version": 1, + "version": 2, "description": "CSSE COVID-19 Daily report", "meta-category": "health", "uuid": "9458bf83-2e29-4ff3-9996-0564f2d954c8", From e387009bdd9fa6ad20aa6c00cabde20061f4c443 Mon Sep 17 00:00:00 2001 From: VVX7 Date: Fri, 27 Mar 2020 15:10:22 -0400 Subject: [PATCH 134/155] new: [object] add narrative. --- objects/narrative/definition.json | 91 +++++++++++++++++++++++++++++++ 1 file changed, 91 insertions(+) create mode 100644 objects/narrative/definition.json diff --git a/objects/narrative/definition.json b/objects/narrative/definition.json new file mode 100644 index 0000000..0707d2c --- /dev/null +++ b/objects/narrative/definition.json @@ -0,0 +1,91 @@ +{ + "requiredOneOf": [ + "attachment", + "archive", + "narrative-description" + ], + "attributes": { + "5Ds-of-propaganda": { + "description": "5 D's of propaganda are tactics of rebuttal used to defend against criticism and adversarial narratives.", + "ui-priority": 1, + "misp-attribute": "text", + "disable_correlation": true, + "multiple": true, + "values_list": [ + "dismiss", + "distort", + "distract", + "dismay", + "divide" + ] + }, + "attachment": { + "description": "Documents related to the narrative.", + "ui-priority": 1, + "misp-attribute": "attachment" + }, + "narrative-description": { + "description": "Raw text of narrative.", + "ui-priority": 1, + "misp-attribute": "text" + }, + "crosspost": { + "description": "Safe site where the narrative has been posted.", + "ui-priority": 0, + "misp-attribute": "link", + "multiple": true + }, + "crosspost-unsafe": { + "description": "Unsafe site where the narrative has been posted.", + "ui-priority": 0, + "misp-attribute": "url", + "multiple": true + }, + "url": { + "description": "Original URL location of the narrative (potentially malicious)", + "ui-priority": 1, + "misp-attribute": "url" + }, + "link": { + "description": "Original link into the narrative (Supposed harmless)", + "ui-priority": 1, + "misp-attribute": "link" + }, + "archive": { + "description": "Archive of the original narrative source (Internet Archive, Archive.is, etc).", + "ui-priority": 1, + "multiple": true, + "misp-attribute": "link" + }, + "objective": { + "description": "Objective of the narrative.", + "ui-priority": 1, + "misp-attribute": "text", + "disable_correlation": true, + "multiple": true, + "sane_default": [ + "Disinformation", + "Advertising", + "Parody", + "Other" + ] + }, + "last-seen": { + "description": "When the meme has been accessible or seen for the last time.", + "disable_correlation": true, + "ui-priority": 0, + "misp-attribute": "datetime" + }, + "first-seen": { + "description": "When the meme has been accessible or seen for the first time.", + "disable_correlation": true, + "ui-priority": 0, + "misp-attribute": "datetime" + } + }, + "version": 7, + "description": "Object describing a narrative.", + "meta-category": "misc", + "uuid": "83bea299-514a-4719-a84b-f6fd0997fac1", + "name": "narrative" +} From 1198f8fe682acff42e8ab9713891b211e2651d72 Mon Sep 17 00:00:00 2001 From: VVX7 Date: Fri, 27 Mar 2020 15:46:31 -0400 Subject: [PATCH 135/155] chg: [object] change narrative version --- objects/narrative/definition.json | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/objects/narrative/definition.json b/objects/narrative/definition.json index 0707d2c..a494553 100644 --- a/objects/narrative/definition.json +++ b/objects/narrative/definition.json @@ -71,19 +71,19 @@ ] }, "last-seen": { - "description": "When the meme has been accessible or seen for the last time.", + "description": "When the narrative has been accessible or seen for the last time.", "disable_correlation": true, "ui-priority": 0, "misp-attribute": "datetime" }, "first-seen": { - "description": "When the meme has been accessible or seen for the first time.", + "description": "When the narrative has been accessible or seen for the first time.", "disable_correlation": true, "ui-priority": 0, "misp-attribute": "datetime" } }, - "version": 7, + "version": 1, "description": "Object describing a narrative.", "meta-category": "misc", "uuid": "83bea299-514a-4719-a84b-f6fd0997fac1", From 0518dd1aa34970ab24268716c04387dc09e29437 Mon Sep 17 00:00:00 2001 From: VVX7 Date: Sat, 28 Mar 2020 19:16:33 -0400 Subject: [PATCH 136/155] chg: [object] add narrative description/summary --- objects/narrative/definition.json | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/objects/narrative/definition.json b/objects/narrative/definition.json index a494553..8b95c1f 100644 --- a/objects/narrative/definition.json +++ b/objects/narrative/definition.json @@ -25,7 +25,12 @@ "misp-attribute": "attachment" }, "narrative-description": { - "description": "Raw text of narrative.", + "description": "A description of the narrative.", + "ui-priority": 1, + "misp-attribute": "text" + }, + "narrative-summary": { + "description": "A summary of the narrative.", "ui-priority": 1, "misp-attribute": "text" }, @@ -83,7 +88,7 @@ "misp-attribute": "datetime" } }, - "version": 1, + "version": 2, "description": "Object describing a narrative.", "meta-category": "misc", "uuid": "83bea299-514a-4719-a84b-f6fd0997fac1", From 2b3e89b614b4b0cd964a4c2f95390a8e80a86af4 Mon Sep 17 00:00:00 2001 From: VVX7 Date: Sat, 28 Mar 2020 19:17:25 -0400 Subject: [PATCH 137/155] chg: [object] add narrative description/summary --- objects/narrative/definition.json | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/objects/narrative/definition.json b/objects/narrative/definition.json index 8b95c1f..b99dca4 100644 --- a/objects/narrative/definition.json +++ b/objects/narrative/definition.json @@ -2,7 +2,8 @@ "requiredOneOf": [ "attachment", "archive", - "narrative-description" + "narrative-description", + "narrative-summary" ], "attributes": { "5Ds-of-propaganda": { From a7e9fd969779ffeb4139cc758de4b4a1c594b468 Mon Sep 17 00:00:00 2001 From: VVX7 Date: Sat, 28 Mar 2020 19:23:28 -0400 Subject: [PATCH 138/155] chg: [object] disable correlation on some fields. add external references. --- objects/narrative/definition.json | 34 ++++++++++++++----------------- 1 file changed, 15 insertions(+), 19 deletions(-) diff --git a/objects/narrative/definition.json b/objects/narrative/definition.json index b99dca4..09e1e16 100644 --- a/objects/narrative/definition.json +++ b/objects/narrative/definition.json @@ -27,6 +27,7 @@ }, "narrative-description": { "description": "A description of the narrative.", + "disable_correlation": true, "ui-priority": 1, "misp-attribute": "text" }, @@ -35,30 +36,25 @@ "ui-priority": 1, "misp-attribute": "text" }, - "crosspost": { - "description": "Safe site where the narrative has been posted.", - "ui-priority": 0, - "misp-attribute": "link", - "multiple": true - }, - "crosspost-unsafe": { - "description": "Unsafe site where the narrative has been posted.", - "ui-priority": 0, - "misp-attribute": "url", - "multiple": true - }, - "url": { - "description": "Original URL location of the narrative (potentially malicious)", - "ui-priority": 1, - "misp-attribute": "url" - }, - "link": { - "description": "Original link into the narrative (Supposed harmless)", + "external-references": { + "description": "Link to external references.", + "disable_correlation": true, "ui-priority": 1, "misp-attribute": "link" }, + "link": { + "description": "Original link to the narrative source (Supposed harmless)", + "ui-priority": 1, + "misp-attribute": "link" + }, + "url": { + "description": "Original link to the narrative source (Supposed malicious)", + "ui-priority": 1, + "misp-attribute": "url" + }, "archive": { "description": "Archive of the original narrative source (Internet Archive, Archive.is, etc).", + "disable_correlation": true, "ui-priority": 1, "multiple": true, "misp-attribute": "link" From 238c44041addb1942240e137162846fa5ecf356e Mon Sep 17 00:00:00 2001 From: Golbark Date: Wed, 8 Apr 2020 01:42:12 -0700 Subject: [PATCH 139/155] chg: [x509] using built-in types wherever possible --- objects/x509/definition.json | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/objects/x509/definition.json b/objects/x509/definition.json index 21097c4..f97b462 100644 --- a/objects/x509/definition.json +++ b/objects/x509/definition.json @@ -110,25 +110,25 @@ "dns_names": { "description": "Subject Alternative Name - DNS names", "multiple": true, - "misp-attribute": "text", + "misp-attribute": "hostname", "ui-priority": 0 }, "email": { "description": "Subject Alternative Name - emails", "multiple": true, - "misp-attribute": "text", + "misp-attribute": "email-dst", "ui-priority": 0 }, "ip": { "description": "Subject Alternative Name - IP", "multiple": true, - "misp-attribute": "text", + "misp-attribute": "ip-dst", "ui-priority": 0 }, "uri": { "description": "Subject Alternative Name - URI", "multiple": true, - "misp-attribute": "text", + "misp-attribute": "uri", "ui-priority": 0 }, "rid": { @@ -148,7 +148,7 @@ ] } }, - "version": 11, + "version": 12, "description": "x509 object describing a X.509 certificate", "meta-category": "network", "uuid": "d1ab756a-26b5-4349-9f43-765630f0911c", From 4991425fc0ce809da8eb5aec76c4ec751c83d4c7 Mon Sep 17 00:00:00 2001 From: Christophe Vandeplas Date: Wed, 8 Apr 2020 10:50:27 +0200 Subject: [PATCH 140/155] chg: [doc] clarify the need to validate before doing a PR --- README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/README.md b/README.md index a6107ee..faeac25 100644 --- a/README.md +++ b/README.md @@ -186,7 +186,7 @@ If the unparsed object can be included, a **raw-base64** attribute can be used i Every object needs a **uuid** which can be created using **uuidgen -r** on a linux command line. -When the object is created, pull a request on this project. We usually merge the objects if it fits existing use-cases. +When the object is created, the `validate_all.sh` and `jq_all_the_things.sh` is run for validation, pull a request on this project. We usually merge the objects if it fits existing use-cases. ## MISP objects documentation From 1527dedb26a3a44696a9fe74942acced5aadb659 Mon Sep 17 00:00:00 2001 From: VVX7 Date: Wed, 8 Apr 2020 09:45:49 -0400 Subject: [PATCH 141/155] chg: [object] update narrative object fields --- objects/narrative/definition.json | 20 ++++---------------- 1 file changed, 4 insertions(+), 16 deletions(-) diff --git a/objects/narrative/definition.json b/objects/narrative/definition.json index 09e1e16..e788789 100644 --- a/objects/narrative/definition.json +++ b/objects/narrative/definition.json @@ -25,8 +25,8 @@ "ui-priority": 1, "misp-attribute": "attachment" }, - "narrative-description": { - "description": "A description of the narrative.", + "narrative-disproof": { + "description": "Disproof or evidence against the narrative.", "disable_correlation": true, "ui-priority": 1, "misp-attribute": "text" @@ -71,23 +71,11 @@ "Parody", "Other" ] - }, - "last-seen": { - "description": "When the narrative has been accessible or seen for the last time.", - "disable_correlation": true, - "ui-priority": 0, - "misp-attribute": "datetime" - }, - "first-seen": { - "description": "When the narrative has been accessible or seen for the first time.", - "disable_correlation": true, - "ui-priority": 0, - "misp-attribute": "datetime" } }, - "version": 2, + "version": 4, "description": "Object describing a narrative.", "meta-category": "misc", - "uuid": "83bea299-514a-4719-a84b-f6fd0997fac1", + "uuid": "fb965678-e14f-4485-bc6c-3fc5463e5318", "name": "narrative" } From efa53e812d35ce64869b1c527ce64062da2e3c30 Mon Sep 17 00:00:00 2001 From: VVX7 Date: Fri, 10 Apr 2020 01:39:05 -0400 Subject: [PATCH 142/155] chg: [object] update narrative required object fields --- objects/narrative/definition.json | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/objects/narrative/definition.json b/objects/narrative/definition.json index e788789..f57edcf 100644 --- a/objects/narrative/definition.json +++ b/objects/narrative/definition.json @@ -2,7 +2,6 @@ "requiredOneOf": [ "attachment", "archive", - "narrative-description", "narrative-summary" ], "attributes": { @@ -76,6 +75,6 @@ "version": 4, "description": "Object describing a narrative.", "meta-category": "misc", - "uuid": "fb965678-e14f-4485-bc6c-3fc5463e5318", + "uuid": "83bea299-514a-4719-a84b-f6fd0997fac1", "name": "narrative" } From ef01e6e37b025a71b40515bc0a9d4e11fef20798 Mon Sep 17 00:00:00 2001 From: Alexandre Dulaunoy Date: Wed, 15 Apr 2020 09:39:32 +0200 Subject: [PATCH 143/155] chg: [victim] add a domain to field to reference a victim by their Internet domain name --- objects/victim/definition.json | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/objects/victim/definition.json b/objects/victim/definition.json index 668c5a6..f7259a5 100644 --- a/objects/victim/definition.json +++ b/objects/victim/definition.json @@ -112,9 +112,15 @@ "misp-attribute": "ip-dst", "ui-priority": 1, "multiple": true + }, + "domain": { + "description": "Domain name of the organisation targeted.", + "misp-attribute": "domain", + "ui-priority": 1, + "multiple": true } }, - "version": 5, + "version": 6, "description": "Victim object describes the target of an attack or abuse.", "meta-category": "misc", "uuid": "a8806e40-39ad-435f-be02-ac2a13d6fc7d", From d50a9eeb13a18fde324d4f2bc976c784f400de49 Mon Sep 17 00:00:00 2001 From: VVX7 Date: Wed, 15 Apr 2020 22:57:12 -0400 Subject: [PATCH 144/155] new: [object] add scheduled-event, add social-media-group --- objects/scheduled-event/definition.json | 129 +++++++++++++++++++++ objects/social-media-group/definition.json | 102 ++++++++++++++++ 2 files changed, 231 insertions(+) create mode 100644 objects/scheduled-event/definition.json create mode 100644 objects/social-media-group/definition.json diff --git a/objects/scheduled-event/definition.json b/objects/scheduled-event/definition.json new file mode 100644 index 0000000..b57c53b --- /dev/null +++ b/objects/scheduled-event/definition.json @@ -0,0 +1,129 @@ +{ + "requiredOneOf": [ + "event-name", + "event-alias", + "archive", + "attachment" + ], + "attributes": { + "event-name": { + "description": "The name of the event.", + "ui-priority": 1, + "misp-attribute": "text" + }, + "event-alias": { + "description": "Aliases of event.", + "ui-priority": 1, + "multiple": true, + "misp-attribute": "text" + }, + "event-listing": { + "description": "Social media and other platforms on which the event is advertised.", + "ui-priority": 1, + "misp-attribute": "text", + "disable_correlation": true, + "multiple": true, + "sane_default": [ + "Twitter", + "Facebook", + "Meetup", + "Eventbrite", + "Other" + ] + }, + "username": { + "description": "A user account who is going to the event.", + "ui-priority": 1, + "misp-attribute": "text", + "multiple": true + }, + "person-name": { + "description": "A person who is going to the event.", + "ui-priority": 1, + "misp-attribute": "text", + "multiple": true + }, + "administrator": { + "description": "A user account who is an owner or admin of the event.", + "ui-priority": 1, + "misp-attribute": "text", + "multiple": true + }, + "hashtag": { + "description": "Hashtag used to identify or promote the event.", + "ui-priority": 0, + "misp-attribute": "text", + "multiple": true + }, + "url": { + "description": "Original URL location of the event (potentially malicious).", + "ui-priority": 1, + "misp-attribute": "url" + }, + "link": { + "description": "Original link into the event (supposed harmless).", + "ui-priority": 1, + "misp-attribute": "link" + }, + "phone-number": { + "description": "Phone number of the event contact.", + "ui-priority": 10, + "misp-attribute": "phone-number", + "multiple": true + }, + "fax-number": { + "description": "Fax number of the event contact.", + "ui-priority": 10, + "misp-attribute": "phone-number", + "multiple": true + }, + "address": { + "description": "Postal address of the event.", + "ui-priority": 10, + "misp-attribute": "text", + "multiple": true + }, + "e-mail": { + "description": "Email address of the event contact.", + "ui-priority": 10, + "misp-attribute": "email-src", + "multiple": true + }, + "embedded-link": { + "description": "Link embedded in the event description (potentially malicious).", + "ui-priority": 0, + "misp-attribute": "url", + "multiple": true + }, + "embedded-safe-link": { + "description": "Link embedded in the event description (supposed safe).", + "ui-priority": 0, + "misp-attribute": "link", + "multiple": true, + "to_ids": false + }, + "archive": { + "description": "Archive of the original event (Internet Archive, Archive.is, etc).", + "ui-priority": 1, + "multiple": true, + "misp-attribute": "link" + }, + "attachment": { + "description": "A screen capture or other attachment relevant to the event.", + "ui-priority": 1, + "multiple": true, + "misp-attribute": "attachment" + }, + "scheduled-date": { + "description": "Initial creation of the microblog post", + "ui-priority": 0, + "multiple": true, + "misp-attribute": "datetime" + } + }, + "version": 1, + "description": "Event object template describing a gathering of individuals in meatspace.", + "meta-category": "misc", + "uuid": "40ba0098-cfd8-4b54-b5a8-9adcdf47533d", + "name": "scheduled-event" +} diff --git a/objects/social-media-group/definition.json b/objects/social-media-group/definition.json new file mode 100644 index 0000000..25a9927 --- /dev/null +++ b/objects/social-media-group/definition.json @@ -0,0 +1,102 @@ +{ + "requiredOneOf": [ + "group-name", + "group-alias", + "archive", + "description" + ], + "attributes": { + "group-name": { + "description": "The name of the group, channel or community.", + "ui-priority": 1, + "misp-attribute": "text" + }, + "description": { + "description": "A description of the group, channel or community.", + "ui-priority": 1, + "misp-attribute": "text" + }, + "group-alias": { + "description": "Aliases of group, channel or community.", + "ui-priority": 1, + "multiple": true, + "misp-attribute": "text" + }, + "platform": { + "description": "The social media platform used.", + "ui-priority": 1, + "misp-attribute": "text", + "disable_correlation": true, + "multiple": true, + "sane_default": [ + "Facebook", + "Twitter" + ] + }, + "username": { + "description": "A user account who is a member of the group.", + "ui-priority": 1, + "misp-attribute": "text", + "multiple": true + }, + "administrator": { + "description": "A user account who is an owner or admin of the group.", + "ui-priority": 1, + "misp-attribute": "text", + "multiple": true + }, + "person-name": { + "description": "A person who is a member of the group.", + "ui-priority": 1, + "misp-attribute": "text", + "multiple": true + }, + "hashtag": { + "description": "Hashtag used to identify or promote the group.", + "ui-priority": 0, + "misp-attribute": "text", + "multiple": true + }, + "url": { + "description": "Original URL location of the group (potentially malicious).", + "ui-priority": 1, + "misp-attribute": "url" + }, + "link": { + "description": "Original link into the group (supposed harmless).", + "ui-priority": 1, + "misp-attribute": "link" + }, + "embedded-link": { + "description": "Link embedded in the group description (potentially malicious).", + "ui-priority": 0, + "misp-attribute": "url", + "multiple": true + }, + "embedded-safe-link": { + "description": "Link embedded in the group description (supposed safe).", + "ui-priority": 0, + "misp-attribute": "link", + "multiple": true, + "to_ids": false + }, + "archive": { + "description": "Archive of the original group (Internet Archive, Archive.is, etc).", + "ui-priority": 1, + "multiple": true, + "disable_correlation": true, + "misp-attribute": "link" + }, + "attachment": { + "description": "A screen capture or exported list of contacts, group members, etc.", + "ui-priority": 1, + "multiple": true, + "misp-attribute": "attachment" + } + }, + "version": 1, + "description": "Social media group object template describing a public or private group or channel.", + "meta-category": "misc", + "uuid": "c4939ec4-ab53-4c35-9a98-3d4d4caf5b6c", + "name": "social-media-group" +} From 28b4b615eddcff9e62e2b0066917ae343fff209d Mon Sep 17 00:00:00 2001 From: VVX7 Date: Fri, 17 Apr 2020 00:11:48 -0400 Subject: [PATCH 145/155] chg: [object] add new microblog attributes, change some of the descriptions to make them clearer --- objects/microblog/definition.json | 50 ++++++++++++++++++++++++------- 1 file changed, 39 insertions(+), 11 deletions(-) diff --git a/objects/microblog/definition.json b/objects/microblog/definition.json index ffc7798..fd8dbb8 100644 --- a/objects/microblog/definition.json +++ b/objects/microblog/definition.json @@ -8,23 +8,23 @@ ], "attributes": { "post": { - "description": "Raw post", + "description": "Raw text of the post.", "ui-priority": 1, "misp-attribute": "text" }, "title": { - "description": "Title of the post", + "description": "Title of the post.", "ui-priority": 1, "misp-attribute": "text" }, "url": { - "description": "Original URL location of the microblog post (potentially malicious)", + "description": "Original URL of the microblog post (potentially malicious).", "ui-priority": 1, "multiple": true, "misp-attribute": "url" }, "link": { - "description": "Original link into the microblog post (Supposed harmless)", + "description": "Original link to the microblog post (supposed harmless).", "ui-priority": 1, "misp-attribute": "link", "multiple": true, @@ -76,6 +76,11 @@ "ui-priority": 0, "misp-attribute": "text" }, + "display-name": { + "description": "Display name of the account who posted the microblog.", + "ui-priority": 0, + "misp-attribute": "text" + }, "verified-username": { "description": "Is the username account verified by the operator of the microblog platform", "ui-priority": 0, @@ -97,6 +102,30 @@ "ui-priority": 0, "misp-attribute": "datetime" }, + "in-reply-to-user-id": { + "description": "The user ID of the microblog this post replies to.", + "ui-priority": 0, + "misp-attribute": "text", + "multiple": true + }, + "in-reply-to-status-id": { + "description": "The microblog ID of the microblog this post replies to.", + "ui-priority": 0, + "misp-attribute": "text", + "multiple": true + }, + "in-reply-to-display-name": { + "description": "The user display name of the microblog this post replies to.", + "ui-priority": 0, + "misp-attribute": "text", + "multiple": true + }, + "language": { + "description": "The language of the post.", + "ui-priority": 0, + "misp-attribute": "text", + "multiple": true + }, "embedded-link": { "description": "Link into the microblog post", "ui-priority": 0, @@ -107,34 +136,33 @@ "description": "Safe link into the microblog post", "ui-priority": 0, "misp-attribute": "link", - "multiple": true, - "to_ids": false + "multiple": true }, "removal-date": { - "description": "When the microblog post was removed", + "description": "When the microblog post was removed.", "ui-priority": 0, "misp-attribute": "datetime" }, "username-quoted": { - "description": "Username who are quoted into the microblog post", + "description": "Username who are quoted in the microblog post.", "ui-priority": 0, "multiple": true, "misp-attribute": "text" }, "twitter-id": { - "description": "Twitter id", + "description": "The microblog post id.", "ui-priority": 0, "multiple": true, "misp-attribute": "twitter-id" }, "hashtag": { - "description": "Hashtag into the microblog post", + "description": "Hashtag embedded in the microblog post", "ui-priority": 0, "misp-attribute": "text", "multiple": true } }, - "version": 19, + "version": 20, "description": "Microblog post like a Twitter tweet or a post on a Facebook wall.", "meta-category": "misc", "uuid": "8ec8c911-ddbe-4f5b-895b-fbff70c42a60", From 3b5451c32518da3e29c575e868d245f27c18dcf4 Mon Sep 17 00:00:00 2001 From: Alexandre Dulaunoy Date: Fri, 24 Apr 2020 18:24:25 +0200 Subject: [PATCH 146/155] chg: [legal-entity] website and logo added for legal entity Thanks to Emmanuel MANCIET for the proposal --- objects/legal-entity/definition.json | 24 +++++++++++++++++------- 1 file changed, 17 insertions(+), 7 deletions(-) diff --git a/objects/legal-entity/definition.json b/objects/legal-entity/definition.json index 29f89c5..6812944 100644 --- a/objects/legal-entity/definition.json +++ b/objects/legal-entity/definition.json @@ -10,37 +10,47 @@ "misp-attribute": "text" }, "name": { - "description": "Name of an entity.", + "description": "Name of the entity.", "ui-priority": 0, "misp-attribute": "text" }, "commercial-name": { - "description": "Commercial name of an entity.", + "description": "Commercial name of the entity.", "ui-priority": 0, "misp-attribute": "text" }, "legal-form": { - "description": "Legal form of an entity.", + "description": "Legal form of the entity.", "ui-priority": 0, "misp-attribute": "text" }, "registration-number": { - "description": "Registration number of an entity in the relevant authority.", + "description": "Registration number of the entity in the relevant authority.", "ui-priority": 0, "misp-attribute": "text" }, "business": { - "description": "Business area of an entity.", + "description": "Business area of the entity.", "ui-priority": 0, "misp-attribute": "text" }, "phone-number": { - "description": "Phone number of an entity.", + "description": "Phone number of the entity.", "ui-priority": 0, "misp-attribute": "phone-number" + }, + "website": { + "description": "Website of the entity.", + "ui-priority": 0, + "misp-attribute": "link" + }, + "logo": { + "description": "Logo of the entity.", + "ui-priority": 0, + "misp-attribute": "attachment" } }, - "version": 1, + "version": 2, "description": "An object to describe a legal entity.", "meta-category": "misc", "uuid": "14f5688f-d89c-469f-9878-c48bf6c41c65", From 73d710cfbcf8f2f5af050a258f30a5e1e92cb430 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Rapha=C3=ABl=20Vinot?= Date: Sun, 26 Apr 2020 02:07:26 +0200 Subject: [PATCH 147/155] fix: Align directory names with object name --- objects/{cytomic_orion => cytomic-orion-file}/definition.json | 0 .../definition.json | 0 objects/{dark-pattern => dark-pattern-item}/definition.json | 0 .../definition.json | 0 .../definition.json | 0 objects/{TSK-Chats => tsk-chats}/definition.json | 0 objects/{TSK-Web-Bookmark => tsk-web-bookmark}/definition.json | 0 objects/{TSK-Web-Cookie => tsk-web-cookie}/definition.json | 0 objects/{TSK-Web-Downloads => tsk-web-downloads}/definition.json | 0 objects/{TSK-Web-History => tsk-web-history}/definition.json | 0 .../definition.json | 0 11 files changed, 0 insertions(+), 0 deletions(-) rename objects/{cytomic_orion => cytomic-orion-file}/definition.json (100%) rename objects/{cytomic_orion_machine => cytomic-orion-machine}/definition.json (100%) rename objects/{dark-pattern => dark-pattern-item}/definition.json (100%) rename objects/{regripper-software-hive-general-windows-info => regripper-software-hive-windows-general-info}/definition.json (100%) rename objects/{regripper-system-hive-service-drivers => regripper-system-hive-services-drivers}/definition.json (100%) rename objects/{TSK-Chats => tsk-chats}/definition.json (100%) rename objects/{TSK-Web-Bookmark => tsk-web-bookmark}/definition.json (100%) rename objects/{TSK-Web-Cookie => tsk-web-cookie}/definition.json (100%) rename objects/{TSK-Web-Downloads => tsk-web-downloads}/definition.json (100%) rename objects/{TSK-Web-History => tsk-web-history}/definition.json (100%) rename objects/{TSK-Web-Search-Query => tsk-web-search-query}/definition.json (100%) diff --git a/objects/cytomic_orion/definition.json b/objects/cytomic-orion-file/definition.json similarity index 100% rename from objects/cytomic_orion/definition.json rename to objects/cytomic-orion-file/definition.json diff --git a/objects/cytomic_orion_machine/definition.json b/objects/cytomic-orion-machine/definition.json similarity index 100% rename from objects/cytomic_orion_machine/definition.json rename to objects/cytomic-orion-machine/definition.json diff --git a/objects/dark-pattern/definition.json b/objects/dark-pattern-item/definition.json similarity index 100% rename from objects/dark-pattern/definition.json rename to objects/dark-pattern-item/definition.json diff --git a/objects/regripper-software-hive-general-windows-info/definition.json b/objects/regripper-software-hive-windows-general-info/definition.json similarity index 100% rename from objects/regripper-software-hive-general-windows-info/definition.json rename to objects/regripper-software-hive-windows-general-info/definition.json diff --git a/objects/regripper-system-hive-service-drivers/definition.json b/objects/regripper-system-hive-services-drivers/definition.json similarity index 100% rename from objects/regripper-system-hive-service-drivers/definition.json rename to objects/regripper-system-hive-services-drivers/definition.json diff --git a/objects/TSK-Chats/definition.json b/objects/tsk-chats/definition.json similarity index 100% rename from objects/TSK-Chats/definition.json rename to objects/tsk-chats/definition.json diff --git a/objects/TSK-Web-Bookmark/definition.json b/objects/tsk-web-bookmark/definition.json similarity index 100% rename from objects/TSK-Web-Bookmark/definition.json rename to objects/tsk-web-bookmark/definition.json diff --git a/objects/TSK-Web-Cookie/definition.json b/objects/tsk-web-cookie/definition.json similarity index 100% rename from objects/TSK-Web-Cookie/definition.json rename to objects/tsk-web-cookie/definition.json diff --git a/objects/TSK-Web-Downloads/definition.json b/objects/tsk-web-downloads/definition.json similarity index 100% rename from objects/TSK-Web-Downloads/definition.json rename to objects/tsk-web-downloads/definition.json diff --git a/objects/TSK-Web-History/definition.json b/objects/tsk-web-history/definition.json similarity index 100% rename from objects/TSK-Web-History/definition.json rename to objects/tsk-web-history/definition.json diff --git a/objects/TSK-Web-Search-Query/definition.json b/objects/tsk-web-search-query/definition.json similarity index 100% rename from objects/TSK-Web-Search-Query/definition.json rename to objects/tsk-web-search-query/definition.json From d9f1db590aa1258950b1b45b57881b33d35a5e93 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Rapha=C3=ABl=20Vinot?= Date: Sun, 26 Apr 2020 02:10:02 +0200 Subject: [PATCH 148/155] chg: Sort all the entries in the templates by default --- objects/ail-leak/definition.json | 126 ++--- objects/ais-info/definition.json | 34 +- objects/android-permission/definition.json | 26 +- objects/annotation/definition.json | 100 ++-- objects/anonymisation/definition.json | 130 ++--- objects/asn/definition.json | 88 +-- objects/attack-pattern/definition.json | 90 +-- .../authenticode-signerinfo/definition.json | 76 +-- objects/av-signature/definition.json | 84 +-- objects/bank-account/definition.json | 226 ++++---- objects/bgp-hijack/definition.json | 90 +-- objects/blog/definition.json | 136 ++--- objects/btc-transaction/definition.json | 88 +-- objects/btc-wallet/definition.json | 46 +- objects/cap-alert/definition.json | 138 ++--- objects/cap-info/definition.json | 206 +++---- objects/cap-resource/definition.json | 66 +-- objects/coin-address/definition.json | 124 ++-- objects/command-line/definition.json | 22 +- objects/command/definition.json | 28 +- objects/cookie/definition.json | 58 +- objects/cortex-taxonomy/definition.json | 84 +-- objects/cortex/definition.json | 52 +- objects/course-of-action/definition.json | 148 ++--- .../covid19-csse-daily-report/definition.json | 106 ++-- objects/covid19-dxy-live-city/definition.json | 40 +- .../covid19-dxy-live-province/definition.json | 50 +- objects/cowrie/definition.json | 208 +++---- objects/credential/definition.json | 108 ++-- objects/credit-card/definition.json | 84 +-- objects/crypto-material/definition.json | 226 ++++---- objects/cytomic-orion-file/definition.json | 74 +-- objects/cytomic-orion-machine/definition.json | 192 +++---- objects/dark-pattern-item/definition.json | 78 +-- objects/ddos/definition.json | 122 ++-- objects/device/definition.json | 110 ++-- objects/diameter-attack/definition.json | 94 ++-- objects/dns-record/definition.json | 104 ++-- objects/domain-crawled/definition.json | 40 +- objects/domain-ip/definition.json | 104 ++-- objects/elf-section/definition.json | 216 +++---- objects/elf/definition.json | 82 +-- objects/email/definition.json | 342 +++++------ objects/employee/definition.json | 86 +-- objects/exploit-poc/definition.json | 76 +-- objects/facial-composite/definition.json | 40 +- objects/fail2ban/definition.json | 108 ++-- objects/file/definition.json | 348 ++++++------ objects/forensic-case/definition.json | 66 +-- objects/forensic-evidence/definition.json | 100 ++-- objects/forged-document/definition.json | 132 ++--- objects/geolocation/definition.json | 134 ++--- objects/gtp-attack/definition.json | 78 +-- objects/http-request/definition.json | 108 ++-- objects/ilr-impact/definition.json | 54 +- .../ilr-notification-incident/definition.json | 186 +++--- objects/impersonation/definition.json | 116 ++-- objects/imsi-catcher/definition.json | 136 ++--- objects/instant-message-group/definition.json | 98 ++-- objects/instant-message/definition.json | 154 ++--- objects/intelmq_event/definition.json | 2 +- objects/intelmq_report/definition.json | 2 +- objects/internal-reference/definition.json | 78 +-- objects/interpol-notice/definition.json | 216 +++---- objects/iot-device/definition.json | 168 +++--- objects/iot-firmware/definition.json | 104 ++-- objects/ip-api-address/definition.json | 142 ++--- objects/ip-port/definition.json | 190 +++---- objects/irc/definition.json | 136 ++--- objects/ja3/definition.json | 46 +- objects/leaked-document/definition.json | 170 +++--- objects/legal-entity/definition.json | 84 +-- objects/lnk/definition.json | 530 +++++++++--------- objects/macho-section/definition.json | 166 +++--- objects/macho/definition.json | 62 +- .../mactime-timeline-analysis/definition.json | 68 +-- objects/malware-config/definition.json | 58 +- objects/meme-image/definition.json | 138 ++--- objects/microblog/definition.json | 258 ++++----- objects/mutex/definition.json | 30 +- objects/narrative/definition.json | 80 +-- objects/netflow/definition.json | 212 +++---- objects/network-connection/definition.json | 122 ++-- objects/network-socket/definition.json | 160 +++--- objects/news-agency/definition.json | 136 ++--- objects/news-media/definition.json | 208 +++---- objects/organization/definition.json | 110 ++-- .../original-imported-file/definition.json | 34 +- objects/passive-dns/definition.json | 126 ++--- objects/paste/definition.json | 80 +-- objects/pcap-metadata/definition.json | 64 +-- objects/pe-section/definition.json | 236 ++++---- objects/pe/definition.json | 236 ++++---- objects/person/definition.json | 258 ++++----- objects/pgp-meta/definition.json | 24 +- objects/phishing-kit/definition.json | 146 ++--- objects/phishing/definition.json | 174 +++--- objects/phone/definition.json | 106 ++-- objects/process/definition.json | 208 +++---- objects/python-etvx-event-log/definition.json | 230 ++++---- objects/r2graphity/definition.json | 212 +++---- objects/regexp/definition.json | 36 +- objects/registry-key/definition.json | 102 ++-- objects/regripper-NTUser/definition.json | 180 +++--- .../definition.json | 116 ++-- .../definition.json | 92 +-- .../definition.json | 106 ++-- .../definition.json | 92 +-- .../definition.json | 84 +-- .../definition.json | 102 ++-- .../definition.json | 52 +- .../definition.json | 70 +-- .../definition.json | 308 +++++----- .../definition.json | 194 +++---- .../definition.json | 66 +-- .../definition.json | 146 ++--- .../definition.json | 164 +++--- .../definition.json | 112 ++-- objects/report/definition.json | 48 +- objects/research-scanner/definition.json | 106 ++-- objects/rogue-dns/definition.json | 54 +- objects/rtir/definition.json | 54 +- objects/sandbox-report/definition.json | 164 +++--- objects/sb-signature/definition.json | 86 +-- objects/scheduled-event/definition.json | 178 +++--- objects/scrippsco2-c13-daily/definition.json | 86 +-- .../scrippsco2-c13-monthly/definition.json | 98 ++-- objects/scrippsco2-co2-daily/definition.json | 86 +-- .../scrippsco2-co2-monthly/definition.json | 98 ++-- objects/scrippsco2-o18-daily/definition.json | 86 +-- .../scrippsco2-o18-monthly/definition.json | 98 ++-- objects/script/definition.json | 64 +-- objects/shell-commands/definition.json | 42 +- objects/shodan-report/definition.json | 118 ++-- objects/short-message-service/definition.json | 102 ++-- objects/shortened-link/definition.json | 76 +-- objects/social-media-group/definition.json | 188 +++---- objects/splunk/definition.json | 106 ++-- objects/ss7-attack/definition.json | 258 ++++----- objects/ssh-authorized-keys/definition.json | 128 ++--- objects/stix2-pattern/definition.json | 24 +- objects/suricata/definition.json | 38 +- objects/target-system/definition.json | 52 +- objects/threatgrid-report/definition.json | 148 ++--- objects/timecode/definition.json | 84 +-- objects/timesketch-timeline/definition.json | 54 +- objects/timesketch_message/definition.json | 22 +- objects/timestamp/definition.json | 50 +- objects/tor-hiddenservice/definition.json | 66 +-- objects/tor-node/definition.json | 156 +++--- objects/tracking-id/definition.json | 70 +-- objects/transaction/definition.json | 216 +++---- objects/translation/definition.json | 232 ++++---- objects/trustar_report/definition.json | 2 +- objects/tsk-chats/definition.json | 128 ++--- objects/tsk-web-bookmark/definition.json | 76 +-- objects/tsk-web-cookie/definition.json | 80 +-- objects/tsk-web-downloads/definition.json | 98 ++-- objects/tsk-web-history/definition.json | 86 +-- objects/tsk-web-search-query/definition.json | 84 +-- objects/url/definition.json | 148 ++--- objects/user-account/definition.json | 202 +++---- objects/vehicle/definition.json | 172 +++--- objects/victim/definition.json | 138 ++--- objects/virustotal-graph/definition.json | 50 +- objects/virustotal-report/definition.json | 116 ++-- objects/vulnerability/definition.json | 174 +++--- objects/weakness/definition.json | 46 +- objects/whois/definition.json | 170 +++--- objects/x509/definition.json | 294 +++++----- objects/yabin/definition.json | 48 +- objects/yara/definition.json | 54 +- 172 files changed, 10100 insertions(+), 10100 deletions(-) diff --git a/objects/ail-leak/definition.json b/objects/ail-leak/definition.json index feae522..8bc341c 100644 --- a/objects/ail-leak/definition.json +++ b/objects/ail-leak/definition.json @@ -1,4 +1,65 @@ { + "attributes": { + "duplicate": { + "description": "Duplicate of the existing leaks.", + "misp-attribute": "text", + "multiple": true, + "ui-priority": 0 + }, + "duplicate_number": { + "description": "Number of known duplicates.", + "disable_correlation": true, + "misp-attribute": "counter", + "ui-priority": 0 + }, + "first-seen": { + "description": "When the leak has been accessible or seen for the first time.", + "disable_correlation": true, + "misp-attribute": "datetime", + "ui-priority": 0 + }, + "last-seen": { + "description": "When the leak has been accessible or seen for the last time.", + "disable_correlation": true, + "misp-attribute": "datetime", + "ui-priority": 0 + }, + "origin": { + "description": "The link where the leak is (or was) accessible at first-seen.", + "misp-attribute": "text", + "ui-priority": 1 + }, + "original-date": { + "description": "When the information available in the leak was created. It's usually before the first-seen.", + "disable_correlation": true, + "misp-attribute": "datetime", + "ui-priority": 0 + }, + "raw-data": { + "description": "Raw data as received by the AIL sensor compressed and encoded in Base64.", + "disable_correlation": true, + "misp-attribute": "attachment", + "ui-priority": 0 + }, + "sensor": { + "description": "The AIL sensor uuid where the leak was processed and analysed.", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 0 + }, + "text": { + "description": "A description of the leak which could include the potential victim(s) or description of the leak.", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 1 + } + }, + "description": "An information leak as defined by the AIL Analysis Information Leak framework.", + "meta-category": "misc", + "name": "ail-leak", + "required": [ + "sensor" + ], "requiredOneOf": [ "text", "first-seen", @@ -6,67 +67,6 @@ "origin", "raw-data" ], - "required": [ - "sensor" - ], - "attributes": { - "sensor": { - "description": "The AIL sensor uuid where the leak was processed and analysed.", - "disable_correlation": true, - "ui-priority": 0, - "misp-attribute": "text" - }, - "duplicate": { - "description": "Duplicate of the existing leaks.", - "ui-priority": 0, - "misp-attribute": "text", - "multiple": true - }, - "duplicate_number": { - "description": "Number of known duplicates.", - "disable_correlation": true, - "ui-priority": 0, - "misp-attribute": "counter" - }, - "origin": { - "description": "The link where the leak is (or was) accessible at first-seen.", - "ui-priority": 1, - "misp-attribute": "text" - }, - "text": { - "description": "A description of the leak which could include the potential victim(s) or description of the leak.", - "disable_correlation": true, - "ui-priority": 1, - "misp-attribute": "text" - }, - "original-date": { - "description": "When the information available in the leak was created. It's usually before the first-seen.", - "disable_correlation": true, - "ui-priority": 0, - "misp-attribute": "datetime" - }, - "last-seen": { - "description": "When the leak has been accessible or seen for the last time.", - "disable_correlation": true, - "ui-priority": 0, - "misp-attribute": "datetime" - }, - "first-seen": { - "description": "When the leak has been accessible or seen for the first time.", - "disable_correlation": true, - "ui-priority": 0, - "misp-attribute": "datetime" - }, - "raw-data": { - "description": "Raw data as received by the AIL sensor compressed and encoded in Base64.", - "disable_correlation": true, - "ui-priority": 0, - "misp-attribute": "attachment" - } - }, - "version": 9, - "description": "An information leak as defined by the AIL Analysis Information Leak framework.", - "meta-category": "misc", "uuid": "dc6a8fa2-0a43-4a0c-a5aa-b1a5336ca80e", - "name": "ail-leak" -} + "version": 9 +} \ No newline at end of file diff --git a/objects/ais-info/definition.json b/objects/ais-info/definition.json index 05e9629..9365798 100644 --- a/objects/ais-info/definition.json +++ b/objects/ais-info/definition.json @@ -1,25 +1,18 @@ { - "requiredOneOf": [ - "organisation", - "administrative-area", - "industry", - "country" - ], "attributes": { - "organisation": { - "description": "AIS Organisation Name.", + "administrative-area": { + "description": "AIS Administrative Area represented using ISO-3166-2.", "misp-attribute": "text", "ui-priority": 1 }, - "administrative-area": { - "description": "AIS Administrative Area represented using ISO-3166-2.", + "country": { + "description": "AIS Country represented using ISO-3166-1_alpha-2.", "misp-attribute": "text", "ui-priority": 1 }, "industry": { "description": "AIS IndustryType.", "misp-attribute": "text", - "ui-priority": 1, "multiple": true, "sane_default": [ "Chemical Sector", @@ -39,17 +32,24 @@ "Transportation Systems Sector", "Water and Wastewater Systems Sector", "Other" - ] + ], + "ui-priority": 1 }, - "country": { - "description": "AIS Country represented using ISO-3166-1_alpha-2.", + "organisation": { + "description": "AIS Organisation Name.", "misp-attribute": "text", "ui-priority": 1 } }, - "version": 1, "description": "Automated Indicator Sharing (AIS) Information Source Markings.", "meta-category": "misc", + "name": "ais-info", + "requiredOneOf": [ + "organisation", + "administrative-area", + "industry", + "country" + ], "uuid": "1f3f466d-465f-4c3a-8cce-933642c9ea83", - "name": "ais-info" -} + "version": 1 +} \ No newline at end of file diff --git a/objects/android-permission/definition.json b/objects/android-permission/definition.json index 0ecf198..993ea0c 100644 --- a/objects/android-permission/definition.json +++ b/objects/android-permission/definition.json @@ -1,11 +1,12 @@ { - "requiredOneOf": [ - "permission" - ], "attributes": { + "comment": { + "description": "Comment about the set of android permission(s)", + "misp-attribute": "comment", + "ui-priority": 0 + }, "permission": { "description": "Android permission", - "ui-priority": 0, "misp-attribute": "text", "multiple": true, "sane_default": [ @@ -155,17 +156,16 @@ "WRITE_SETTINGS", "WRITE_SYNC_SETTINGS", "WRITE_VOICEMAIL" - ] - }, - "comment": { - "description": "Comment about the set of android permission(s)", - "ui-priority": 0, - "misp-attribute": "comment" + ], + "ui-priority": 0 } }, - "version": 2, "description": "A set of android permissions - one or more permission(s) which can be linked to other objects (e.g. malware, app).", "meta-category": "misc", + "name": "android-permission", + "requiredOneOf": [ + "permission" + ], "uuid": "d81003b2-5c03-4d96-ae30-e6695de1aea2", - "name": "android-permission" -} + "version": 2 +} \ No newline at end of file diff --git a/objects/annotation/definition.json b/objects/annotation/definition.json index b64ee94..4d0f2fb 100644 --- a/objects/annotation/definition.json +++ b/objects/annotation/definition.json @@ -1,24 +1,55 @@ { - "requiredOneOf": [ - "text" - ], "attributes": { - "text": { - "description": "Raw text of the annotation", - "ui-priority": 0, - "misp-attribute": "text" + "attachment": { + "description": "An attachment to support the annotation", + "misp-attribute": "attachment", + "multiple": true, + "ui-priority": 0 + }, + "creation-date": { + "description": "Initial creation of the annotation", + "misp-attribute": "datetime", + "ui-priority": 0 + }, + "format": { + "description": "Format of the annotation", + "disable_correlation": true, + "misp-attribute": "text", + "sane_default": [ + "text", + "markdown", + "asciidoctor", + "MultiMarkdown", + "GFM", + "pandoc", + "Fountain", + "CommonWork", + "kramdown-rfc2629", + "rfc7328", + "Extra" + ], + "ui-priority": 0 + }, + "modification-date": { + "description": "Last update of the annotation", + "misp-attribute": "datetime", + "ui-priority": 0 }, "ref": { "description": "Reference(s) to the annotation", - "ui-priority": 0, "misp-attribute": "link", - "multiple": true + "multiple": true, + "ui-priority": 0 + }, + "text": { + "description": "Raw text of the annotation", + "misp-attribute": "text", + "ui-priority": 0 }, "type": { "description": "Type of the annotation", - "ui-priority": 0, - "misp-attribute": "text", "disable_correlation": true, + "misp-attribute": "text", "sane_default": [ "Annotation", "Executive Summary", @@ -32,47 +63,16 @@ "Authors", "Logo", "Full Report" - ] - }, - "format": { - "description": "Format of the annotation", - "ui-priority": 0, - "misp-attribute": "text", - "disable_correlation": true, - "sane_default": [ - "text", - "markdown", - "asciidoctor", - "MultiMarkdown", - "GFM", - "pandoc", - "Fountain", - "CommonWork", - "kramdown-rfc2629", - "rfc7328", - "Extra" - ] - }, - "creation-date": { - "description": "Initial creation of the annotation", - "ui-priority": 0, - "misp-attribute": "datetime" - }, - "modification-date": { - "description": "Last update of the annotation", - "ui-priority": 0, - "misp-attribute": "datetime" - }, - "attachment": { - "description": "An attachment to support the annotation", - "ui-priority": 0, - "misp-attribute": "attachment", - "multiple": true + ], + "ui-priority": 0 } }, - "version": 3, "description": "An annotation object allowing analysts to add annotations, comments, executive summary to a MISP event, objects or attributes.", "meta-category": "misc", + "name": "annotation", + "requiredOneOf": [ + "text" + ], "uuid": "5d8dc046-15a1-4ca3-a09f-ed4ede7c4487", - "name": "annotation" -} + "version": 3 +} \ No newline at end of file diff --git a/objects/anonymisation/definition.json b/objects/anonymisation/definition.json index d9da978..aa97427 100644 --- a/objects/anonymisation/definition.json +++ b/objects/anonymisation/definition.json @@ -1,62 +1,15 @@ { - "requiredOneOf": [ - "description", - "method", - "key", - "keyed-hash-function", - "encryption-function", - "regexp", - "iv" - ], "attributes": { - "method": { - "description": "Anonymisation (or pseudo-anonymisation) method(s) used", - "ui-priority": 1, + "description": { + "description": "Description of the anonymisation technique or tool used", "disable_correlation": true, - "sane_default": [ - "hiding - Attribute is replaced with a constant value (typically 0) of the same size. Sometimes called 'black marker'.", - "hash - A hash function maps each attribute to a new (not necessarily unique) attribute.", - "permutation - Maps each original value to a unique new value.", - "prefix-preserving - Any two values that had the same n-bit prefix before anonymisation will still have the same n-bit prefix as each other after anonymization. (Would be more accurately called 'prefix-relationship-preserving', because the actual prefix values are not preserved.) ", - "shift - Adds a fixed offset to each value/attribute.", - "enumeration - Map each original value to a new value such that their ordering is preserved.", - "partitioning - Possible values are partitioned into meaningful sets; actual values are replaced with a fixed value from the same set. E.g., TCP port numbers 0 to 1023 are replaced with 0, and 1024 to 65535 replaced with 65535.", - "updated - Checksums are recalculated to reflect changes made to other fields.", - "truncation - Field is shortened, losing data at the end.", - "encryption - Attribute is encrypted." - ], "misp-attribute": "text", - "multiple": true - }, - "key": { - "description": "Key (such as a PSK in a keyed-hash-function) used to anonymise the attribute", - "ui-priority": 1, - "disable_correlation": true, - "misp-attribute": "text" - }, - "iv": { - "description": "Initialisation vector for the encryption function used to anonymise the attribute", - "ui-priority": 1, - "disable_correlation": true, - "misp-attribute": "text" - }, - "keyed-hash-function": { - "description": "Keyed-hash function used to anonymise the attribute", - "ui-priority": 1, - "disable_correlation": true, - "sane_default": [ - "hmac-sha1", - "hmac-md5", - "hmac-sha256", - "hmac-sha384", - "hmac-sha512" - ], - "misp-attribute": "text" + "ui-priority": 1 }, "encryption-function": { "description": "Encryption function or algorithm used to anonymise the attribute", - "ui-priority": 1, "disable_correlation": true, + "misp-attribute": "text", "sane_default": [ "aes128", "aes-128-cbc", @@ -165,34 +118,81 @@ "sm4-ecb", "sm4-ofb" ], - "misp-attribute": "text" + "ui-priority": 1 }, - "regexp": { - "description": "Regular expression to perfom the anonymisation (reversible or not)", - "ui-priority": 10, + "iv": { + "description": "Initialisation vector for the encryption function used to anonymise the attribute", "disable_correlation": true, - "misp-attribute": "text" + "misp-attribute": "text", + "ui-priority": 1 }, - "description": { - "description": "Description of the anonymisation technique or tool used", - "ui-priority": 1, + "key": { + "description": "Key (such as a PSK in a keyed-hash-function) used to anonymise the attribute", "disable_correlation": true, - "misp-attribute": "text" + "misp-attribute": "text", + "ui-priority": 1 + }, + "keyed-hash-function": { + "description": "Keyed-hash function used to anonymise the attribute", + "disable_correlation": true, + "misp-attribute": "text", + "sane_default": [ + "hmac-sha1", + "hmac-md5", + "hmac-sha256", + "hmac-sha384", + "hmac-sha512" + ], + "ui-priority": 1 }, "level-of-knowledge": { "description": "Level of knowledge of the organisation who created this object", + "disable_correlation": true, + "misp-attribute": "text", "ui-priority": 10, "values_list": [ "Only the anonymised data is known", "Deanonymised data is known" - ], + ] + }, + "method": { + "description": "Anonymisation (or pseudo-anonymisation) method(s) used", "disable_correlation": true, - "misp-attribute": "text" + "misp-attribute": "text", + "multiple": true, + "sane_default": [ + "hiding - Attribute is replaced with a constant value (typically 0) of the same size. Sometimes called 'black marker'.", + "hash - A hash function maps each attribute to a new (not necessarily unique) attribute.", + "permutation - Maps each original value to a unique new value.", + "prefix-preserving - Any two values that had the same n-bit prefix before anonymisation will still have the same n-bit prefix as each other after anonymization. (Would be more accurately called 'prefix-relationship-preserving', because the actual prefix values are not preserved.) ", + "shift - Adds a fixed offset to each value/attribute.", + "enumeration - Map each original value to a new value such that their ordering is preserved.", + "partitioning - Possible values are partitioned into meaningful sets; actual values are replaced with a fixed value from the same set. E.g., TCP port numbers 0 to 1023 are replaced with 0, and 1024 to 65535 replaced with 65535.", + "updated - Checksums are recalculated to reflect changes made to other fields.", + "truncation - Field is shortened, losing data at the end.", + "encryption - Attribute is encrypted." + ], + "ui-priority": 1 + }, + "regexp": { + "description": "Regular expression to perfom the anonymisation (reversible or not)", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 10 } }, - "version": 2, "description": "Anonymisation object describing an anonymisation technique used to encode MISP attribute values. Reference: https://www.caida.org/tools/taxonomy/anonymization.xml", "meta-category": "misc", + "name": "anonymisation", + "requiredOneOf": [ + "description", + "method", + "key", + "keyed-hash-function", + "encryption-function", + "regexp", + "iv" + ], "uuid": "5867cffe-60ff-44f6-b097-e5f36b5de0ac", - "name": "anonymisation" -} + "version": 2 +} \ No newline at end of file diff --git a/objects/asn/definition.json b/objects/asn/definition.json index 9f8b1d6..9ca9c6a 100644 --- a/objects/asn/definition.json +++ b/objects/asn/definition.json @@ -1,69 +1,69 @@ { - "requiredOneOf": [ - "asn" - ], "attributes": { "asn": { "description": "Autonomous System Number", - "ui-priority": 1, - "misp-attribute": "AS" - }, - "description": { - "description": "Description of the autonomous system", - "ui-priority": 1, - "misp-attribute": "text" + "misp-attribute": "AS", + "ui-priority": 1 }, "country": { "description": "Country code of the main location of the autonomous system", - "ui-priority": 1, - "misp-attribute": "text" + "misp-attribute": "text", + "ui-priority": 1 }, - "subnet-announced": { - "description": "Subnet announced", - "ui-priority": 0, - "misp-attribute": "ip-src", - "multiple": true + "description": { + "description": "Description of the autonomous system", + "misp-attribute": "text", + "ui-priority": 1 + }, + "export": { + "description": "The outbound routing policy of the AS in RFC 2622 – Routing Policy Specification Language (RPSL) format", + "misp-attribute": "text", + "multiple": true, + "ui-priority": 0 }, "first-seen": { "description": "First time the ASN was seen", "disable_correlation": true, - "ui-priority": 0, - "misp-attribute": "datetime" + "misp-attribute": "datetime", + "ui-priority": 0 + }, + "import": { + "description": "The inbound IPv4 routing policy of the AS in RFC 2622 – Routing Policy Specification Language (RPSL) format", + "misp-attribute": "text", + "multiple": true, + "ui-priority": 0 }, "last-seen": { "description": "Last time the ASN was seen", "disable_correlation": true, - "ui-priority": 0, - "misp-attribute": "datetime" - }, - "import": { - "description": "The inbound IPv4 routing policy of the AS in RFC 2622 – Routing Policy Specification Language (RPSL) format", - "ui-priority": 0, - "misp-attribute": "text", - "multiple": true - }, - "export": { - "description": "The outbound routing policy of the AS in RFC 2622 – Routing Policy Specification Language (RPSL) format", - "ui-priority": 0, - "misp-attribute": "text", - "multiple": true - }, - "mp-import": { - "description": "The inbound IPv4 or IPv6 routing policy of the AS in RFC 4012 – Routing Policy Specification Language next generation (RPSLng), section 4.5. format", - "ui-priority": 0, - "misp-attribute": "text", - "multiple": true + "misp-attribute": "datetime", + "ui-priority": 0 }, "mp-export": { "description": "This attribute performs the same function as the export attribute above. The difference is that mp-export allows both IPv4 and IPv6 address families to be specified. The export is described in RFC 4012 – Routing Policy Specification Language next generation (RPSLng), section 4.5. format", - "ui-priority": 0, "misp-attribute": "text", - "multiple": true + "multiple": true, + "ui-priority": 0 + }, + "mp-import": { + "description": "The inbound IPv4 or IPv6 routing policy of the AS in RFC 4012 – Routing Policy Specification Language next generation (RPSLng), section 4.5. format", + "misp-attribute": "text", + "multiple": true, + "ui-priority": 0 + }, + "subnet-announced": { + "description": "Subnet announced", + "misp-attribute": "ip-src", + "multiple": true, + "ui-priority": 0 } }, - "version": 4, "description": "Autonomous system object describing an autonomous system which can include one or more network operators management an entity (e.g. ISP) along with their routing policy, routing prefixes or alike.", "meta-category": "network", + "name": "asn", + "requiredOneOf": [ + "asn" + ], "uuid": "4ec55cc6-9e49-4c64-b794-03c25c1a6587", - "name": "asn" -} + "version": 4 +} \ No newline at end of file diff --git a/objects/attack-pattern/definition.json b/objects/attack-pattern/definition.json index e3aa6a4..29255b5 100644 --- a/objects/attack-pattern/definition.json +++ b/objects/attack-pattern/definition.json @@ -1,51 +1,51 @@ { + "attributes": { + "id": { + "description": "CAPEC ID.", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 0 + }, + "name": { + "description": "Name of the attack pattern.", + "misp-attribute": "text", + "ui-priority": 0 + }, + "prerequisites": { + "description": "Prerequisites for the attack pattern to succeed.", + "misp-attribute": "text", + "ui-priority": 0 + }, + "references": { + "description": "External references", + "misp-attribute": "link", + "multiple": true, + "ui-priority": 0 + }, + "related-weakness": { + "description": "Weakness related to the attack pattern.", + "misp-attribute": "weakness", + "multiple": true, + "ui-priority": 0 + }, + "solutions": { + "description": "Solutions for the attack pattern to be countered.", + "misp-attribute": "text", + "ui-priority": 0 + }, + "summary": { + "description": "Summary description of the attack pattern.", + "misp-attribute": "text", + "ui-priority": 0 + } + }, + "description": "Attack pattern describing a common attack pattern enumeration and classification.", + "meta-category": "vulnerability", + "name": "attack-pattern", "requiredOneOf": [ "name", "id" ], - "attributes": { - "id": { - "description": "CAPEC ID.", - "ui-priority": 0, - "disable_correlation": true, - "misp-attribute": "text" - }, - "name": { - "description": "Name of the attack pattern.", - "ui-priority": 0, - "misp-attribute": "text" - }, - "summary": { - "description": "Summary description of the attack pattern.", - "ui-priority": 0, - "misp-attribute": "text" - }, - "prerequisites": { - "description": "Prerequisites for the attack pattern to succeed.", - "ui-priority": 0, - "misp-attribute": "text" - }, - "solutions": { - "description": "Solutions for the attack pattern to be countered.", - "ui-priority": 0, - "misp-attribute": "text" - }, - "related-weakness": { - "description": "Weakness related to the attack pattern.", - "ui-priority": 0, - "multiple": true, - "misp-attribute": "weakness" - }, - "references": { - "description": "External references", - "ui-priority": 0, - "multiple": true, - "misp-attribute": "link" - } - }, - "version": 1, - "description": "Attack pattern describing a common attack pattern enumeration and classification.", - "meta-category": "vulnerability", "uuid": "35928348-56be-4d7f-9752-a80927936351", - "name": "attack-pattern" -} + "version": 1 +} \ No newline at end of file diff --git a/objects/authenticode-signerinfo/definition.json b/objects/authenticode-signerinfo/definition.json index 7010ce9..64d6070 100644 --- a/objects/authenticode-signerinfo/definition.json +++ b/objects/authenticode-signerinfo/definition.json @@ -1,34 +1,19 @@ { - "requiredOneOf": [ - "url", - "program-name" - ], "attributes": { - "text": { - "description": "Free text description of the signer info", - "ui-priority": 1, - "misp-attribute": "text" + "content-type": { + "description": "Content type", + "misp-attribute": "text", + "ui-priority": 0 + }, + "digest_algorithm": { + "description": "Digest algorithm", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 0 }, "issuer": { "description": "Issuer of the certificate", - "ui-priority": 0, - "misp-attribute": "text", - "disable_correlation": true - }, - "version": { - "description": "Version of the certificate", - "ui-priority": 0, - "misp-attribute": "text", - "disable_correlation": true - }, - "url": { - "description": "Url", - "multiple": true, - "misp-attribute": "url", - "ui-priority": 0 - }, - "content-type": { - "description": "Content type", + "disable_correlation": true, "misp-attribute": "text", "ui-priority": 0 }, @@ -37,26 +22,41 @@ "misp-attribute": "text", "ui-priority": 0 }, - "digest_algorithm": { - "description": "Digest algorithm", - "misp-attribute": "text", - "ui-priority": 0, - "disable_correlation": true - }, "signature_algorithm": { "description": "Signature algorithm", - "misp-attribute": "text", - "ui-priority": 0, "disable_correlation": true, + "misp-attribute": "text", "sane_default": [ "SHA1_WITH_RSA_ENCRYPTION", "SHA256_WITH_RSA_ENCRYPTION" - ] + ], + "ui-priority": 0 + }, + "text": { + "description": "Free text description of the signer info", + "misp-attribute": "text", + "ui-priority": 1 + }, + "url": { + "description": "Url", + "misp-attribute": "url", + "multiple": true, + "ui-priority": 0 + }, + "version": { + "description": "Version of the certificate", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 0 } }, - "version": 1, "description": "Authenticode Signer Info", "meta-category": "file", + "name": "authenticode-signerinfo", + "requiredOneOf": [ + "url", + "program-name" + ], "uuid": "965cb0aa-baf1-4cc6-9070-68f5c1698c1e", - "name": "authenticode-signerinfo" -} + "version": 1 +} \ No newline at end of file diff --git a/objects/av-signature/definition.json b/objects/av-signature/definition.json index 345f887..b8609bb 100644 --- a/objects/av-signature/definition.json +++ b/objects/av-signature/definition.json @@ -1,48 +1,48 @@ { + "attributes": { + "datetime": { + "categories": [ + "Other" + ], + "description": "Datetime", + "disable_correlation": true, + "misp-attribute": "datetime", + "ui-priority": 0 + }, + "signature": { + "categories": [ + "Antivirus detection" + ], + "description": "Name of detection signature", + "misp-attribute": "text", + "ui-priority": 2 + }, + "software": { + "categories": [ + "Antivirus detection" + ], + "description": "Name of antivirus software", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 1 + }, + "text": { + "categories": [ + "Other" + ], + "description": "Free text value to attach to the file", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 0 + } + }, + "description": "Antivirus detection signature", + "meta-category": "misc", + "name": "av-signature", "required": [ "software", "signature" ], - "attributes": { - "software": { - "description": "Name of antivirus software", - "disable_correlation": true, - "categories": [ - "Antivirus detection" - ], - "ui-priority": 1, - "misp-attribute": "text" - }, - "signature": { - "description": "Name of detection signature", - "categories": [ - "Antivirus detection" - ], - "ui-priority": 2, - "misp-attribute": "text" - }, - "text": { - "description": "Free text value to attach to the file", - "disable_correlation": true, - "categories": [ - "Other" - ], - "ui-priority": 0, - "misp-attribute": "text" - }, - "datetime": { - "description": "Datetime", - "disable_correlation": true, - "categories": [ - "Other" - ], - "ui-priority": 0, - "misp-attribute": "datetime" - } - }, - "version": 1, - "description": "Antivirus detection signature", - "meta-category": "misc", "uuid": "4dbb56ef-4763-4c97-8696-a2bfc305cf8e", - "name": "av-signature" -} + "version": 1 +} \ No newline at end of file diff --git a/objects/bank-account/definition.json b/objects/bank-account/definition.json index 37d0527..fd19d8b 100644 --- a/objects/bank-account/definition.json +++ b/objects/bank-account/definition.json @@ -1,83 +1,110 @@ { - "requiredOneOf": [ - "account", - "iban" - ], "attributes": { - "text": { - "description": "A description of the bank account.", - "disable_correlation": true, - "ui-priority": 0, - "misp-attribute": "text" + "aba-rtn": { + "description": " ABA routing transit number", + "misp-attribute": "aba-rtn", + "ui-priority": 0 }, - "institution-name": { - "description": "Name of the bank or financial organisation.", - "disable_correlation": true, - "ui-priority": 0, - "misp-attribute": "text" + "account": { + "description": "Account number", + "misp-attribute": "bank-account-nr", + "ui-priority": 0 }, - "institution-code": { - "description": "Institution code of the bank.", - "disable_correlation": true, - "ui-priority": 0, - "misp-attribute": "text" + "account-name": { + "description": "A field to freely describe the bank account details.", + "misp-attribute": "text", + "ui-priority": 0 }, - "swift": { - "description": "SWIFT or BIC as defined in ISO 9362.", + "balance": { + "description": "The balance of the account after the suspicious transaction was processed.", "disable_correlation": true, - "ui-priority": 0, - "misp-attribute": "bic" + "misp-attribute": "text", + "ui-priority": 0 + }, + "beneficiary": { + "description": "Final beneficiary of the bank account.", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 0 + }, + "beneficiary-comment": { + "description": "Comment about the final beneficiary.", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 0 }, "branch": { "description": "Branch code or name", "disable_correlation": true, - "ui-priority": 0, - "misp-attribute": "text" + "misp-attribute": "text", + "ui-priority": 0 }, - "non-banking-institution": { - "description": "A flag to define if this account belong to a non-banking organisation. If set to true, it's a non-banking organisation.", + "client-number": { + "description": "Client number as seen by the bank.", + "misp-attribute": "text", + "ui-priority": 0 + }, + "closed": { + "description": "When the account was closed.", "disable_correlation": true, - "ui-priority": 0, - "misp-attribute": "boolean" + "misp-attribute": "datetime", + "ui-priority": 0 }, - "account": { - "description": "Account number", - "ui-priority": 0, - "misp-attribute": "bank-account-nr" + "comments": { + "description": "Comments about the bank account.", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 0 }, "currency-code": { "description": "Currency of the account.", - "ui-priority": 0, + "disable_correlation": true, + "misp-attribute": "text", "sane_default": [ "USD", "EUR" ], + "ui-priority": 0 + }, + "date-balance": { + "description": "When the balance was reported.", "disable_correlation": true, - "misp-attribute": "text" - }, - "aba-rtn": { - "description": " ABA routing transit number", - "ui-priority": 0, - "misp-attribute": "aba-rtn" - }, - "account-name": { - "description": "A field to freely describe the bank account details.", - "ui-priority": 0, - "misp-attribute": "text" + "misp-attribute": "datetime", + "ui-priority": 0 }, "iban": { "description": "IBAN of the bank account.", - "ui-priority": 0, - "misp-attribute": "iban" + "misp-attribute": "iban", + "ui-priority": 0 }, - "client-number": { - "description": "Client number as seen by the bank.", - "ui-priority": 0, - "misp-attribute": "text" + "institution-code": { + "description": "Institution code of the bank.", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 0 + }, + "institution-name": { + "description": "Name of the bank or financial organisation.", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 0 + }, + "non-banking-institution": { + "description": "A flag to define if this account belong to a non-banking organisation. If set to true, it's a non-banking organisation.", + "disable_correlation": true, + "misp-attribute": "boolean", + "ui-priority": 0 + }, + "opened": { + "description": "When the account was opened.", + "disable_correlation": true, + "misp-attribute": "datetime", + "ui-priority": 0 }, "personal-account-type": { "description": "Account type.", - "ui-priority": 0, + "disable_correlation": true, + "misp-attribute": "text", "sane_default": [ "A - Business", "B - Personal Current", @@ -86,67 +113,12 @@ "E - Trading Account", "O - Other" ], - "disable_correlation": true, - "misp-attribute": "text" - }, - "opened": { - "description": "When the account was opened.", - "ui-priority": 0, - "misp-attribute": "datetime", - "disable_correlation": true - }, - "closed": { - "description": "When the account was closed.", - "ui-priority": 0, - "misp-attribute": "datetime", - "disable_correlation": true - }, - "balance": { - "description": "The balance of the account after the suspicious transaction was processed.", - "ui-priority": 0, - "misp-attribute": "text", - "disable_correlation": true - }, - "date-balance": { - "description": "When the balance was reported.", - "ui-priority": 0, - "misp-attribute": "datetime", - "disable_correlation": true - }, - "status-code": { - "description": "Account status at the time of the transaction processed.", - "ui-priority": 0, - "misp-attribute": "text", - "disable_correlation": true, - "sane_default": [ - "A - Active", - "B - Inactive", - "C - Dormant" - ] - }, - "beneficiary": { - "description": "Final beneficiary of the bank account.", - "ui-priority": 0, - "misp-attribute": "text", - "disable_correlation": true - }, - "beneficiary-comment": { - "description": "Comment about the final beneficiary.", - "ui-priority": 0, - "misp-attribute": "text", - "disable_correlation": true - }, - "comments": { - "description": "Comments about the bank account.", - "ui-priority": 0, - "misp-attribute": "text", - "disable_correlation": true + "ui-priority": 0 }, "report-code": { "description": "Report code of the bank account.", - "ui-priority": 0, - "misp-attribute": "text", "disable_correlation": true, + "misp-attribute": "text", "sane_default": [ "CTR Cash Transaction Report", "STR Suspicious Transaction Report", @@ -160,12 +132,40 @@ "ORI Outgoing Request for Information – International", "IRD Incoming Request for Information – Domestic", "ORD Outgoing Request for Information – Domestic" - ] + ], + "ui-priority": 0 + }, + "status-code": { + "description": "Account status at the time of the transaction processed.", + "disable_correlation": true, + "misp-attribute": "text", + "sane_default": [ + "A - Active", + "B - Inactive", + "C - Dormant" + ], + "ui-priority": 0 + }, + "swift": { + "description": "SWIFT or BIC as defined in ISO 9362.", + "disable_correlation": true, + "misp-attribute": "bic", + "ui-priority": 0 + }, + "text": { + "description": "A description of the bank account.", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 0 } }, - "version": 2, "description": "An object describing bank account information based on account description from goAML 4.0.", "meta-category": "financial", + "name": "bank-account", + "requiredOneOf": [ + "account", + "iban" + ], "uuid": "b4712203-95a8-4883-80e9-b566f5df11c9", - "name": "bank-account" -} + "version": 2 +} \ No newline at end of file diff --git a/objects/bgp-hijack/definition.json b/objects/bgp-hijack/definition.json index 1955f9a..4253d08 100644 --- a/objects/bgp-hijack/definition.json +++ b/objects/bgp-hijack/definition.json @@ -1,53 +1,53 @@ { + "attributes": { + "country": { + "description": "Country code of the main location of the attacking autonomous system", + "misp-attribute": "text", + "ui-priority": 1 + }, + "description": { + "description": "BGP Hijack details", + "misp-attribute": "text", + "ui-priority": 1 + }, + "detected-asn": { + "description": "Detected Autonomous System Number", + "misp-attribute": "AS", + "ui-priority": 1 + }, + "end": { + "description": "Last time the Prefix hijack was seen", + "disable_correlation": true, + "misp-attribute": "datetime", + "ui-priority": 0 + }, + "expected-asn": { + "description": "Expected Autonomous System Number", + "misp-attribute": "AS", + "ui-priority": 1 + }, + "start": { + "description": "First time the Prefix hijack was seen", + "disable_correlation": true, + "misp-attribute": "datetime", + "ui-priority": 0 + }, + "subnet-announced": { + "description": "Subnet announced", + "misp-attribute": "ip-src", + "multiple": true, + "ui-priority": 0 + } + }, + "description": "Object encapsulating BGP Hijack description as specified, for example, by bgpstream.com", + "meta-category": "network", + "name": "bgp-hijack", "required": [ "expected-asn", "detected-asn", "start", "subnet-announced" ], - "attributes": { - "expected-asn": { - "description": "Expected Autonomous System Number", - "ui-priority": 1, - "misp-attribute": "AS" - }, - "detected-asn": { - "description": "Detected Autonomous System Number", - "ui-priority": 1, - "misp-attribute": "AS" - }, - "description": { - "description": "BGP Hijack details", - "ui-priority": 1, - "misp-attribute": "text" - }, - "country": { - "description": "Country code of the main location of the attacking autonomous system", - "ui-priority": 1, - "misp-attribute": "text" - }, - "subnet-announced": { - "description": "Subnet announced", - "ui-priority": 0, - "misp-attribute": "ip-src", - "multiple": true - }, - "start": { - "description": "First time the Prefix hijack was seen", - "disable_correlation": true, - "ui-priority": 0, - "misp-attribute": "datetime" - }, - "end": { - "description": "Last time the Prefix hijack was seen", - "disable_correlation": true, - "ui-priority": 0, - "misp-attribute": "datetime" - } - }, - "version": 1, - "description": "Object encapsulating BGP Hijack description as specified, for example, by bgpstream.com", - "meta-category": "network", "uuid": "42355673-1fab-4908-8045-00bebd91c389", - "name": "bgp-hijack" -} + "version": 1 +} \ No newline at end of file diff --git a/objects/blog/definition.json b/objects/blog/definition.json index 7528174..9a1873c 100644 --- a/objects/blog/definition.json +++ b/objects/blog/definition.json @@ -1,42 +1,57 @@ { - "requiredOneOf": [ - "post", - "archive", - "url", - "link" - ], "attributes": { - "post": { - "description": "Raw post.", - "ui-priority": 1, - "misp-attribute": "text" + "archive": { + "description": "Archive of the original document (Internet Archive, Archive.is, etc).", + "misp-attribute": "link", + "multiple": true, + "ui-priority": 1 }, - "title": { - "description": "Title of blog post.", - "ui-priority": 1, - "misp-attribute": "text" + "creation-date": { + "description": "Initial creation of the blog post.", + "misp-attribute": "datetime", + "ui-priority": 0 }, - "url": { - "description": "Original URL location of the blog post (potentially malicious).", - "ui-priority": 1, - "misp-attribute": "url" + "embedded-link": { + "description": "Site linked by the blog post.", + "misp-attribute": "url", + "multiple": true, + "ui-priority": 0 + }, + "embedded-safe-link": { + "description": "Safe site linked by the blog post.", + "misp-attribute": "link", + "multiple": true, + "ui-priority": 0 }, "link": { "description": "Original link into the blog post (Supposed harmless).", - "ui-priority": 1, - "misp-attribute": "link" + "misp-attribute": "link", + "ui-priority": 1 }, - "archive": { - "description": "Archive of the original document (Internet Archive, Archive.is, etc).", - "ui-priority": 1, - "multiple": true, - "misp-attribute": "link" + "modification-date": { + "description": "Last update of the blog post.", + "misp-attribute": "datetime", + "ui-priority": 0 + }, + "post": { + "description": "Raw post.", + "misp-attribute": "text", + "ui-priority": 1 + }, + "removal-date": { + "description": "When the blog post was removed.", + "misp-attribute": "datetime", + "ui-priority": 0 + }, + "title": { + "description": "Title of blog post.", + "misp-attribute": "text", + "ui-priority": 1 }, "type": { "description": "Type of blog post.", - "ui-priority": 1, - "misp-attribute": "text", "disable_correlation": true, + "misp-attribute": "text", "sane_default": [ "Medium", "WordPress", @@ -45,61 +60,46 @@ "LiveJournal", "Forum", "Other" - ] + ], + "ui-priority": 1 + }, + "url": { + "description": "Original URL location of the blog post (potentially malicious).", + "misp-attribute": "url", + "ui-priority": 1 }, "username": { "description": "Username who posted the blog post.", - "ui-priority": 0, - "misp-attribute": "text" + "misp-attribute": "text", + "ui-priority": 0 + }, + "username-quoted": { + "description": "Username who are quoted into the blog post.", + "misp-attribute": "text", + "multiple": true, + "ui-priority": 0 }, "verified-username": { "description": "Is the username account verified by the operator of the blog platform.", - "ui-priority": 0, - "misp-attribute": "text", "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 0, "values_list": [ "Verified", "Unverified", "Unknown" ] - }, - "creation-date": { - "description": "Initial creation of the blog post.", - "ui-priority": 0, - "misp-attribute": "datetime" - }, - "modification-date": { - "description": "Last update of the blog post.", - "ui-priority": 0, - "misp-attribute": "datetime" - }, - "embedded-link": { - "description": "Site linked by the blog post.", - "ui-priority": 0, - "misp-attribute": "url", - "multiple": true - }, - "embedded-safe-link": { - "description": "Safe site linked by the blog post.", - "ui-priority": 0, - "misp-attribute": "link", - "multiple": true - }, - "removal-date": { - "description": "When the blog post was removed.", - "ui-priority": 0, - "misp-attribute": "datetime" - }, - "username-quoted": { - "description": "Username who are quoted into the blog post.", - "ui-priority": 0, - "multiple": true, - "misp-attribute": "text" } }, - "version": 14, "description": "Blog post like Medium or WordPress.", "meta-category": "misc", + "name": "blog", + "requiredOneOf": [ + "post", + "archive", + "url", + "link" + ], "uuid": "1f165fc0-b158-498f-8bc8-6dc3d2822bb1", - "name": "blog" -} + "version": 14 +} \ No newline at end of file diff --git a/objects/btc-transaction/definition.json b/objects/btc-transaction/definition.json index 109b70b..0b5dcd5 100644 --- a/objects/btc-transaction/definition.json +++ b/objects/btc-transaction/definition.json @@ -1,51 +1,51 @@ { + "attributes": { + "btc-address": { + "description": "A Bitcoin transactional address", + "disable_correlation": true, + "misp-attribute": "btc", + "ui-priority": 0 + }, + "time": { + "description": "Date and time of transaction", + "disable_correlation": true, + "misp-attribute": "datetime", + "ui-priority": 0 + }, + "transaction-number": { + "description": "A Bitcoin transaction number in a sequence of transactions", + "disable_correlation": true, + "misp-attribute": "text", + "multiple": true, + "ui-priority": 0 + }, + "value_BTC": { + "description": "Value in BTC at date/time displayed in field 'time'", + "disable_correlation": true, + "misp-attribute": "float", + "ui-priority": 0 + }, + "value_EUR": { + "description": "Value in EUR with conversion rate as of date/time displayed in field 'time'", + "disable_correlation": true, + "misp-attribute": "float", + "ui-priority": 0 + }, + "value_USD": { + "description": "Value in USD with conversion rate as of date/time displayed in field 'time'", + "disable_correlation": true, + "misp-attribute": "float", + "ui-priority": 0 + } + }, + "description": "An object to describe a Bitcoin transaction. Best to be used with bitcoin-wallet.", + "meta-category": "financial", + "name": "btc-transaction", "requiredOneOf": [ "transaction-number", "time", "value_BTC" ], - "attributes": { - "transaction-number": { - "description": "A Bitcoin transaction number in a sequence of transactions", - "ui-priority": 0, - "disable_correlation": true, - "multiple": true, - "misp-attribute": "text" - }, - "time": { - "description": "Date and time of transaction", - "ui-priority": 0, - "disable_correlation": true, - "misp-attribute": "datetime" - }, - "value_BTC": { - "description": "Value in BTC at date/time displayed in field 'time'", - "ui-priority": 0, - "disable_correlation": true, - "misp-attribute": "float" - }, - "value_EUR": { - "description": "Value in EUR with conversion rate as of date/time displayed in field 'time'", - "ui-priority": 0, - "disable_correlation": true, - "misp-attribute": "float" - }, - "value_USD": { - "description": "Value in USD with conversion rate as of date/time displayed in field 'time'", - "ui-priority": 0, - "disable_correlation": true, - "misp-attribute": "float" - }, - "btc-address": { - "description": "A Bitcoin transactional address", - "ui-priority": 0, - "disable_correlation": true, - "misp-attribute": "btc" - } - }, - "version": 4, - "description": "An object to describe a Bitcoin transaction. Best to be used with bitcoin-wallet.", - "meta-category": "financial", "uuid": "B7341729-5A8A-439F-A775-6D814DA3C7B5", - "name": "btc-transaction" -} + "version": 4 +} \ No newline at end of file diff --git a/objects/btc-wallet/definition.json b/objects/btc-wallet/definition.json index e73bdef..a1db69b 100644 --- a/objects/btc-wallet/definition.json +++ b/objects/btc-wallet/definition.json @@ -1,41 +1,41 @@ { - "requiredOneOf": [ - "wallet-address" - ], "attributes": { - "wallet-address": { - "description": "A Bitcoin wallet address", - "ui-priority": 0, - "misp-attribute": "btc" - }, - "balance_BTC": { - "description": "Value in BTC at date/time displayed in field 'time'", - "ui-priority": 0, - "disable_correlation": true, - "misp-attribute": "float" - }, "BTC_received": { "description": "Value of received BTC", - "ui-priority": 0, "disable_correlation": true, - "misp-attribute": "float" + "misp-attribute": "float", + "ui-priority": 0 }, "BTC_sent": { "description": "Value of sent BTC", - "ui-priority": 0, "disable_correlation": true, - "misp-attribute": "float" + "misp-attribute": "float", + "ui-priority": 0 + }, + "balance_BTC": { + "description": "Value in BTC at date/time displayed in field 'time'", + "disable_correlation": true, + "misp-attribute": "float", + "ui-priority": 0 }, "time": { "description": "Date and time of lookup/conversion", - "ui-priority": 0, "disable_correlation": true, - "misp-attribute": "datetime" + "misp-attribute": "datetime", + "ui-priority": 0 + }, + "wallet-address": { + "description": "A Bitcoin wallet address", + "misp-attribute": "btc", + "ui-priority": 0 } }, - "version": 2, "description": "An object to describe a Bitcoin wallet. Best to be used with bitcoin-transactions.", "meta-category": "financial", + "name": "btc-wallet", + "requiredOneOf": [ + "wallet-address" + ], "uuid": "22910C83-DD0E-4ED2-9823-45F8CAD562A4", - "name": "btc-wallet" -} + "version": 2 +} \ No newline at end of file diff --git a/objects/cap-alert/definition.json b/objects/cap-alert/definition.json index c9fe3ac..b60328c 100644 --- a/objects/cap-alert/definition.json +++ b/objects/cap-alert/definition.json @@ -1,41 +1,31 @@ { - "requiredOneOf": [ - "msgType" - ], "attributes": { + "addresses": { + "description": "The group listing of intended recipients of the alert message. (1) Required when is “Private”, optional when is “Public” or “Restricted”. (2) Each recipient SHALL be identified by an identifier or an address. (3) Multiple space-delimited addresses MAY be included. Addresses including whitespace MUST be enclosed in double-quotes. ", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 0 + }, + "code": { + "description": "The code denoting the special handling of the alert message.", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 0 + }, "identifier": { "description": "The identifier of the alert message in a number or string uniquely identifying this message, assigned by the sender.", "disable_correlation": true, - "ui-priority": 1, - "misp-attribute": "text" - }, - "sender": { - "description": "The identifier of the sender of the alert message which identifies the originator of this alert. Guaranteed by assigner to be unique globally; e.g., may be based on an Internet domain name.", - "disable_correlation": true, - "ui-priority": 0, - "misp-attribute": "text" - }, - "sent": { - "description": "The time and date of the origination of the alert message.", - "disable_correlation": true, - "ui-priority": 0, - "misp-attribute": "datetime" - }, - "status": { - "description": "The code denoting the appropriate handling of the alert message.", - "ui-priority": 0, "misp-attribute": "text", - "sane_default": [ - "Actual", - "Exercise", - "System", - "Test", - "Draft" - ] + "ui-priority": 1 + }, + "incident": { + "description": "The group listing naming the referent incident(s) of the alert message. (1) Used to collate multiple messages referring to different aspects of the same incident. (2) If multiple incident identifiers are referenced, they SHALL be separated by whitespace. Incident names including whitespace SHALL be surrounded by double-quotes.", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 0 }, "msgType": { "description": "The code denoting the nature of the alert message.", - "ui-priority": 0, "disable_correlation": true, "misp-attribute": "text", "sane_default": [ @@ -44,65 +34,75 @@ "Cancel", "Ack", "Error" - ] + ], + "ui-priority": 0 }, - "source": { - "description": "The text identifying the source of the alert message. The particular source of this alert; e.g., an operator or a specific device.", - "ui-priority": 0, + "note": { + "description": "The text describing the purpose or significance of the alert message.", "disable_correlation": true, - "misp-attribute": "text" + "misp-attribute": "text", + "ui-priority": 0 + }, + "references": { + "description": "The group listing identifying earlier message(s) referenced by the alert message. (1) The extended message identifier(s) (in the form sender,identifier,sent) of an earlier CAP message or messages referenced by this one. (2) If multiple messages are referenced, they SHALL be separated by whitespace.", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 0 + }, + "restriction": { + "description": "The text describing the rule for limiting distribution of the restricted alert message.", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 0 }, "scope": { "description": "The code denoting the intended distribution of the alert message. ", - "ui-priority": 0, - "misp-attribute": "text", "disable_correlation": true, + "misp-attribute": "text", "sane_default": [ "Public", "Restricted", "Private" - ] + ], + "ui-priority": 0 }, - "restriction": { - "description": "The text describing the rule for limiting distribution of the restricted alert message.", - "ui-priority": 0, + "sender": { + "description": "The identifier of the sender of the alert message which identifies the originator of this alert. Guaranteed by assigner to be unique globally; e.g., may be based on an Internet domain name.", + "disable_correlation": true, "misp-attribute": "text", - "disable_correlation": true + "ui-priority": 0 }, - "addresses": { - "description": "The group listing of intended recipients of the alert message. (1) Required when is “Private”, optional when is “Public” or “Restricted”. (2) Each recipient SHALL be identified by an identifier or an address. (3) Multiple space-delimited addresses MAY be included. Addresses including whitespace MUST be enclosed in double-quotes. ", - "ui-priority": 0, - "misp-attribute": "text", - "disable_correlation": true + "sent": { + "description": "The time and date of the origination of the alert message.", + "disable_correlation": true, + "misp-attribute": "datetime", + "ui-priority": 0 }, - "code": { - "description": "The code denoting the special handling of the alert message.", - "ui-priority": 0, + "source": { + "description": "The text identifying the source of the alert message. The particular source of this alert; e.g., an operator or a specific device.", + "disable_correlation": true, "misp-attribute": "text", - "disable_correlation": true + "ui-priority": 0 }, - "note": { - "description": "The text describing the purpose or significance of the alert message.", - "ui-priority": 0, + "status": { + "description": "The code denoting the appropriate handling of the alert message.", "misp-attribute": "text", - "disable_correlation": true - }, - "references": { - "description": "The group listing identifying earlier message(s) referenced by the alert message. (1) The extended message identifier(s) (in the form sender,identifier,sent) of an earlier CAP message or messages referenced by this one. (2) If multiple messages are referenced, they SHALL be separated by whitespace.", - "ui-priority": 0, - "misp-attribute": "text", - "disable_correlation": true - }, - "incident": { - "description": "The group listing naming the referent incident(s) of the alert message. (1) Used to collate multiple messages referring to different aspects of the same incident. (2) If multiple incident identifiers are referenced, they SHALL be separated by whitespace. Incident names including whitespace SHALL be surrounded by double-quotes.", - "ui-priority": 0, - "misp-attribute": "text", - "disable_correlation": true + "sane_default": [ + "Actual", + "Exercise", + "System", + "Test", + "Draft" + ], + "ui-priority": 0 } }, - "version": 1, "description": "Common Alerting Protocol Version (CAP) alert object", "meta-category": "misc", + "name": "cap-alert", + "requiredOneOf": [ + "msgType" + ], "uuid": "03b107bb-133d-4180-87ff-e3dbe731f828", - "name": "cap-alert" -} + "version": 1 +} \ No newline at end of file diff --git a/objects/cap-info/definition.json b/objects/cap-info/definition.json index 9645f13..6161884 100644 --- a/objects/cap-info/definition.json +++ b/objects/cap-info/definition.json @@ -1,17 +1,14 @@ { - "requiredOneOf": [ - "category" - ], "attributes": { - "language": { - "description": "The code denoting the language of the info sub-element of the alert message. ", - "ui-priority": 0, + "audience": { + "description": "The text describing the intended audience of the alert message.", "disable_correlation": true, - "misp-attribute": "text" + "misp-attribute": "text", + "ui-priority": 0 }, "category": { "description": "The code denoting the category of the subject event of the alert message.", - "ui-priority": 0, + "disable_correlation": true, "misp-attribute": "text", "sane_default": [ "Geo", @@ -27,17 +24,88 @@ "CBRNE", "Other" ], - "disable_correlation": true + "ui-priority": 0 + }, + "certainty": { + "description": "The code denoting the certainty of the subject event of the alert message. For backward compatibility with CAP 1.0, the deprecated value of “Very Likely” SHOULD be treated as equivalent to “Likely”.", + "disable_correlation": true, + "misp-attribute": "text", + "sane_default": [ + "Likely", + "Possible", + "Unlikely", + "Unknown" + ], + "ui-priority": 0 + }, + "contact": { + "description": "The text describing the contact for follow-up and confirmation of the alert message.", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 0 + }, + "description": { + "description": "The text describing the subject event of the alert message.", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 0 + }, + "effective": { + "description": "The effective time of the information of the alert message.", + "disable_correlation": true, + "misp-attribute": "datetime", + "ui-priority": 0 }, "event": { "description": "The text denoting the type of the subject event of the alert message.", - "ui-priority": 0, "disable_correlation": true, - "misp-attribute": "text" + "misp-attribute": "text", + "ui-priority": 0 + }, + "eventCode": { + "description": "A system-specific code identifying the event type of the alert message.", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 0 + }, + "expires": { + "description": "The expiry time of the information of the alert message.", + "disable_correlation": true, + "misp-attribute": "datetime", + "ui-priority": 0 + }, + "headline": { + "description": "The text headline of the alert message.", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 0 + }, + "instruction": { + "description": "The text describing the recommended action to be taken by recipients of the alert message.", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 0 + }, + "language": { + "description": "The code denoting the language of the info sub-element of the alert message. ", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 0 + }, + "onset": { + "description": "The expected time of the beginning of the subject event of the alert message.", + "disable_correlation": true, + "misp-attribute": "datetime", + "ui-priority": 0 + }, + "parameter": { + "description": "A system-specific additional parameter associated with the alert message.", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 0 }, "responseType": { "description": "The code denoting the type of action recommended for the target audience.", - "ui-priority": 0, "disable_correlation": true, "misp-attribute": "text", "sane_default": [ @@ -50,24 +118,17 @@ "Assess", "AllClear", "None" - ] + ], + "ui-priority": 0 }, - "urgency": { - "description": "The code denoting the urgency of the subject event of the alert message.", - "ui-priority": 0, + "senderName": { + "description": "The text naming the originator of the alert message.", "disable_correlation": true, "misp-attribute": "text", - "sane_default": [ - "Immediate", - "Expected", - "Future", - "Past", - "Unknown" - ] + "ui-priority": 0 }, "severity": { "description": "The code denoting the severity of the subject event of the alert message.", - "ui-priority": 0, "disable_correlation": true, "misp-attribute": "text", "sane_default": [ @@ -76,96 +137,35 @@ "Moderate", "Minor", "Unknown" - ] + ], + "ui-priority": 0 }, - "certainty": { - "description": "The code denoting the certainty of the subject event of the alert message. For backward compatibility with CAP 1.0, the deprecated value of “Very Likely” SHOULD be treated as equivalent to “Likely”.", - "ui-priority": 0, + "urgency": { + "description": "The code denoting the urgency of the subject event of the alert message.", "disable_correlation": true, "misp-attribute": "text", "sane_default": [ - "Likely", - "Possible", - "Unlikely", + "Immediate", + "Expected", + "Future", + "Past", "Unknown" - ] - }, - "audience": { - "description": "The text describing the intended audience of the alert message.", - "ui-priority": 0, - "disable_correlation": true, - "misp-attribute": "text" - }, - "eventCode": { - "description": "A system-specific code identifying the event type of the alert message.", - "ui-priority": 0, - "disable_correlation": true, - "misp-attribute": "text" - }, - "effective": { - "description": "The effective time of the information of the alert message.", - "ui-priority": 0, - "disable_correlation": true, - "misp-attribute": "datetime" - }, - "onset": { - "description": "The expected time of the beginning of the subject event of the alert message.", - "ui-priority": 0, - "disable_correlation": true, - "misp-attribute": "datetime" - }, - "expires": { - "description": "The expiry time of the information of the alert message.", - "ui-priority": 0, - "disable_correlation": true, - "misp-attribute": "datetime" - }, - "senderName": { - "description": "The text naming the originator of the alert message.", - "ui-priority": 0, - "disable_correlation": true, - "misp-attribute": "text" - }, - "headline": { - "description": "The text headline of the alert message.", - "ui-priority": 0, - "disable_correlation": true, - "misp-attribute": "text" - }, - "description": { - "description": "The text describing the subject event of the alert message.", - "ui-priority": 0, - "disable_correlation": true, - "misp-attribute": "text" - }, - "instruction": { - "description": "The text describing the recommended action to be taken by recipients of the alert message.", - "ui-priority": 0, - "disable_correlation": true, - "misp-attribute": "text" + ], + "ui-priority": 0 }, "web": { "description": "The identifier of the hyperlink associating additional information with the alert message.", - "ui-priority": 0, "disable_correlation": true, - "misp-attribute": "link" - }, - "contact": { - "description": "The text describing the contact for follow-up and confirmation of the alert message.", - "ui-priority": 0, - "disable_correlation": true, - "misp-attribute": "text" - }, - "parameter": { - "description": "A system-specific additional parameter associated with the alert message.", - "ui-priority": 0, - "disable_correlation": true, - "misp-attribute": "text" + "misp-attribute": "link", + "ui-priority": 0 } }, - "version": 1, "description": "Common Alerting Protocol Version (CAP) info object", "meta-category": "misc", + "name": "cap-info", + "requiredOneOf": [ + "category" + ], "uuid": "826c25e6-fdd5-4e4a-b081-be5ba3ac2c3d", - "name": "cap-info" -} + "version": 1 +} \ No newline at end of file diff --git a/objects/cap-resource/definition.json b/objects/cap-resource/definition.json index 92502a2..753ef30 100644 --- a/objects/cap-resource/definition.json +++ b/objects/cap-resource/definition.json @@ -1,46 +1,46 @@ { - "requiredOneOf": [ - "resourceDesc" - ], "attributes": { - "resourceDesc": { - "description": "The text describing the type and content of the resource file.", - "ui-priority": 0, - "disable_correlation": true, - "misp-attribute": "text" - }, - "mimeType": { - "description": "The identifier of the MIME content type and sub-type describing the resource file.", - "ui-priority": 0, - "disable_correlation": true, - "misp-attribute": "mime-type" - }, - "size": { - "description": "The integer indicating the size of the resource file.", - "ui-priority": 0, - "disable_correlation": true, - "misp-attribute": "text" - }, - "uri": { - "description": "The identifier of the hyperlink for the resource file.", - "ui-priority": 0, - "misp-attribute": "link" - }, "derefUri": { "description": "The base-64 encoded data content of the resource file.", - "ui-priority": 0, + "disable_correlation": true, "misp-attribute": "attachment", - "disable_correlation": true + "ui-priority": 0 }, "digest": { "description": "The code representing the digital digest (“hash”) computed from the resource file (OPTIONAL).", - "ui-priority": 0, - "misp-attribute": "sha1" + "misp-attribute": "sha1", + "ui-priority": 0 + }, + "mimeType": { + "description": "The identifier of the MIME content type and sub-type describing the resource file.", + "disable_correlation": true, + "misp-attribute": "mime-type", + "ui-priority": 0 + }, + "resourceDesc": { + "description": "The text describing the type and content of the resource file.", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 0 + }, + "size": { + "description": "The integer indicating the size of the resource file.", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 0 + }, + "uri": { + "description": "The identifier of the hyperlink for the resource file.", + "misp-attribute": "link", + "ui-priority": 0 } }, - "version": 1, "description": "Common Alerting Protocol Version (CAP) resource object", "meta-category": "misc", + "name": "cap-resource", + "requiredOneOf": [ + "resourceDesc" + ], "uuid": "6fddc76b-59fc-49f6-a673-52f8d15149c4", - "name": "cap-resource" -} + "version": 1 +} \ No newline at end of file diff --git a/objects/coin-address/definition.json b/objects/coin-address/definition.json index 659b59d..d40dcdf 100644 --- a/objects/coin-address/definition.json +++ b/objects/coin-address/definition.json @@ -1,24 +1,44 @@ { - "requiredOneOf": [ - "address", - "address-xmr" - ], "attributes": { "address": { "description": "Bitcoin address used as a payment destination in a cryptocurrency", - "ui-priority": 1, - "misp-attribute": "btc" + "misp-attribute": "btc", + "ui-priority": 1 }, "address-xmr": { "description": "Monero address used as a payment destination in a cryptocurrency", - "ui-priority": 1, - "misp-attribute": "xmr" + "misp-attribute": "xmr", + "ui-priority": 1 + }, + "current-balance": { + "description": "Current balance of address", + "disable_correlation": true, + "misp-attribute": "float", + "recommended": false, + "ui-priority": 1 + }, + "first-seen": { + "description": "First time this payment destination address has been seen", + "disable_correlation": true, + "misp-attribute": "datetime", + "ui-priority": 0 + }, + "last-seen": { + "description": "Last time this payment destination address has been seen", + "disable_correlation": true, + "misp-attribute": "datetime", + "ui-priority": 0 + }, + "last-updated": { + "description": "Last time the balances and totals have been updated", + "disable_correlation": true, + "misp-attribute": "datetime", + "ui-priority": 0 }, "symbol": { "description": "The (uppercase) symbol of the cryptocurrency used. Symbol should be from https://coinmarketcap.com/all/views/all/", - "misp-attribute": "text", "disable_correlation": true, - "ui-priority": 1, + "misp-attribute": "text", "sane_default": [ "BTC", "ETH", @@ -46,65 +66,45 @@ "WAVES", "PPT", "ETN" - ] - }, - "last-seen": { - "description": "Last time this payment destination address has been seen", - "disable_correlation": true, - "ui-priority": 0, - "misp-attribute": "datetime" - }, - "first-seen": { - "description": "First time this payment destination address has been seen", - "disable_correlation": true, - "ui-priority": 0, - "misp-attribute": "datetime" - }, - "last-updated": { - "description": "Last time the balances and totals have been updated", - "disable_correlation": true, - "ui-priority": 0, - "misp-attribute": "datetime" - }, - "current-balance": { - "description": "Current balance of address", - "disable_correlation": true, - "ui-priority": 1, - "misp-attribute": "float", - "recommended": false - }, - "total-transactions": { - "description": "Total transactions performed", - "disable_correlation": true, - "ui-priority": 1, - "misp-attribute": "text", - "recommended": false - }, - "total-received": { - "description": "Total balance received", - "disable_correlation": true, - "ui-priority": 1, - "misp-attribute": "float", - "recommended": false - }, - "total-sent": { - "description": "Total balance sent", - "disable_correlation": true, - "ui-priority": 1, - "misp-attribute": "float", - "recommended": false + ], + "ui-priority": 1 }, "text": { "description": "Free text value", "disable_correlation": true, - "ui-priority": 1, "misp-attribute": "text", - "recommended": false + "recommended": false, + "ui-priority": 1 + }, + "total-received": { + "description": "Total balance received", + "disable_correlation": true, + "misp-attribute": "float", + "recommended": false, + "ui-priority": 1 + }, + "total-sent": { + "description": "Total balance sent", + "disable_correlation": true, + "misp-attribute": "float", + "recommended": false, + "ui-priority": 1 + }, + "total-transactions": { + "description": "Total transactions performed", + "disable_correlation": true, + "misp-attribute": "text", + "recommended": false, + "ui-priority": 1 } }, - "version": 5, "description": "An address used in a cryptocurrency", "meta-category": "financial", + "name": "coin-address", + "requiredOneOf": [ + "address", + "address-xmr" + ], "uuid": "d0e6997e-78da-4815-a6a1-cfc1c1cb8a46", - "name": "coin-address" -} + "version": 5 +} \ No newline at end of file diff --git a/objects/command-line/definition.json b/objects/command-line/definition.json index f48dcbd..f80dd52 100644 --- a/objects/command-line/definition.json +++ b/objects/command-line/definition.json @@ -1,20 +1,20 @@ { "attributes": { - "value": { - "description": "command code", - "ui-priority": 1, - "misp-attribute": "text", - "multiple": true - }, "description": { "description": "description of the command", - "ui-priority": 1, - "misp-attribute": "text" + "misp-attribute": "text", + "ui-priority": 1 + }, + "value": { + "description": "command code", + "misp-attribute": "text", + "multiple": true, + "ui-priority": 1 } }, - "version": 1, "description": "Command line and options related to a specific command executed by a program, whether it is malicious or not.", "meta-category": "misc", + "name": "command-line", "uuid": "88ebe222-d3cc-11e9-875d-7f13f460adaf", - "name": "command-line" -} + "version": 1 +} \ No newline at end of file diff --git a/objects/command/definition.json b/objects/command/definition.json index 651d7d8..4cd2f72 100644 --- a/objects/command/definition.json +++ b/objects/command/definition.json @@ -1,37 +1,37 @@ { "attributes": { + "description": { + "description": "Description of the command functionalities", + "misp-attribute": "text", + "ui-priority": 1 + }, "location": { "description": "Location of the command functionality", - "ui-priority": 1, - "misp-attribute": "text", "disable_correlation": true, + "misp-attribute": "text", "sane_default": [ "Bundled", "Module", "Libraries", "Unknown" - ] + ], + "ui-priority": 1 }, "trigger": { "description": "How the commands are triggered", - "ui-priority": 1, - "misp-attribute": "text", "disable_correlation": true, + "misp-attribute": "text", "sane_default": [ "Local", "Network", "Unknown" - ] - }, - "description": { - "description": "Description of the command functionalities", - "ui-priority": 1, - "misp-attribute": "text" + ], + "ui-priority": 1 } }, - "version": 1, "description": "Command functionalities related to specific commands executed by a program, whether it is malicious or not. Command-line are attached to this object for the related commands.", "meta-category": "misc", + "name": "command", "uuid": "21ad70d8-d397-11e9-9ea7-43b2d5f6a6e3", - "name": "command" -} + "version": 1 +} \ No newline at end of file diff --git a/objects/cookie/definition.json b/objects/cookie/definition.json index 450e605..4250054 100644 --- a/objects/cookie/definition.json +++ b/objects/cookie/definition.json @@ -1,54 +1,53 @@ { - "required": [ - "cookie" - ], "attributes": { "cookie": { "description": "Full cookie", - "ui-priority": 1, - "misp-attribute": "cookie" + "misp-attribute": "cookie", + "ui-priority": 1 }, "cookie-name": { "description": "Name of the cookie (if splitted)", - "ui-priority": 0, - "misp-attribute": "text" + "misp-attribute": "text", + "ui-priority": 0 }, "cookie-value": { "description": "Value of the cookie (if splitted)", - "ui-priority": 0, - "misp-attribute": "text" - }, - "path": { - "description": "Path defined in the cookie", - "ui-priority": 0, - "disable_correlation": true, - "misp-attribute": "text" + "misp-attribute": "text", + "ui-priority": 0 }, "expires": { "description": "Expiration date/time of the cookie", - "ui-priority": 0, "disable_correlation": true, - "misp-attribute": "datetime" + "misp-attribute": "datetime", + "ui-priority": 0 }, "http-only": { "description": "True if send only through HTTP", - "ui-priority": 0, "disable_correlation": true, - "misp-attribute": "boolean" + "misp-attribute": "boolean", + "ui-priority": 0 + }, + "path": { + "description": "Path defined in the cookie", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 0 }, "secure": { "description": "True if cookie is sent over TLS", - "ui-priority": 0, "disable_correlation": true, - "misp-attribute": "boolean" + "misp-attribute": "boolean", + "ui-priority": 0 }, "text": { "description": "A description of the cookie.", "disable_correlation": true, - "ui-priority": 0, - "misp-attribute": "text" + "misp-attribute": "text", + "ui-priority": 0 }, "type": { + "description": "Type of cookie and how it's used in this specific object.", + "misp-attribute": "text", "sane_default": [ "Session management", "Personalization", @@ -57,14 +56,15 @@ "Malicious Payload", "Beaconing" ], - "description": "Type of cookie and how it's used in this specific object.", - "ui-priority": 0, - "misp-attribute": "text" + "ui-priority": 0 } }, - "version": 3, "description": "An HTTP cookie (web cookie, browser cookie) is a small piece of data that a server sends to the user's web browser. The browser may store it and send it back with the next request to the same server. Typically, it's used to tell if two requests came from the same browser — keeping a user logged-in, for example. It remembers stateful information for the stateless HTTP protocol. (as defined by the Mozilla foundation.", "meta-category": "network", + "name": "cookie", + "required": [ + "cookie" + ], "uuid": "7755ad19-55c7-4da4-805e-197cf81bbcb8", - "name": "cookie" -} + "version": 3 +} \ No newline at end of file diff --git a/objects/cortex-taxonomy/definition.json b/objects/cortex-taxonomy/definition.json index edb3580..5b33a70 100644 --- a/objects/cortex-taxonomy/definition.json +++ b/objects/cortex-taxonomy/definition.json @@ -1,40 +1,10 @@ { - "required": [ - "level", - "predicate", - "value", - "namespace" - ], "attributes": { - "namespace": { - "categories": [ - "External analysis" - ], - "description": "Cortex Taxonomy Namespace", + "cortex_url": { + "description": "URL to the Cortex job", "disable_correlation": true, - "multiple": false, - "ui-priority": 0, - "misp-attribute": "text" - }, - "predicate": { - "categories": [ - "External analysis" - ], - "description": "Cortex Taxonomy Predicate", - "disable_correlation": true, - "multiple": false, - "ui-priority": 0, - "misp-attribute": "text" - }, - "value": { - "categories": [ - "External analysis" - ], - "description": "Cortex Taxonomy Value", - "disable_correlation": true, - "multiple": false, - "ui-priority": 0, - "misp-attribute": "text" + "misp-attribute": "link", + "ui-priority": 0 }, "level": { "categories": [ @@ -42,8 +12,8 @@ ], "description": "Cortex Taxonomy Level", "disable_correlation": true, - "multiple": false, "misp-attribute": "text", + "multiple": false, "ui-priority": 0, "values_list": [ "info", @@ -52,16 +22,46 @@ "malicious" ] }, - "cortex_url": { - "description": "URL to the Cortex job", + "namespace": { + "categories": [ + "External analysis" + ], + "description": "Cortex Taxonomy Namespace", "disable_correlation": true, - "ui-priority": 0, - "misp-attribute": "link" + "misp-attribute": "text", + "multiple": false, + "ui-priority": 0 + }, + "predicate": { + "categories": [ + "External analysis" + ], + "description": "Cortex Taxonomy Predicate", + "disable_correlation": true, + "misp-attribute": "text", + "multiple": false, + "ui-priority": 0 + }, + "value": { + "categories": [ + "External analysis" + ], + "description": "Cortex Taxonomy Value", + "disable_correlation": true, + "misp-attribute": "text", + "multiple": false, + "ui-priority": 0 } }, - "version": 4, "description": "Cortex object describing an Cortex Taxonomy (or mini report)", "meta-category": "misc", + "name": "cortex-taxonomy", + "required": [ + "level", + "predicate", + "value", + "namespace" + ], "uuid": "bef7d23b-e796-4d46-803a-32e317896894", - "name": "cortex-taxonomy" -} + "version": 4 +} \ No newline at end of file diff --git a/objects/cortex/definition.json b/objects/cortex/definition.json index a45a0a3..bb5ddb7 100644 --- a/objects/cortex/definition.json +++ b/objects/cortex/definition.json @@ -1,48 +1,48 @@ { - "requiredOneOf": [ - "full" - ], "attributes": { - "summary": { - "description": "Cortex summary object (summary) in JSON", - "disable_correlation": false, - "ui-priority": 0, - "misp-attribute": "text" - }, "full": { "description": "Cortex report object (full report) in JSON", "disable_correlation": true, - "ui-priority": 0, - "misp-attribute": "text" - }, - "start-date": { - "description": "When the Cortex analyser was started", - "disable_correlation": true, - "ui-priority": 0, - "misp-attribute": "datetime" + "misp-attribute": "text", + "ui-priority": 0 }, "name": { "description": "Cortex analyser/worker name", "disable_correlation": true, - "ui-priority": 0, - "misp-attribute": "text" + "misp-attribute": "text", + "ui-priority": 0 }, "server-name": { "description": "Name of the cortex server", "disable_correlation": true, - "ui-priority": 0, - "misp-attribute": "text" + "misp-attribute": "text", + "ui-priority": 0 + }, + "start-date": { + "description": "When the Cortex analyser was started", + "disable_correlation": true, + "misp-attribute": "datetime", + "ui-priority": 0 }, "success": { "description": "Result of the cortex job", "disable_correlation": true, - "ui-priority": 0, - "misp-attribute": "boolean" + "misp-attribute": "boolean", + "ui-priority": 0 + }, + "summary": { + "description": "Cortex summary object (summary) in JSON", + "disable_correlation": false, + "misp-attribute": "text", + "ui-priority": 0 } }, - "version": 1, "description": "Cortex object describing a complete cortex analysis. Observables would be attribute with a relationship from this object.", "meta-category": "misc", + "name": "cortex", + "requiredOneOf": [ + "full" + ], "uuid": "144988f3-fa00-4374-8015-c1a32092f451", - "name": "cortex" -} + "version": 1 +} \ No newline at end of file diff --git a/objects/course-of-action/definition.json b/objects/course-of-action/definition.json index b2099e0..ace7e70 100644 --- a/objects/course-of-action/definition.json +++ b/objects/course-of-action/definition.json @@ -1,20 +1,77 @@ { - "requiredOneOf": [ - "name", - "type" - ], "attributes": { + "cost": { + "description": "The estimated cost of applying the course of action.", + "disable_correlation": true, + "misp-attribute": "text", + "sane_default": [ + "High", + "Medium", + "Low", + "None", + "Unknown" + ], + "ui-priority": 0 + }, + "description": { + "description": "A description of the course of action.", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 0 + }, + "efficacy": { + "description": "The estimated efficacy of applying the course of action.", + "disable_correlation": true, + "misp-attribute": "text", + "sane_default": [ + "High", + "Medium", + "Low", + "None", + "Unknown" + ], + "ui-priority": 0 + }, + "impact": { + "description": "The estimated impact of applying the course of action.", + "disable_correlation": true, + "misp-attribute": "text", + "sane_default": [ + "High", + "Medium", + "Low", + "None", + "Unknown" + ], + "ui-priority": 0 + }, "name": { "description": "The name used to identify the course of action.", + "disable_correlation": true, "misp-attribute": "text", - "ui-priority": 0, - "disable_correlation": true + "ui-priority": 0 + }, + "objective": { + "description": "The objective of the course of action.", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 0 + }, + "stage": { + "description": "The stage of the threat management lifecycle that the course of action is applicable to.", + "disable_correlation": true, + "misp-attribute": "text", + "sane_default": [ + "Remedy", + "Response", + "Further Analysis Required" + ], + "ui-priority": 0 }, "type": { "description": "The type of the course of action.", - "misp-attribute": "text", - "ui-priority": 0, "disable_correlation": true, + "misp-attribute": "text", "sane_default": [ "Perimeter Blocking", "Internal Blocking", @@ -32,74 +89,17 @@ "Diplomatic Actions", "Policy Actions", "Other" - ] - }, - "description": { - "description": "A description of the course of action.", - "misp-attribute": "text", - "ui-priority": 0, - "disable_correlation": true - }, - "objective": { - "description": "The objective of the course of action.", - "misp-attribute": "text", - "ui-priority": 0, - "disable_correlation": true - }, - "stage": { - "description": "The stage of the threat management lifecycle that the course of action is applicable to.", - "misp-attribute": "text", - "ui-priority": 0, - "disable_correlation": true, - "sane_default": [ - "Remedy", - "Response", - "Further Analysis Required" - ] - }, - "cost": { - "description": "The estimated cost of applying the course of action.", - "misp-attribute": "text", - "ui-priority": 0, - "disable_correlation": true, - "sane_default": [ - "High", - "Medium", - "Low", - "None", - "Unknown" - ] - }, - "impact": { - "description": "The estimated impact of applying the course of action.", - "misp-attribute": "text", - "ui-priority": 0, - "disable_correlation": true, - "sane_default": [ - "High", - "Medium", - "Low", - "None", - "Unknown" - ] - }, - "efficacy": { - "description": "The estimated efficacy of applying the course of action.", - "misp-attribute": "text", - "ui-priority": 0, - "disable_correlation": true, - "sane_default": [ - "High", - "Medium", - "Low", - "None", - "Unknown" - ] + ], + "ui-priority": 0 } }, - "version": 1, "description": "An object describing a specific measure taken to prevent or respond to an attack.", "meta-category": "misc", + "name": "course-of-action", + "requiredOneOf": [ + "name", + "type" + ], "uuid": "3d1c2c06-68a9-4394-8c8d-258d115f796f", - "name": "course-of-action" -} + "version": 1 +} \ No newline at end of file diff --git a/objects/covid19-csse-daily-report/definition.json b/objects/covid19-csse-daily-report/definition.json index dc261d0..59171cf 100644 --- a/objects/covid19-csse-daily-report/definition.json +++ b/objects/covid19-csse-daily-report/definition.json @@ -1,79 +1,79 @@ { - "required": [ - "country-region", - "update" - ], "attributes": { - "fips": { - "description": "Federal Information Processing Standard county code (US Only)", - "ui-priority": 0, + "active": { + "description": "the number of active cases.", + "disable_correlation": true, "misp-attribute": "counter", - "disable_correlation": true - }, - "county": { - "description": "US County (US Only)", - "ui-priority": 0, - "misp-attribute": "counter", - "disable_correlation": true - }, - "province-state": { - "description": "province name; US/Canada/Australia/ - city name, state/province name; Others - name of the event (e.g., \"Diamond Princess\" cruise ship); other countries - blank.", - "ui-priority": 1, - "misp-attribute": "text", - "disable_correlation": true - }, - "country-region": { - "description": "country/region name conforming to WHO (will be updated).", - "ui-priority": 1, - "misp-attribute": "text", - "disable_correlation": true - }, - "update": { - "description": "Time of the last update that day (UTC)", - "ui-priority": 1, - "misp-attribute": "datetime", - "disable_correlation": true - }, - "latitude": { - "description": "Approximate latitude of the entry", - "ui-priority": 0, - "misp-attribute": "float", - "disable_correlation": true - }, - "longitude": { - "description": "Approximate longitude of the entry", - "ui-priority": 0, - "misp-attribute": "float", - "disable_correlation": true + "ui-priority": 1 }, "confirmed": { "description": "the number of confirmed cases. For Hubei Province: from Feb 13 (GMT +8), we report both clinically diagnosed and lab-confirmed cases. For lab-confirmed cases only (Before Feb 17), please refer to https://github.com/CSSEGISandData/COVID-19/tree/master/who_covid_19_situation_reports.", - "misp-attribute": "counter", "disable_correlation": true, + "misp-attribute": "counter", "ui-priority": 1 }, + "country-region": { + "description": "country/region name conforming to WHO (will be updated).", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 1 + }, + "county": { + "description": "US County (US Only)", + "disable_correlation": true, + "misp-attribute": "counter", + "ui-priority": 0 + }, "death": { "description": "the number of deaths.", - "misp-attribute": "counter", "disable_correlation": true, + "misp-attribute": "counter", + "ui-priority": 1 + }, + "fips": { + "description": "Federal Information Processing Standard county code (US Only)", + "disable_correlation": true, + "misp-attribute": "counter", + "ui-priority": 0 + }, + "latitude": { + "description": "Approximate latitude of the entry", + "disable_correlation": true, + "misp-attribute": "float", + "ui-priority": 0 + }, + "longitude": { + "description": "Approximate longitude of the entry", + "disable_correlation": true, + "misp-attribute": "float", + "ui-priority": 0 + }, + "province-state": { + "description": "province name; US/Canada/Australia/ - city name, state/province name; Others - name of the event (e.g., \"Diamond Princess\" cruise ship); other countries - blank.", + "disable_correlation": true, + "misp-attribute": "text", "ui-priority": 1 }, "recovered": { "description": "the number of recovered cases.", - "misp-attribute": "counter", "disable_correlation": true, + "misp-attribute": "counter", "ui-priority": 1 }, - "active": { - "description": "the number of active cases.", - "misp-attribute": "counter", + "update": { + "description": "Time of the last update that day (UTC)", "disable_correlation": true, + "misp-attribute": "datetime", "ui-priority": 1 } }, - "version": 2, "description": "CSSE COVID-19 Daily report", "meta-category": "health", + "name": "covid19-csse-daily-report", + "required": [ + "country-region", + "update" + ], "uuid": "9458bf83-2e29-4ff3-9996-0564f2d954c8", - "name": "covid19-csse-daily-report" -} + "version": 2 +} \ No newline at end of file diff --git a/objects/covid19-dxy-live-city/definition.json b/objects/covid19-dxy-live-city/definition.json index 1a665b1..d079c32 100644 --- a/objects/covid19-dxy-live-city/definition.json +++ b/objects/covid19-dxy-live-city/definition.json @@ -1,49 +1,49 @@ { - "required": [ - "city", - "update" - ], "attributes": { "city": { "description": "Name of the Chinese city, in Chinese.", - "ui-priority": 1, + "disable_correlation": true, "misp-attribute": "text", - "disable_correlation": true - }, - "update": { - "description": "Approximate time of the update (~hour)", - "ui-priority": 1, - "misp-attribute": "datetime", - "disable_correlation": true + "ui-priority": 1 }, "current-confirmed": { "description": "Current number of confirmed cases", - "ui-priority": 1, + "disable_correlation": true, "misp-attribute": "counter", - "disable_correlation": true + "ui-priority": 1 }, "total-confirmed": { "description": "Total number of confirmed cases.", - "misp-attribute": "counter", "disable_correlation": true, + "misp-attribute": "counter", "ui-priority": 1 }, "total-cured": { "description": "Total number of cured cases.", - "misp-attribute": "counter", "disable_correlation": true, + "misp-attribute": "counter", "ui-priority": 1 }, "total-death": { "description": "Total number of deaths.", - "misp-attribute": "counter", "disable_correlation": true, + "misp-attribute": "counter", + "ui-priority": 1 + }, + "update": { + "description": "Approximate time of the update (~hour)", + "disable_correlation": true, + "misp-attribute": "datetime", "ui-priority": 1 } }, - "version": 1, "description": "COVID 19 from dxy.cn - Aggregation by city", "meta-category": "health", + "name": "covid19-dxy-live-city", + "required": [ + "city", + "update" + ], "uuid": "9132452b-f60a-41ac-a3b9-62701b85621b", - "name": "covid19-dxy-live-city" -} + "version": 1 +} \ No newline at end of file diff --git a/objects/covid19-dxy-live-province/definition.json b/objects/covid19-dxy-live-province/definition.json index 3bb3cf8..d9cb08d 100644 --- a/objects/covid19-dxy-live-province/definition.json +++ b/objects/covid19-dxy-live-province/definition.json @@ -1,55 +1,55 @@ { - "required": [ - "province", - "update" - ], "attributes": { - "province": { - "description": "Name of the Chinese province, in Chinese.", - "ui-priority": 1, + "comment": { + "description": "Comment, in chinese", + "disable_correlation": true, "misp-attribute": "text", - "disable_correlation": true - }, - "update": { - "description": "Approximate time of the update (~hour)", - "ui-priority": 1, - "misp-attribute": "datetime", - "disable_correlation": true + "ui-priority": 1 }, "current-confirmed": { "description": "Current number of confirmed cases", - "ui-priority": 1, + "disable_correlation": true, "misp-attribute": "counter", - "disable_correlation": true + "ui-priority": 1 + }, + "province": { + "description": "Name of the Chinese province, in Chinese.", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 1 }, "total-confirmed": { "description": "Total number of confirmed cases.", - "misp-attribute": "counter", "disable_correlation": true, + "misp-attribute": "counter", "ui-priority": 1 }, "total-cured": { "description": "Total number of cured cases.", - "misp-attribute": "counter", "disable_correlation": true, + "misp-attribute": "counter", "ui-priority": 1 }, "total-death": { "description": "Total number of deaths.", - "misp-attribute": "counter", "disable_correlation": true, + "misp-attribute": "counter", "ui-priority": 1 }, - "comment": { - "description": "Comment, in chinese", - "misp-attribute": "text", + "update": { + "description": "Approximate time of the update (~hour)", "disable_correlation": true, + "misp-attribute": "datetime", "ui-priority": 1 } }, - "version": 1, "description": "COVID 19 from dxy.cn - Aggregation by province", "meta-category": "health", + "name": "covid19-dxy-live-province", + "required": [ + "province", + "update" + ], "uuid": "40b49502-088b-44a5-80a7-0e55653f3ed4", - "name": "covid19-dxy-live-province" -} + "version": 1 +} \ No newline at end of file diff --git a/objects/cowrie/definition.json b/objects/cowrie/definition.json index a29410f..2d8206a 100644 --- a/objects/cowrie/definition.json +++ b/objects/cowrie/definition.json @@ -1,131 +1,131 @@ { - "requiredOneOf": [ - "session" - ], "attributes": { - "eventid": { - "description": "Eventid of the session in the cowrie honeypot", + "compCS": { + "description": "SSH compression algorithm supported in the session", "disable_correlation": true, - "ui-priority": 1, - "misp-attribute": "text" - }, - "system": { - "description": "System origin in cowrie honeypot", - "disable_correlation": true, - "ui-priority": 1, - "misp-attribute": "text" - }, - "username": { - "description": "Username related to the password(s)", - "ui-priority": 1, - "misp-attribute": "text" - }, - "password": { - "description": "Password", + "misp-attribute": "text", "multiple": true, - "ui-priority": 1, - "misp-attribute": "text" - }, - "session": { - "description": "Session id", - "ui-priority": 1, - "misp-attribute": "text" - }, - "timestamp": { - "description": "When the event happened", - "ui-priority": 1, - "misp-attribute": "datetime", - "disable_correlation": true - }, - "message": { - "description": "Message of the cowrie honeypot", - "ui-priority": 1, - "misp-attribute": "text", - "disable_correlation": true - }, - "protocol": { - "description": "Protocol used in the cowrie honeypot", - "ui-priority": 1, - "misp-attribute": "text", - "disable_correlation": true - }, - "sensor": { - "description": "Cowrie sensor name", - "ui-priority": 1, - "misp-attribute": "text", - "disable_correlation": true - }, - "src_ip": { - "description": "Source IP address of the session", - "ui-priority": 1, - "misp-attribute": "ip-src" + "ui-priority": 1 }, "dst_ip": { "description": "Destination IP address of the session", - "ui-priority": 1, + "disable_correlation": true, "misp-attribute": "ip-dst", - "disable_correlation": true - }, - "src_port": { - "description": "Source port of the session", - "ui-priority": 1, - "misp-attribute": "port", - "disable_correlation": true + "ui-priority": 1 }, "dst_port": { "description": "Destination port of the session", - "ui-priority": 1, + "disable_correlation": true, "misp-attribute": "port", - "disable_correlation": true - }, - "isError": { - "description": "isError", - "ui-priority": 1, - "misp-attribute": "text", - "disable_correlation": true - }, - "input": { - "description": "Input of the session", - "ui-priority": 1, - "misp-attribute": "text" - }, - "macCS": { - "description": "SSH MAC supported in the sesssion", - "multiple": true, - "disable_correlation": true, - "ui-priority": 1, - "misp-attribute": "text" - }, - "keyAlgs": { - "description": "SSH public-key algorithm supported in the session", - "multiple": true, - "disable_correlation": true, - "ui-priority": 1, - "misp-attribute": "text" + "ui-priority": 1 }, "encCS": { "description": "SSH symmetric encryption algorithm supported in the session", - "multiple": true, "disable_correlation": true, - "ui-priority": 1, - "misp-attribute": "text" - }, - "compCS": { - "description": "SSH compression algorithm supported in the session", - "multiple": true, - "ui-priority": 1, "misp-attribute": "text", - "disable_correlation": true + "multiple": true, + "ui-priority": 1 + }, + "eventid": { + "description": "Eventid of the session in the cowrie honeypot", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 1 }, "hassh": { "description": "HASSH of the client SSH session following Salesforce algorithm", "misp-attribute": "hassh-md5", "ui-priority": 1 + }, + "input": { + "description": "Input of the session", + "misp-attribute": "text", + "ui-priority": 1 + }, + "isError": { + "description": "isError", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 1 + }, + "keyAlgs": { + "description": "SSH public-key algorithm supported in the session", + "disable_correlation": true, + "misp-attribute": "text", + "multiple": true, + "ui-priority": 1 + }, + "macCS": { + "description": "SSH MAC supported in the sesssion", + "disable_correlation": true, + "misp-attribute": "text", + "multiple": true, + "ui-priority": 1 + }, + "message": { + "description": "Message of the cowrie honeypot", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 1 + }, + "password": { + "description": "Password", + "misp-attribute": "text", + "multiple": true, + "ui-priority": 1 + }, + "protocol": { + "description": "Protocol used in the cowrie honeypot", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 1 + }, + "sensor": { + "description": "Cowrie sensor name", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 1 + }, + "session": { + "description": "Session id", + "misp-attribute": "text", + "ui-priority": 1 + }, + "src_ip": { + "description": "Source IP address of the session", + "misp-attribute": "ip-src", + "ui-priority": 1 + }, + "src_port": { + "description": "Source port of the session", + "disable_correlation": true, + "misp-attribute": "port", + "ui-priority": 1 + }, + "system": { + "description": "System origin in cowrie honeypot", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 1 + }, + "timestamp": { + "description": "When the event happened", + "disable_correlation": true, + "misp-attribute": "datetime", + "ui-priority": 1 + }, + "username": { + "description": "Username related to the password(s)", + "misp-attribute": "text", + "ui-priority": 1 } }, - "version": 3, "description": "Cowrie honeypot object template", "meta-category": "network", + "name": "cowrie", + "requiredOneOf": [ + "session" + ], "uuid": "ae085d32-6534-4d52-b3eb-063fccb753e7", - "name": "cowrie" -} + "version": 3 +} \ No newline at end of file diff --git a/objects/credential/definition.json b/objects/credential/definition.json index b1b90fd..fe6685c 100644 --- a/objects/credential/definition.json +++ b/objects/credential/definition.json @@ -1,57 +1,10 @@ { - "requiredOneOf": [ - "password", - "username" - ], "attributes": { - "text": { - "description": "A description of the credential(s)", - "disable_correlation": true, - "ui-priority": 1, - "misp-attribute": "text" - }, - "username": { - "description": "Username related to the password(s)", - "ui-priority": 1, - "misp-attribute": "text" - }, - "password": { - "description": "Password", - "multiple": true, - "ui-priority": 1, - "misp-attribute": "text" - }, - "type": { - "description": "Type of password(s)", - "ui-priority": 1, - "misp-attribute": "text", - "disable_correlation": true, - "values_list": [ - "password", - "api-key", - "encryption-key", - "unknown" - ] - }, - "origin": { - "description": "Origin of the credential(s)", - "ui-priority": 1, - "misp-attribute": "text", - "disable_correlation": true, - "sane_default": [ - "bruteforce-scanning", - "malware-analysis", - "memory-analysis", - "network-analysis", - "leak", - "unknown" - ] - }, "format": { "description": "Format of the password(s)", - "ui-priority": 1, - "misp-attribute": "text", "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 1, "values_list": [ "clear-text", "hashed", @@ -61,20 +14,67 @@ }, "notification": { "description": "Mention of any notification(s) towards the potential owner(s) of the credential(s)", - "ui-priority": 1, - "misp-attribute": "text", "disable_correlation": true, + "misp-attribute": "text", "multiple": true, + "ui-priority": 1, "values_list": [ "victim-notified", "service-notified", "none" ] + }, + "origin": { + "description": "Origin of the credential(s)", + "disable_correlation": true, + "misp-attribute": "text", + "sane_default": [ + "bruteforce-scanning", + "malware-analysis", + "memory-analysis", + "network-analysis", + "leak", + "unknown" + ], + "ui-priority": 1 + }, + "password": { + "description": "Password", + "misp-attribute": "text", + "multiple": true, + "ui-priority": 1 + }, + "text": { + "description": "A description of the credential(s)", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 1 + }, + "type": { + "description": "Type of password(s)", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 1, + "values_list": [ + "password", + "api-key", + "encryption-key", + "unknown" + ] + }, + "username": { + "description": "Username related to the password(s)", + "misp-attribute": "text", + "ui-priority": 1 } }, - "version": 4, "description": "Credential describes one or more credential(s) including password(s), api key(s) or decryption key(s).", "meta-category": "misc", + "name": "credential", + "requiredOneOf": [ + "password", + "username" + ], "uuid": "a27e98c9-9b0e-414c-8076-d201e039ca09", - "name": "credential" -} + "version": 4 +} \ No newline at end of file diff --git a/objects/credit-card/definition.json b/objects/credit-card/definition.json index 2a2e36b..8c97571 100644 --- a/objects/credit-card/definition.json +++ b/objects/credit-card/definition.json @@ -1,57 +1,57 @@ { - "requiredOneOf": [ - "cc-number" - ], "attributes": { - "iin": { - "description": "International Issuer Number (First eight digits of the credit card number", - "ui-priority": 0, - "misp-attribute": "text" - }, "bank_name": { "description": "Name of the bank which have issued the card", - "ui-priority": 0, - "misp-attribute": "text" - }, - "version": { - "description": "Version of the card.", - "ui-priority": 0, - "misp-attribute": "text" - }, - "comment": { - "description": "A description of the card.", - "ui-priority": 0, - "misp-attribute": "comment" + "misp-attribute": "text", + "ui-priority": 0 }, "card-security-code": { "description": "Card security code (CSC, CVD, CVV, CVC and SPC) as embossed or printed on the card.", - "ui-priority": 0, - "misp-attribute": "text" - }, - "name": { - "description": "Name of the card owner.", - "ui-priority": 0, - "misp-attribute": "text" - }, - "issued": { - "description": "Initial date of validity or issued date.", - "ui-priority": 0, - "misp-attribute": "datetime" - }, - "expiration": { - "description": "Maximum date of validity", - "ui-priority": 0, - "misp-attribute": "datetime" + "misp-attribute": "text", + "ui-priority": 0 }, "cc-number": { "description": "credit-card number as encoded on the card.", - "ui-priority": 0, - "misp-attribute": "cc-number" + "misp-attribute": "cc-number", + "ui-priority": 0 + }, + "comment": { + "description": "A description of the card.", + "misp-attribute": "comment", + "ui-priority": 0 + }, + "expiration": { + "description": "Maximum date of validity", + "misp-attribute": "datetime", + "ui-priority": 0 + }, + "iin": { + "description": "International Issuer Number (First eight digits of the credit card number", + "misp-attribute": "text", + "ui-priority": 0 + }, + "issued": { + "description": "Initial date of validity or issued date.", + "misp-attribute": "datetime", + "ui-priority": 0 + }, + "name": { + "description": "Name of the card owner.", + "misp-attribute": "text", + "ui-priority": 0 + }, + "version": { + "description": "Version of the card.", + "misp-attribute": "text", + "ui-priority": 0 } }, - "version": 3, "description": "A payment card like credit card, debit card or any similar cards which can be used for financial transactions.", "meta-category": "financial", + "name": "credit-card", + "requiredOneOf": [ + "cc-number" + ], "uuid": "2b9c57aa-daba-4330-a738-56f18743b0c7", - "name": "credit-card" -} + "version": 3 +} \ No newline at end of file diff --git a/objects/crypto-material/definition.json b/objects/crypto-material/definition.json index 3283a62..ac93cd5 100644 --- a/objects/crypto-material/definition.json +++ b/objects/crypto-material/definition.json @@ -1,126 +1,40 @@ { - "requiredOneOf": [ - "generic-symmetric-key", - "text", - "private", - "p", - "q", - "modulus" - ], "attributes": { - "text": { - "description": "A description of the cryptographic materials.", - "disable_correlation": true, - "ui-priority": 1, - "misp-attribute": "text" - }, - "rsa-modulus-size": { - "description": "RSA modulus size in bits", - "disable_correlation": true, - "ui-priority": 1, - "misp-attribute": "text" - }, - "modulus": { - "description": "Modulus Parameter - in hexadecimal - no 0x, no :", - "disable_correlation": false, - "ui-priority": 1, - "misp-attribute": "text" - }, - "e": { - "description": "RSA public exponent", - "disable_correlation": false, - "ui-priority": 1, - "misp-attribute": "text" - }, - "p": { - "description": "Prime Parameter - P in decimal", - "disable_correlation": false, - "ui-priority": 1, - "misp-attribute": "text" - }, - "q": { - "description": "Prime Parameter - Q in decimal", - "disable_correlation": false, - "ui-priority": 1, - "misp-attribute": "text" - }, - "g": { - "description": "Curve Parameter - G in decimal", - "disable_correlation": true, - "ui-priority": 1, - "misp-attribute": "text" - }, - "y": { - "description": "Curve Parameter - Y in decimal", - "disable_correlation": true, - "ui-priority": 1, - "misp-attribute": "text" - }, - "x": { - "description": "Curve Parameter - X in decimal", - "disable_correlation": true, - "ui-priority": 1, - "misp-attribute": "text" - }, - "n": { - "description": "Curve Parameter - N in decimal", - "disable_correlation": true, - "ui-priority": 1, - "misp-attribute": "text" - }, - "b": { - "description": "Curve Parameter - B in decimal", - "disable_correlation": true, - "ui-priority": 1, - "misp-attribute": "text" - }, - "curve-length": { - "description": "Length of the Curve in bits", - "disable_correlation": true, - "ui-priority": 1, - "misp-attribute": "text" - }, "Gx": { "description": "Curve Parameter - Gx in decimal", "disable_correlation": true, - "ui-priority": 1, - "misp-attribute": "text" + "misp-attribute": "text", + "ui-priority": 1 }, "Gy": { "description": "Curve Parameter - Gy in decimal", "disable_correlation": true, - "ui-priority": 1, - "misp-attribute": "text" - }, - "private": { - "description": "Private part of the cryptographic materials in PEM format", - "ui-priority": 1, - "misp-attribute": "text" - }, - "generic-symmetric-key": { - "description": "Generic symmetric key (please precise the type)", - "ui-priority": 1, - "misp-attribute": "text" - }, - "type": { - "description": "Type of crytographic materials", - "ui-priority": 1, "misp-attribute": "text", + "ui-priority": 1 + }, + "b": { + "description": "Curve Parameter - B in decimal", "disable_correlation": true, - "values_list": [ - "RSA", - "DSA", - "ECDSA", - "RC4", - "XOR", - "unknown" - ] + "misp-attribute": "text", + "ui-priority": 1 + }, + "curve-length": { + "description": "Length of the Curve in bits", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 1 + }, + "e": { + "description": "RSA public exponent", + "disable_correlation": false, + "misp-attribute": "text", + "ui-priority": 1 }, "ecdsa-type": { "description": "Curve type of the ECDSA cryptographic materials", - "ui-priority": 1, - "misp-attribute": "text", "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 1, "values_list": [ "Anomalous", "M-221", @@ -144,11 +58,33 @@ "E-521" ] }, + "g": { + "description": "Curve Parameter - G in decimal", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 1 + }, + "generic-symmetric-key": { + "description": "Generic symmetric key (please precise the type)", + "misp-attribute": "text", + "ui-priority": 1 + }, + "modulus": { + "description": "Modulus Parameter - in hexadecimal - no 0x, no :", + "disable_correlation": false, + "misp-attribute": "text", + "ui-priority": 1 + }, + "n": { + "description": "Curve Parameter - N in decimal", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 1 + }, "origin": { "description": "Origin of the cryptographic materials", - "ui-priority": 1, - "misp-attribute": "text", "disable_correlation": true, + "misp-attribute": "text", "sane_default": [ "mathematical-attack", "exhaustive-search", @@ -158,12 +94,76 @@ "network-interception", "leak", "unknown" + ], + "ui-priority": 1 + }, + "p": { + "description": "Prime Parameter - P in decimal", + "disable_correlation": false, + "misp-attribute": "text", + "ui-priority": 1 + }, + "private": { + "description": "Private part of the cryptographic materials in PEM format", + "misp-attribute": "text", + "ui-priority": 1 + }, + "q": { + "description": "Prime Parameter - Q in decimal", + "disable_correlation": false, + "misp-attribute": "text", + "ui-priority": 1 + }, + "rsa-modulus-size": { + "description": "RSA modulus size in bits", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 1 + }, + "text": { + "description": "A description of the cryptographic materials.", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 1 + }, + "type": { + "description": "Type of crytographic materials", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 1, + "values_list": [ + "RSA", + "DSA", + "ECDSA", + "RC4", + "XOR", + "unknown" ] + }, + "x": { + "description": "Curve Parameter - X in decimal", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 1 + }, + "y": { + "description": "Curve Parameter - Y in decimal", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 1 } }, - "version": 3, "description": "Cryptographic materials such as public or/and private keys.", "meta-category": "misc", + "name": "crypto-material", + "requiredOneOf": [ + "generic-symmetric-key", + "text", + "private", + "p", + "q", + "modulus" + ], "uuid": "50677f82-ec9c-4484-bb29-2519cfe56823", - "name": "crypto-material" -} + "version": 3 +} \ No newline at end of file diff --git a/objects/cytomic-orion-file/definition.json b/objects/cytomic-orion-file/definition.json index 050506c..d7ec063 100644 --- a/objects/cytomic-orion-file/definition.json +++ b/objects/cytomic-orion-file/definition.json @@ -1,63 +1,63 @@ { - "required": [], "attributes": { - "fileName": { - "description": "Original filename", - "ui-priority": 9, - "categories": [ - "Other" - ], - "misp-attribute": "filename" - }, - "fileSize": { - "description": "Size of the file", - "to_ids": false, - "ui-priority": 0, - "categories": [ - "Other" - ], - "misp-attribute": "size-in-bytes" - }, "classification": { - "description": "File classification - number", - "to_ids": false, - "ui-priority": 2, "categories": [ "Other" ], - "misp-attribute": "text" + "description": "File classification - number", + "misp-attribute": "text", + "to_ids": false, + "ui-priority": 2 }, "classificationName": { - "description": "File classification", - "to_ids": false, - "ui-priority": 1, "categories": [ "Other" ], - "misp-attribute": "text" + "description": "File classification", + "misp-attribute": "text", + "to_ids": false, + "ui-priority": 1 + }, + "fileName": { + "categories": [ + "Other" + ], + "description": "Original filename", + "misp-attribute": "filename", + "ui-priority": 9 + }, + "fileSize": { + "categories": [ + "Other" + ], + "description": "Size of the file", + "misp-attribute": "size-in-bytes", + "to_ids": false, + "ui-priority": 0 }, "first-seen": { - "description": "First seen timestamp of the file", - "to_ids": false, - "ui-priority": 3, "categories": [ "Other" ], - "misp-attribute": "datetime" + "description": "First seen timestamp of the file", + "misp-attribute": "datetime", + "to_ids": false, + "ui-priority": 3 }, "last-seen": { - "description": "Last seen timestamp of the file", - "to_ids": false, - "ui-priority": 4, "categories": [ "Other" ], - "misp-attribute": "datetime" + "description": "Last seen timestamp of the file", + "misp-attribute": "datetime", + "to_ids": false, + "ui-priority": 4 } }, - "version": 7, "description": "Cytomic Orion File Detection", "meta-category": "misc", + "name": "cytomic-orion-file", + "required": [], "uuid": "0ad86572-ba38-4baf-9fed-1926e9ecc916", - "name": "cytomic-orion-file" -} + "version": 7 +} \ No newline at end of file diff --git a/objects/cytomic-orion-machine/definition.json b/objects/cytomic-orion-machine/definition.json index 5a25dd7..ce00962 100644 --- a/objects/cytomic-orion-machine/definition.json +++ b/objects/cytomic-orion-machine/definition.json @@ -1,101 +1,101 @@ { + "attributes": { + "clientCreationDateUTC": { + "categories": [ + "Other" + ], + "description": "Client creation date UTC", + "misp-attribute": "datetime", + "to_ids": false, + "ui-priority": 0 + }, + "clientId": { + "categories": [ + "Other" + ], + "description": "Client id", + "misp-attribute": "text", + "to_ids": false, + "ui-priority": 0 + }, + "clientName": { + "categories": [ + "Other" + ], + "description": "Client name", + "misp-attribute": "target-org", + "to_ids": false, + "ui-priority": 0 + }, + "creationDate": { + "categories": [ + "Other" + ], + "description": "Client creation date", + "misp-attribute": "datetime", + "to_ids": false, + "ui-priority": 0 + }, + "first-seen": { + "categories": [ + "Other" + ], + "description": "First seen on machine", + "misp-attribute": "datetime", + "to_ids": false, + "ui-priority": 3 + }, + "last-seen": { + "categories": [ + "Other" + ], + "description": "Last seen on machine", + "misp-attribute": "datetime", + "to_ids": false, + "ui-priority": 4 + }, + "lastSeenUtc": { + "categories": [ + "Other" + ], + "description": "Client last seen UTC", + "misp-attribute": "datetime", + "to_ids": false, + "ui-priority": 0 + }, + "machineMuid": { + "categories": [ + "Other" + ], + "description": "Machine UID", + "misp-attribute": "text", + "to_ids": false, + "ui-priority": 0 + }, + "machineName": { + "categories": [ + "Other" + ], + "description": "Machine name", + "misp-attribute": "target-machine", + "ui-priority": 9 + }, + "machinePath": { + "categories": [ + "Other" + ], + "description": "Path of observable", + "misp-attribute": "text", + "to_ids": false, + "ui-priority": 2 + } + }, + "description": "Cytomic Orion File at Machine Detection", + "meta-category": "misc", + "name": "cytomic-orion-machine", "required": [ "machineName" ], - "attributes": { - "machineName": { - "description": "Machine name", - "ui-priority": 9, - "categories": [ - "Other" - ], - "misp-attribute": "target-machine" - }, - "machineMuid": { - "description": "Machine UID", - "to_ids": false, - "ui-priority": 0, - "categories": [ - "Other" - ], - "misp-attribute": "text" - }, - "clientName": { - "description": "Client name", - "to_ids": false, - "ui-priority": 0, - "categories": [ - "Other" - ], - "misp-attribute": "target-org" - }, - "clientId": { - "description": "Client id", - "to_ids": false, - "ui-priority": 0, - "categories": [ - "Other" - ], - "misp-attribute": "text" - }, - "machinePath": { - "description": "Path of observable", - "to_ids": false, - "ui-priority": 2, - "categories": [ - "Other" - ], - "misp-attribute": "text" - }, - "first-seen": { - "description": "First seen on machine", - "to_ids": false, - "ui-priority": 3, - "categories": [ - "Other" - ], - "misp-attribute": "datetime" - }, - "last-seen": { - "description": "Last seen on machine", - "to_ids": false, - "ui-priority": 4, - "categories": [ - "Other" - ], - "misp-attribute": "datetime" - }, - "clientCreationDateUTC": { - "description": "Client creation date UTC", - "to_ids": false, - "ui-priority": 0, - "categories": [ - "Other" - ], - "misp-attribute": "datetime" - }, - "creationDate": { - "description": "Client creation date", - "to_ids": false, - "ui-priority": 0, - "categories": [ - "Other" - ], - "misp-attribute": "datetime" - }, - "lastSeenUtc": { - "description": "Client last seen UTC", - "to_ids": false, - "ui-priority": 0, - "categories": [ - "Other" - ], - "misp-attribute": "datetime" - } - }, - "version": 4, - "description": "Cytomic Orion File at Machine Detection", - "meta-category": "misc", "uuid": "e0e46343-43fd-4ce7-b447-51381402c774", - "name": "cytomic-orion-machine" -} + "version": 4 +} \ No newline at end of file diff --git a/objects/dark-pattern-item/definition.json b/objects/dark-pattern-item/definition.json index fb0c75c..362fa58 100644 --- a/objects/dark-pattern-item/definition.json +++ b/objects/dark-pattern-item/definition.json @@ -1,63 +1,63 @@ { - "requiredOneOf": [ - "location", - "screenshot" - ], "attributes": { - "location": { - "description": "Location where to find the item", - "ui-priority": 0, - "disable_correlation": true, - "multiple": true, - "misp-attribute": "text" - }, - "time": { - "description": "Date and time when first-seen", - "ui-priority": 0, - "disable_correlation": true, - "misp-attribute": "datetime" - }, - "implementer": { - "description": "Who is the vendor / holder of the item", - "ui-priority": 0, - "disable_correlation": true, - "misp-attribute": "text" - }, - "user": { - "description": "who are the user of the item", - "ui-priority": 0, - "disable_correlation": true, - "misp-attribute": "text" - }, "comment": { "description": "textual comment about the item", - "ui-priority": 0, "disable_correlation": true, - "misp-attribute": "text" + "misp-attribute": "text", + "ui-priority": 0 }, "gain": { "description": "What is the implementer is gaining by deceiving the user", - "ui-priority": 0, + "disable_correlation": true, "misp-attribute": "text", + "ui-priority": 0, "values_list": [ "registration", "personal data", "money", "contacts", "audience" - ], - "disable_correlation": true + ] + }, + "implementer": { + "description": "Who is the vendor / holder of the item", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 0 + }, + "location": { + "description": "Location where to find the item", + "disable_correlation": true, + "misp-attribute": "text", + "multiple": true, + "ui-priority": 0 }, "screenshot": { "description": "A screencapture or a screengrab of the item at work", - "ui-priority": 1, "disable_correlation": true, - "misp-attribute": "attachment" + "misp-attribute": "attachment", + "ui-priority": 1 + }, + "time": { + "description": "Date and time when first-seen", + "disable_correlation": true, + "misp-attribute": "datetime", + "ui-priority": 0 + }, + "user": { + "description": "who are the user of the item", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 0 } }, - "version": 2, "description": "An Item whose User Interface implements a dark pattern.", "meta-category": "misc", + "name": "dark-pattern-item", + "requiredOneOf": [ + "location", + "screenshot" + ], "uuid": "05755e29-8f5f-464d-bcff-2b4686472769", - "name": "dark-pattern-item" -} + "version": 2 +} \ No newline at end of file diff --git a/objects/ddos/definition.json b/objects/ddos/definition.json index 715150c..55bebf3 100644 --- a/objects/ddos/definition.json +++ b/objects/ddos/definition.json @@ -1,65 +1,22 @@ { - "name": "ddos", - "uuid": "e2f124d6-f57c-4f93-99e6-8450545fa05d", - "meta-category": "network", - "description": "DDoS object describes a current DDoS activity from a specific or/and to a specific target. Type of DDoS can be attached to the object as a taxonomy", - "version": 6, "attributes": { - "total-bps": { - "description": "Bits per second", - "misp-attribute": "counter", - "ui-priority": 0 - }, - "text": { - "description": "Description of the DDoS", - "disable_correlation": true, - "misp-attribute": "text", - "ui-priority": 0 - }, "domain-dst": { + "categories": [ + "Network activity", + "External analysis" + ], "description": "Destination domain (victim)", "misp-attribute": "domain", - "ui-priority": 1, - "categories": [ - "Network activity", - "External analysis" - ] - }, - "ip-dst": { - "description": "Destination IP (victim)", - "misp-attribute": "ip-dst", - "ui-priority": 1, - "categories": [ - "Network activity", - "External analysis" - ] - }, - "ip-src": { - "description": "IP address originating the attack", - "misp-attribute": "ip-src", - "ui-priority": 1, - "categories": [ - "Network activity", - "External analysis" - ] + "ui-priority": 1 }, "dst-port": { + "categories": [ + "Network activity", + "External analysis" + ], "description": "Destination port of the attack", "misp-attribute": "port", - "ui-priority": 0, - "categories": [ - "Network activity", - "External analysis" - ] - }, - "src-port": { - "description": "Port originating the attack", - "misp-attribute": "port", - "ui-priority": 0, - "categories": [ - "Network activity", - "External analysis" - ] + "ui-priority": 0 }, "first-seen": { "description": "Beginning of the attack", @@ -67,6 +24,30 @@ "misp-attribute": "datetime", "ui-priority": 0 }, + "ip-dst": { + "categories": [ + "Network activity", + "External analysis" + ], + "description": "Destination IP (victim)", + "misp-attribute": "ip-dst", + "ui-priority": 1 + }, + "ip-src": { + "categories": [ + "Network activity", + "External analysis" + ], + "description": "IP address originating the attack", + "misp-attribute": "ip-src", + "ui-priority": 1 + }, + "last-seen": { + "description": "End of the attack", + "disable_correlation": true, + "misp-attribute": "datetime", + "ui-priority": 0 + }, "protocol": { "description": "Protocol used for the attack", "misp-attribute": "text", @@ -78,21 +59,40 @@ "IP" ] }, + "src-port": { + "categories": [ + "Network activity", + "External analysis" + ], + "description": "Port originating the attack", + "misp-attribute": "port", + "ui-priority": 0 + }, + "text": { + "description": "Description of the DDoS", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 0 + }, + "total-bps": { + "description": "Bits per second", + "misp-attribute": "counter", + "ui-priority": 0 + }, "total-pps": { "description": "Packets per second", "misp-attribute": "counter", "ui-priority": 0 - }, - "last-seen": { - "description": "End of the attack", - "disable_correlation": true, - "misp-attribute": "datetime", - "ui-priority": 0 } }, + "description": "DDoS object describes a current DDoS activity from a specific or/and to a specific target. Type of DDoS can be attached to the object as a taxonomy", + "meta-category": "network", + "name": "ddos", "requiredOneOf": [ "ip-dst", "ip-src", "domain-dst" - ] -} + ], + "uuid": "e2f124d6-f57c-4f93-99e6-8450545fa05d", + "version": 6 +} \ No newline at end of file diff --git a/objects/device/definition.json b/objects/device/definition.json index d9f05d5..2a81682 100644 --- a/objects/device/definition.json +++ b/objects/device/definition.json @@ -1,31 +1,44 @@ { - "requiredOneOf": [ - "name", - "alias" - ], "attributes": { - "description": { - "description": "Description of the Device", - "ui-priority": 0, - "misp-attribute": "text", - "disable_correlation": true + "MAC-address": { + "description": "Device MAC address", + "misp-attribute": "mac-address", + "ui-priority": 0 }, - "name": { - "description": "Name of the Device", - "ui-priority": 101, - "misp-attribute": "text" + "OS": { + "description": "OS of the device", + "disable_correlation": true, + "misp-attribute": "text", + "multiple": true, + "ui-priority": 98 }, "alias": { "description": "Alias of the Device", - "ui-priority": 100, "misp-attribute": "text", - "multiple": true + "multiple": true, + "ui-priority": 100 + }, + "analysis-date": { + "description": "Date of device analysis", + "misp-attribute": "datetime", + "ui-priority": 0 + }, + "attachment": { + "description": "An attachment", + "misp-attribute": "attachment", + "multiple": true, + "ui-priority": 0 + }, + "description": { + "description": "Description of the Device", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 0 }, "device-type": { "description": "Type of the device", - "ui-priority": 99, - "misp-attribute": "text", "disable_correlation": true, + "misp-attribute": "text", "sane_default": [ "PC", "Mobile", @@ -35,53 +48,40 @@ "IoT", "Hardware", "Other" - ] - }, - "OS": { - "description": "OS of the device", - "ui-priority": 98, - "misp-attribute": "text", - "disable_correlation": true, - "multiple": true - }, - "version": { - "description": "Version of the device/ OS", - "ui-priority": 97, - "misp-attribute": "text", - "disable_correlation": true - }, - "ip-address": { - "description": "Device IP address", - "ui-priority": 0, - "misp-attribute": "ip-src", - "multiple": true + ], + "ui-priority": 99 }, "dns-name": { "description": "Device DNS Name", - "ui-priority": 0, "misp-attribute": "text", - "multiple": true + "multiple": true, + "ui-priority": 0 }, - "MAC-address": { - "description": "Device MAC address", - "ui-priority": 0, - "misp-attribute": "mac-address" + "ip-address": { + "description": "Device IP address", + "misp-attribute": "ip-src", + "multiple": true, + "ui-priority": 0 }, - "analysis-date": { - "description": "Date of device analysis", - "ui-priority": 0, - "misp-attribute": "datetime" + "name": { + "description": "Name of the Device", + "misp-attribute": "text", + "ui-priority": 101 }, - "attachment": { - "description": "An attachment", - "ui-priority": 0, - "misp-attribute": "attachment", - "multiple": true + "version": { + "description": "Version of the device/ OS", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 97 } }, - "version": 7, "description": "An object to define a device", "meta-category": "misc", + "name": "device", + "requiredOneOf": [ + "name", + "alias" + ], "uuid": "0c64b41a-e583-4f4d-ac92-d484163b9e52", - "name": "device" -} + "version": 7 +} \ No newline at end of file diff --git a/objects/diameter-attack/definition.json b/objects/diameter-attack/definition.json index 71c2766..11ee5b5 100644 --- a/objects/diameter-attack/definition.json +++ b/objects/diameter-attack/definition.json @@ -1,89 +1,89 @@ { - "requiredOneOf": [ - "text" - ], "attributes": { - "category": { - "description": "Category.", - "sane_default": [ - "Cat0", - "Cat1", - "Cat2", - "Cat3", - "CatSMS" - ], - "misp-attribute": "text", - "disable_correlation": true, - "ui-priority": 0 - }, "ApplicationId": { "description": "Application-ID is used to identify for which Diameter application the message is applicable. Application-ID is a decimal representation.", "misp-attribute": "text", "ui-priority": 0 }, - "SessionId": { - "description": "Session-ID.", - "misp-attribute": "text", - "ui-priority": 0 - }, "CmdCode": { "description": "A decimal representation of the diameter Command Code.", "disable_correlation": true, "misp-attribute": "text", "ui-priority": 0 }, - "Origin-Host": { - "description": "Origin-Host.", - "misp-attribute": "text", - "multiple": true, - "ui-priority": 0 - }, "Destination-Host": { "description": "Destination-Host.", "misp-attribute": "text", "multiple": true, "ui-priority": 0 }, - "Origin-Realm": { - "description": "Origin-Realm.", - "misp-attribute": "text", - "multiple": true, - "ui-priority": 0 - }, "Destination-Realm": { "description": "Destination-Realm.", "misp-attribute": "text", "multiple": true, "ui-priority": 0 }, + "IdrFlags": { + "description": "IDR-Flags.", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 0 + }, + "Origin-Host": { + "description": "Origin-Host.", + "misp-attribute": "text", + "multiple": true, + "ui-priority": 0 + }, + "Origin-Realm": { + "description": "Origin-Realm.", + "misp-attribute": "text", + "multiple": true, + "ui-priority": 0 + }, + "SessionId": { + "description": "Session-ID.", + "misp-attribute": "text", + "ui-priority": 0 + }, "Username": { "description": "Username (in this case, usually the IMSI).", "misp-attribute": "text", "multiple": true, "ui-priority": 0 }, - "IdrFlags": { - "description": "IDR-Flags.", - "misp-attribute": "text", + "category": { + "description": "Category.", "disable_correlation": true, + "misp-attribute": "text", + "sane_default": [ + "Cat0", + "Cat1", + "Cat2", + "Cat3", + "CatSMS" + ], + "ui-priority": 0 + }, + "first-seen": { + "description": "When the attack has been seen for the first time.", + "disable_correlation": true, + "misp-attribute": "datetime", "ui-priority": 0 }, "text": { "description": "A description of the attack seen.", "disable_correlation": true, - "ui-priority": 0, - "misp-attribute": "text" - }, - "first-seen": { - "description": "When the attack has been seen for the first time.", - "disable_correlation": true, - "ui-priority": 0, - "misp-attribute": "datetime" + "misp-attribute": "text", + "ui-priority": 0 } }, - "version": 1, "description": "Attack as seen on diameter authentication against a GSM, UMTS or LTE network", "meta-category": "network", + "name": "diameter-attack", + "requiredOneOf": [ + "text" + ], "uuid": "a3fdce4c-8e21-4acc-ab8e-9976e9165a12", - "name": "diameter-attack" -} + "version": 1 +} \ No newline at end of file diff --git a/objects/dns-record/definition.json b/objects/dns-record/definition.json index 8c4d5c1..12ef92a 100644 --- a/objects/dns-record/definition.json +++ b/objects/dns-record/definition.json @@ -1,4 +1,54 @@ { + "attributes": { + "a-record": { + "categories": [ + "Network activity", + "External analysis" + ], + "description": "IP Address sassociated with A Records", + "misp-attribute": "ip-dst", + "multiple": true, + "ui-priority": 1 + }, + "mx-record": { + "categories": [ + "Network activity", + "External analysis" + ], + "description": "Domain associated with MX Record", + "misp-attribute": "domain", + "multiple": true, + "ui-priority": 1 + }, + "ns-record": { + "categories": [ + "Network activity", + "External analysis" + ], + "description": "Domain associated with NS Records", + "misp-attribute": "domain", + "multiple": true, + "ui-priority": 1 + }, + "queried-domain": { + "categories": [ + "Network activity", + "External analysis" + ], + "description": "Domain name", + "misp-attribute": "domain", + "ui-priority": 1 + }, + "text": { + "description": "A description of the records", + "misp-attribute": "text", + "recommended": false, + "ui-priority": 1 + } + }, + "description": "A set of dns records observed for a specific domain.", + "meta-category": "network", + "name": "dns-record", "required": [ "queried-domain" ], @@ -7,56 +57,6 @@ "mx-record", "ns-record" ], - "attributes": { - "text": { - "description": "A description of the records", - "ui-priority": 1, - "misp-attribute": "text", - "recommended": false - }, - "queried-domain": { - "description": "Domain name", - "categories": [ - "Network activity", - "External analysis" - ], - "ui-priority": 1, - "misp-attribute": "domain" - }, - "a-record": { - "description": "IP Address sassociated with A Records", - "categories": [ - "Network activity", - "External analysis" - ], - "ui-priority": 1, - "misp-attribute": "ip-dst", - "multiple": true - }, - "mx-record": { - "description": "Domain associated with MX Record", - "categories": [ - "Network activity", - "External analysis" - ], - "ui-priority": 1, - "misp-attribute": "domain", - "multiple": true - }, - "ns-record": { - "description": "Domain associated with NS Records", - "categories": [ - "Network activity", - "External analysis" - ], - "ui-priority": 1, - "misp-attribute": "domain", - "multiple": true - } - }, - "version": 1, - "description": "A set of dns records observed for a specific domain.", - "meta-category": "network", "uuid": "f023c8f0-81ab-41f3-9f5d-fa597a34a9b9", - "name": "dns-record" -} + "version": 1 +} \ No newline at end of file diff --git a/objects/domain-crawled/definition.json b/objects/domain-crawled/definition.json index 4c89e6e..8e0de46 100644 --- a/objects/domain-crawled/definition.json +++ b/objects/domain-crawled/definition.json @@ -1,38 +1,38 @@ { - "required": [ - "domain" - ], "attributes": { + "domain": { + "categories": [ + "Network activity", + "External analysis" + ], + "description": "Domain name", + "misp-attribute": "domain", + "ui-priority": 1 + }, "text": { "description": "A description of the tuple", "disable_correlation": true, - "ui-priority": 1, "misp-attribute": "text", - "recommended": false - }, - "domain": { - "description": "Domain name", - "categories": [ - "Network activity", - "External analysis" - ], - "ui-priority": 1, - "misp-attribute": "domain" + "recommended": false, + "ui-priority": 1 }, "url": { - "description": "domain url", "categories": [ "Network activity", "External analysis" ], - "ui-priority": 1, + "description": "domain url", "misp-attribute": "url", - "multiple": true + "multiple": true, + "ui-priority": 1 } }, - "version": 2, "description": "A domain crawled over time", "meta-category": "network", + "name": "domain-crawled", + "required": [ + "domain" + ], "uuid": "bad4888d-c44e-4612-b08f-3d97c1e0014a", - "name": "domain-crawled" -} + "version": 2 +} \ No newline at end of file diff --git a/objects/domain-ip/definition.json b/objects/domain-ip/definition.json index f5fc64a..f780dbe 100644 --- a/objects/domain-ip/definition.json +++ b/objects/domain-ip/definition.json @@ -1,68 +1,68 @@ { - "required": [ - "ip", - "domain" - ], "attributes": { - "text": { - "description": "A description of the tuple", - "disable_correlation": true, - "ui-priority": 1, - "misp-attribute": "text", - "recommended": false - }, - "last-seen": { - "description": "Last time the tuple has been seen", - "disable_correlation": true, - "ui-priority": 0, - "misp-attribute": "datetime" + "domain": { + "categories": [ + "Network activity", + "External analysis" + ], + "description": "Domain name", + "misp-attribute": "domain", + "multiple": true, + "ui-priority": 1 }, "first-seen": { "description": "First time the tuple has been seen", "disable_correlation": true, - "ui-priority": 0, - "misp-attribute": "datetime" + "misp-attribute": "datetime", + "ui-priority": 0 + }, + "ip": { + "categories": [ + "Network activity", + "External analysis" + ], + "description": "IP Address", + "misp-attribute": "ip-dst", + "multiple": true, + "ui-priority": 1 + }, + "last-seen": { + "description": "Last time the tuple has been seen", + "disable_correlation": true, + "misp-attribute": "datetime", + "ui-priority": 0 + }, + "port": { + "categories": [ + "Network activity", + "External analysis" + ], + "description": "Associated TCP port with the domain", + "misp-attribute": "port", + "multiple": true, + "ui-priority": 1 }, "registration-date": { "description": "Registration date of domain", "disable_correlation": false, - "ui-priority": 0, - "misp-attribute": "datetime" + "misp-attribute": "datetime", + "ui-priority": 0 }, - "domain": { - "description": "Domain name", - "categories": [ - "Network activity", - "External analysis" - ], - "ui-priority": 1, - "misp-attribute": "domain", - "multiple": true - }, - "ip": { - "description": "IP Address", - "categories": [ - "Network activity", - "External analysis" - ], - "ui-priority": 1, - "misp-attribute": "ip-dst", - "multiple": true - }, - "port": { - "description": "Associated TCP port with the domain", - "categories": [ - "Network activity", - "External analysis" - ], - "ui-priority": 1, - "misp-attribute": "port", - "multiple": true + "text": { + "description": "A description of the tuple", + "disable_correlation": true, + "misp-attribute": "text", + "recommended": false, + "ui-priority": 1 } }, - "version": 8, "description": "A domain and IP address seen as a tuple in a specific time frame.", "meta-category": "network", + "name": "domain-ip", + "required": [ + "ip", + "domain" + ], "uuid": "43b3b146-77eb-4931-b4cc-b66c60f28734", - "name": "domain-ip" -} + "version": 8 +} \ No newline at end of file diff --git a/objects/elf-section/definition.json b/objects/elf-section/definition.json index 97e049b..f891881 100644 --- a/objects/elf-section/definition.json +++ b/objects/elf-section/definition.json @@ -1,95 +1,116 @@ { - "requiredOneOf": [ - "text", - "name", - "md5", - "sha1", - "sha224", - "sha256", - "sha384", - "sha512", - "sha512/224", - "sha512/256" - ], "attributes": { - "md5": { - "description": "[Insecure] MD5 hash (128 bits)", - "ui-priority": 1, - "misp-attribute": "md5", - "recommended": false - }, - "sha1": { - "description": "[Insecure] Secure Hash Algorithm 1 (160 bits)", - "ui-priority": 1, - "misp-attribute": "sha1", - "recommended": false - }, - "sha224": { - "description": "Secure Hash Algorithm 2 (224 bits)", - "ui-priority": 0, - "misp-attribute": "sha224", - "recommended": false - }, - "sha256": { - "description": "Secure Hash Algorithm 2 (256 bits)", - "ui-priority": 1, - "misp-attribute": "sha256" - }, - "sha384": { - "description": "Secure Hash Algorithm 2 (384 bits)", - "ui-priority": 0, - "misp-attribute": "sha384", - "recommended": false - }, - "sha512": { - "description": "Secure Hash Algorithm 2 (512 bits)", - "ui-priority": 1, - "misp-attribute": "sha512" - }, - "sha512/224": { - "description": "Secure Hash Algorithm 2 (224 bits)", - "ui-priority": 0, - "misp-attribute": "sha512/224", - "recommended": false - }, - "sha512/256": { - "description": "Secure Hash Algorithm 2 (256 bits)", - "ui-priority": 0, - "misp-attribute": "sha512/256", - "recommended": false - }, - "ssdeep": { - "description": "Fuzzy hash using context triggered piecewise hashes (CTPH)", - "ui-priority": 0, - "misp-attribute": "ssdeep" - }, "entropy": { "description": "Entropy of the whole section", "disable_correlation": true, - "ui-priority": 0, - "misp-attribute": "float" + "misp-attribute": "float", + "ui-priority": 0 + }, + "flag": { + "description": "Flag of the section", + "disable_correlation": true, + "misp-attribute": "text", + "multiple": true, + "sane_default": [ + "ALLOC", + "EXCLUDE", + "EXECINSTR", + "GROUP", + "HEX_GPREL", + "INFO_LINK", + "LINK_ORDER", + "MASKOS", + "MASKPROC", + "MERGE", + "MIPS_ADDR", + "MIPS_LOCAL", + "MIPS_MERGE", + "MIPS_NAMES", + "MIPS_NODUPES", + "MIPS_NOSTRIP", + "NONE", + "OS_NONCONFORMING", + "STRINGS", + "TLS", + "WRITE", + "XCORE_SHF_CP_SECTION" + ], + "ui-priority": 0 + }, + "md5": { + "description": "[Insecure] MD5 hash (128 bits)", + "misp-attribute": "md5", + "recommended": false, + "ui-priority": 1 }, "name": { "description": "Name of the section", "disable_correlation": true, - "ui-priority": 1, - "misp-attribute": "text" + "misp-attribute": "text", + "ui-priority": 1 + }, + "sha1": { + "description": "[Insecure] Secure Hash Algorithm 1 (160 bits)", + "misp-attribute": "sha1", + "recommended": false, + "ui-priority": 1 + }, + "sha224": { + "description": "Secure Hash Algorithm 2 (224 bits)", + "misp-attribute": "sha224", + "recommended": false, + "ui-priority": 0 + }, + "sha256": { + "description": "Secure Hash Algorithm 2 (256 bits)", + "misp-attribute": "sha256", + "ui-priority": 1 + }, + "sha384": { + "description": "Secure Hash Algorithm 2 (384 bits)", + "misp-attribute": "sha384", + "recommended": false, + "ui-priority": 0 + }, + "sha512": { + "description": "Secure Hash Algorithm 2 (512 bits)", + "misp-attribute": "sha512", + "ui-priority": 1 + }, + "sha512/224": { + "description": "Secure Hash Algorithm 2 (224 bits)", + "misp-attribute": "sha512/224", + "recommended": false, + "ui-priority": 0 + }, + "sha512/256": { + "description": "Secure Hash Algorithm 2 (256 bits)", + "misp-attribute": "sha512/256", + "recommended": false, + "ui-priority": 0 }, "size-in-bytes": { "description": "Size of the section, in bytes", "disable_correlation": true, - "ui-priority": 1, - "misp-attribute": "size-in-bytes" + "misp-attribute": "size-in-bytes", + "ui-priority": 1 + }, + "ssdeep": { + "description": "Fuzzy hash using context triggered piecewise hashes (CTPH)", + "misp-attribute": "ssdeep", + "ui-priority": 0 }, "text": { "description": "Free text value to attach to the section", "disable_correlation": true, - "ui-priority": 1, "misp-attribute": "text", - "recommended": false + "recommended": false, + "ui-priority": 1 }, "type": { "description": "Type of the section", + "disable_correlation": true, + "misp-attribute": "text", "sane_default": [ "NULL", "PROGBITS", @@ -127,45 +148,24 @@ "LOUSER", "HIUSER" ], - "disable_correlation": true, - "ui-priority": 0, - "misp-attribute": "text" - }, - "flag": { - "description": "Flag of the section", - "sane_default": [ - "ALLOC", - "EXCLUDE", - "EXECINSTR", - "GROUP", - "HEX_GPREL", - "INFO_LINK", - "LINK_ORDER", - "MASKOS", - "MASKPROC", - "MERGE", - "MIPS_ADDR", - "MIPS_LOCAL", - "MIPS_MERGE", - "MIPS_NAMES", - "MIPS_NODUPES", - "MIPS_NOSTRIP", - "NONE", - "OS_NONCONFORMING", - "STRINGS", - "TLS", - "WRITE", - "XCORE_SHF_CP_SECTION" - ], - "disable_correlation": true, - "ui-priority": 0, - "misp-attribute": "text", - "multiple": true + "ui-priority": 0 } }, - "version": 4, "description": "Object describing a section of an Executable and Linkable Format", "meta-category": "file", + "name": "elf-section", + "requiredOneOf": [ + "text", + "name", + "md5", + "sha1", + "sha224", + "sha256", + "sha384", + "sha512", + "sha512/224", + "sha512/256" + ], "uuid": "ca271f32-1234-4e87-b240-6b6e882de5de", - "name": "elf-section" -} + "version": 4 +} \ No newline at end of file diff --git a/objects/elf/definition.json b/objects/elf/definition.json index 34ee8c7..b6ba345 100644 --- a/objects/elf/definition.json +++ b/objects/elf/definition.json @@ -1,38 +1,9 @@ { - "requiredOneOf": [ - "text", - "entrypoint-address" - ], "attributes": { - "entrypoint-address": { - "description": "Address of the entry point", - "disable_correlation": true, - "ui-priority": 0, - "misp-attribute": "text" - }, - "type": { - "description": "Type of ELF", - "sane_default": [ - "CORE", - "DYNAMIC", - "EXECUTABLE", - "HIPROC", - "LOPROC", - "NONE", - "RELOCATABLE" - ], - "ui-priority": 0, - "misp-attribute": "text", - "disable_correlation": true - }, - "number-sections": { - "description": "Number of sections", - "disable_correlation": true, - "ui-priority": 0, - "misp-attribute": "counter" - }, "arch": { "description": "Architecture of the ELF file", + "disable_correlation": true, + "misp-attribute": "text", "sane_default": [ "None", "M32", @@ -210,12 +181,24 @@ "CSR_KALIMBA", "AMDGPU" ], - "ui-priority": 0, + "ui-priority": 0 + }, + "entrypoint-address": { + "description": "Address of the entry point", + "disable_correlation": true, "misp-attribute": "text", - "disable_correlation": true + "ui-priority": 0 + }, + "number-sections": { + "description": "Number of sections", + "disable_correlation": true, + "misp-attribute": "counter", + "ui-priority": 0 }, "os_abi": { "description": "Header operating system application binary interface (ABI)", + "disable_correlation": true, + "misp-attribute": "text", "sane_default": [ "AIX", "ARM", @@ -239,21 +222,38 @@ "SYSTEMV", "TRU64" ], - "ui-priority": 0, - "misp-attribute": "text", - "disable_correlation": true + "ui-priority": 0 }, "text": { "description": "Free text value to attach to the ELF", "disable_correlation": true, - "ui-priority": 1, "misp-attribute": "text", - "recommended": false + "recommended": false, + "ui-priority": 1 + }, + "type": { + "description": "Type of ELF", + "disable_correlation": true, + "misp-attribute": "text", + "sane_default": [ + "CORE", + "DYNAMIC", + "EXECUTABLE", + "HIPROC", + "LOPROC", + "NONE", + "RELOCATABLE" + ], + "ui-priority": 0 } }, - "version": 5, "description": "Object describing a Executable and Linkable Format", "meta-category": "file", + "name": "elf", + "requiredOneOf": [ + "text", + "entrypoint-address" + ], "uuid": "fa6534ae-ad74-4ce0-8f23-15a66c82c7fa", - "name": "elf" -} + "version": 5 +} \ No newline at end of file diff --git a/objects/email/definition.json b/objects/email/definition.json index f984e0a..30191bd 100644 --- a/objects/email/definition.json +++ b/objects/email/definition.json @@ -1,195 +1,193 @@ { - "name": "email", - "uuid": "a0c666e0-fc65-4be8-b48f-3423d788b552", - "meta-category": "network", - "description": "Email object describing an email with meta-information", - "version": 15, "attributes": { - "reply-to": { - "description": "Email address the reply will be sent to", - "misp-attribute": "email-reply-to", - "ui-priority": 1, - "categories": [ - "Payload delivery" - ] - }, - "message-id": { - "description": "Message ID", - "misp-attribute": "email-message-id", - "disable_correlation": true, - "ui-priority": 0, - "categories": [ - "Payload delivery" - ] - }, - "to": { - "description": "Destination email address", - "misp-attribute": "email-dst", - "disable_correlation": true, - "ui-priority": 1, - "categories": [ - "Payload delivery" - ], - "multiple": true - }, - "cc": { - "description": "Carbon copy", - "misp-attribute": "email-dst", - "disable_correlation": true, - "ui-priority": 1, - "categories": [ - "Payload delivery" - ], - "multiple": true - }, - "to-display-name": { - "description": "Display name of the receiver", - "misp-attribute": "email-dst-display-name", - "ui-priority": 1, - "categories": [ - "Payload delivery" - ], - "multiple": true - }, - "subject": { - "description": "Subject", - "misp-attribute": "email-subject", - "ui-priority": 1, - "categories": [ - "Payload delivery" - ], - "multiple": true - }, - "screenshot": { - "description": "Screenshot of email", - "misp-attribute": "attachment", - "disable_correlation": true, - "ui-priority": 1, - "categories": [ - "External analysis" - ] - }, "attachment": { + "categories": [ + "Payload delivery" + ], "description": "Attachment", "misp-attribute": "email-attachment", - "ui-priority": 0, + "multiple": true, + "ui-priority": 0 + }, + "cc": { "categories": [ "Payload delivery" ], - "multiple": true - }, - "received-header-ip": { - "description": "Extracted IP address from parsed headers", - "misp-attribute": "ip-src", - "ui-priority": 0, - "multiple": true - }, - "received-header-hostname": { - "description": "Extracted hostname from parsed headers", - "misp-attribute": "hostname", - "ui-priority": 0, - "multiple": true - }, - "x-mailer": { - "description": "X-Mailer generally tells the program that was used to draft and send the original email", - "misp-attribute": "email-x-mailer", + "description": "Carbon copy", "disable_correlation": true, - "ui-priority": 0, - "categories": [ - "Payload delivery" - ] - }, - "header": { - "description": "Full headers", - "misp-attribute": "email-header", - "disable_correlation": true, - "ui-priority": 0, - "categories": [ - "Payload delivery" - ], - "multiple": true - }, - "send-date": { - "description": "Date the email has been sent", - "misp-attribute": "datetime", - "ui-priority": 0, - "disable_correlation": true, - "categories": [ - "Other" - ] - }, - "mime-boundary": { - "description": "MIME Boundary", - "misp-attribute": "email-mime-boundary", - "disable_correlation": true, - "ui-priority": 0, - "categories": [ - "Payload delivery" - ] - }, - "thread-index": { - "description": "Identifies a particular conversation thread", - "misp-attribute": "email-thread-index", - "disable_correlation": true, - "ui-priority": 0, - "categories": [ - "Payload delivery" - ] - }, - "from": { - "description": "Sender email address", - "misp-attribute": "email-src", - "ui-priority": 1, - "categories": [ - "Payload delivery" - ], - "multiple": true - }, - "return-path": { - "description": "Message return path", - "misp-attribute": "email-src", - "ui-priority": 1, - "categories": [ - "Payload delivery" - ] - }, - "from-display-name": { - "description": "Display name of the sender", - "misp-attribute": "email-src-display-name", - "ui-priority": 1, - "categories": [ - "Payload delivery" - ], - "multiple": true + "misp-attribute": "email-dst", + "multiple": true, + "ui-priority": 1 }, "email-body": { - "description": "Body of the email", - "misp-attribute": "email-body", - "disable_correlation": true, - "ui-priority": 1, "categories": [ "Payload delivery" - ] + ], + "description": "Body of the email", + "disable_correlation": true, + "misp-attribute": "email-body", + "ui-priority": 1 }, - "user-agent": { - "description": "User Agent of the sender", - "misp-attribute": "text", - "ui-priority": 0, - "disable_correlation": true + "eml": { + "description": "Full EML", + "disable_correlation": true, + "misp-attribute": "attachment", + "ui-priority": 1 + }, + "from": { + "categories": [ + "Payload delivery" + ], + "description": "Sender email address", + "misp-attribute": "email-src", + "multiple": true, + "ui-priority": 1 + }, + "from-display-name": { + "categories": [ + "Payload delivery" + ], + "description": "Display name of the sender", + "misp-attribute": "email-src-display-name", + "multiple": true, + "ui-priority": 1 + }, + "header": { + "categories": [ + "Payload delivery" + ], + "description": "Full headers", + "disable_correlation": true, + "misp-attribute": "email-header", + "multiple": true, + "ui-priority": 0 }, "ip-src": { "description": "Source IP address of the email sender", "misp-attribute": "ip-src", - "ui-priority": 0, - "multiple": true + "multiple": true, + "ui-priority": 0 }, - "eml": { - "description": "Full EML", - "misp-attribute": "attachment", + "message-id": { + "categories": [ + "Payload delivery" + ], + "description": "Message ID", "disable_correlation": true, + "misp-attribute": "email-message-id", + "ui-priority": 0 + }, + "mime-boundary": { + "categories": [ + "Payload delivery" + ], + "description": "MIME Boundary", + "disable_correlation": true, + "misp-attribute": "email-mime-boundary", + "ui-priority": 0 + }, + "received-header-hostname": { + "description": "Extracted hostname from parsed headers", + "misp-attribute": "hostname", + "multiple": true, + "ui-priority": 0 + }, + "received-header-ip": { + "description": "Extracted IP address from parsed headers", + "misp-attribute": "ip-src", + "multiple": true, + "ui-priority": 0 + }, + "reply-to": { + "categories": [ + "Payload delivery" + ], + "description": "Email address the reply will be sent to", + "misp-attribute": "email-reply-to", "ui-priority": 1 + }, + "return-path": { + "categories": [ + "Payload delivery" + ], + "description": "Message return path", + "misp-attribute": "email-src", + "ui-priority": 1 + }, + "screenshot": { + "categories": [ + "External analysis" + ], + "description": "Screenshot of email", + "disable_correlation": true, + "misp-attribute": "attachment", + "ui-priority": 1 + }, + "send-date": { + "categories": [ + "Other" + ], + "description": "Date the email has been sent", + "disable_correlation": true, + "misp-attribute": "datetime", + "ui-priority": 0 + }, + "subject": { + "categories": [ + "Payload delivery" + ], + "description": "Subject", + "misp-attribute": "email-subject", + "multiple": true, + "ui-priority": 1 + }, + "thread-index": { + "categories": [ + "Payload delivery" + ], + "description": "Identifies a particular conversation thread", + "disable_correlation": true, + "misp-attribute": "email-thread-index", + "ui-priority": 0 + }, + "to": { + "categories": [ + "Payload delivery" + ], + "description": "Destination email address", + "disable_correlation": true, + "misp-attribute": "email-dst", + "multiple": true, + "ui-priority": 1 + }, + "to-display-name": { + "categories": [ + "Payload delivery" + ], + "description": "Display name of the receiver", + "misp-attribute": "email-dst-display-name", + "multiple": true, + "ui-priority": 1 + }, + "user-agent": { + "description": "User Agent of the sender", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 0 + }, + "x-mailer": { + "categories": [ + "Payload delivery" + ], + "description": "X-Mailer generally tells the program that was used to draft and send the original email", + "disable_correlation": true, + "misp-attribute": "email-x-mailer", + "ui-priority": 0 } }, + "description": "Email object describing an email with meta-information", + "meta-category": "network", + "name": "email", "requiredOneOf": [ "from", "from-display-name", @@ -207,5 +205,7 @@ "return-path", "email-body", "eml" - ] -} + ], + "uuid": "a0c666e0-fc65-4be8-b48f-3423d788b552", + "version": 15 +} \ No newline at end of file diff --git a/objects/employee/definition.json b/objects/employee/definition.json index 8db5a4e..5f68ad3 100644 --- a/objects/employee/definition.json +++ b/objects/employee/definition.json @@ -1,53 +1,21 @@ { - "required": [ - "email-address" - ], "attributes": { - "text": { - "description": "A description of the person or identity.", - "disable_correlation": true, - "ui-priority": 1, - "misp-attribute": "text" - }, - "last-name": { - "description": "Last name Employee", - "disable_correlation": true, - "ui-priority": 0, - "misp-attribute": "last-name" - }, - "first-name": { - "description": "First name of Employee", - "disable_correlation": true, - "ui-priority": 0, - "misp-attribute": "first-name" - }, - "email-address": { - "description": "Employee Email Address", - "ui-priority": 0, - "misp-attribute": "target-email" - }, - "userid": { - "description": "EMployee user identification", - "disable_correlation": true, - "ui-priority": 0, - "misp-attribute": "target-user" - }, - "primary-asset": { - "description": "Asset tag of the primary asset assigned to employee", - "ui-priority": 0, - "misp-attribute": "target-machine" - }, "business-unit": { "description": "the organizational business unit associated with the employee", "disable_correlation": true, - "ui-priority": 0, - "misp-attribute": "target-org" + "misp-attribute": "target-org", + "ui-priority": 0 + }, + "email-address": { + "description": "Employee Email Address", + "misp-attribute": "target-email", + "ui-priority": 0 }, "employee-type": { "description": "type of employee", "disable_correlation": true, - "ui-priority": 0, "misp-attribute": "text", + "ui-priority": 0, "values_list": [ "Mid-Level Manager", "Senior Manager", @@ -56,11 +24,43 @@ "First-Line Manager", "Director" ] + }, + "first-name": { + "description": "First name of Employee", + "disable_correlation": true, + "misp-attribute": "first-name", + "ui-priority": 0 + }, + "last-name": { + "description": "Last name Employee", + "disable_correlation": true, + "misp-attribute": "last-name", + "ui-priority": 0 + }, + "primary-asset": { + "description": "Asset tag of the primary asset assigned to employee", + "misp-attribute": "target-machine", + "ui-priority": 0 + }, + "text": { + "description": "A description of the person or identity.", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 1 + }, + "userid": { + "description": "EMployee user identification", + "disable_correlation": true, + "misp-attribute": "target-user", + "ui-priority": 0 } }, - "version": 1, "description": "An employee and related data points", "meta-category": "misc", + "name": "employee", + "required": [ + "email-address" + ], "uuid": "443b2f15-d7c9-4d3d-bfd2-38f099753e83", - "name": "employee" -} + "version": 1 +} \ No newline at end of file diff --git a/objects/exploit-poc/definition.json b/objects/exploit-poc/definition.json index 55d9bc7..b3d9818 100644 --- a/objects/exploit-poc/definition.json +++ b/objects/exploit-poc/definition.json @@ -1,45 +1,45 @@ { + "attributes": { + "author": { + "description": "Author of the exploit - proof of concept", + "disable_correlation": true, + "misp-attribute": "text", + "multiple": true, + "ui-priority": 0 + }, + "description": { + "description": "Description of the exploit - proof of concept", + "misp-attribute": "text", + "ui-priority": 0 + }, + "poc": { + "description": "Proof of Concept or exploit (as a script, binary or described process)", + "disable_correlation": true, + "misp-attribute": "attachment", + "multiple": true, + "ui-priority": 0 + }, + "references": { + "description": "External references", + "misp-attribute": "link", + "multiple": true, + "ui-priority": 0 + }, + "vulnerable_configuration": { + "description": "The vulnerable configuration described in CPE format where the exploit/proof of concept is valid", + "misp-attribute": "text", + "multiple": true, + "ui-priority": 0 + } + }, + "description": "Exploit-poc object describing a proof of concept or exploit of a vulnerability. This object has often a relationship with a vulnerability object.", + "meta-category": "vulnerability", + "name": "exploit-poc", "requiredOneOf": [ "vulnerable_configuration", "description", "poc" ], - "attributes": { - "description": { - "description": "Description of the exploit - proof of concept", - "ui-priority": 0, - "misp-attribute": "text" - }, - "vulnerable_configuration": { - "description": "The vulnerable configuration described in CPE format where the exploit/proof of concept is valid", - "multiple": true, - "ui-priority": 0, - "misp-attribute": "text" - }, - "author": { - "description": "Author of the exploit - proof of concept", - "ui-priority": 0, - "disable_correlation": true, - "misp-attribute": "text", - "multiple": true - }, - "references": { - "description": "External references", - "multiple": true, - "ui-priority": 0, - "misp-attribute": "link" - }, - "poc": { - "description": "Proof of Concept or exploit (as a script, binary or described process)", - "ui-priority": 0, - "misp-attribute": "attachment", - "disable_correlation": true, - "multiple": true - } - }, - "version": 2, - "description": "Exploit-poc object describing a proof of concept or exploit of a vulnerability. This object has often a relationship with a vulnerability object.", - "meta-category": "vulnerability", "uuid": "e3bdeef8-78c3-48d8-9c2f-1be5e5bde93b", - "name": "exploit-poc" -} + "version": 2 +} \ No newline at end of file diff --git a/objects/facial-composite/definition.json b/objects/facial-composite/definition.json index 585f4ee..997c339 100644 --- a/objects/facial-composite/definition.json +++ b/objects/facial-composite/definition.json @@ -1,19 +1,16 @@ { - "requiredOneOf": [ - "facial-composite", - "text" - ], "attributes": { - "text": { - "description": "A description of the facial composite.", - "disable_correlation": true, - "ui-priority": 1, - "misp-attribute": "text" + "facial-composite": { + "description": "Facial composite image.", + "misp-attribute": "attachment", + "multiple": true, + "ui-priority": 10 }, "technique": { "description": "Construction technique of the facial composite.", - "ui-priority": 0, + "disable_correlation": true, "misp-attribute": "text", + "ui-priority": 0, "values_list": [ "E-FIT", "PROfit", @@ -21,19 +18,22 @@ "Photofit", "EvoFIT", "PortraitPad" - ], - "disable_correlation": true + ] }, - "facial-composite": { - "description": "Facial composite image.", - "ui-priority": 10, - "misp-attribute": "attachment", - "multiple": true + "text": { + "description": "A description of the facial composite.", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 1 } }, - "version": 1, "description": "An object which describes a facial composite.", "meta-category": "misc", + "name": "facial-composite", + "requiredOneOf": [ + "facial-composite", + "text" + ], "uuid": "d727bc27-d1b9-4754-972c-dea305bd5976", - "name": "facial-composite" -} + "version": 1 +} \ No newline at end of file diff --git a/objects/fail2ban/definition.json b/objects/fail2ban/definition.json index 90b0151..3519740 100644 --- a/objects/fail2ban/definition.json +++ b/objects/fail2ban/definition.json @@ -1,61 +1,61 @@ { + "attributes": { + "attack-type": { + "description": "Type of the attack", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 1 + }, + "banned-ip": { + "description": "IP Address banned by fail2ban", + "misp-attribute": "ip-src", + "ui-priority": 1 + }, + "failures": { + "description": "Amount of failures that lead to the ban.", + "disable_correlation": true, + "misp-attribute": "counter", + "ui-priority": 1 + }, + "logfile": { + "description": "Full logfile related to the attack.", + "disable_correlation": true, + "misp-attribute": "attachment", + "ui-priority": 1 + }, + "logline": { + "description": "Example log line that caused the ban.", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 1 + }, + "processing-timestamp": { + "description": "Timestamp of the report", + "disable_correlation": true, + "misp-attribute": "datetime", + "ui-priority": 1 + }, + "sensor": { + "description": "Identifier of the sensor", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 1 + }, + "victim": { + "description": "Identifier of the victim", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 1 + } + }, + "description": "Fail2ban event", + "meta-category": "network", + "name": "fail2ban", "required": [ "banned-ip", "processing-timestamp", "attack-type" ], - "attributes": { - "banned-ip": { - "description": "IP Address banned by fail2ban", - "ui-priority": 1, - "misp-attribute": "ip-src" - }, - "processing-timestamp": { - "description": "Timestamp of the report", - "ui-priority": 1, - "misp-attribute": "datetime", - "disable_correlation": true - }, - "attack-type": { - "description": "Type of the attack", - "ui-priority": 1, - "misp-attribute": "text", - "disable_correlation": true - }, - "failures": { - "description": "Amount of failures that lead to the ban.", - "ui-priority": 1, - "misp-attribute": "counter", - "disable_correlation": true - }, - "sensor": { - "description": "Identifier of the sensor", - "ui-priority": 1, - "misp-attribute": "text", - "disable_correlation": true - }, - "victim": { - "description": "Identifier of the victim", - "ui-priority": 1, - "misp-attribute": "text", - "disable_correlation": true - }, - "logline": { - "description": "Example log line that caused the ban.", - "ui-priority": 1, - "misp-attribute": "text", - "disable_correlation": true - }, - "logfile": { - "description": "Full logfile related to the attack.", - "ui-priority": 1, - "misp-attribute": "attachment", - "disable_correlation": true - } - }, - "version": 5, - "description": "Fail2ban event", - "meta-category": "network", "uuid": "8be2271-7326-41a5-a0dd-9b4bec88e1ba", - "name": "fail2ban" -} + "version": 5 +} \ No newline at end of file diff --git a/objects/file/definition.json b/objects/file/definition.json index 07897ae..eed1408 100644 --- a/objects/file/definition.json +++ b/objects/file/definition.json @@ -1,185 +1,36 @@ { - "requiredOneOf": [ - "filename", - "size-in-bytes", - "authentihash", - "ssdeep", - "md5", - "sha1", - "sha224", - "sha256", - "sha384", - "sha512", - "sha512/224", - "sha512/256", - "tlsh", - "pattern-in-file", - "certificate", - "malware-sample", - "attachment", - "path", - "fullpath" - ], "attributes": { - "md5": { - "description": "[Insecure] MD5 hash (128 bits)", - "ui-priority": 1, - "misp-attribute": "md5", - "recommended": false - }, - "sha1": { - "description": "[Insecure] Secure Hash Algorithm 1 (160 bits)", - "ui-priority": 1, - "misp-attribute": "sha1", - "recommended": false - }, - "sha224": { - "description": "Secure Hash Algorithm 2 (224 bits)", - "ui-priority": 0, - "misp-attribute": "sha224", - "recommended": false - }, - "sha256": { - "description": "Secure Hash Algorithm 2 (256 bits)", - "ui-priority": 1, - "misp-attribute": "sha256" - }, - "sha384": { - "description": "Secure Hash Algorithm 2 (384 bits)", - "ui-priority": 0, - "misp-attribute": "sha384", - "recommended": false - }, - "sha512": { - "description": "Secure Hash Algorithm 2 (512 bits)", - "ui-priority": 1, - "misp-attribute": "sha512" - }, - "sha512/224": { - "description": "Secure Hash Algorithm 2 (224 bits)", - "ui-priority": 0, - "misp-attribute": "sha512/224", - "recommended": false - }, - "sha512/256": { - "description": "Secure Hash Algorithm 2 (256 bits)", - "ui-priority": 0, - "misp-attribute": "sha512/256", - "recommended": false - }, - "ssdeep": { - "description": "Fuzzy hash using context triggered piecewise hashes (CTPH)", - "ui-priority": 0, - "misp-attribute": "ssdeep" + "attachment": { + "description": "A non-malicious file.", + "misp-attribute": "attachment", + "ui-priority": 1 }, "authentihash": { "description": "Authenticode executable signature hash", - "ui-priority": 0, "misp-attribute": "authentihash", - "recommended": false + "recommended": false, + "ui-priority": 0 }, - "size-in-bytes": { - "description": "Size of the file, in bytes", - "disable_correlation": true, - "ui-priority": 0, - "misp-attribute": "size-in-bytes" + "certificate": { + "description": "Certificate value if the binary is signed with another authentication scheme than authenticode", + "misp-attribute": "x509-fingerprint-sha1", + "ui-priority": 0 + }, + "compilation-timestamp": { + "description": "Compilation timestamp", + "misp-attribute": "datetime", + "ui-priority": 0 }, "entropy": { "description": "Entropy of the whole file", "disable_correlation": true, - "ui-priority": 1, - "misp-attribute": "float" - }, - "pattern-in-file": { - "description": "Pattern that can be found in the file", - "categories": [ - "Artifacts dropped", - "Payload installation", - "External analysis" - ], - "ui-priority": 1, - "misp-attribute": "pattern-in-file", - "multiple": true - }, - "text": { - "description": "Free text value to attach to the file", - "disable_correlation": true, - "ui-priority": 1, - "misp-attribute": "text", - "recommended": false - }, - "malware-sample": { - "description": "The file itself (binary)", - "ui-priority": 1, - "misp-attribute": "malware-sample" - }, - "attachment": { - "description": "A non-malicious file.", - "ui-priority": 1, - "misp-attribute": "attachment" - }, - "filename": { - "description": "Filename on disk", - "disable_correlation": true, - "multiple": true, - "categories": [ - "Payload delivery", - "Artifacts dropped", - "Payload installation", - "External analysis" - ], - "ui-priority": 1, - "misp-attribute": "filename" - }, - "path": { - "description": "Path of the filename complete or partial", - "disable_correlation": true, - "multiple": true, - "ui-priority": 0, - "misp-attribute": "text" - }, - "fullpath": { - "description": "Complete path of the filename including the filename", - "multiple": true, - "ui-priority": 0, - "misp-attribute": "text" - }, - "tlsh": { - "description": "Fuzzy hash by Trend Micro: Locality Sensitive Hash", - "ui-priority": 0, - "misp-attribute": "tlsh" - }, - "certificate": { - "description": "Certificate value if the binary is signed with another authentication scheme than authenticode", - "ui-priority": 0, - "misp-attribute": "x509-fingerprint-sha1" - }, - "mimetype": { - "description": "Mime type", - "disable_correlation": true, - "ui-priority": 0, - "misp-attribute": "mime-type" - }, - "state": { - "misp-attribute": "text", - "ui-priority": 0, - "description": "State of the file", - "multiple": true, - "disable_correlation": true, - "values_list": [ - "Malicious", - "Harmless", - "Signed", - "Revoked", - "Expired", - "Trusted" - ] + "misp-attribute": "float", + "ui-priority": 1 }, "file-encoding": { - "misp-attribute": "text", - "ui-priority": 0, "description": "Encoding format of the file", "disable_correlation": true, + "misp-attribute": "text", "sane_default": [ "Adobe-Standard-Encoding", "Adobe-Symbol-Encoding", @@ -439,17 +290,166 @@ "windows-1258", "Windows-31J", "windows-874" + ], + "ui-priority": 0 + }, + "filename": { + "categories": [ + "Payload delivery", + "Artifacts dropped", + "Payload installation", + "External analysis" + ], + "description": "Filename on disk", + "disable_correlation": true, + "misp-attribute": "filename", + "multiple": true, + "ui-priority": 1 + }, + "fullpath": { + "description": "Complete path of the filename including the filename", + "misp-attribute": "text", + "multiple": true, + "ui-priority": 0 + }, + "malware-sample": { + "description": "The file itself (binary)", + "misp-attribute": "malware-sample", + "ui-priority": 1 + }, + "md5": { + "description": "[Insecure] MD5 hash (128 bits)", + "misp-attribute": "md5", + "recommended": false, + "ui-priority": 1 + }, + "mimetype": { + "description": "Mime type", + "disable_correlation": true, + "misp-attribute": "mime-type", + "ui-priority": 0 + }, + "path": { + "description": "Path of the filename complete or partial", + "disable_correlation": true, + "misp-attribute": "text", + "multiple": true, + "ui-priority": 0 + }, + "pattern-in-file": { + "categories": [ + "Artifacts dropped", + "Payload installation", + "External analysis" + ], + "description": "Pattern that can be found in the file", + "misp-attribute": "pattern-in-file", + "multiple": true, + "ui-priority": 1 + }, + "sha1": { + "description": "[Insecure] Secure Hash Algorithm 1 (160 bits)", + "misp-attribute": "sha1", + "recommended": false, + "ui-priority": 1 + }, + "sha224": { + "description": "Secure Hash Algorithm 2 (224 bits)", + "misp-attribute": "sha224", + "recommended": false, + "ui-priority": 0 + }, + "sha256": { + "description": "Secure Hash Algorithm 2 (256 bits)", + "misp-attribute": "sha256", + "ui-priority": 1 + }, + "sha384": { + "description": "Secure Hash Algorithm 2 (384 bits)", + "misp-attribute": "sha384", + "recommended": false, + "ui-priority": 0 + }, + "sha512": { + "description": "Secure Hash Algorithm 2 (512 bits)", + "misp-attribute": "sha512", + "ui-priority": 1 + }, + "sha512/224": { + "description": "Secure Hash Algorithm 2 (224 bits)", + "misp-attribute": "sha512/224", + "recommended": false, + "ui-priority": 0 + }, + "sha512/256": { + "description": "Secure Hash Algorithm 2 (256 bits)", + "misp-attribute": "sha512/256", + "recommended": false, + "ui-priority": 0 + }, + "size-in-bytes": { + "description": "Size of the file, in bytes", + "disable_correlation": true, + "misp-attribute": "size-in-bytes", + "ui-priority": 0 + }, + "ssdeep": { + "description": "Fuzzy hash using context triggered piecewise hashes (CTPH)", + "misp-attribute": "ssdeep", + "ui-priority": 0 + }, + "state": { + "description": "State of the file", + "disable_correlation": true, + "misp-attribute": "text", + "multiple": true, + "ui-priority": 0, + "values_list": [ + "Malicious", + "Harmless", + "Signed", + "Revoked", + "Expired", + "Trusted" ] }, - "compilation-timestamp": { - "description": "Compilation timestamp", - "ui-priority": 0, - "misp-attribute": "datetime" + "text": { + "description": "Free text value to attach to the file", + "disable_correlation": true, + "misp-attribute": "text", + "recommended": false, + "ui-priority": 1 + }, + "tlsh": { + "description": "Fuzzy hash by Trend Micro: Locality Sensitive Hash", + "misp-attribute": "tlsh", + "ui-priority": 0 } }, - "version": 20, "description": "File object describing a file with meta-information", "meta-category": "file", + "name": "file", + "requiredOneOf": [ + "filename", + "size-in-bytes", + "authentihash", + "ssdeep", + "md5", + "sha1", + "sha224", + "sha256", + "sha384", + "sha512", + "sha512/224", + "sha512/256", + "tlsh", + "pattern-in-file", + "certificate", + "malware-sample", + "attachment", + "path", + "fullpath" + ], "uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", - "name": "file" -} + "version": 20 +} \ No newline at end of file diff --git a/objects/forensic-case/definition.json b/objects/forensic-case/definition.json index a15b7c2..da0b805 100644 --- a/objects/forensic-case/definition.json +++ b/objects/forensic-case/definition.json @@ -1,47 +1,47 @@ { - "requiredOneOf": [ - "case-number" - ], "attributes": { - "case-number": { - "description": "Any unique number assigned to the case for unique identification.", - "ui-priority": 0, - "misp-attribute": "text" - }, - "case-name": { - "description": "Name to address the case.", - "ui-priority": 0, - "misp-attribute": "text" - }, - "name-of-the-analyst": { - "description": "Name(s) of the analyst assigned to the case.", - "multiple": true, - "ui-priority": 0, + "additional-comments": { + "description": "Comments.", + "disable_correlation": true, "misp-attribute": "text", - "disable_correlation": true - }, - "references": { - "description": "External references", - "multiple": true, - "ui-priority": 0, - "misp-attribute": "link" + "ui-priority": 0 }, "analysis-start-date": { "description": "Date when the analysis began.", - "ui-priority": 0, + "disable_correlation": true, "misp-attribute": "datetime", - "disable_correlation": true + "ui-priority": 0 }, - "additional-comments": { - "description": "Comments.", - "ui-priority": 0, + "case-name": { + "description": "Name to address the case.", "misp-attribute": "text", - "disable_correlation": true + "ui-priority": 0 + }, + "case-number": { + "description": "Any unique number assigned to the case for unique identification.", + "misp-attribute": "text", + "ui-priority": 0 + }, + "name-of-the-analyst": { + "description": "Name(s) of the analyst assigned to the case.", + "disable_correlation": true, + "misp-attribute": "text", + "multiple": true, + "ui-priority": 0 + }, + "references": { + "description": "External references", + "misp-attribute": "link", + "multiple": true, + "ui-priority": 0 } }, - "version": 1, "description": "An object template to describe a digital forensic case.", "meta-category": "misc", + "name": "forensic-case", + "requiredOneOf": [ + "case-number" + ], "uuid": "3ea36022-ae93-455e-88b1-d43aca789cac", - "name": "forensic-case" -} + "version": 1 +} \ No newline at end of file diff --git a/objects/forensic-evidence/definition.json b/objects/forensic-evidence/definition.json index 95e5398..5188280 100644 --- a/objects/forensic-evidence/definition.json +++ b/objects/forensic-evidence/definition.json @@ -1,43 +1,8 @@ { - "required": [ - "case-number", - "evidence-number" - ], "attributes": { - "case-number": { - "description": "A unique number assigned to the case for unique identification.", - "ui-priority": 0, - "misp-attribute": "text" - }, - "evidence-number": { - "description": "A unique number assigned to the evidence for unique identification.", - "ui-priority": 0, - "misp-attribute": "text" - }, - "type": { - "description": "Evidence type.", - "multiple": true, - "ui-priority": 0, - "misp-attribute": "text", - "sane_default": [ - "Computer", - "Network", - "Mobile Device", - "Multimedia", - "Cloud", - "IoT", - "Other" - ], - "disable_correlation": true - }, - "name": { - "description": "Name of the evidence acquired.", - "ui-priority": 0, - "misp-attribute": "text" - }, "acquisition-method": { "description": "Method used for acquisition of the evidence.", - "ui-priority": 0, + "disable_correlation": true, "misp-attribute": "text", "sane_default": [ "Live acquisition", @@ -48,11 +13,11 @@ "Chip-off", "Other" ], - "disable_correlation": true + "ui-priority": 0 }, "acquisition-tools": { "description": "Tools used for acquisition of the evidence.", - "ui-priority": 0, + "disable_correlation": true, "misp-attribute": "text", "multiple": true, "sane_default": [ @@ -67,24 +32,59 @@ "IXimager", "Other" ], - "disable_correlation": true - }, - "references": { - "description": "External references", - "multiple": true, - "ui-priority": 0, - "misp-attribute": "link" + "ui-priority": 0 }, "additional-comments": { "description": "Comments.", - "ui-priority": 0, + "disable_correlation": true, "misp-attribute": "text", - "disable_correlation": true + "ui-priority": 0 + }, + "case-number": { + "description": "A unique number assigned to the case for unique identification.", + "misp-attribute": "text", + "ui-priority": 0 + }, + "evidence-number": { + "description": "A unique number assigned to the evidence for unique identification.", + "misp-attribute": "text", + "ui-priority": 0 + }, + "name": { + "description": "Name of the evidence acquired.", + "misp-attribute": "text", + "ui-priority": 0 + }, + "references": { + "description": "External references", + "misp-attribute": "link", + "multiple": true, + "ui-priority": 0 + }, + "type": { + "description": "Evidence type.", + "disable_correlation": true, + "misp-attribute": "text", + "multiple": true, + "sane_default": [ + "Computer", + "Network", + "Mobile Device", + "Multimedia", + "Cloud", + "IoT", + "Other" + ], + "ui-priority": 0 } }, - "version": 2, "description": "An object template to describe a digital forensic evidence.", "meta-category": "misc", + "name": "forensic-evidence", + "required": [ + "case-number", + "evidence-number" + ], "uuid": "fe44c648-63ef-43fc-b3de-af71a2e023e4", - "name": "forensic-evidence" -} + "version": 2 +} \ No newline at end of file diff --git a/objects/forged-document/definition.json b/objects/forged-document/definition.json index f8a8f7a..2acefd1 100644 --- a/objects/forged-document/definition.json +++ b/objects/forged-document/definition.json @@ -1,34 +1,30 @@ { - "requiredOneOf": [ - "document-name", - "attachment", - "document-text" - ], "attributes": { - "purpose-of-document": { - "description": "What the document is used for.", - "ui-priority": 1, - "misp-attribute": "text", - "disable_correlation": true, + "archive": { + "description": "Archive of the original document (Internet Archive, Archive.is, etc).", + "misp-attribute": "link", "multiple": true, - "sane_default": [ - "Identification", - "Travel", - "Health", - "Legal", - "Financial", - "Government", - "Military", - "Media", - "Communication", - "Other" - ] + "ui-priority": 1 + }, + "attachment": { + "description": "The forged document file.", + "misp-attribute": "attachment", + "ui-priority": 1 + }, + "document-name": { + "description": "Title of the document.", + "misp-attribute": "text", + "ui-priority": 0 + }, + "document-text": { + "description": "Raw text of document", + "misp-attribute": "text", + "ui-priority": 1 }, "document-type": { "description": "The type of document (not the file type).", - "ui-priority": 1, - "misp-attribute": "text", "disable_correlation": true, + "misp-attribute": "text", "multiple": true, "sane_default": [ "email", @@ -42,68 +38,72 @@ "invoice", "receipt", "other" - ] + ], + "ui-priority": 1 }, - "attachment": { - "description": "The forged document file.", - "ui-priority": 1, - "misp-attribute": "attachment" + "first-seen": { + "description": "When the document has been accessible or seen for the first time.", + "disable_correlation": true, + "misp-attribute": "datetime", + "ui-priority": 0 }, - "document-name": { - "misp-attribute": "text", - "ui-priority": 0, - "description": "Title of the document." - }, - "document-text": { - "description": "Raw text of document", - "ui-priority": 1, - "misp-attribute": "text" - }, - "url": { - "description": "Original URL location of the document (potentially malicious)", - "ui-priority": 1, - "misp-attribute": "url" + "last-seen": { + "description": "When the document has been accessible or seen for the last time.", + "disable_correlation": true, + "misp-attribute": "datetime", + "ui-priority": 0 }, "link": { "description": "Original link into the document (Supposed harmless)", - "ui-priority": 1, - "misp-attribute": "link" - }, - "archive": { - "description": "Archive of the original document (Internet Archive, Archive.is, etc).", - "ui-priority": 1, - "multiple": true, - "misp-attribute": "link" + "misp-attribute": "link", + "ui-priority": 1 }, "objective": { "description": "Objective of the forged document.", - "ui-priority": 1, - "misp-attribute": "text", "disable_correlation": true, + "misp-attribute": "text", "multiple": true, "sane_default": [ "Disinformation", "Advertising", "Parody", "Other" - ] + ], + "ui-priority": 1 }, - "last-seen": { - "description": "When the document has been accessible or seen for the last time.", + "purpose-of-document": { + "description": "What the document is used for.", "disable_correlation": true, - "ui-priority": 0, - "misp-attribute": "datetime" + "misp-attribute": "text", + "multiple": true, + "sane_default": [ + "Identification", + "Travel", + "Health", + "Legal", + "Financial", + "Government", + "Military", + "Media", + "Communication", + "Other" + ], + "ui-priority": 1 }, - "first-seen": { - "description": "When the document has been accessible or seen for the first time.", - "disable_correlation": true, - "ui-priority": 0, - "misp-attribute": "datetime" + "url": { + "description": "Original URL location of the document (potentially malicious)", + "misp-attribute": "url", + "ui-priority": 1 } }, - "version": 7, "description": "Object describing a forged document.", "meta-category": "file", + "name": "forged-document", + "requiredOneOf": [ + "document-name", + "attachment", + "document-text" + ], "uuid": "7e927620-b97c-4b00-98c0-8c0184d83d21", - "name": "forged-document" -} + "version": 7 +} \ No newline at end of file diff --git a/objects/geolocation/definition.json b/objects/geolocation/definition.json index f0d2a33..8de5984 100644 --- a/objects/geolocation/definition.json +++ b/objects/geolocation/definition.json @@ -1,80 +1,27 @@ { - "requiredOneOf": [ - "latitude", - "longitude", - "city", - "region", - "country", - "epsg" - ], "attributes": { - "first-seen": { - "description": "When the location was seen for the first time.", + "accuracy-radius": { + "description": "The approximate accuracy radius, in kilometers, around the latitude and longitude for the geographical entity (country, subdivision, city or postal code) associated with the related object. (based on geoip2 accuracy of maxmind)", "disable_correlation": true, - "ui-priority": 0, - "misp-attribute": "datetime" - }, - "last-seen": { - "description": "When the location was seen for the last time.", - "disable_correlation": true, - "ui-priority": 0, - "misp-attribute": "datetime" - }, - "text": { - "description": "A generic description of the location.", - "disable_correlation": true, - "ui-priority": 1, - "misp-attribute": "text" - }, - "latitude": { - "description": "The latitude is the decimal value of the latitude in the World Geodetic System 84 (WGS84) reference.", - "disable_correlation": true, - "ui-priority": 90, - "misp-attribute": "float" - }, - "longitude": { - "description": "The longitude is the decimal value of the longitude in the World Geodetic System 84 (WGS84) reference", - "disable_correlation": true, - "ui-priority": 89, - "misp-attribute": "float" - }, - "altitude": { - "description": "The altitude is the decimal value of the altitude in the World Geodetic System 84 (WGS84) reference.", - "ui-priority": 0, "misp-attribute": "float", - "disable_correlation": true + "ui-priority": 1 }, "address": { "description": "Address.", "misp-attribute": "text", "ui-priority": 1 }, - "neighborhood": { - "description": "Neighborhood.", - "misp-attribute": "text", - "ui-priority": 1 - }, - "zipcode": { - "description": "Zip Code.", - "misp-attribute": "text", - "ui-priority": 1 + "altitude": { + "description": "The altitude is the decimal value of the altitude in the World Geodetic System 84 (WGS84) reference.", + "disable_correlation": true, + "misp-attribute": "float", + "ui-priority": 0 }, "city": { "description": "City.", "misp-attribute": "text", "ui-priority": 1 }, - "region": { - "description": "Region.", - "misp-attribute": "text", - "ui-priority": 1 - }, - "accuracy-radius": { - "description": "The approximate accuracy radius, in kilometers, around the latitude and longitude for the geographical entity (country, subdivision, city or postal code) associated with the related object. (based on geoip2 accuracy of maxmind)", - "misp-attribute": "float", - "ui-priority": 1, - "disable_correlation": true - }, "country": { "description": "Country.", "misp-attribute": "text", @@ -82,24 +29,77 @@ }, "epsg": { "description": "EPSG Geodetic Parameter value. This is an integer value of the EPSG.", + "disable_correlation": true, "misp-attribute": "text", - "ui-priority": 70, - "disable_correlation": true + "ui-priority": 70 + }, + "first-seen": { + "description": "When the location was seen for the first time.", + "disable_correlation": true, + "misp-attribute": "datetime", + "ui-priority": 0 + }, + "last-seen": { + "description": "When the location was seen for the last time.", + "disable_correlation": true, + "misp-attribute": "datetime", + "ui-priority": 0 + }, + "latitude": { + "description": "The latitude is the decimal value of the latitude in the World Geodetic System 84 (WGS84) reference.", + "disable_correlation": true, + "misp-attribute": "float", + "ui-priority": 90 + }, + "longitude": { + "description": "The longitude is the decimal value of the longitude in the World Geodetic System 84 (WGS84) reference", + "disable_correlation": true, + "misp-attribute": "float", + "ui-priority": 89 + }, + "neighborhood": { + "description": "Neighborhood.", + "misp-attribute": "text", + "ui-priority": 1 + }, + "region": { + "description": "Region.", + "misp-attribute": "text", + "ui-priority": 1 }, "spacial-reference": { "description": "Default spacial or projection refence for this object.", + "disable_correlation": true, "misp-attribute": "text", "ui-priority": 1, - "disable_correlation": true, "values_list": [ "WGS84 EPSG:4326", "Mercator EPSG:3857" ] + }, + "text": { + "description": "A generic description of the location.", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 1 + }, + "zipcode": { + "description": "Zip Code.", + "misp-attribute": "text", + "ui-priority": 1 } }, - "version": 5, "description": "An object to describe a geographic location.", "meta-category": "misc", + "name": "geolocation", + "requiredOneOf": [ + "latitude", + "longitude", + "city", + "region", + "country", + "epsg" + ], "uuid": "fdd30d5f-6752-45ed-bef2-25e8ce4d8a3", - "name": "geolocation" -} + "version": 5 +} \ No newline at end of file diff --git a/objects/gtp-attack/definition.json b/objects/gtp-attack/definition.json index 6f6cc78..36af16e 100644 --- a/objects/gtp-attack/definition.json +++ b/objects/gtp-attack/definition.json @@ -1,24 +1,10 @@ { - "requiredOneOf": [ - "text" - ], "attributes": { - "GtpServingNetwork": { - "description": "GTP Serving Network.", - "misp-attribute": "text", - "disable_correlation": true, - "ui-priority": 1 - }, "GtpImei": { "description": "GTP IMEI (International Mobile Equipment Identity).", "misp-attribute": "text", "ui-priority": 1 }, - "GtpMsisdn": { - "description": "GTP MSISDN.", - "misp-attribute": "text", - "ui-priority": 1 - }, "GtpImsi": { "description": "GTP IMSI (International mobile subscriber identity).", "misp-attribute": "text", @@ -26,6 +12,9 @@ }, "GtpInterface": { "description": "GTP interface.", + "disable_correlation": true, + "misp-attribute": "text", + "multiple": true, "sane_default": [ "S5", "S11", @@ -34,9 +23,6 @@ "Gn", "Gp" ], - "misp-attribute": "text", - "disable_correlation": true, - "multiple": true, "ui-priority": 1 }, "GtpMessageType": { @@ -45,6 +31,28 @@ "misp-attribute": "text", "ui-priority": 1 }, + "GtpMsisdn": { + "description": "GTP MSISDN.", + "misp-attribute": "text", + "ui-priority": 1 + }, + "GtpServingNetwork": { + "description": "GTP Serving Network.", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 1 + }, + "GtpVersion": { + "description": "GTP version", + "disable_correlation": true, + "misp-attribute": "text", + "sane_default": [ + "0", + "1", + "2" + ], + "ui-priority": 0 + }, "PortDest": { "description": "Destination port.", "disable_correlation": true, @@ -57,6 +65,12 @@ "misp-attribute": "port", "ui-priority": 0 }, + "first-seen": { + "description": "When the attack has been seen for the first time.", + "disable_correlation": true, + "misp-attribute": "datetime", + "ui-priority": 0 + }, "ipDest": { "description": "IP destination address.", "misp-attribute": "ip-dst", @@ -67,33 +81,19 @@ "misp-attribute": "ip-src", "ui-priority": 0 }, - "GtpVersion": { - "description": "GTP version", - "sane_default": [ - "0", - "1", - "2" - ], - "misp-attribute": "text", - "disable_correlation": true, - "ui-priority": 0 - }, "text": { "description": "A description of the GTP attack.", "disable_correlation": true, - "ui-priority": 0, - "misp-attribute": "text" - }, - "first-seen": { - "description": "When the attack has been seen for the first time.", - "disable_correlation": true, - "ui-priority": 0, - "misp-attribute": "datetime" + "misp-attribute": "text", + "ui-priority": 0 } }, - "version": 3, "description": "GTP attack object as seen on a GSM, UMTS or LTE network", "meta-category": "network", + "name": "gtp-attack", + "requiredOneOf": [ + "text" + ], "uuid": "6b3c48d2-0ca6-4608-9c36-455105439145", - "name": "gtp-attack" -} + "version": 3 +} \ No newline at end of file diff --git a/objects/http-request/definition.json b/objects/http-request/definition.json index c538392..0206d0c 100644 --- a/objects/http-request/definition.json +++ b/objects/http-request/definition.json @@ -1,56 +1,46 @@ { - "requiredOneOf": [ - "url", - "uri" - ], "attributes": { - "text": { - "description": "HTTP Request comment", - "disable_correlation": true, - "ui-priority": 1, - "misp-attribute": "text" - }, "basicauth-password": { "categories": [ "Network activity" ], "description": "HTTP Basic Authentication Password", - "ui-priority": 1, - "misp-attribute": "text" + "misp-attribute": "text", + "ui-priority": 1 }, "basicauth-user": { "categories": [ "Network activity" ], "description": "HTTP Basic Authentication Username", - "ui-priority": 1, - "misp-attribute": "text" + "misp-attribute": "text", + "ui-priority": 1 }, "content-type": { "categories": [ "Network activity" ], "description": "The MIME type of the body of the request", - "ui-priority": 1, - "misp-attribute": "other" + "misp-attribute": "other", + "ui-priority": 1 }, "cookie": { "categories": [ "Network activity" ], "description": "An HTTP cookie previously sent by the server with Set-Cookie", - "ui-priority": 1, "misp-attribute": "text", - "multiple": true + "multiple": true, + "ui-priority": 1 }, "header": { "categories": [ "Network activity" ], "description": "An HTTP header sent during HTTP request", - "ui-priority": 1, "misp-attribute": "text", - "multiple": true + "multiple": true, + "ui-priority": 1 }, "host": { "categories": [ @@ -58,8 +48,8 @@ "Payload delivery" ], "description": "The domain name of the server", - "ui-priority": 1, - "misp-attribute": "hostname" + "misp-attribute": "hostname", + "ui-priority": 1 }, "ip-dst": { "categories": [ @@ -67,8 +57,8 @@ "Payload delivery" ], "description": "The IP address of the server", - "ui-priority": 1, - "misp-attribute": "ip-dst" + "misp-attribute": "ip-dst", + "ui-priority": 1 }, "ip-src": { "categories": [ @@ -76,8 +66,8 @@ "Payload delivery" ], "description": "The IP address of the client", - "ui-priority": 1, - "misp-attribute": "ip-src" + "misp-attribute": "ip-src", + "ui-priority": 1 }, "method": { "categories": [ @@ -85,8 +75,24 @@ ], "description": "HTTP Method invoked (one of GET, POST, PUT, HEAD, DELETE, OPTIONS, CONNECT)", "disable_correlation": true, - "ui-priority": 1, - "misp-attribute": "http-method" + "misp-attribute": "http-method", + "ui-priority": 1 + }, + "proxy-password": { + "categories": [ + "Network activity" + ], + "description": "HTTP Proxy Password", + "misp-attribute": "text", + "ui-priority": 1 + }, + "proxy-user": { + "categories": [ + "Network activity" + ], + "description": "HTTP Proxy Username", + "misp-attribute": "text", + "ui-priority": 1 }, "referer": { "categories": [ @@ -94,32 +100,22 @@ "Payload delivery" ], "description": "This is the address of the previous web page from which a link to the currently requested page was followed", - "ui-priority": 1, - "misp-attribute": "other" + "misp-attribute": "other", + "ui-priority": 1 }, - "proxy-password": { - "categories": [ - "Network activity" - ], - "description": "HTTP Proxy Password", - "ui-priority": 1, - "misp-attribute": "text" - }, - "proxy-user": { - "categories": [ - "Network activity" - ], - "description": "HTTP Proxy Username", - "ui-priority": 1, - "misp-attribute": "text" + "text": { + "description": "HTTP Request comment", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 1 }, "uri": { "categories": [ "Network activity" ], "description": "Request URI", - "ui-priority": 1, - "misp-attribute": "uri" + "misp-attribute": "uri", + "ui-priority": 1 }, "url": { "categories": [ @@ -127,21 +123,25 @@ "Payload delivery" ], "description": "Full HTTP Request URL", - "ui-priority": 1, - "misp-attribute": "url" + "misp-attribute": "url", + "ui-priority": 1 }, "user-agent": { "categories": [ "Network activity" ], "description": "The user agent string of the user agent", - "ui-priority": 1, - "misp-attribute": "user-agent" + "misp-attribute": "user-agent", + "ui-priority": 1 } }, - "version": 4, "description": "A single HTTP request header", "meta-category": "network", + "name": "http-request", + "requiredOneOf": [ + "url", + "uri" + ], "uuid": "b4a8d163-8110-4239-bfcf-e08f3a9fdf7b", - "name": "http-request" -} + "version": 4 +} \ No newline at end of file diff --git a/objects/ilr-impact/definition.json b/objects/ilr-impact/definition.json index 4529a06..87562de 100644 --- a/objects/ilr-impact/definition.json +++ b/objects/ilr-impact/definition.json @@ -1,43 +1,43 @@ { - "required": [ - "service" - ], "attributes": { - "service": { + "duree": { + "description": "Duree de l'incident en hh : mm", + "disable_correlation": true, "misp-attribute": "text", - "ui-priority": 0, + "ui-priority": 0 + }, + "nombre-utilisateurs-touches": { + "description": "Nombre d’utilisateurs touches par l'incident", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 0 + }, + "pourcentage-utilisateurs-touches": { + "description": "Pourcentage d'utilisateurs du service touches par l'incident", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 0 + }, + "service": { "description": "Service impacte par l'incident", "disable_correlation": true, + "misp-attribute": "text", "multiple": true, "sane_default": [ "Telephonie fixe", "Acces Internet fixe", "Telephonie mobile", "Acces Internet mobile" - ] - }, - "nombre-utilisateurs-touches": { - "description": "Nombre d’utilisateurs touches par l'incident", - "ui-priority": 0, - "disable_correlation": true, - "misp-attribute": "text" - }, - "pourcentage-utilisateurs-touches": { - "description": "Pourcentage d'utilisateurs du service touches par l'incident", - "ui-priority": 0, - "disable_correlation": true, - "misp-attribute": "text" - }, - "duree": { - "description": "Duree de l'incident en hh : mm", - "ui-priority": 0, - "disable_correlation": true, - "misp-attribute": "text" + ], + "ui-priority": 0 } }, - "version": 1, "description": "Institut Luxembourgeois de Regulation - Impact", "meta-category": "misc", + "name": "ilr-impact", + "required": [ + "service" + ], "uuid": "b995af48-39b2-11e9-b2ab-b77adfee75d1", - "name": "ilr-impact" -} + "version": 1 +} \ No newline at end of file diff --git a/objects/ilr-notification-incident/definition.json b/objects/ilr-notification-incident/definition.json index 1dde3d2..11311e4 100644 --- a/objects/ilr-notification-incident/definition.json +++ b/objects/ilr-notification-incident/definition.json @@ -3,65 +3,32 @@ "Nom entreprise": { "description": "Nom de l’entreprise notifiee", "disable_correlation": true, - "ui-priority": 0, - "misp-attribute": "text" - }, - "date-incident": { - "description": "Date/heure de la detection de l’incident:", - "disable_correlation": true, - "ui-priority": 0, - "misp-attribute": "datetime" - }, - "date-pre-notification": { - "description": "Date de la pre-notification", - "disable_correlation": true, - "ui-priority": 0, - "misp-attribute": "text" - }, - "impact-servicesw-urgence": { - "description": "Services d’urgences impactes ?", - "disable_correlation": true, - "ui-priority": 0, "misp-attribute": "text", - "values_list": [ - "Oui", - "Non" - ] + "ui-priority": 0 }, - "description-probleme-services-urgence": { - "description": "Description du probleme sur les services d’urgences impactes", + "actions-corrective": { + "description": "Actions correctives a long terme", "disable_correlation": true, - "ui-priority": 0, - "misp-attribute": "text" - }, - "delimitation-geographique": { - "description": "Delimitation geographique", - "disable_correlation": true, - "ui-priority": 0, "misp-attribute": "text", - "values_list": [ - "Nationale", - "Regionale" - ] + "ui-priority": 0 }, - "zone-impactee": { - "description": "zones/communes/villes impactees ", + "actions-posterieur": { + "description": "Actions posterieures de l’incident pour minimiser le risque ", "disable_correlation": true, - "ui-priority": 0, - "multiple": true, - "misp-attribute": "text" + "misp-attribute": "text", + "ui-priority": 0 }, - "details-service": { - "description": "Details relatifs au service concerne et a l’impact de l’incident", + "autres-informations": { + "description": "Autres informations concernant la nature de l’incident notamment la liste des actifs affectes et les causes subsequentes eventuelles, declenches par la cause initiale ", "disable_correlation": true, - "ui-priority": 0, - "misp-attribute": "text" + "misp-attribute": "text", + "ui-priority": 0 }, "cause-initiale-incident": { "description": "Cause initiale de l'incident", "disable_correlation": true, - "ui-priority": 0, "misp-attribute": "text", + "ui-priority": 0, "values_list": [ "rreur humaine", "Defaut systeme 'hardware', 'software', 'procedures'", @@ -70,70 +37,103 @@ "Catastrophe naturelle" ] }, - "autres-informations": { - "description": "Autres informations concernant la nature de l’incident notamment la liste des actifs affectes et les causes subsequentes eventuelles, declenches par la cause initiale ", + "date-incident": { + "description": "Date/heure de la detection de l’incident:", "disable_correlation": true, + "misp-attribute": "datetime", + "ui-priority": 0 + }, + "date-pre-notification": { + "description": "Date de la pre-notification", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 0 + }, + "delimitation-geographique": { + "description": "Delimitation geographique", + "disable_correlation": true, + "misp-attribute": "text", "ui-priority": 0, - "misp-attribute": "text" + "values_list": [ + "Nationale", + "Regionale" + ] }, "description-incident": { "description": "Description generale de l’incident", "disable_correlation": true, - "ui-priority": 0, - "misp-attribute": "text" + "misp-attribute": "text", + "ui-priority": 0 }, - "traitement-incident": { - "description": "Traitement de l’incident et actions effectuees en ordre chronologique", + "description-probleme-services-urgence": { + "description": "Description du probleme sur les services d’urgences impactes", "disable_correlation": true, - "ui-priority": 0, - "misp-attribute": "text" + "misp-attribute": "text", + "ui-priority": 0 }, - "actions-posterieur": { - "description": "Actions posterieures de l’incident pour minimiser le risque ", + "details-service": { + "description": "Details relatifs au service concerne et a l’impact de l’incident", "disable_correlation": true, - "ui-priority": 0, - "misp-attribute": "text" - }, - "interconnections-affectees": { - "description": "Interconnections nationales et/ou internationales affectees", - "disable_correlation": true, - "ui-priority": 0, - "misp-attribute": "text" - }, - "actions-corrective": { - "description": "Actions correctives a long terme", - "disable_correlation": true, - "ui-priority": 0, - "misp-attribute": "text" - }, - "remarques": { - "description": "Remarque(s), notamment les experiences gagnees et les leçons tirees de l’incident", - "disable_correlation": true, - "ui-priority": 0, - "misp-attribute": "text" - }, - "nom-contact-incident": { - "description": "Nom de la personne de contact en rapport avec l’incident", - "disable_correlation": true, - "ui-priority": 0, - "misp-attribute": "text" - }, - "telephone-contact-incident": { - "description": "Telephone de la personne de contact en rapport avec l’incident", - "disable_correlation": true, - "ui-priority": 0, - "misp-attribute": "text" + "misp-attribute": "text", + "ui-priority": 0 }, "email-contact-incident": { "description": "Email de la personne de contact en rapport avec l’incident", "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 0 + }, + "impact-servicesw-urgence": { + "description": "Services d’urgences impactes ?", + "disable_correlation": true, + "misp-attribute": "text", "ui-priority": 0, - "misp-attribute": "text" + "values_list": [ + "Oui", + "Non" + ] + }, + "interconnections-affectees": { + "description": "Interconnections nationales et/ou internationales affectees", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 0 + }, + "nom-contact-incident": { + "description": "Nom de la personne de contact en rapport avec l’incident", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 0 + }, + "remarques": { + "description": "Remarque(s), notamment les experiences gagnees et les leçons tirees de l’incident", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 0 + }, + "telephone-contact-incident": { + "description": "Telephone de la personne de contact en rapport avec l’incident", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 0 + }, + "traitement-incident": { + "description": "Traitement de l’incident et actions effectuees en ordre chronologique", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 0 + }, + "zone-impactee": { + "description": "zones/communes/villes impactees ", + "disable_correlation": true, + "misp-attribute": "text", + "multiple": true, + "ui-priority": 0 } }, - "version": 1, "description": "Institut Luxembourgeois de Regulation - Notification d'incident", "meta-category": "misc", + "name": "ilr-notification-incident", "uuid": "b8ade604-39b2-11e9-b753-1fd28d3b612c", - "name": "ilr-notification-incident" -} + "version": 1 +} \ No newline at end of file diff --git a/objects/impersonation/definition.json b/objects/impersonation/definition.json index 78a35b5..6b80914 100644 --- a/objects/impersonation/definition.json +++ b/objects/impersonation/definition.json @@ -1,10 +1,61 @@ { "attributes": { + "account-name": { + "description": "Name of the impersonating account", + "misp-attribute": "text", + "ui-priority": 1 + }, + "account-url": { + "description": "url of the impersonating account", + "misp-attribute": "url", + "ui-priority": 1 + }, + "impersonated-account-name": { + "description": "Name of the impersonated account", + "misp-attribute": "text", + "ui-priority": 1 + }, + "impersonated-account-url": { + "description": "url of the impersonated account", + "misp-attribute": "link", + "ui-priority": 1 + }, + "objective": { + "description": "Objective of the impersonation", + "disable_correlation": true, + "misp-attribute": "text", + "multiple": true, + "sane_default": [ + "Information stealing", + "Disinformation", + "Distrusting", + "Advertising", + "Parody", + "Other" + ], + "ui-priority": 1 + }, + "real-name": { + "description": "Real name of the impersonated person or entity", + "misp-attribute": "text", + "ui-priority": 1 + }, + "type": { + "description": "Type of the account", + "disable_correlation": true, + "misp-attribute": "text", + "sane_default": [ + "Person", + "Association", + "Enterprise", + "Other" + ], + "ui-priority": 1 + }, "type-of-account": { "description": "Type of the impersonated account", - "ui-priority": 1, - "misp-attribute": "text", "disable_correlation": true, + "misp-attribute": "text", "sane_default": [ "Twitter", "Facebook", @@ -14,64 +65,13 @@ "Instagram", "Forum", "Other" - ] - }, - "account-url": { - "description": "url of the impersonating account", - "ui-priority": 1, - "misp-attribute": "url" - }, - "account-name": { - "description": "Name of the impersonating account", - "ui-priority": 1, - "misp-attribute": "text" - }, - "impersonated-account-url": { - "description": "url of the impersonated account", - "ui-priority": 1, - "misp-attribute": "link" - }, - "impersonated-account-name": { - "description": "Name of the impersonated account", - "ui-priority": 1, - "misp-attribute": "text" - }, - "real-name": { - "description": "Real name of the impersonated person or entity", - "ui-priority": 1, - "misp-attribute": "text" - }, - "type": { - "description": "Type of the account", - "ui-priority": 1, - "misp-attribute": "text", - "disable_correlation": true, - "sane_default": [ - "Person", - "Association", - "Enterprise", - "Other" - ] - }, - "objective": { - "description": "Objective of the impersonation", - "ui-priority": 1, - "misp-attribute": "text", - "disable_correlation": true, - "multiple": true, - "sane_default": [ - "Information stealing", - "Disinformation", - "Distrusting", - "Advertising", - "Parody", - "Other" - ] + ], + "ui-priority": 1 } }, - "version": 1, "description": "Represent an impersonating account", "meta-category": "misc", + "name": "impersonation", "uuid": "01833a92-d2ff-11e9-8016-d3b988153702", - "name": "impersonation" -} + "version": 1 +} \ No newline at end of file diff --git a/objects/imsi-catcher/definition.json b/objects/imsi-catcher/definition.json index 061ebc5..7c13595 100644 --- a/objects/imsi-catcher/definition.json +++ b/objects/imsi-catcher/definition.json @@ -1,15 +1,70 @@ { - "requiredOneOf": [ - "text", - "first-seen", - "imsi" - ], "attributes": { + "brand": { + "description": "Brand associated with the IMSI registration.", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 0 + }, + "cellid": { + "description": "CellID", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 0 + }, + "country": { + "description": "Country where the IMSI is registered.", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 0 + }, + "first-seen": { + "description": "When the IMSI has been accessible or seen for the first time.", + "disable_correlation": true, + "misp-attribute": "datetime", + "ui-priority": 0 + }, "imsi": { "description": "A usually unique International Mobile Subscriber Identity (IMSI) is allocated to each mobile subscriber in the GSM/UMTS/EPS system. IMSI can also refer to International Mobile Station Identity in the ITU nomenclature.", "misp-attribute": "text", "ui-priority": 1 }, + "lac": { + "description": "LAC - Location Area Code", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 0 + }, + "mcc": { + "description": "MCC - Mobile Country Code", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 0 + }, + "mnc": { + "description": "MNC - Mobile Network Code", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 0 + }, + "operator": { + "description": "Operator associated with the IMSI registration.", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 0 + }, + "seq": { + "description": "A sequence number for the collection", + "disable_correlation": true, + "misp-attribute": "counter", + "ui-priority": 0 + }, + "text": { + "description": "A description of the IMSI record.", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 1 + }, "tmsi-1": { "description": "Temporary Mobile Subscriber Identities (TMSI) to visiting mobile subscribers can be allocated.", "misp-attribute": "text", @@ -19,71 +74,16 @@ "description": "Temporary Mobile Subscriber Identities (TMSI) to visiting mobile subscribers can be allocated.", "misp-attribute": "text", "ui-priority": 0 - }, - "country": { - "description": "Country where the IMSI is registered.", - "misp-attribute": "text", - "ui-priority": 0, - "disable_correlation": true - }, - "brand": { - "description": "Brand associated with the IMSI registration.", - "misp-attribute": "text", - "ui-priority": 0, - "disable_correlation": true - }, - "operator": { - "description": "Operator associated with the IMSI registration.", - "misp-attribute": "text", - "ui-priority": 0, - "disable_correlation": true - }, - "mcc": { - "description": "MCC - Mobile Country Code", - "misp-attribute": "text", - "ui-priority": 0, - "disable_correlation": true - }, - "mnc": { - "description": "MNC - Mobile Network Code", - "misp-attribute": "text", - "ui-priority": 0, - "disable_correlation": true - }, - "lac": { - "description": "LAC - Location Area Code", - "misp-attribute": "text", - "ui-priority": 0, - "disable_correlation": true - }, - "cellid": { - "description": "CellID", - "misp-attribute": "text", - "ui-priority": 0, - "disable_correlation": true - }, - "text": { - "description": "A description of the IMSI record.", - "disable_correlation": true, - "ui-priority": 1, - "misp-attribute": "text" - }, - "first-seen": { - "description": "When the IMSI has been accessible or seen for the first time.", - "disable_correlation": true, - "ui-priority": 0, - "misp-attribute": "datetime" - }, - "seq": { - "description": "A sequence number for the collection", - "disable_correlation": true, - "ui-priority": 0, - "misp-attribute": "counter" } }, - "version": 1, "description": "IMSI Catcher entry object based on the open source IMSI cather", "meta-category": "misc", + "name": "imsi-catcher", + "requiredOneOf": [ + "text", + "first-seen", + "imsi" + ], "uuid": "a64f21b1-2f1b-4298-8243-c45db2c4aa7c", - "name": "imsi-catcher" -} + "version": 1 +} \ No newline at end of file diff --git a/objects/instant-message-group/definition.json b/objects/instant-message-group/definition.json index 6232afb..b5174dc 100644 --- a/objects/instant-message-group/definition.json +++ b/objects/instant-message-group/definition.json @@ -1,27 +1,9 @@ { - "requiredOneOf": [ - "group-name", - "group-alias", - "archive", - "attachment" - ], "attributes": { - "group-name": { - "description": "The name of the group, channel or community.", - "ui-priority": 1, - "misp-attribute": "text" - }, - "group-alias": { - "description": "Aliases of group, channel or community.", - "ui-priority": 1, - "multiple": true, - "misp-attribute": "text" - }, "app-used": { "description": "The IM application used to send the message.", - "ui-priority": 1, - "misp-attribute": "text", "disable_correlation": true, + "misp-attribute": "text", "multiple": true, "sane_default": [ "WhatsApp", @@ -35,46 +17,64 @@ "TorChat", "RetroShare", "Slack" - ] - }, - "username": { - "description": "A user account who is a member of the group.", - "ui-priority": 1, - "misp-attribute": "text", - "multiple": true - }, - "person-name": { - "description": "A person who is a member of the group.", - "ui-priority": 1, - "misp-attribute": "text", - "multiple": true - }, - "url": { - "description": "Original URL location of the group (potentially malicious).", - "ui-priority": 1, - "misp-attribute": "url" - }, - "link": { - "description": "Original link into the group (Supposed harmless).", - "ui-priority": 1, - "misp-attribute": "link" + ], + "ui-priority": 1 }, "archive": { "description": "Archive of the original group (Internet Archive, Archive.is, etc).", - "ui-priority": 1, + "misp-attribute": "link", "multiple": true, - "misp-attribute": "link" + "ui-priority": 1 }, "attachment": { "description": "A screen capture or exported list of contacts, group members, etc.", - "ui-priority": 1, + "misp-attribute": "attachment", "multiple": true, - "misp-attribute": "attachment" + "ui-priority": 1 + }, + "group-alias": { + "description": "Aliases of group, channel or community.", + "misp-attribute": "text", + "multiple": true, + "ui-priority": 1 + }, + "group-name": { + "description": "The name of the group, channel or community.", + "misp-attribute": "text", + "ui-priority": 1 + }, + "link": { + "description": "Original link into the group (Supposed harmless).", + "misp-attribute": "link", + "ui-priority": 1 + }, + "person-name": { + "description": "A person who is a member of the group.", + "misp-attribute": "text", + "multiple": true, + "ui-priority": 1 + }, + "url": { + "description": "Original URL location of the group (potentially malicious).", + "misp-attribute": "url", + "ui-priority": 1 + }, + "username": { + "description": "A user account who is a member of the group.", + "misp-attribute": "text", + "multiple": true, + "ui-priority": 1 } }, - "version": 1, "description": "Instant Message (IM) group object template describing a public or private IM group, channel or conversation.", "meta-category": "misc", + "name": "instant-message-group", + "requiredOneOf": [ + "group-name", + "group-alias", + "archive", + "attachment" + ], "uuid": "e26becca-2149-4bc0-b3fb-7090d43af28f", - "name": "instant-message-group" -} + "version": 1 +} \ No newline at end of file diff --git a/objects/instant-message/definition.json b/objects/instant-message/definition.json index 802b0a8..5936290 100644 --- a/objects/instant-message/definition.json +++ b/objects/instant-message/definition.json @@ -1,60 +1,9 @@ { - "requiredOneOf": [ - "body", - "from-user" - ], "attributes": { - "body": { - "description": "Message body of the IM.", - "ui-priority": 1, - "misp-attribute": "text" - }, - "from-number": { - "description": "Phone number used to send the message.", - "ui-priority": 1, - "misp-attribute": "phone-number", - "multiple": true - }, - "to-number": { - "description": "Phone number receiving the message.", - "ui-priority": 1, - "misp-attribute": "phone-number", - "multiple": true - }, - "from-user": { - "description": "User account that sent the message.", - "ui-priority": 1, - "misp-attribute": "text", - "multiple": true - }, - "to-user": { - "description": "User account that received the message.", - "ui-priority": 1, - "misp-attribute": "text", - "multiple": true - }, - "from-name": { - "description": "Name of the person that sent the message.", - "ui-priority": 1, - "misp-attribute": "text", - "multiple": true - }, - "to-name": { - "description": "Name of the person that received the message.", - "ui-priority": 1, - "misp-attribute": "text", - "multiple": true - }, - "subject": { - "description": "Subject of the message if any.", - "ui-priority": 0, - "misp-attribute": "text" - }, "app-used": { "description": "The IM application used to send the message.", - "ui-priority": 1, - "misp-attribute": "text", "disable_correlation": true, + "misp-attribute": "text", "sane_default": [ "WhatsApp", "Google Hangouts", @@ -67,46 +16,97 @@ "TorChat", "RetroShare", "Slack" - ] - }, - "url": { - "description": "Original URL location of the message (potentially malicious).", - "ui-priority": 1, - "misp-attribute": "url" - }, - "link": { - "description": "Original link into the message (Supposed harmless).", - "ui-priority": 1, - "misp-attribute": "link" + ], + "ui-priority": 1 }, "archive": { "description": "Archive of the original message (Internet Archive, Archive.is, etc).", - "ui-priority": 1, + "misp-attribute": "link", "multiple": true, - "misp-attribute": "link" + "ui-priority": 1 }, "attachment": { "description": "The message file or screen capture.", - "ui-priority": 1, + "misp-attribute": "attachment", "multiple": true, - "misp-attribute": "attachment" + "ui-priority": 1 }, - "sent-date": { - "description": "Initial sent date of the message.", - "ui-priority": 0, - "misp-attribute": "datetime", - "disable_correlation": true + "body": { + "description": "Message body of the IM.", + "misp-attribute": "text", + "ui-priority": 1 + }, + "from-name": { + "description": "Name of the person that sent the message.", + "misp-attribute": "text", + "multiple": true, + "ui-priority": 1 + }, + "from-number": { + "description": "Phone number used to send the message.", + "misp-attribute": "phone-number", + "multiple": true, + "ui-priority": 1 + }, + "from-user": { + "description": "User account that sent the message.", + "misp-attribute": "text", + "multiple": true, + "ui-priority": 1 + }, + "link": { + "description": "Original link into the message (Supposed harmless).", + "misp-attribute": "link", + "ui-priority": 1 }, "received-date": { "description": "Received date of the message.", - "ui-priority": 0, + "disable_correlation": true, "misp-attribute": "datetime", - "disable_correlation": true + "ui-priority": 0 + }, + "sent-date": { + "description": "Initial sent date of the message.", + "disable_correlation": true, + "misp-attribute": "datetime", + "ui-priority": 0 + }, + "subject": { + "description": "Subject of the message if any.", + "misp-attribute": "text", + "ui-priority": 0 + }, + "to-name": { + "description": "Name of the person that received the message.", + "misp-attribute": "text", + "multiple": true, + "ui-priority": 1 + }, + "to-number": { + "description": "Phone number receiving the message.", + "misp-attribute": "phone-number", + "multiple": true, + "ui-priority": 1 + }, + "to-user": { + "description": "User account that received the message.", + "misp-attribute": "text", + "multiple": true, + "ui-priority": 1 + }, + "url": { + "description": "Original URL location of the message (potentially malicious).", + "misp-attribute": "url", + "ui-priority": 1 } }, - "version": 1, "description": "Instant Message (IM) object template describing one or more IM message.", "meta-category": "misc", + "name": "instant-message", + "requiredOneOf": [ + "body", + "from-user" + ], "uuid": "5fa51a24-f40f-4696-a77e-d31e26bab5fc", - "name": "instant-message" -} + "version": 1 +} \ No newline at end of file diff --git a/objects/intelmq_event/definition.json b/objects/intelmq_event/definition.json index 6bd7969..5540e00 100644 --- a/objects/intelmq_event/definition.json +++ b/objects/intelmq_event/definition.json @@ -416,4 +416,4 @@ "name": "intelmq_event", "uuid": "491ac7d2-25a1-4078-8246-b04a132d003d", "version": 4 -} +} \ No newline at end of file diff --git a/objects/intelmq_report/definition.json b/objects/intelmq_report/definition.json index 2b07893..bb428ad 100644 --- a/objects/intelmq_report/definition.json +++ b/objects/intelmq_report/definition.json @@ -56,4 +56,4 @@ "name": "intelmq_report", "uuid": "c3d34be1-904b-455b-bceb-509418392110", "version": 3 -} +} \ No newline at end of file diff --git a/objects/internal-reference/definition.json b/objects/internal-reference/definition.json index f5ff0e3..da32f9e 100644 --- a/objects/internal-reference/definition.json +++ b/objects/internal-reference/definition.json @@ -1,44 +1,44 @@ { + "attributes": { + "comment": { + "categories": [ + "Internal reference" + ], + "description": "Comment associated to the identifier.", + "misp-attribute": "comment", + "ui-priority": 0 + }, + "identifier": { + "categories": [ + "Internal reference" + ], + "description": "Identifier of the reference. Should be unique in your system.", + "misp-attribute": "text", + "ui-priority": 1 + }, + "link": { + "categories": [ + "Internal reference" + ], + "description": "Link associated to the identifier.", + "misp-attribute": "link", + "ui-priority": 1 + }, + "type": { + "categories": [ + "Internal reference" + ], + "description": "Type of internal reference.", + "misp-attribute": "text", + "ui-priority": 1 + } + }, + "description": "Internal reference.", + "meta-category": "misc", + "name": "internal-reference", "required": [ "identifier" ], - "attributes": { - "identifier": { - "description": "Identifier of the reference. Should be unique in your system.", - "ui-priority": 1, - "misp-attribute": "text", - "categories": [ - "Internal reference" - ] - }, - "comment": { - "description": "Comment associated to the identifier.", - "ui-priority": 0, - "misp-attribute": "comment", - "categories": [ - "Internal reference" - ] - }, - "type": { - "description": "Type of internal reference.", - "ui-priority": 1, - "misp-attribute": "text", - "categories": [ - "Internal reference" - ] - }, - "link": { - "description": "Link associated to the identifier.", - "ui-priority": 1, - "misp-attribute": "link", - "categories": [ - "Internal reference" - ] - } - }, - "version": 2, - "description": "Internal reference.", - "meta-category": "misc", "uuid": "a3984dc5-5f70-4776-9262-c19641c0ff6a", - "name": "internal-reference" -} + "version": 2 +} \ No newline at end of file diff --git a/objects/interpol-notice/definition.json b/objects/interpol-notice/definition.json index 95aacaa..409cd24 100644 --- a/objects/interpol-notice/definition.json +++ b/objects/interpol-notice/definition.json @@ -1,12 +1,85 @@ { - "required": [ - "notice-color" - ], "attributes": { + "alias": { + "description": "Alias name or known as.", + "misp-attribute": "text", + "multiple": true, + "ui-priority": 0 + }, + "charges": { + "description": "Charges published as provided by requesting entity", + "disable_correlation": true, + "misp-attribute": "text", + "multiple": true, + "ui-priority": 0 + }, + "colour-of-eyes": { + "description": "Description of a person's colour of eyes.", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 0 + }, + "colour-of-hair": { + "description": "Description of a person's colour of hair.", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 0 + }, + "date-of-birth": { + "description": "Date of birth of a natural person (in YYYY-MM-DD format).", + "misp-attribute": "date-of-birth", + "ui-priority": 0 + }, + "date-of-disappearance": { + "description": "Date of disappearance of a missing person.", + "misp-attribute": "text", + "ui-priority": 0 + }, + "distinguishing-marks-and-characteristics": { + "description": "Distinguishing marks and characteristics of a person.", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 0 + }, + "father-s-family-name-&-forename": { + "description": "Father's family name & forename.", + "misp-attribute": "text", + "ui-priority": 0 + }, + "forename": { + "description": "First name of a natural person.", + "disable_correlation": true, + "misp-attribute": "first-name", + "ui-priority": 0 + }, + "height": { + "description": "Height of a person.", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 0 + }, + "language-spoken": { + "description": "Languages spoken by a person.", + "disable_correlation": true, + "misp-attribute": "text", + "multiple": true, + "ui-priority": 0 + }, + "mother-s-family-name-&-forename": { + "description": "Mother's family name & forename.", + "misp-attribute": "text", + "ui-priority": 0 + }, + "nationality": { + "description": "The nationality of a natural person.", + "disable_correlation": true, + "misp-attribute": "nationality", + "multiple": true, + "ui-priority": 0 + }, "notice-color": { "description": "The color/type of the notice", "misp-attribute": "text", - "ui-priority": 1, "sane_default": [ "Red", "Yellow", @@ -15,129 +88,56 @@ "Green", "Orange", "Purple" - ] - }, - "present-family-name": { - "description": "Last name of a natural person.", - "ui-priority": 0, - "misp-attribute": "last-name" - }, - "forename": { - "description": "First name of a natural person.", - "ui-priority": 0, - "misp-attribute": "first-name", - "disable_correlation": true - }, - "alias": { - "description": "Alias name or known as.", - "ui-priority": 0, - "misp-attribute": "text", - "multiple": true - }, - "father-s-family-name-&-forename": { - "description": "Father's family name & forename.", - "ui-priority": 0, - "misp-attribute": "text" - }, - "mother-s-family-name-&-forename": { - "description": "Mother's family name & forename.", - "ui-priority": 0, - "misp-attribute": "text" - }, - "date-of-birth": { - "description": "Date of birth of a natural person (in YYYY-MM-DD format).", - "ui-priority": 0, - "misp-attribute": "date-of-birth" + ], + "ui-priority": 1 }, "place-of-birth": { "description": "Place of birth of a natural person.", - "ui-priority": 0, + "disable_correlation": true, "misp-attribute": "place-of-birth", - "disable_correlation": true + "ui-priority": 0 + }, + "place-of-disappearance": { + "description": "Place of birth of a natural person.", + "misp-attribute": "text", + "ui-priority": 0 + }, + "portrait": { + "description": "Portrait of the person.", + "misp-attribute": "attachment", + "multiple": true, + "ui-priority": 10 + }, + "present-family-name": { + "description": "Last name of a natural person.", + "misp-attribute": "last-name", + "ui-priority": 0 }, "sex": { "description": "The gender of a natural person.", - "ui-priority": 0, + "disable_correlation": true, "misp-attribute": "gender", + "ui-priority": 0, "values_list": [ "Male", "Female", "Other", "Prefer not to say" - ], - "disable_correlation": true - }, - "nationality": { - "description": "The nationality of a natural person.", - "ui-priority": 0, - "misp-attribute": "nationality", - "multiple": true, - "disable_correlation": true - }, - "language-spoken": { - "description": "Languages spoken by a person.", - "ui-priority": 0, - "misp-attribute": "text", - "multiple": true, - "disable_correlation": true - }, - "charges": { - "description": "Charges published as provided by requesting entity", - "ui-priority": 0, - "misp-attribute": "text", - "multiple": true, - "disable_correlation": true - }, - "date-of-disappearance": { - "description": "Date of disappearance of a missing person.", - "ui-priority": 0, - "misp-attribute": "text" - }, - "place-of-disappearance": { - "description": "Place of birth of a natural person.", - "ui-priority": 0, - "misp-attribute": "text" - }, - "height": { - "description": "Height of a person.", - "ui-priority": 0, - "misp-attribute": "text", - "disable_correlation": true + ] }, "weight": { "description": "weight of a person.", - "ui-priority": 0, + "disable_correlation": true, "misp-attribute": "text", - "disable_correlation": true - }, - "colour-of-hair": { - "description": "Description of a person's colour of hair.", - "ui-priority": 0, - "misp-attribute": "text", - "disable_correlation": true - }, - "colour-of-eyes": { - "description": "Description of a person's colour of eyes.", - "ui-priority": 0, - "misp-attribute": "text", - "disable_correlation": true - }, - "distinguishing-marks-and-characteristics": { - "description": "Distinguishing marks and characteristics of a person.", - "ui-priority": 0, - "misp-attribute": "text", - "disable_correlation": true - }, - "portrait": { - "description": "Portrait of the person.", - "ui-priority": 10, - "misp-attribute": "attachment", - "multiple": true + "ui-priority": 0 } }, - "version": 1, "description": "An object which describes a Interpol notice.", "meta-category": "misc", + "name": "interpol-notice", + "required": [ + "notice-color" + ], "uuid": "24927972-1e4a-11e9-857e-3b2306b99911", - "name": "interpol-notice" -} + "version": 1 +} \ No newline at end of file diff --git a/objects/iot-device/definition.json b/objects/iot-device/definition.json index 0aac22f..7f1c6ab 100644 --- a/objects/iot-device/definition.json +++ b/objects/iot-device/definition.json @@ -1,40 +1,69 @@ { - "requiredOneOf": [ - "model", - "vendor", - "architecture", - "boot-log", - "picture-pcb", - "picture-device" - ], "attributes": { - "picture-pcb": { - "description": "Picture of the IoT device PCB", - "ui-priority": 10, - "misp-attribute": "attachment", - "multiple": true - }, - "picture-device": { - "description": "Picture of the IoT device", - "ui-priority": 10, - "misp-attribute": "attachment", - "multiple": true - }, - "fcc-id": { - "description": "FCC-ID of the IoT device", - "ui-priority": 10, + "architecture": { + "description": "architecture of the IoT device", "misp-attribute": "text", - "multiple": true + "sane_default": [ + "ARC", + "ARM", + "M68000", + "MicroBlaze", + "MIPS", + "NSD32", + "Nios II", + "PowerPC", + "RISC-V", + "Sandbox", + "SH", + "x86", + "Xtensa" + ], + "ui-priority": 1 }, "boot-log": { "description": "Boot log of the IoT device", - "ui-priority": 10, "misp-attribute": "attachment", - "multiple": true + "multiple": true, + "ui-priority": 10 + }, + "fcc-id": { + "description": "FCC-ID of the IoT device", + "misp-attribute": "text", + "multiple": true, + "ui-priority": 10 + }, + "jtag-interface": { + "description": "JTAG interface of the IoT device", + "disable_correlation": true, + "misp-attribute": "text", + "sane_default": [ + "Yes", + "No", + "Unknown", + "Disabled" + ], + "ui-priority": 1 + }, + "model": { + "description": "Model of the IoT device", + "misp-attribute": "text", + "multiple": true, + "ui-priority": 1 + }, + "picture-device": { + "description": "Picture of the IoT device", + "misp-attribute": "attachment", + "multiple": true, + "ui-priority": 10 + }, + "picture-pcb": { + "description": "Picture of the IoT device PCB", + "misp-attribute": "attachment", + "multiple": true, + "ui-priority": 10 }, "platform": { "description": "Platform of of the IoT device", - "ui-priority": 10, "misp-attribute": "text", "sane_default": [ "mach-aspeed", @@ -87,85 +116,56 @@ "mach-mscc", "mach-mtmips", "mach-pic32" - ] - }, - "architecture": { - "description": "architecture of the IoT device", - "ui-priority": 1, - "misp-attribute": "text", - "sane_default": [ - "ARC", - "ARM", - "M68000", - "MicroBlaze", - "MIPS", - "NSD32", - "Nios II", - "PowerPC", - "RISC-V", - "Sandbox", - "SH", - "x86", - "Xtensa" - ] - }, - "model": { - "description": "Model of the IoT device", - "ui-priority": 1, - "misp-attribute": "text", - "multiple": true - }, - "vendor": { - "description": "Vendor of the IoT device", - "ui-priority": 1, - "misp-attribute": "text" + ], + "ui-priority": 10 }, "reference": { "description": "Reference of the IoT device", - "ui-priority": 1, "misp-attribute": "link", - "multiple": true - }, - "spi-interface": { - "description": "SPI interface of the IoT device", - "ui-priority": 1, - "misp-attribute": "text", - "disable_correlation": true, - "sane_default": [ - "Yes", - "No", - "Unknown", - "Disabled" - ] + "multiple": true, + "ui-priority": 1 }, "serial-interface": { "description": "Serial interface of the IoT device", - "ui-priority": 1, - "misp-attribute": "text", "disable_correlation": true, + "misp-attribute": "text", "sane_default": [ "Yes", "No", "Unknown", "Disabled" - ] + ], + "ui-priority": 1 }, - "jtag-interface": { - "description": "JTAG interface of the IoT device", - "ui-priority": 1, - "misp-attribute": "text", + "spi-interface": { + "description": "SPI interface of the IoT device", "disable_correlation": true, + "misp-attribute": "text", "sane_default": [ "Yes", "No", "Unknown", "Disabled" - ] + ], + "ui-priority": 1 + }, + "vendor": { + "description": "Vendor of the IoT device", + "misp-attribute": "text", + "ui-priority": 1 } }, - "version": 3, "description": "An IoT device.", "meta-category": "iot", + "name": "iot-device", + "requiredOneOf": [ + "model", + "vendor", + "architecture", + "boot-log", + "picture-pcb", + "picture-device" + ], "uuid": "3de3b92a-859b-431b-9c4f-1a81de1d9637", - "name": "iot-device" -} + "version": 3 +} \ No newline at end of file diff --git a/objects/iot-firmware/definition.json b/objects/iot-firmware/definition.json index 4ba6e67..4e74789 100644 --- a/objects/iot-firmware/definition.json +++ b/objects/iot-firmware/definition.json @@ -1,99 +1,99 @@ { - "requiredOneOf": [ - "firmware", - "filename", - "binwalk-output" - ], "attributes": { - "firmware": { - "description": "Firmware of the IoT device", - "ui-priority": 10, + "binwalk-entropy-graph": { + "description": "Entropy graph of the firmware", + "disable_correlation": true, "misp-attribute": "attachment", - "multiple": true - }, - "version": { - "description": "Version of the firmware", - "ui-priority": 10, - "misp-attribute": "text", - "multiple": true - }, - "filename": { - "description": "Filename of the firmware", - "ui-priority": 10, - "misp-attribute": "text" - }, - "boot-log": { - "description": "Boot log of the IoT device for this firmware", - "ui-priority": 10, - "misp-attribute": "attachment", - "multiple": true + "ui-priority": 0 }, "binwalk-output": { "description": "Binwalk output of the firmware image", - "ui-priority": 10, - "misp-attribute": "attachment" + "misp-attribute": "attachment", + "ui-priority": 10 + }, + "boot-log": { + "description": "Boot log of the IoT device for this firmware", + "misp-attribute": "attachment", + "multiple": true, + "ui-priority": 10 + }, + "filename": { + "description": "Filename of the firmware", + "misp-attribute": "text", + "ui-priority": 10 + }, + "firmware": { + "description": "Firmware of the IoT device", + "misp-attribute": "attachment", + "multiple": true, + "ui-priority": 10 }, "format": { "description": "Format of the firmware", - "ui-priority": 10, "misp-attribute": "text", "sane_default": [ "raw", "Intel hex", "Motorola S-Record", "Unknown" - ] + ], + "ui-priority": 10 }, "md5": { "description": "[Insecure] MD5 hash (128 bits)", - "ui-priority": 1, "misp-attribute": "md5", - "recommended": false + "recommended": false, + "ui-priority": 1 }, "sha1": { "description": "[Insecure] Secure Hash Algorithm 1 (160 bits)", - "ui-priority": 1, "misp-attribute": "sha1", - "recommended": false + "recommended": false, + "ui-priority": 1 }, "sha224": { "description": "Secure Hash Algorithm 2 (224 bits)", - "ui-priority": 0, "misp-attribute": "sha224", - "recommended": false + "recommended": false, + "ui-priority": 0 }, "sha256": { "description": "Secure Hash Algorithm 2 (256 bits)", - "ui-priority": 1, - "misp-attribute": "sha256" + "misp-attribute": "sha256", + "ui-priority": 1 }, "sha384": { "description": "Secure Hash Algorithm 2 (384 bits)", - "ui-priority": 0, "misp-attribute": "sha384", - "recommended": false + "recommended": false, + "ui-priority": 0 }, "sha512": { "description": "Secure Hash Algorithm 2 (512 bits)", - "ui-priority": 1, - "misp-attribute": "sha512" + "misp-attribute": "sha512", + "ui-priority": 1 }, "size-in-bytes": { "description": "Size of the file, in bytes", "disable_correlation": true, - "ui-priority": 0, - "misp-attribute": "size-in-bytes" + "misp-attribute": "size-in-bytes", + "ui-priority": 0 }, - "binwalk-entropy-graph": { - "description": "Entropy graph of the firmware", - "disable_correlation": true, - "ui-priority": 0, - "misp-attribute": "attachment" + "version": { + "description": "Version of the firmware", + "misp-attribute": "text", + "multiple": true, + "ui-priority": 10 } }, - "version": 1, "description": "A firmware for an IoT device.", "meta-category": "iot", + "name": "iot-firmware", + "requiredOneOf": [ + "firmware", + "filename", + "binwalk-output" + ], "uuid": "8bafb8fc-d986-4a58-b22b-6b8c7c0e8b70", - "name": "iot-firmware" -} + "version": 1 +} \ No newline at end of file diff --git a/objects/ip-api-address/definition.json b/objects/ip-api-address/definition.json index 88030d3..9eac0a9 100644 --- a/objects/ip-api-address/definition.json +++ b/objects/ip-api-address/definition.json @@ -1,101 +1,101 @@ { - "name": "ip-api-address", - "meta-category": "network", - "description": "IP Address information. Useful if you are pulling your ip information from ip-api.com", - "version": 2, - "uuid": "4336f124-6264-4f72-943e-cc3797e4122b", "attributes": { - "ip-src": { - "description": "Source IP address of the network connection.", - "ui-priority": 1, - "misp-attribute": "ip-src" + "ISP": { + "description": "ISP.", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 1 }, "asn": { "description": "Autonomous System Number", - "ui-priority": 1, + "disable_correlation": true, "misp-attribute": "AS", - "disable_correlation": true - }, - "organization": { - "description": "organization", - "ui-priority": 1, - "misp-attribute": "text", - "disable_correlation": true - }, - "ISP": { - "description": "ISP.", - "ui-priority": 1, - "misp-attribute": "text", - "disable_correlation": true - }, - "zipcode": { - "description": "Zip Code.", - "misp-attribute": "text", - "ui-priority": 1, - "disable_correlation": true + "ui-priority": 1 }, "city": { "description": "City.", + "disable_correlation": true, "misp-attribute": "text", - "ui-priority": 1, - "disable_correlation": true - }, - "state": { - "description": "State.", - "misp-attribute": "text", - "ui-priority": 1, - "disable_correlation": true + "ui-priority": 1 }, "country": { "description": "Country name", - "ui-priority": 1, + "disable_correlation": true, "misp-attribute": "text", - "disable_correlation": true + "ui-priority": 1 }, "country code": { "description": "Country code ", - "ui-priority": 1, - "misp-attribute": "text", - "disable_correlation": true - }, - "region": { - "description": "Region. example: California.", - "misp-attribute": "text", - "ui-priority": 1, - "disable_correlation": true - }, - "region code": { - "description": "Region code. example: CA", - "misp-attribute": "text", - "ui-priority": 1, - "disable_correlation": true - }, - "latitude": { - "description": "The latitude is the decimal value of the latitude in the World Geodetic System 84 (WGS84) reference.", "disable_correlation": true, - "ui-priority": 90, - "misp-attribute": "float" - }, - "longitude": { - "description": "The longitude is the decimal value of the longitude in the World Geodetic System 84 (WGS84) reference", - "disable_correlation": true, - "ui-priority": 89, - "misp-attribute": "float" + "misp-attribute": "text", + "ui-priority": 1 }, "first-seen": { "description": "First time the ASN was seen", "disable_correlation": true, - "ui-priority": 0, - "misp-attribute": "datetime" + "misp-attribute": "datetime", + "ui-priority": 0 + }, + "ip-src": { + "description": "Source IP address of the network connection.", + "misp-attribute": "ip-src", + "ui-priority": 1 }, "last-seen": { "description": "Last time the ASN was seen", "disable_correlation": true, - "ui-priority": 0, - "misp-attribute": "datetime" + "misp-attribute": "datetime", + "ui-priority": 0 + }, + "latitude": { + "description": "The latitude is the decimal value of the latitude in the World Geodetic System 84 (WGS84) reference.", + "disable_correlation": true, + "misp-attribute": "float", + "ui-priority": 90 + }, + "longitude": { + "description": "The longitude is the decimal value of the longitude in the World Geodetic System 84 (WGS84) reference", + "disable_correlation": true, + "misp-attribute": "float", + "ui-priority": 89 + }, + "organization": { + "description": "organization", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 1 + }, + "region": { + "description": "Region. example: California.", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 1 + }, + "region code": { + "description": "Region code. example: CA", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 1 + }, + "state": { + "description": "State.", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 1 + }, + "zipcode": { + "description": "Zip Code.", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 1 } }, + "description": "IP Address information. Useful if you are pulling your ip information from ip-api.com", + "meta-category": "network", + "name": "ip-api-address", "requiredOneOf": [ "ip-src" - ] -} + ], + "uuid": "4336f124-6264-4f72-943e-cc3797e4122b", + "version": 2 +} \ No newline at end of file diff --git a/objects/ip-port/definition.json b/objects/ip-port/definition.json index bb9a1f6..9054eee 100644 --- a/objects/ip-port/definition.json +++ b/objects/ip-port/definition.json @@ -1,4 +1,97 @@ { + "attributes": { + "domain": { + "categories": [ + "Network activity", + "External analysis" + ], + "description": "Domain", + "misp-attribute": "domain", + "multiple": true, + "ui-priority": 1 + }, + "dst-port": { + "categories": [ + "Network activity", + "External analysis" + ], + "description": "Destination port", + "disable_correlation": true, + "misp-attribute": "port", + "multiple": true, + "ui-priority": 1 + }, + "first-seen": { + "description": "First time the tuple has been seen", + "disable_correlation": true, + "misp-attribute": "datetime", + "ui-priority": 0 + }, + "hostname": { + "categories": [ + "Network activity", + "External analysis" + ], + "description": "Hostname", + "misp-attribute": "hostname", + "multiple": true, + "ui-priority": 1 + }, + "ip": { + "categories": [ + "Network activity", + "External analysis" + ], + "description": "IP Address", + "misp-attribute": "ip-dst", + "multiple": true, + "ui-priority": 1 + }, + "ip-dst": { + "categories": [ + "Network activity", + "External analysis" + ], + "description": "destination IP address", + "misp-attribute": "ip-dst", + "multiple": true, + "ui-priority": 1 + }, + "ip-src": { + "categories": [ + "Network activity", + "External analysis" + ], + "description": "source IP address", + "misp-attribute": "ip-src", + "multiple": true, + "ui-priority": 1 + }, + "last-seen": { + "description": "Last time the tuple has been seen", + "disable_correlation": true, + "misp-attribute": "datetime", + "ui-priority": 0 + }, + "src-port": { + "categories": [ + "Network activity", + "External analysis" + ], + "description": "Source port", + "misp-attribute": "port", + "ui-priority": 0 + }, + "text": { + "description": "Description of the tuple", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 0 + } + }, + "description": "An IP address (or domain or hostname) and a port seen as a tuple (or as a triple) in a specific time frame.", + "meta-category": "network", + "name": "ip-port", "requiredOneOf": [ "dst-port", "src-port", @@ -8,99 +101,6 @@ "ip-src", "ip-dst" ], - "attributes": { - "text": { - "description": "Description of the tuple", - "disable_correlation": true, - "ui-priority": 0, - "misp-attribute": "text" - }, - "last-seen": { - "description": "Last time the tuple has been seen", - "disable_correlation": true, - "ui-priority": 0, - "misp-attribute": "datetime" - }, - "first-seen": { - "description": "First time the tuple has been seen", - "disable_correlation": true, - "ui-priority": 0, - "misp-attribute": "datetime" - }, - "src-port": { - "description": "Source port", - "categories": [ - "Network activity", - "External analysis" - ], - "ui-priority": 0, - "misp-attribute": "port" - }, - "dst-port": { - "description": "Destination port", - "categories": [ - "Network activity", - "External analysis" - ], - "ui-priority": 1, - "misp-attribute": "port", - "disable_correlation": true, - "multiple": true - }, - "domain": { - "description": "Domain", - "categories": [ - "Network activity", - "External analysis" - ], - "ui-priority": 1, - "misp-attribute": "domain", - "multiple": true - }, - "hostname": { - "description": "Hostname", - "categories": [ - "Network activity", - "External analysis" - ], - "ui-priority": 1, - "misp-attribute": "hostname", - "multiple": true - }, - "ip": { - "description": "IP Address", - "categories": [ - "Network activity", - "External analysis" - ], - "ui-priority": 1, - "misp-attribute": "ip-dst", - "multiple": true - }, - "ip-src": { - "description": "source IP address", - "categories": [ - "Network activity", - "External analysis" - ], - "ui-priority": 1, - "misp-attribute": "ip-src", - "multiple": true - }, - "ip-dst": { - "description": "destination IP address", - "categories": [ - "Network activity", - "External analysis" - ], - "ui-priority": 1, - "misp-attribute": "ip-dst", - "multiple": true - } - }, - "version": 8, - "description": "An IP address (or domain or hostname) and a port seen as a tuple (or as a triple) in a specific time frame.", - "meta-category": "network", "uuid": "9f8cea74-16fe-4968-a2b4-026676949ac6", - "name": "ip-port" -} + "version": 8 +} \ No newline at end of file diff --git a/objects/irc/definition.json b/objects/irc/definition.json index a371761..3ffa44e 100644 --- a/objects/irc/definition.json +++ b/objects/irc/definition.json @@ -1,76 +1,76 @@ { + "attributes": { + "channel": { + "description": "IRC channel associated to the IRC server", + "misp-attribute": "text", + "multiple": true, + "ui-priority": 1 + }, + "dst-port": { + "categories": [ + "Network activity", + "External analysis" + ], + "description": "Destination port to reach the IRC server", + "disable_correlation": true, + "misp-attribute": "port", + "multiple": true, + "ui-priority": 1 + }, + "first-seen": { + "description": "First time the IRC server with the associated channels has been seen", + "disable_correlation": true, + "misp-attribute": "datetime", + "ui-priority": 0 + }, + "hostname": { + "categories": [ + "Network activity", + "External analysis" + ], + "description": "Hostname of the IRC server", + "misp-attribute": "hostname", + "multiple": true, + "ui-priority": 1 + }, + "ip": { + "categories": [ + "Network activity", + "External analysis" + ], + "description": "IP address of the IRC server", + "misp-attribute": "ip-dst", + "multiple": true, + "ui-priority": 1 + }, + "last-seen": { + "description": "Last time the IRC server with the associated channels has been seen", + "disable_correlation": true, + "misp-attribute": "datetime", + "ui-priority": 0 + }, + "nickname": { + "description": "IRC nickname used to connect to the associated IRC server and channels", + "misp-attribute": "text", + "multiple": true, + "ui-priority": 1 + }, + "text": { + "description": "Description of the IRC server", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 0 + } + }, + "description": "An IRC object to describe an IRC server and the associated channels.", + "meta-category": "network", + "name": "irc", "requiredOneOf": [ "ip", "hostname", "channel", "nickname" ], - "attributes": { - "text": { - "description": "Description of the IRC server", - "disable_correlation": true, - "ui-priority": 0, - "misp-attribute": "text" - }, - "last-seen": { - "description": "Last time the IRC server with the associated channels has been seen", - "disable_correlation": true, - "ui-priority": 0, - "misp-attribute": "datetime" - }, - "first-seen": { - "description": "First time the IRC server with the associated channels has been seen", - "disable_correlation": true, - "ui-priority": 0, - "misp-attribute": "datetime" - }, - "dst-port": { - "description": "Destination port to reach the IRC server", - "categories": [ - "Network activity", - "External analysis" - ], - "ui-priority": 1, - "misp-attribute": "port", - "disable_correlation": true, - "multiple": true - }, - "channel": { - "description": "IRC channel associated to the IRC server", - "ui-priority": 1, - "misp-attribute": "text", - "multiple": true - }, - "nickname": { - "description": "IRC nickname used to connect to the associated IRC server and channels", - "ui-priority": 1, - "misp-attribute": "text", - "multiple": true - }, - "hostname": { - "description": "Hostname of the IRC server", - "categories": [ - "Network activity", - "External analysis" - ], - "ui-priority": 1, - "misp-attribute": "hostname", - "multiple": true - }, - "ip": { - "description": "IP address of the IRC server", - "categories": [ - "Network activity", - "External analysis" - ], - "ui-priority": 1, - "misp-attribute": "ip-dst", - "multiple": true - } - }, - "version": 2, - "description": "An IRC object to describe an IRC server and the associated channels.", - "meta-category": "network", "uuid": "4bbbc004-c344-4b20-8672-b41102177fc7", - "name": "irc" -} + "version": 2 +} \ No newline at end of file diff --git a/objects/ja3/definition.json b/objects/ja3/definition.json index 39b539d..9a4ee94 100644 --- a/objects/ja3/definition.json +++ b/objects/ja3/definition.json @@ -1,44 +1,44 @@ { - "name": "ja3", - "meta-category": "network", - "description": "JA3 is a new technique for creating SSL client fingerprints that are easy to produce and can be easily shared for threat intelligence. Fingerprints are composed of Client Hello packet; SSL Version, Accepted Ciphers, List of Extensions, Elliptic Curves, and Elliptic Curve Formats. https://github.com/salesforce/ja3", - "version": 4, - "uuid": "09b45449-5d6e-492c-a68a-cb2e188cbfac", "attributes": { - "ja3-fingerprint-md5": { - "description": "Hash identifying source", - "misp-attribute": "ja3-fingerprint-md5", - "ui-priority": 1 - }, "description": { "description": "Type of detected software ie software, malware", "misp-attribute": "text", "ui-priority": 1 }, + "first-seen": { + "description": "First seen of the SSL/TLS handshake", + "disable_correlation": true, + "misp-attribute": "datetime", + "ui-priority": 0 + }, + "ip-dst": { + "description": "Destination IP address", + "misp-attribute": "ip-dst", + "ui-priority": 1 + }, "ip-src": { "description": "Source IP Address", "misp-attribute": "ip-src", "ui-priority": 1 }, - "ip-dst": { - "description": "Destination IP address", - "misp-attribute": "ip-dst", + "ja3-fingerprint-md5": { + "description": "Hash identifying source", + "misp-attribute": "ja3-fingerprint-md5", "ui-priority": 1 }, - "first-seen": { - "misp-attribute": "datetime", - "disable_correlation": true, - "ui-priority": 0, - "description": "First seen of the SSL/TLS handshake" - }, "last-seen": { - "misp-attribute": "datetime", - "disable_correlation": true, "description": "Last seen of the SSL/TLS handshake", + "disable_correlation": true, + "misp-attribute": "datetime", "ui-priority": 0 } }, + "description": "JA3 is a new technique for creating SSL client fingerprints that are easy to produce and can be easily shared for threat intelligence. Fingerprints are composed of Client Hello packet; SSL Version, Accepted Ciphers, List of Extensions, Elliptic Curves, and Elliptic Curve Formats. https://github.com/salesforce/ja3", + "meta-category": "network", + "name": "ja3", "required": [ "ja3-fingerprint-md5" - ] -} + ], + "uuid": "09b45449-5d6e-492c-a68a-cb2e188cbfac", + "version": 4 +} \ No newline at end of file diff --git a/objects/leaked-document/definition.json b/objects/leaked-document/definition.json index 6adf927..766784e 100644 --- a/objects/leaked-document/definition.json +++ b/objects/leaked-document/definition.json @@ -1,20 +1,84 @@ { - "requiredOneOf": [ - "document-name", - "attachment", - "document-text" - ], "attributes": { + "archive": { + "description": "Archive of the original document (Internet Archive, Archive.is, etc).", + "misp-attribute": "link", + "multiple": true, + "ui-priority": 1 + }, + "attachment": { + "description": "The leaked document file.", + "misp-attribute": "attachment", + "ui-priority": 1 + }, + "document-name": { + "description": "Title of the document.", + "misp-attribute": "text", + "ui-priority": 0 + }, + "document-text": { + "description": "Raw text of document", + "misp-attribute": "text", + "ui-priority": 1 + }, + "document-type": { + "description": "The type of document (not the file type).", + "disable_correlation": true, + "misp-attribute": "text", + "multiple": true, + "sane_default": [ + "email", + "letterhead", + "speech", + "literature", + "photo", + "audio", + "invoice", + "receipt", + "other" + ], + "ui-priority": 1 + }, + "first-seen": { + "description": "When the document has been accessible or seen for the first time.", + "disable_correlation": true, + "misp-attribute": "datetime", + "ui-priority": 0 + }, + "last-seen": { + "description": "When the document has been accessible or seen for the last time.", + "disable_correlation": true, + "misp-attribute": "datetime", + "ui-priority": 0 + }, + "link": { + "description": "Original link into the document (Supposed harmless)", + "misp-attribute": "link", + "ui-priority": 1 + }, + "objective": { + "description": "Reason for leaking the document.", + "disable_correlation": true, + "misp-attribute": "text", + "multiple": true, + "sane_default": [ + "Disinformation", + "Influence", + "Whistleblowing", + "Extortion", + "Other" + ], + "ui-priority": 1 + }, "origin": { "description": "Original source of leaked document.", - "ui-priority": 1, - "misp-attribute": "text" + "misp-attribute": "text", + "ui-priority": 1 }, "purpose-of-document": { "description": "What the document is used for.", - "ui-priority": 1, - "misp-attribute": "text", "disable_correlation": true, + "misp-attribute": "text", "multiple": true, "sane_default": [ "Identification", @@ -27,87 +91,23 @@ "Media", "Communication", "Other" - ] - }, - "document-type": { - "description": "The type of document (not the file type).", - "ui-priority": 1, - "misp-attribute": "text", - "disable_correlation": true, - "multiple": true, - "sane_default": [ - "email", - "letterhead", - "speech", - "literature", - "photo", - "audio", - "invoice", - "receipt", - "other" - ] - }, - "attachment": { - "description": "The leaked document file.", - "ui-priority": 1, - "misp-attribute": "attachment" - }, - "document-name": { - "misp-attribute": "text", - "ui-priority": 0, - "description": "Title of the document." - }, - "document-text": { - "description": "Raw text of document", - "ui-priority": 1, - "misp-attribute": "text" + ], + "ui-priority": 1 }, "url": { "description": "Original URL location of the document (potentially malicious)", - "ui-priority": 1, - "misp-attribute": "url" - }, - "link": { - "description": "Original link into the document (Supposed harmless)", - "ui-priority": 1, - "misp-attribute": "link" - }, - "archive": { - "description": "Archive of the original document (Internet Archive, Archive.is, etc).", - "ui-priority": 1, - "multiple": true, - "misp-attribute": "link" - }, - "objective": { - "description": "Reason for leaking the document.", - "ui-priority": 1, - "misp-attribute": "text", - "disable_correlation": true, - "multiple": true, - "sane_default": [ - "Disinformation", - "Influence", - "Whistleblowing", - "Extortion", - "Other" - ] - }, - "last-seen": { - "description": "When the document has been accessible or seen for the last time.", - "disable_correlation": true, - "ui-priority": 0, - "misp-attribute": "datetime" - }, - "first-seen": { - "description": "When the document has been accessible or seen for the first time.", - "disable_correlation": true, - "ui-priority": 0, - "misp-attribute": "datetime" + "misp-attribute": "url", + "ui-priority": 1 } }, - "version": 6, "description": "Object describing a leaked document.", "meta-category": "file", + "name": "leaked-document", + "requiredOneOf": [ + "document-name", + "attachment", + "document-text" + ], "uuid": "ea145ecd-b3c2-4f57-ac11-c16e883c4247", - "name": "leaked-document" -} + "version": 6 +} \ No newline at end of file diff --git a/objects/legal-entity/definition.json b/objects/legal-entity/definition.json index 6812944..00a604f 100644 --- a/objects/legal-entity/definition.json +++ b/objects/legal-entity/definition.json @@ -1,58 +1,58 @@ { - "requiredOneOf": [ - "name" - ], "attributes": { - "text": { - "description": "A description of the entity.", - "disable_correlation": true, - "ui-priority": 1, - "misp-attribute": "text" - }, - "name": { - "description": "Name of the entity.", - "ui-priority": 0, - "misp-attribute": "text" + "business": { + "description": "Business area of the entity.", + "misp-attribute": "text", + "ui-priority": 0 }, "commercial-name": { "description": "Commercial name of the entity.", - "ui-priority": 0, - "misp-attribute": "text" + "misp-attribute": "text", + "ui-priority": 0 }, "legal-form": { "description": "Legal form of the entity.", - "ui-priority": 0, - "misp-attribute": "text" - }, - "registration-number": { - "description": "Registration number of the entity in the relevant authority.", - "ui-priority": 0, - "misp-attribute": "text" - }, - "business": { - "description": "Business area of the entity.", - "ui-priority": 0, - "misp-attribute": "text" - }, - "phone-number": { - "description": "Phone number of the entity.", - "ui-priority": 0, - "misp-attribute": "phone-number" - }, - "website": { - "description": "Website of the entity.", - "ui-priority": 0, - "misp-attribute": "link" + "misp-attribute": "text", + "ui-priority": 0 }, "logo": { "description": "Logo of the entity.", - "ui-priority": 0, - "misp-attribute": "attachment" + "misp-attribute": "attachment", + "ui-priority": 0 + }, + "name": { + "description": "Name of the entity.", + "misp-attribute": "text", + "ui-priority": 0 + }, + "phone-number": { + "description": "Phone number of the entity.", + "misp-attribute": "phone-number", + "ui-priority": 0 + }, + "registration-number": { + "description": "Registration number of the entity in the relevant authority.", + "misp-attribute": "text", + "ui-priority": 0 + }, + "text": { + "description": "A description of the entity.", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 1 + }, + "website": { + "description": "Website of the entity.", + "misp-attribute": "link", + "ui-priority": 0 } }, - "version": 2, "description": "An object to describe a legal entity.", "meta-category": "misc", + "name": "legal-entity", + "requiredOneOf": [ + "name" + ], "uuid": "14f5688f-d89c-469f-9878-c48bf6c41c65", - "name": "legal-entity" -} + "version": 2 +} \ No newline at end of file diff --git a/objects/lnk/definition.json b/objects/lnk/definition.json index 83eca79..704b4b6 100644 --- a/objects/lnk/definition.json +++ b/objects/lnk/definition.json @@ -1,4 +1,267 @@ { + "attributes": { + "birth-droid-file-identifier": { + "description": "Birth droid volume identifier (UUIDv1 where MAC can be extracted)", + "misp-attribute": "text", + "ui-priority": 0 + }, + "birth-droid-volume-identifier": { + "description": "Droid volume identifier", + "misp-attribute": "text", + "ui-priority": 0 + }, + "droid-file-identifier": { + "description": "Droid file identifier (UUIDv1 where MAC can be extracted)", + "misp-attribute": "text", + "ui-priority": 0 + }, + "droid-volume-identifier": { + "description": "Droid volume identifier", + "misp-attribute": "text", + "ui-priority": 0 + }, + "entropy": { + "description": "Entropy of the whole file", + "disable_correlation": true, + "misp-attribute": "float", + "ui-priority": 1 + }, + "filename": { + "categories": [ + "Payload delivery", + "Artifacts dropped", + "Payload installation", + "External analysis" + ], + "description": "Filename on disk", + "disable_correlation": true, + "misp-attribute": "filename", + "multiple": true, + "ui-priority": 1 + }, + "fullpath": { + "description": "Complete path of the LNK filename including the filename", + "misp-attribute": "text", + "multiple": true, + "ui-priority": 0 + }, + "lnk-access-time": { + "categories": [ + "Other" + ], + "description": "Access time of the LNK", + "disable_correlation": true, + "misp-attribute": "datetime", + "ui-priority": 0 + }, + "lnk-command-line-arguments": { + "description": "LNK command line arguments", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 0 + }, + "lnk-creation-time": { + "categories": [ + "Other" + ], + "description": "Creation time of the LNK", + "disable_correlation": true, + "misp-attribute": "datetime", + "ui-priority": 0 + }, + "lnk-description": { + "description": "LNK description", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 0 + }, + "lnk-drive-serial-number": { + "description": "Drive serial number", + "misp-attribute": "text", + "ui-priority": 0 + }, + "lnk-drive-type": { + "description": "Drive type", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 0 + }, + "lnk-file-attribute-flags": { + "description": "File attribute flags", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 0 + }, + "lnk-file-size": { + "description": "Size of the target file, in bytes", + "disable_correlation": true, + "misp-attribute": "size-in-bytes", + "ui-priority": 0 + }, + "lnk-hot-key-value": { + "description": "Hot Key value", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 0 + }, + "lnk-icon-index": { + "description": "Icon index", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 0 + }, + "lnk-local-path": { + "description": "Local path", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 0 + }, + "lnk-modification-time": { + "categories": [ + "Other" + ], + "description": "Modification time of the LNK", + "disable_correlation": true, + "misp-attribute": "datetime", + "ui-priority": 0 + }, + "lnk-relative-path": { + "description": "Relative path", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 0 + }, + "lnk-show-window-value": { + "description": "Show Window value", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 0 + }, + "lnk-volume-label": { + "description": "Volume label", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 0 + }, + "lnk-working-directory": { + "description": "LNK working path", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 0 + }, + "machine-identifier": { + "description": "Machine identifier", + "misp-attribute": "text", + "ui-priority": 0 + }, + "malware-sample": { + "description": "The LNK file itself (binary)", + "misp-attribute": "malware-sample", + "ui-priority": 1 + }, + "md5": { + "description": "[Insecure] MD5 hash (128 bits)", + "misp-attribute": "md5", + "recommended": false, + "ui-priority": 1 + }, + "path": { + "description": "Path of the LNK filename complete or partial", + "disable_correlation": true, + "misp-attribute": "text", + "multiple": true, + "ui-priority": 0 + }, + "pattern-in-file": { + "categories": [ + "Artifacts dropped", + "Payload installation", + "External analysis" + ], + "description": "Pattern that can be found in the file", + "misp-attribute": "pattern-in-file", + "multiple": true, + "ui-priority": 1 + }, + "sha1": { + "description": "[Insecure] Secure Hash Algorithm 1 (160 bits)", + "misp-attribute": "sha1", + "recommended": false, + "ui-priority": 1 + }, + "sha224": { + "description": "Secure Hash Algorithm 2 (224 bits)", + "misp-attribute": "sha224", + "recommended": false, + "ui-priority": 0 + }, + "sha256": { + "description": "Secure Hash Algorithm 2 (256 bits)", + "misp-attribute": "sha256", + "ui-priority": 1 + }, + "sha384": { + "description": "Secure Hash Algorithm 2 (384 bits)", + "misp-attribute": "sha384", + "recommended": false, + "ui-priority": 0 + }, + "sha512": { + "description": "Secure Hash Algorithm 2 (512 bits)", + "misp-attribute": "sha512", + "ui-priority": 1 + }, + "sha512/224": { + "description": "Secure Hash Algorithm 2 (224 bits)", + "misp-attribute": "sha512/224", + "recommended": false, + "ui-priority": 0 + }, + "sha512/256": { + "description": "Secure Hash Algorithm 2 (256 bits)", + "misp-attribute": "sha512/256", + "recommended": false, + "ui-priority": 0 + }, + "size-in-bytes": { + "description": "Size of the LNK file, in bytes", + "disable_correlation": true, + "misp-attribute": "size-in-bytes", + "ui-priority": 0 + }, + "ssdeep": { + "description": "Fuzzy hash using context triggered piecewise hashes (CTPH)", + "misp-attribute": "ssdeep", + "ui-priority": 0 + }, + "state": { + "description": "State of the LNK file", + "disable_correlation": true, + "misp-attribute": "text", + "multiple": true, + "ui-priority": 0, + "values_list": [ + "Malicious", + "Harmless", + "Trusted" + ] + }, + "text": { + "description": "Free text value to attach to the file", + "disable_correlation": true, + "misp-attribute": "text", + "recommended": false, + "ui-priority": 1 + }, + "tlsh": { + "description": "Fuzzy hash by Trend Micro: Locality Sensitive Hash", + "misp-attribute": "tlsh", + "ui-priority": 0 + } + }, + "description": "LNK object describing a Windows LNK binary file (aka Windows shortcut)", + "meta-category": "file", + "name": "lnk", "requiredOneOf": [ "filename", "ssdeep", @@ -11,269 +274,6 @@ "sha512/224", "sha512/256" ], - "attributes": { - "md5": { - "description": "[Insecure] MD5 hash (128 bits)", - "ui-priority": 1, - "misp-attribute": "md5", - "recommended": false - }, - "sha1": { - "description": "[Insecure] Secure Hash Algorithm 1 (160 bits)", - "ui-priority": 1, - "misp-attribute": "sha1", - "recommended": false - }, - "sha224": { - "description": "Secure Hash Algorithm 2 (224 bits)", - "ui-priority": 0, - "misp-attribute": "sha224", - "recommended": false - }, - "sha256": { - "description": "Secure Hash Algorithm 2 (256 bits)", - "ui-priority": 1, - "misp-attribute": "sha256" - }, - "sha384": { - "description": "Secure Hash Algorithm 2 (384 bits)", - "ui-priority": 0, - "misp-attribute": "sha384", - "recommended": false - }, - "sha512": { - "description": "Secure Hash Algorithm 2 (512 bits)", - "ui-priority": 1, - "misp-attribute": "sha512" - }, - "sha512/224": { - "description": "Secure Hash Algorithm 2 (224 bits)", - "ui-priority": 0, - "misp-attribute": "sha512/224", - "recommended": false - }, - "sha512/256": { - "description": "Secure Hash Algorithm 2 (256 bits)", - "ui-priority": 0, - "misp-attribute": "sha512/256", - "recommended": false - }, - "ssdeep": { - "description": "Fuzzy hash using context triggered piecewise hashes (CTPH)", - "ui-priority": 0, - "misp-attribute": "ssdeep" - }, - "size-in-bytes": { - "description": "Size of the LNK file, in bytes", - "disable_correlation": true, - "ui-priority": 0, - "misp-attribute": "size-in-bytes" - }, - "entropy": { - "description": "Entropy of the whole file", - "disable_correlation": true, - "ui-priority": 1, - "misp-attribute": "float" - }, - "pattern-in-file": { - "description": "Pattern that can be found in the file", - "categories": [ - "Artifacts dropped", - "Payload installation", - "External analysis" - ], - "ui-priority": 1, - "misp-attribute": "pattern-in-file", - "multiple": true - }, - "text": { - "description": "Free text value to attach to the file", - "disable_correlation": true, - "ui-priority": 1, - "misp-attribute": "text", - "recommended": false - }, - "malware-sample": { - "description": "The LNK file itself (binary)", - "ui-priority": 1, - "misp-attribute": "malware-sample" - }, - "filename": { - "description": "Filename on disk", - "disable_correlation": true, - "multiple": true, - "categories": [ - "Payload delivery", - "Artifacts dropped", - "Payload installation", - "External analysis" - ], - "ui-priority": 1, - "misp-attribute": "filename" - }, - "path": { - "description": "Path of the LNK filename complete or partial", - "disable_correlation": true, - "multiple": true, - "ui-priority": 0, - "misp-attribute": "text" - }, - "fullpath": { - "description": "Complete path of the LNK filename including the filename", - "multiple": true, - "ui-priority": 0, - "misp-attribute": "text" - }, - "tlsh": { - "description": "Fuzzy hash by Trend Micro: Locality Sensitive Hash", - "ui-priority": 0, - "misp-attribute": "tlsh" - }, - "state": { - "misp-attribute": "text", - "ui-priority": 0, - "description": "State of the LNK file", - "multiple": true, - "disable_correlation": true, - "values_list": [ - "Malicious", - "Harmless", - "Trusted" - ] - }, - "lnk-creation-time": { - "description": "Creation time of the LNK", - "categories": [ - "Other" - ], - "ui-priority": 0, - "misp-attribute": "datetime", - "disable_correlation": true - }, - "lnk-modification-time": { - "description": "Modification time of the LNK", - "categories": [ - "Other" - ], - "ui-priority": 0, - "misp-attribute": "datetime", - "disable_correlation": true - }, - "lnk-access-time": { - "description": "Access time of the LNK", - "categories": [ - "Other" - ], - "ui-priority": 0, - "misp-attribute": "datetime", - "disable_correlation": true - }, - "lnk-file-size": { - "description": "Size of the target file, in bytes", - "disable_correlation": true, - "ui-priority": 0, - "misp-attribute": "size-in-bytes" - }, - "lnk-icon-index": { - "description": "Icon index", - "disable_correlation": true, - "ui-priority": 0, - "misp-attribute": "text" - }, - "lnk-show-window-value": { - "description": "Show Window value", - "disable_correlation": true, - "ui-priority": 0, - "misp-attribute": "text" - }, - "lnk-hot-key-value": { - "description": "Hot Key value", - "disable_correlation": true, - "ui-priority": 0, - "misp-attribute": "text" - }, - "lnk-file-attribute-flags": { - "description": "File attribute flags", - "disable_correlation": true, - "ui-priority": 0, - "misp-attribute": "text" - }, - "lnk-drive-type": { - "description": "Drive type", - "disable_correlation": true, - "ui-priority": 0, - "misp-attribute": "text" - }, - "lnk-drive-serial-number": { - "description": "Drive serial number", - "ui-priority": 0, - "misp-attribute": "text" - }, - "lnk-volume-label": { - "description": "Volume label", - "disable_correlation": true, - "ui-priority": 0, - "misp-attribute": "text" - }, - "lnk-local-path": { - "description": "Local path", - "disable_correlation": true, - "ui-priority": 0, - "misp-attribute": "text" - }, - "lnk-description": { - "description": "LNK description", - "disable_correlation": true, - "ui-priority": 0, - "misp-attribute": "text" - }, - "lnk-relative-path": { - "description": "Relative path", - "disable_correlation": true, - "ui-priority": 0, - "misp-attribute": "text" - }, - "lnk-working-directory": { - "description": "LNK working path", - "disable_correlation": true, - "ui-priority": 0, - "misp-attribute": "text" - }, - "lnk-command-line-arguments": { - "description": "LNK command line arguments", - "disable_correlation": true, - "ui-priority": 0, - "misp-attribute": "text" - }, - "machine-identifier": { - "description": "Machine identifier", - "ui-priority": 0, - "misp-attribute": "text" - }, - "droid-volume-identifier": { - "description": "Droid volume identifier", - "ui-priority": 0, - "misp-attribute": "text" - }, - "droid-file-identifier": { - "description": "Droid file identifier (UUIDv1 where MAC can be extracted)", - "ui-priority": 0, - "misp-attribute": "text" - }, - "birth-droid-volume-identifier": { - "description": "Droid volume identifier", - "ui-priority": 0, - "misp-attribute": "text" - }, - "birth-droid-file-identifier": { - "description": "Birth droid volume identifier (UUIDv1 where MAC can be extracted)", - "ui-priority": 0, - "misp-attribute": "text" - } - }, - "version": 1, - "description": "LNK object describing a Windows LNK binary file (aka Windows shortcut)", - "meta-category": "file", "uuid": "ad13533e-1853-4da0-a111-33a7ce7e6c09", - "name": "lnk" -} + "version": 1 +} \ No newline at end of file diff --git a/objects/macho-section/definition.json b/objects/macho-section/definition.json index f2258f5..fced91f 100644 --- a/objects/macho-section/definition.json +++ b/objects/macho-section/definition.json @@ -1,4 +1,85 @@ { + "attributes": { + "entropy": { + "description": "Entropy of the whole section", + "disable_correlation": true, + "misp-attribute": "float", + "ui-priority": 0 + }, + "md5": { + "description": "[Insecure] MD5 hash (128 bits)", + "misp-attribute": "md5", + "recommended": false, + "ui-priority": 1 + }, + "name": { + "description": "Name of the section", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 1 + }, + "sha1": { + "description": "[Insecure] Secure Hash Algorithm 1 (160 bits)", + "misp-attribute": "sha1", + "recommended": false, + "ui-priority": 1 + }, + "sha224": { + "description": "Secure Hash Algorithm 2 (224 bits)", + "misp-attribute": "sha224", + "recommended": false, + "ui-priority": 0 + }, + "sha256": { + "description": "Secure Hash Algorithm 2 (256 bits)", + "misp-attribute": "sha256", + "ui-priority": 1 + }, + "sha384": { + "description": "Secure Hash Algorithm 2 (384 bits)", + "misp-attribute": "sha384", + "recommended": false, + "ui-priority": 0 + }, + "sha512": { + "description": "Secure Hash Algorithm 2 (512 bits)", + "misp-attribute": "sha512", + "ui-priority": 1 + }, + "sha512/224": { + "description": "Secure Hash Algorithm 2 (224 bits)", + "misp-attribute": "sha512/224", + "recommended": false, + "ui-priority": 0 + }, + "sha512/256": { + "description": "Secure Hash Algorithm 2 (256 bits)", + "misp-attribute": "sha512/256", + "recommended": false, + "ui-priority": 0 + }, + "size-in-bytes": { + "description": "Size of the section, in bytes", + "disable_correlation": true, + "misp-attribute": "size-in-bytes", + "ui-priority": 1 + }, + "ssdeep": { + "description": "Fuzzy hash using context triggered piecewise hashes (CTPH)", + "misp-attribute": "ssdeep", + "ui-priority": 0 + }, + "text": { + "description": "Free text value to attach to the section", + "disable_correlation": true, + "misp-attribute": "text", + "recommended": false, + "ui-priority": 1 + } + }, + "description": "Object describing a section of a file in Mach-O format.", + "meta-category": "file", + "name": "macho-section", "requiredOneOf": [ "text", "name", @@ -11,87 +92,6 @@ "sha512/224", "sha512/256" ], - "attributes": { - "md5": { - "description": "[Insecure] MD5 hash (128 bits)", - "ui-priority": 1, - "misp-attribute": "md5", - "recommended": false - }, - "sha1": { - "description": "[Insecure] Secure Hash Algorithm 1 (160 bits)", - "ui-priority": 1, - "misp-attribute": "sha1", - "recommended": false - }, - "sha224": { - "description": "Secure Hash Algorithm 2 (224 bits)", - "ui-priority": 0, - "misp-attribute": "sha224", - "recommended": false - }, - "sha256": { - "description": "Secure Hash Algorithm 2 (256 bits)", - "ui-priority": 1, - "misp-attribute": "sha256" - }, - "sha384": { - "description": "Secure Hash Algorithm 2 (384 bits)", - "ui-priority": 0, - "misp-attribute": "sha384", - "recommended": false - }, - "sha512": { - "description": "Secure Hash Algorithm 2 (512 bits)", - "ui-priority": 1, - "misp-attribute": "sha512" - }, - "sha512/224": { - "description": "Secure Hash Algorithm 2 (224 bits)", - "ui-priority": 0, - "misp-attribute": "sha512/224", - "recommended": false - }, - "sha512/256": { - "description": "Secure Hash Algorithm 2 (256 bits)", - "ui-priority": 0, - "misp-attribute": "sha512/256", - "recommended": false - }, - "ssdeep": { - "description": "Fuzzy hash using context triggered piecewise hashes (CTPH)", - "ui-priority": 0, - "misp-attribute": "ssdeep" - }, - "entropy": { - "description": "Entropy of the whole section", - "disable_correlation": true, - "ui-priority": 0, - "misp-attribute": "float" - }, - "name": { - "description": "Name of the section", - "disable_correlation": true, - "ui-priority": 1, - "misp-attribute": "text" - }, - "size-in-bytes": { - "description": "Size of the section, in bytes", - "disable_correlation": true, - "ui-priority": 1, - "misp-attribute": "size-in-bytes" - }, - "text": { - "description": "Free text value to attach to the section", - "disable_correlation": true, - "ui-priority": 1, - "misp-attribute": "text", - "recommended": false - } - }, - "version": 2, - "description": "Object describing a section of a file in Mach-O format.", - "meta-category": "file", "uuid": "fca3c534-d188-4964-9c6e-9922e1dfe66e", - "name": "macho-section" -} + "version": 2 +} \ No newline at end of file diff --git a/objects/macho/definition.json b/objects/macho/definition.json index 956fbb0..a100617 100644 --- a/objects/macho/definition.json +++ b/objects/macho/definition.json @@ -1,18 +1,33 @@ { - "requiredOneOf": [ - "text", - "name", - "entrypoint-address" - ], "attributes": { "entrypoint-address": { "description": "Address of the entry point", "disable_correlation": true, - "ui-priority": 0, - "misp-attribute": "text" + "misp-attribute": "text", + "ui-priority": 0 + }, + "name": { + "description": "Binary's name", + "disable_correlation": false, + "misp-attribute": "text", + "ui-priority": 1 + }, + "number-sections": { + "description": "Number of sections", + "disable_correlation": true, + "misp-attribute": "counter", + "ui-priority": 0 + }, + "text": { + "description": "Free text value to attach to the Mach-O file", + "disable_correlation": true, + "misp-attribute": "text", + "recommended": false, + "ui-priority": 1 }, "type": { "description": "Type of Mach-O", + "misp-attribute": "text", "sane_default": [ "BUNDLE", "CORE", @@ -26,32 +41,17 @@ "OBJECT", "PRELOAD" ], - "ui-priority": 0, - "misp-attribute": "text" - }, - "number-sections": { - "description": "Number of sections", - "disable_correlation": true, - "ui-priority": 0, - "misp-attribute": "counter" - }, - "name": { - "description": "Binary's name", - "disable_correlation": false, - "ui-priority": 1, - "misp-attribute": "text" - }, - "text": { - "description": "Free text value to attach to the Mach-O file", - "disable_correlation": true, - "ui-priority": 1, - "misp-attribute": "text", - "recommended": false + "ui-priority": 0 } }, - "version": 2, "description": "Object describing a file in Mach-O format.", "meta-category": "file", + "name": "macho", + "requiredOneOf": [ + "text", + "name", + "entrypoint-address" + ], "uuid": "23fb8371-c7e3-45fe-b897-fdf074f95267", - "name": "macho" -} + "version": 2 +} \ No newline at end of file diff --git a/objects/mactime-timeline-analysis/definition.json b/objects/mactime-timeline-analysis/definition.json index cb20d2b..f77dfea 100644 --- a/objects/mactime-timeline-analysis/definition.json +++ b/objects/mactime-timeline-analysis/definition.json @@ -1,30 +1,8 @@ { - "requiredOneOf": [ - "file-path", - "activityType", - "datetime" - ], "attributes": { - "file-path": { - "description": "Location of the file on the disc", - "ui-priority": 0, - "misp-attribute": "text" - }, - "datetime": { - "description": "Date and time when the operation was conducted on the file", - "ui-priority": 0, - "misp-attribute": "datetime", - "disable_correlation": true - }, - "file_size": { - "description": "Determines the file size in bytes", - "ui-priority": 0, - "misp-attribute": "text", - "disable_correlation": true - }, "activityType": { "description": "Determines the type of activity conducted on the file at a given time", - "ui-priority": 0, + "disable_correlation": true, "misp-attribute": "text", "sane_default": [ "Accessed", @@ -33,24 +11,46 @@ "Modified", "Other" ], - "disable_correlation": true + "ui-priority": 0 }, - "filePermissions": { - "description": "Describes permissions assigned the file", - "ui-priority": 0, - "misp-attribute": "text", - "disable_correlation": true + "datetime": { + "description": "Date and time when the operation was conducted on the file", + "disable_correlation": true, + "misp-attribute": "datetime", + "ui-priority": 0 }, "file": { "description": "Mactime output file", - "ui-priority": 0, + "disable_correlation": true, "misp-attribute": "attachment", - "disable_correlation": true + "ui-priority": 0 + }, + "file-path": { + "description": "Location of the file on the disc", + "misp-attribute": "text", + "ui-priority": 0 + }, + "filePermissions": { + "description": "Describes permissions assigned the file", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 0 + }, + "file_size": { + "description": "Determines the file size in bytes", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 0 } }, - "version": 3, "description": "Mactime template, used in forensic investigations to describe the timeline of a file activity", "meta-category": "file", + "name": "mactime-timeline-analysis", + "requiredOneOf": [ + "file-path", + "activityType", + "datetime" + ], "uuid": "9297982e-be62-4772-a665-c91f5a8d639", - "name": "mactime-timeline-analysis" -} + "version": 3 +} \ No newline at end of file diff --git a/objects/malware-config/definition.json b/objects/malware-config/definition.json index 435fc95..e8ec946 100644 --- a/objects/malware-config/definition.json +++ b/objects/malware-config/definition.json @@ -1,51 +1,51 @@ { - "requiredOneOf": [ - "config" - ], "attributes": { "config": { "description": "Raw (decrypted, decoded) text of the malware configuration.", - "ui-priority": 1, - "misp-attribute": "text" + "misp-attribute": "text", + "ui-priority": 1 + }, + "encrypted": { + "description": "Encrypted or encoded text of the malware configuration in base64.", + "misp-attribute": "text", + "ui-priority": 1 + }, + "first-seen": { + "description": "When the malware configuration has been seen for the first time.", + "disable_correlation": true, + "misp-attribute": "datetime", + "ui-priority": 0 }, "format": { + "description": "Original format of the malware configuration.", + "disable_correlation": true, + "misp-attribute": "text", "sane_default": [ "JSON", "yaml", "INI", "other" ], - "description": "Original format of the malware configuration.", - "ui-priority": 0, - "misp-attribute": "text", - "disable_correlation": true - }, - "encrypted": { - "description": "Encrypted or encoded text of the malware configuration in base64.", - "ui-priority": 1, - "misp-attribute": "text" - }, - "password": { - "description": "Password or encryption key used to encrypt the malware configuration.", - "ui-priority": 1, - "misp-attribute": "text" + "ui-priority": 0 }, "last-seen": { "description": "When the malware configuration has been seen for the last time.", "disable_correlation": true, - "ui-priority": 0, - "misp-attribute": "datetime" + "misp-attribute": "datetime", + "ui-priority": 0 }, - "first-seen": { - "description": "When the malware configuration has been seen for the first time.", - "disable_correlation": true, - "ui-priority": 0, - "misp-attribute": "datetime" + "password": { + "description": "Password or encryption key used to encrypt the malware configuration.", + "misp-attribute": "text", + "ui-priority": 1 } }, - "version": 1, "description": "Malware configuration recovered or extracted from a malicious binary.", "meta-category": "file", + "name": "malware-config", + "requiredOneOf": [ + "config" + ], "uuid": "8200b79b-1d8c-49a8-9a63-7710e613c059", - "name": "malware-config" -} + "version": 1 +} \ No newline at end of file diff --git a/objects/meme-image/definition.json b/objects/meme-image/definition.json index 06cb1a7..d6b2484 100644 --- a/objects/meme-image/definition.json +++ b/objects/meme-image/definition.json @@ -1,21 +1,11 @@ { - "requiredOneOf": [ - "attachment", - "archive", - "document-text" - ], "attributes": { - "username": { - "description": "Username who posted the meme.", - "ui-priority": 0, - "misp-attribute": "text" - }, "5Ds-of-propaganda": { "description": "5 D's of propaganda are tactics of rebuttal used to defend against criticism and adversarial narratives.", - "ui-priority": 1, - "misp-attribute": "text", "disable_correlation": true, + "misp-attribute": "text", "multiple": true, + "ui-priority": 1, "values_list": [ "dismiss", "distort", @@ -24,84 +14,94 @@ "divide" ] }, - "attachment": { - "description": "The image file.", - "ui-priority": 1, - "misp-attribute": "attachment" - }, - "document-text": { - "description": "Raw text of meme", - "ui-priority": 1, - "misp-attribute": "text" - }, - "meme-reference": { - "description": "A link to know-your-meme or similar reference material.", - "ui-priority": 1, - "misp-attribute": "link" - }, "a/b-test": { "description": "A flag to define if this meme is part of an a/b test. If set to true, it is part of an a/b test set.", "disable_correlation": true, - "ui-priority": 0, - "misp-attribute": "boolean" - }, - "crosspost": { - "description": "Safe site where the meme has been posted.", - "ui-priority": 0, - "misp-attribute": "link", - "multiple": true - }, - "crosspost-unsafe": { - "description": "Unsafe site where the meme has been posted.", - "ui-priority": 0, - "misp-attribute": "url", - "multiple": true - }, - "url": { - "description": "Original URL location of the meme (potentially malicious)", - "ui-priority": 1, - "misp-attribute": "url" - }, - "link": { - "description": "Original link into the meme (Supposed harmless)", - "ui-priority": 1, - "misp-attribute": "link" + "misp-attribute": "boolean", + "ui-priority": 0 }, "archive": { "description": "Archive of the original document (Internet Archive, Archive.is, etc).", - "ui-priority": 1, + "misp-attribute": "link", "multiple": true, - "misp-attribute": "link" + "ui-priority": 1 + }, + "attachment": { + "description": "The image file.", + "misp-attribute": "attachment", + "ui-priority": 1 + }, + "crosspost": { + "description": "Safe site where the meme has been posted.", + "misp-attribute": "link", + "multiple": true, + "ui-priority": 0 + }, + "crosspost-unsafe": { + "description": "Unsafe site where the meme has been posted.", + "misp-attribute": "url", + "multiple": true, + "ui-priority": 0 + }, + "document-text": { + "description": "Raw text of meme", + "misp-attribute": "text", + "ui-priority": 1 + }, + "first-seen": { + "description": "When the meme has been accessible or seen for the first time.", + "disable_correlation": true, + "misp-attribute": "datetime", + "ui-priority": 0 + }, + "last-seen": { + "description": "When the meme has been accessible or seen for the last time.", + "disable_correlation": true, + "misp-attribute": "datetime", + "ui-priority": 0 + }, + "link": { + "description": "Original link into the meme (Supposed harmless)", + "misp-attribute": "link", + "ui-priority": 1 + }, + "meme-reference": { + "description": "A link to know-your-meme or similar reference material.", + "misp-attribute": "link", + "ui-priority": 1 }, "objective": { "description": "Objective of the meme.", - "ui-priority": 1, - "misp-attribute": "text", "disable_correlation": true, + "misp-attribute": "text", "multiple": true, "sane_default": [ "Disinformation", "Advertising", "Parody", "Other" - ] + ], + "ui-priority": 1 }, - "last-seen": { - "description": "When the meme has been accessible or seen for the last time.", - "disable_correlation": true, - "ui-priority": 0, - "misp-attribute": "datetime" + "url": { + "description": "Original URL location of the meme (potentially malicious)", + "misp-attribute": "url", + "ui-priority": 1 }, - "first-seen": { - "description": "When the meme has been accessible or seen for the first time.", - "disable_correlation": true, - "ui-priority": 0, - "misp-attribute": "datetime" + "username": { + "description": "Username who posted the meme.", + "misp-attribute": "text", + "ui-priority": 0 } }, - "version": 7, "description": "Object describing a meme (image).", "meta-category": "file", + "name": "meme-image", + "requiredOneOf": [ + "attachment", + "archive", + "document-text" + ], "uuid": "6f6c3b61-f085-475e-93df-2e2d9c2fb0f6", - "name": "meme-image" -} + "version": 7 +} \ No newline at end of file diff --git a/objects/microblog/definition.json b/objects/microblog/definition.json index fd8dbb8..44216a8 100644 --- a/objects/microblog/definition.json +++ b/objects/microblog/definition.json @@ -1,52 +1,119 @@ { - "requiredOneOf": [ - "post", - "archive", - "url", - "link", - "attachment" - ], "attributes": { - "post": { - "description": "Raw text of the post.", - "ui-priority": 1, - "misp-attribute": "text" - }, - "title": { - "description": "Title of the post.", - "ui-priority": 1, - "misp-attribute": "text" - }, - "url": { - "description": "Original URL of the microblog post (potentially malicious).", - "ui-priority": 1, - "multiple": true, - "misp-attribute": "url" - }, - "link": { - "description": "Original link to the microblog post (supposed harmless).", - "ui-priority": 1, - "misp-attribute": "link", - "multiple": true, - "to_ids": false - }, "archive": { "description": "Archive of the original document (Internet Archive, Archive.is, etc).", - "ui-priority": 1, + "misp-attribute": "link", "multiple": true, - "misp-attribute": "link" + "ui-priority": 1 }, "attachment": { "description": "The microblog post file or screen capture.", - "ui-priority": 1, + "misp-attribute": "attachment", "multiple": true, - "misp-attribute": "attachment" + "ui-priority": 1 + }, + "creation-date": { + "description": "Initial creation of the microblog post", + "misp-attribute": "datetime", + "ui-priority": 0 + }, + "display-name": { + "description": "Display name of the account who posted the microblog.", + "misp-attribute": "text", + "ui-priority": 0 + }, + "embedded-link": { + "description": "Link into the microblog post", + "misp-attribute": "url", + "multiple": true, + "ui-priority": 0 + }, + "embedded-safe-link": { + "description": "Safe link into the microblog post", + "misp-attribute": "link", + "multiple": true, + "ui-priority": 0 + }, + "hashtag": { + "description": "Hashtag embedded in the microblog post", + "misp-attribute": "text", + "multiple": true, + "ui-priority": 0 + }, + "in-reply-to-display-name": { + "description": "The user display name of the microblog this post replies to.", + "misp-attribute": "text", + "multiple": true, + "ui-priority": 0 + }, + "in-reply-to-status-id": { + "description": "The microblog ID of the microblog this post replies to.", + "misp-attribute": "text", + "multiple": true, + "ui-priority": 0 + }, + "in-reply-to-user-id": { + "description": "The user ID of the microblog this post replies to.", + "misp-attribute": "text", + "multiple": true, + "ui-priority": 0 + }, + "language": { + "description": "The language of the post.", + "misp-attribute": "text", + "multiple": true, + "ui-priority": 0 + }, + "link": { + "description": "Original link to the microblog post (supposed harmless).", + "misp-attribute": "link", + "multiple": true, + "to_ids": false, + "ui-priority": 1 + }, + "modification-date": { + "description": "Last update of the microblog post", + "misp-attribute": "datetime", + "ui-priority": 0 + }, + "post": { + "description": "Raw text of the post.", + "misp-attribute": "text", + "ui-priority": 1 + }, + "removal-date": { + "description": "When the microblog post was removed.", + "misp-attribute": "datetime", + "ui-priority": 0 + }, + "state": { + "description": "State of the microblog post", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 0, + "values_list": [ + "Informative", + "Malicious", + "Misinformation", + "Disinformation", + "Unknown" + ] + }, + "title": { + "description": "Title of the post.", + "misp-attribute": "text", + "ui-priority": 1 + }, + "twitter-id": { + "description": "The microblog post id.", + "misp-attribute": "twitter-id", + "multiple": true, + "ui-priority": 0 }, "type": { "description": "Type of the microblog post", - "ui-priority": 1, - "misp-attribute": "text", "disable_correlation": true, + "misp-attribute": "text", "sane_default": [ "Twitter", "Facebook", @@ -56,115 +123,48 @@ "Instagram", "Forum", "Other" - ] + ], + "ui-priority": 1 }, - "state": { - "misp-attribute": "text", - "ui-priority": 0, - "description": "State of the microblog post", - "disable_correlation": true, - "values_list": [ - "Informative", - "Malicious", - "Misinformation", - "Disinformation", - "Unknown" - ] + "url": { + "description": "Original URL of the microblog post (potentially malicious).", + "misp-attribute": "url", + "multiple": true, + "ui-priority": 1 }, "username": { "description": "Username who posted the microblog post (without the @ prefix)", - "ui-priority": 0, - "misp-attribute": "text" + "misp-attribute": "text", + "ui-priority": 0 }, - "display-name": { - "description": "Display name of the account who posted the microblog.", - "ui-priority": 0, - "misp-attribute": "text" + "username-quoted": { + "description": "Username who are quoted in the microblog post.", + "misp-attribute": "text", + "multiple": true, + "ui-priority": 0 }, "verified-username": { "description": "Is the username account verified by the operator of the microblog platform", - "ui-priority": 0, - "misp-attribute": "text", "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 0, "values_list": [ "Verified", "Unverified", "Unknown" ] - }, - "creation-date": { - "description": "Initial creation of the microblog post", - "ui-priority": 0, - "misp-attribute": "datetime" - }, - "modification-date": { - "description": "Last update of the microblog post", - "ui-priority": 0, - "misp-attribute": "datetime" - }, - "in-reply-to-user-id": { - "description": "The user ID of the microblog this post replies to.", - "ui-priority": 0, - "misp-attribute": "text", - "multiple": true - }, - "in-reply-to-status-id": { - "description": "The microblog ID of the microblog this post replies to.", - "ui-priority": 0, - "misp-attribute": "text", - "multiple": true - }, - "in-reply-to-display-name": { - "description": "The user display name of the microblog this post replies to.", - "ui-priority": 0, - "misp-attribute": "text", - "multiple": true - }, - "language": { - "description": "The language of the post.", - "ui-priority": 0, - "misp-attribute": "text", - "multiple": true - }, - "embedded-link": { - "description": "Link into the microblog post", - "ui-priority": 0, - "misp-attribute": "url", - "multiple": true - }, - "embedded-safe-link": { - "description": "Safe link into the microblog post", - "ui-priority": 0, - "misp-attribute": "link", - "multiple": true - }, - "removal-date": { - "description": "When the microblog post was removed.", - "ui-priority": 0, - "misp-attribute": "datetime" - }, - "username-quoted": { - "description": "Username who are quoted in the microblog post.", - "ui-priority": 0, - "multiple": true, - "misp-attribute": "text" - }, - "twitter-id": { - "description": "The microblog post id.", - "ui-priority": 0, - "multiple": true, - "misp-attribute": "twitter-id" - }, - "hashtag": { - "description": "Hashtag embedded in the microblog post", - "ui-priority": 0, - "misp-attribute": "text", - "multiple": true } }, - "version": 20, "description": "Microblog post like a Twitter tweet or a post on a Facebook wall.", "meta-category": "misc", + "name": "microblog", + "requiredOneOf": [ + "post", + "archive", + "url", + "link", + "attachment" + ], "uuid": "8ec8c911-ddbe-4f5b-895b-fbff70c42a60", - "name": "microblog" -} + "version": 20 +} \ No newline at end of file diff --git a/objects/mutex/definition.json b/objects/mutex/definition.json index f9d23aa..df22638 100644 --- a/objects/mutex/definition.json +++ b/objects/mutex/definition.json @@ -1,31 +1,31 @@ { - "requiredOneOf": [ - "name" - ], "attributes": { "description": { "description": "Description", - "ui-priority": 0, - "misp-attribute": "text" + "misp-attribute": "text", + "ui-priority": 0 + }, + "name": { + "description": "name of the mutex", + "misp-attribute": "text", + "ui-priority": 0 }, "operating-system": { "description": "Operating system where the mutex has been seen", - "ui-priority": 0, "misp-attribute": "text", "sane_default": [ "Windows", "Unix" - ] - }, - "name": { - "description": "name of the mutex", - "ui-priority": 0, - "misp-attribute": "text" + ], + "ui-priority": 0 } }, - "version": 1, "description": "Object to describe mutual exclusion locks (mutex) as seen in memory or computer program", "meta-category": "misc", + "name": "mutex", + "requiredOneOf": [ + "name" + ], "uuid": "9f5c1a68-2021-4faa-b409-61c899c86466", - "name": "mutex" -} + "version": 1 +} \ No newline at end of file diff --git a/objects/narrative/definition.json b/objects/narrative/definition.json index f57edcf..9c551cc 100644 --- a/objects/narrative/definition.json +++ b/objects/narrative/definition.json @@ -1,16 +1,11 @@ { - "requiredOneOf": [ - "attachment", - "archive", - "narrative-summary" - ], "attributes": { "5Ds-of-propaganda": { "description": "5 D's of propaganda are tactics of rebuttal used to defend against criticism and adversarial narratives.", - "ui-priority": 1, - "misp-attribute": "text", "disable_correlation": true, + "misp-attribute": "text", "multiple": true, + "ui-priority": 1, "values_list": [ "dismiss", "distort", @@ -19,62 +14,67 @@ "divide" ] }, + "archive": { + "description": "Archive of the original narrative source (Internet Archive, Archive.is, etc).", + "disable_correlation": true, + "misp-attribute": "link", + "multiple": true, + "ui-priority": 1 + }, "attachment": { "description": "Documents related to the narrative.", - "ui-priority": 1, - "misp-attribute": "attachment" - }, - "narrative-disproof": { - "description": "Disproof or evidence against the narrative.", - "disable_correlation": true, - "ui-priority": 1, - "misp-attribute": "text" - }, - "narrative-summary": { - "description": "A summary of the narrative.", - "ui-priority": 1, - "misp-attribute": "text" + "misp-attribute": "attachment", + "ui-priority": 1 }, "external-references": { "description": "Link to external references.", "disable_correlation": true, - "ui-priority": 1, - "misp-attribute": "link" + "misp-attribute": "link", + "ui-priority": 1 }, "link": { "description": "Original link to the narrative source (Supposed harmless)", - "ui-priority": 1, - "misp-attribute": "link" + "misp-attribute": "link", + "ui-priority": 1 }, - "url": { - "description": "Original link to the narrative source (Supposed malicious)", - "ui-priority": 1, - "misp-attribute": "url" - }, - "archive": { - "description": "Archive of the original narrative source (Internet Archive, Archive.is, etc).", + "narrative-disproof": { + "description": "Disproof or evidence against the narrative.", "disable_correlation": true, - "ui-priority": 1, - "multiple": true, - "misp-attribute": "link" + "misp-attribute": "text", + "ui-priority": 1 + }, + "narrative-summary": { + "description": "A summary of the narrative.", + "misp-attribute": "text", + "ui-priority": 1 }, "objective": { "description": "Objective of the narrative.", - "ui-priority": 1, - "misp-attribute": "text", "disable_correlation": true, + "misp-attribute": "text", "multiple": true, "sane_default": [ "Disinformation", "Advertising", "Parody", "Other" - ] + ], + "ui-priority": 1 + }, + "url": { + "description": "Original link to the narrative source (Supposed malicious)", + "misp-attribute": "url", + "ui-priority": 1 } }, - "version": 4, "description": "Object describing a narrative.", "meta-category": "misc", + "name": "narrative", + "requiredOneOf": [ + "attachment", + "archive", + "narrative-summary" + ], "uuid": "83bea299-514a-4719-a84b-f6fd0997fac1", - "name": "narrative" -} + "version": 4 +} \ No newline at end of file diff --git a/objects/netflow/definition.json b/objects/netflow/definition.json index 35d412b..5e80527 100644 --- a/objects/netflow/definition.json +++ b/objects/netflow/definition.json @@ -1,159 +1,159 @@ { - "name": "netflow", - "uuid": "bf148c58-3e7e-414e-8de8-5d96379ca77e", - "meta-category": "network", - "description": "Netflow object describes an network object based on the Netflowv5/v9 minimal definition", - "version": 2, "attributes": { - "ip-dst": { - "misp-attribute": "ip-dst", - "ui-priority": 1, - "categories": [ - "Network activity", - "External analysis" - ], - "description": "IP address destination of the netflow" + "byte-count": { + "description": "Bytes counted in this flow", + "disable_correlation": true, + "misp-attribute": "counter", + "ui-priority": 0 }, - "ip-src": { - "misp-attribute": "ip-src", - "ui-priority": 1, + "community-id": { + "description": "Community id of the represented flow", + "misp-attribute": "community-id", + "ui-priority": 0 + }, + "direction": { + "description": "Direction of this flow", + "disable_correlation": true, + "misp-attribute": "text", + "sane_default": [ + "Ingress", + "Egress" + ], + "ui-priority": 0 + }, + "dst-as": { "categories": [ "Network activity", "External analysis" ], - "description": "IP address source of the netflow" + "description": "Destination AS number for this flow", + "misp-attribute": "AS", + "ui-priority": 0 }, "dst-port": { + "categories": [ + "Network activity", + "External analysis" + ], "description": "Destination port of the netflow", "misp-attribute": "port", - "ui-priority": 1, - "categories": [ - "Network activity", - "External analysis" - ] + "ui-priority": 1 }, - "src-port": { - "description": "Source port of the netflow", - "misp-attribute": "port", - "ui-priority": 1, - "categories": [ - "Network activity", - "External analysis" - ] - }, - "tcp-flags": { - "misp-attribute": "text", - "ui-priority": 0, + "first-packet-seen": { + "description": "First packet seen in this flow", "disable_correlation": true, - "categories": [ - "Network activity", - "External analysis" - ], - "description": "TCP flags of the flow" + "misp-attribute": "datetime", + "ui-priority": 1 + }, + "flow-count": { + "description": "Flows counted in this flow", + "disable_correlation": true, + "misp-attribute": "counter", + "ui-priority": 0 }, "icmp-type": { - "misp-attribute": "text", - "ui-priority": 0, - "disable_correlation": true, "categories": [ "Network activity", "External analysis" ], - "description": "ICMP type of the flow (if the traffic is ICMP)" + "description": "ICMP type of the flow (if the traffic is ICMP)", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 0 + }, + "ip-dst": { + "categories": [ + "Network activity", + "External analysis" + ], + "description": "IP address destination of the netflow", + "misp-attribute": "ip-dst", + "ui-priority": 1 }, "ip-protocol-number": { - "misp-attribute": "size-in-bytes", - "ui-priority": 0, + "description": "IP protocol number of this flow", "disable_correlation": true, - "description": "IP protocol number of this flow" + "misp-attribute": "size-in-bytes", + "ui-priority": 0 + }, + "ip-src": { + "categories": [ + "Network activity", + "External analysis" + ], + "description": "IP address source of the netflow", + "misp-attribute": "ip-src", + "ui-priority": 1 + }, + "ip_version": { + "description": "IP version of this flow", + "disable_correlation": true, + "misp-attribute": "counter", + "ui-priority": 0 + }, + "last-packet-seen": { + "description": "Last packet seen in this flow", + "disable_correlation": true, + "misp-attribute": "datetime", + "ui-priority": 0 + }, + "packet-count": { + "description": "Packets counted in this flow", + "disable_correlation": true, + "misp-attribute": "counter", + "ui-priority": 0 }, "protocol": { + "description": "Protocol used for this flow", + "disable_correlation": true, "misp-attribute": "text", "ui-priority": 0, - "disable_correlation": true, "values_list": [ "TCP", "UDP", "ICMP", "IP" - ], - "description": "Protocol used for this flow" + ] }, "src-as": { - "misp-attribute": "AS", - "ui-priority": 0, "categories": [ "Network activity", "External analysis" ], - "description": "Source AS number for this flow" - }, - "dst-as": { + "description": "Source AS number for this flow", "misp-attribute": "AS", - "ui-priority": 0, + "ui-priority": 0 + }, + "src-port": { "categories": [ "Network activity", "External analysis" ], - "description": "Destination AS number for this flow" + "description": "Source port of the netflow", + "misp-attribute": "port", + "ui-priority": 1 }, - "ip_version": { - "misp-attribute": "counter", - "ui-priority": 0, + "tcp-flags": { + "categories": [ + "Network activity", + "External analysis" + ], + "description": "TCP flags of the flow", "disable_correlation": true, - "description": "IP version of this flow" - }, - "direction": { "misp-attribute": "text", - "ui-priority": 0, - "disable_correlation": true, - "sane_default": [ - "Ingress", - "Egress" - ], - "description": "Direction of this flow" - }, - "flow-count": { - "misp-attribute": "counter", - "ui-priority": 0, - "disable_correlation": true, - "description": "Flows counted in this flow" - }, - "packet-count": { - "misp-attribute": "counter", - "ui-priority": 0, - "disable_correlation": true, - "description": "Packets counted in this flow" - }, - "byte-count": { - "misp-attribute": "counter", - "ui-priority": 0, - "disable_correlation": true, - "description": "Bytes counted in this flow" - }, - "first-packet-seen": { - "misp-attribute": "datetime", - "ui-priority": 1, - "description": "First packet seen in this flow", - "disable_correlation": true - }, - "last-packet-seen": { - "misp-attribute": "datetime", - "ui-priority": 0, - "description": "Last packet seen in this flow", - "disable_correlation": true - }, - "community-id": { - "misp-attribute": "community-id", - "ui-priority": 0, - "description": "Community id of the represented flow" + "ui-priority": 0 } }, + "description": "Netflow object describes an network object based on the Netflowv5/v9 minimal definition", + "meta-category": "network", + "name": "netflow", "requiredOneOf": [ "first-packet-seen", "ip-src", "ip-dst", "dst-port", "community-id" - ] -} + ], + "uuid": "bf148c58-3e7e-414e-8de8-5d96379ca77e", + "version": 2 +} \ No newline at end of file diff --git a/objects/network-connection/definition.json b/objects/network-connection/definition.json index e0ac368..16efe53 100644 --- a/objects/network-connection/definition.json +++ b/objects/network-connection/definition.json @@ -1,100 +1,98 @@ { - "name": "network-connection", - "uuid": "af16764b-f8e5-4603-9de1-de34d272f80b", - "meta-category": "network", - "description": "A local or remote network connection.", - "version": 3, "attributes": { - "ip-src": { - "description": "Source IP address of the nework connection.", - "ui-priority": 1, - "categories": [ - "Network activity", - "External analysis" - ], - "misp-attribute": "ip-src" - }, - "ip-dst": { - "description": "Destination IP address of the nework connection.", - "ui-priority": 1, - "categories": [ - "Network activity", - "External analysis" - ], - "misp-attribute": "ip-dst" - }, - "src-port": { - "description": "Source port of the nework connection.", - "ui-priority": 1, - "categories": [ - "Network activity", - "External analysis" - ], - "misp-attribute": "port" + "community-id": { + "description": "Flow description as a community ID hash value", + "misp-attribute": "community-id", + "ui-priority": 1 }, "dst-port": { - "description": "Destination port of the nework connection.", - "ui-priority": 1, "categories": [ "Network activity", "External analysis" ], - "misp-attribute": "port" + "description": "Destination port of the nework connection.", + "misp-attribute": "port", + "ui-priority": 1 }, - "hostname-src": { - "description": "Source hostname of the network connection.", - "ui-priority": 1, - "misp-attribute": "hostname" + "first-packet-seen": { + "description": "Datetime of the first packet seen.", + "disable_correlation": true, + "misp-attribute": "datetime", + "ui-priority": 1 }, "hostname-dst": { "description": "Destination hostname of the network connection.", - "ui-priority": 1, - "misp-attribute": "hostname" + "misp-attribute": "hostname", + "ui-priority": 1 + }, + "hostname-src": { + "description": "Source hostname of the network connection.", + "misp-attribute": "hostname", + "ui-priority": 1 + }, + "ip-dst": { + "categories": [ + "Network activity", + "External analysis" + ], + "description": "Destination IP address of the nework connection.", + "misp-attribute": "ip-dst", + "ui-priority": 1 + }, + "ip-src": { + "categories": [ + "Network activity", + "External analysis" + ], + "description": "Source IP address of the nework connection.", + "misp-attribute": "ip-src", + "ui-priority": 1 }, "layer3-protocol": { "description": "Layer 3 protocol of the network connection.", - "ui-priority": 0, + "disable_correlation": true, + "misp-attribute": "text", "sane_default": [ "IP", "ICMP", "ARP" ], - "misp-attribute": "text", - "disable_correlation": true + "ui-priority": 0 }, "layer4-protocol": { "description": "Layer 4 protocol of the network connection.", - "ui-priority": 0, + "disable_correlation": true, + "misp-attribute": "text", "sane_default": [ "TCP", "UDP" ], - "misp-attribute": "text", - "disable_correlation": true + "ui-priority": 0 }, "layer7-protocol": { "description": "Layer 7 protocol of the network connection.", - "ui-priority": 0, + "disable_correlation": true, + "misp-attribute": "text", "sane_default": [ "HTTP", "HTTPS", "FTP" ], - "misp-attribute": "text", - "disable_correlation": true + "ui-priority": 0 }, - "first-packet-seen": { - "misp-attribute": "datetime", - "ui-priority": 1, - "description": "Datetime of the first packet seen.", - "disable_correlation": true - }, - "community-id": { - "misp-attribute": "community-id", - "ui-priority": 1, - "description": "Flow description as a community ID hash value" + "src-port": { + "categories": [ + "Network activity", + "External analysis" + ], + "description": "Source port of the nework connection.", + "misp-attribute": "port", + "ui-priority": 1 } }, + "description": "A local or remote network connection.", + "meta-category": "network", + "name": "network-connection", "requiredOneOf": [ "first-packet-seen", "ip-src", @@ -102,5 +100,7 @@ "src-port", "dst-port", "community-id" - ] -} + ], + "uuid": "af16764b-f8e5-4603-9de1-de34d272f80b", + "version": 3 +} \ No newline at end of file diff --git a/objects/network-socket/definition.json b/objects/network-socket/definition.json index 94ecb53..0e1498a 100644 --- a/objects/network-socket/definition.json +++ b/objects/network-socket/definition.json @@ -1,75 +1,8 @@ { - "name": "network-socket", - "uuid": "48bbfd72-ef8e-4649-b14d-41b4b5a0eba2", - "meta-category": "network", - "description": "Network socket object describes a local or remote network connections based on the socket data structure.", - "version": 2, "attributes": { - "ip-src": { - "description": "Source (local) IP address of the network socket connection.", - "ui-priority": 1, - "categories": [ - "Network activity", - "External analysis" - ], - "misp-attribute": "ip-src" - }, - "filename": { - "description": "Socket using filename", - "ui-priority": 1, - "misp-attribute": "filename" - }, - "hostname-src": { - "description": "Source (local) hostname of the network socket connection.", - "ui-priority": 1, - "misp-attribute": "hostname" - }, - "ip-dst": { - "description": "Destination IP address of the network socket connection.", - "ui-priority": 1, - "categories": [ - "Network activity", - "External analysis" - ], - "misp-attribute": "ip-dst" - }, - "hostname-dst": { - "description": "Destination hostname of the network socket connection.", - "ui-priority": 1, - "misp-attribute": "hostname" - }, - "src-port": { - "description": "Source (local) port of the network socket connection.", - "ui-priority": 1, - "categories": [ - "Network activity", - "External analysis" - ], - "misp-attribute": "port" - }, - "dst-port": { - "description": "Destination port of the network socket connection.", - "ui-priority": 1, - "categories": [ - "Network activity", - "External analysis" - ], - "misp-attribute": "port" - }, - "protocol": { - "misp-attribute": "text", - "ui-priority": 0, - "values_list": [ - "TCP", - "UDP", - "ICMP", - "IP" - ], - "description": "Protocol used by the network socket." - }, "address-family": { "description": "Address family who specifies the address family type (AF_*) of the socket connection.", - "ui-priority": 1, + "misp-attribute": "text", "sane_default": [ "AF_UNSPEC", "AF_LOCAL", @@ -118,11 +51,11 @@ "AF_KCM", "AF_MAX" ], - "misp-attribute": "text" + "ui-priority": 1 }, "domain-family": { "description": "Domain family who specifies the communication domain (PF_*) of the socket connection.", - "ui-priority": 1, + "misp-attribute": "text", "sane_default": [ "PF_UNSPEC", "PF_LOCAL", @@ -171,29 +104,96 @@ "PF_KCM", "PF_MAX" ], - "misp-attribute": "text" + "ui-priority": 1 + }, + "dst-port": { + "categories": [ + "Network activity", + "External analysis" + ], + "description": "Destination port of the network socket connection.", + "misp-attribute": "port", + "ui-priority": 1 + }, + "filename": { + "description": "Socket using filename", + "misp-attribute": "filename", + "ui-priority": 1 + }, + "hostname-dst": { + "description": "Destination hostname of the network socket connection.", + "misp-attribute": "hostname", + "ui-priority": 1 + }, + "hostname-src": { + "description": "Source (local) hostname of the network socket connection.", + "misp-attribute": "hostname", + "ui-priority": 1 + }, + "ip-dst": { + "categories": [ + "Network activity", + "External analysis" + ], + "description": "Destination IP address of the network socket connection.", + "misp-attribute": "ip-dst", + "ui-priority": 1 + }, + "ip-src": { + "categories": [ + "Network activity", + "External analysis" + ], + "description": "Source (local) IP address of the network socket connection.", + "misp-attribute": "ip-src", + "ui-priority": 1 + }, + "option": { + "description": "Option on the socket connection.", + "misp-attribute": "text", + "multiple": true, + "ui-priority": 1 + }, + "protocol": { + "description": "Protocol used by the network socket.", + "misp-attribute": "text", + "ui-priority": 0, + "values_list": [ + "TCP", + "UDP", + "ICMP", + "IP" + ] + }, + "src-port": { + "categories": [ + "Network activity", + "External analysis" + ], + "description": "Source (local) port of the network socket connection.", + "misp-attribute": "port", + "ui-priority": 1 }, "state": { "description": "State of the socket connection.", + "misp-attribute": "text", "multiple": true, "sane_default": [ "blocking", "listening" ], - "misp-attribute": "text", - "ui-priority": 1 - }, - "option": { - "description": "Option on the socket connection.", - "multiple": true, - "misp-attribute": "text", "ui-priority": 1 } }, + "description": "Network socket object describes a local or remote network connections based on the socket data structure.", + "meta-category": "network", + "name": "network-socket", "requiredOneOf": [ "ip-src", "ip-dst", "src-port", "dst-port" - ] -} + ], + "uuid": "48bbfd72-ef8e-4649-b14d-41b4b5a0eba2", + "version": 2 +} \ No newline at end of file diff --git a/objects/news-agency/definition.json b/objects/news-agency/definition.json index 438da8b..6cfd6e1 100644 --- a/objects/news-agency/definition.json +++ b/objects/news-agency/definition.json @@ -1,4 +1,70 @@ { + "attributes": { + "address": { + "description": "Postal address of the news agency.", + "misp-attribute": "text", + "multiple": true, + "ui-priority": 10 + }, + "alias": { + "description": "Alias of the news agency.", + "disable_correlation": true, + "misp-attribute": "text", + "multiple": true, + "ui-priority": 99 + }, + "archive": { + "description": "Archive of the original document (Internet Archive, Archive.is, etc).", + "misp-attribute": "link", + "multiple": true, + "ui-priority": 1 + }, + "attachment": { + "description": "The news file, screen capture, audio, etc.", + "misp-attribute": "attachment", + "multiple": true, + "ui-priority": 1 + }, + "e-mail": { + "description": "Email address of the organization.", + "misp-attribute": "email-src", + "multiple": true, + "ui-priority": 10 + }, + "fax-number": { + "description": "Fax number of the news agency.", + "misp-attribute": "phone-number", + "multiple": true, + "ui-priority": 10 + }, + "link": { + "description": "Original link to the news agency (Supposed harmless).", + "misp-attribute": "link", + "multiple": true, + "ui-priority": 1 + }, + "name": { + "description": "Name of the news agency.", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 100 + }, + "phone-number": { + "description": "Phone number of the news agency.", + "misp-attribute": "phone-number", + "multiple": true, + "ui-priority": 10 + }, + "url": { + "description": "Original URL location of the news agency (potentially malicious).", + "misp-attribute": "url", + "multiple": true, + "ui-priority": 1 + } + }, + "description": "News agencies compile news and disseminate news in bulk.", + "meta-category": "misc", + "name": "news-agency", "requiredOneOf": [ "name", "alias", @@ -7,72 +73,6 @@ "link", "attachment" ], - "attributes": { - "name": { - "description": "Name of the news agency.", - "disable_correlation": true, - "ui-priority": 100, - "misp-attribute": "text" - }, - "alias": { - "description": "Alias of the news agency.", - "ui-priority": 99, - "disable_correlation": true, - "misp-attribute": "text", - "multiple": true - }, - "archive": { - "description": "Archive of the original document (Internet Archive, Archive.is, etc).", - "ui-priority": 1, - "multiple": true, - "misp-attribute": "link" - }, - "attachment": { - "description": "The news file, screen capture, audio, etc.", - "ui-priority": 1, - "multiple": true, - "misp-attribute": "attachment" - }, - "url": { - "description": "Original URL location of the news agency (potentially malicious).", - "ui-priority": 1, - "misp-attribute": "url", - "multiple": true - }, - "link": { - "description": "Original link to the news agency (Supposed harmless).", - "ui-priority": 1, - "misp-attribute": "link", - "multiple": true - }, - "phone-number": { - "description": "Phone number of the news agency.", - "ui-priority": 10, - "misp-attribute": "phone-number", - "multiple": true - }, - "fax-number": { - "description": "Fax number of the news agency.", - "ui-priority": 10, - "misp-attribute": "phone-number", - "multiple": true - }, - "address": { - "description": "Postal address of the news agency.", - "ui-priority": 10, - "misp-attribute": "text", - "multiple": true - }, - "e-mail": { - "description": "Email address of the organization.", - "ui-priority": 10, - "misp-attribute": "email-src", - "multiple": true - } - }, - "version": 2, - "description": "News agencies compile news and disseminate news in bulk.", - "meta-category": "misc", "uuid": "92b3f7fd-c4bc-42af-a73b-033ace439622", - "name": "news-agency" -} + "version": 2 +} \ No newline at end of file diff --git a/objects/news-media/definition.json b/objects/news-media/definition.json index 8a46926..a1d4e32 100644 --- a/objects/news-media/definition.json +++ b/objects/news-media/definition.json @@ -1,84 +1,82 @@ { - "requiredOneOf": [ - "source", - "alias", - "archive", - "content", - "url", - "link", - "attachment" - ], "attributes": { - "source": { - "description": "Name of the news source.", - "disable_correlation": true, - "ui-priority": 100, - "misp-attribute": "text" + "address": { + "description": "Postal address of the news source.", + "misp-attribute": "text", + "multiple": true, + "ui-priority": 10 }, "alias": { "description": "Alias of the news source.", - "ui-priority": 99, "disable_correlation": true, "misp-attribute": "text", - "multiple": true - }, - "username": { - "description": "Username who posted the blog post.", - "ui-priority": 0, - "misp-attribute": "text" - }, - "content": { - "description": "Raw content of the news.", - "ui-priority": 1, - "misp-attribute": "text" - }, - "transcription": { - "description": "Transcribed audio/visual content.", - "ui-priority": 1, - "misp-attribute": "text" - }, - "title": { - "description": "Title of the post.", - "ui-priority": 1, - "misp-attribute": "text" + "multiple": true, + "ui-priority": 99 }, "archive": { "description": "Archive of the news (Internet Archive, Archive.is, etc).", - "ui-priority": 1, + "misp-attribute": "link", "multiple": true, - "misp-attribute": "link" + "ui-priority": 1 }, "attachment": { "description": "The news file, screen capture, audio, etc.", - "ui-priority": 1, + "misp-attribute": "attachment", "multiple": true, - "misp-attribute": "attachment" + "ui-priority": 1 }, - "type": { - "description": "Type of news media (newspaper, TV, podcast, etc).", - "ui-priority": 1, + "content": { + "description": "Raw content of the news.", "misp-attribute": "text", - "disable_correlation": true, + "ui-priority": 1 + }, + "e-mail": { + "description": "Email address of the news source.", + "misp-attribute": "email-src", "multiple": true, - "sane_default": [ - "Newspaper", - "Newspaper (Online)", - "Magazine", - "Magazine (Online)", - "TV", - "Tube", - "Radio", - "Radio (Online)", - "Podcast", - "Alternative Media", - "Other" - ] + "ui-priority": 10 + }, + "embedded-link": { + "description": "Site linked by the blog post.", + "misp-attribute": "url", + "multiple": true, + "ui-priority": 0 + }, + "embedded-safe-link": { + "description": "Safe site linked by the blog post.", + "misp-attribute": "link", + "multiple": true, + "ui-priority": 0 + }, + "fax-number": { + "description": "Fax number of the news source.", + "misp-attribute": "phone-number", + "multiple": true, + "ui-priority": 10 + }, + "link": { + "description": "Original link to news (Supposed harmless).", + "misp-attribute": "link", + "multiple": true, + "ui-priority": 1 + }, + "phone-number": { + "description": "Phone number of the news source.", + "misp-attribute": "phone-number", + "multiple": true, + "ui-priority": 10 + }, + "source": { + "description": "Name of the news source.", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 100 }, "sub-type": { - "misp-attribute": "text", - "ui-priority": 0, "description": "Format of the news post (business daily, local news, metasite, etc).", "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 0, "values_list": [ "Business Daily", "Local News", @@ -93,58 +91,60 @@ "Other" ] }, + "title": { + "description": "Title of the post.", + "misp-attribute": "text", + "ui-priority": 1 + }, + "transcription": { + "description": "Transcribed audio/visual content.", + "misp-attribute": "text", + "ui-priority": 1 + }, + "type": { + "description": "Type of news media (newspaper, TV, podcast, etc).", + "disable_correlation": true, + "misp-attribute": "text", + "multiple": true, + "sane_default": [ + "Newspaper", + "Newspaper (Online)", + "Magazine", + "Magazine (Online)", + "TV", + "Tube", + "Radio", + "Radio (Online)", + "Podcast", + "Alternative Media", + "Other" + ], + "ui-priority": 1 + }, "url": { "description": "Original URL location of news (potentially malicious).", - "ui-priority": 1, "misp-attribute": "url", - "multiple": true + "multiple": true, + "ui-priority": 1 }, - "link": { - "description": "Original link to news (Supposed harmless).", - "ui-priority": 1, - "misp-attribute": "link", - "multiple": true - }, - "phone-number": { - "description": "Phone number of the news source.", - "ui-priority": 10, - "misp-attribute": "phone-number", - "multiple": true - }, - "fax-number": { - "description": "Fax number of the news source.", - "ui-priority": 10, - "misp-attribute": "phone-number", - "multiple": true - }, - "address": { - "description": "Postal address of the news source.", - "ui-priority": 10, + "username": { + "description": "Username who posted the blog post.", "misp-attribute": "text", - "multiple": true - }, - "embedded-link": { - "description": "Site linked by the blog post.", - "ui-priority": 0, - "misp-attribute": "url", - "multiple": true - }, - "embedded-safe-link": { - "description": "Safe site linked by the blog post.", - "ui-priority": 0, - "misp-attribute": "link", - "multiple": true - }, - "e-mail": { - "description": "Email address of the news source.", - "ui-priority": 10, - "misp-attribute": "email-src", - "multiple": true + "ui-priority": 0 } }, - "version": 2, "description": "News media are forms of mass media delivering news to the general public.", "meta-category": "misc", + "name": "news-media", + "requiredOneOf": [ + "source", + "alias", + "archive", + "content", + "url", + "link", + "attachment" + ], "uuid": "691463c5-5302-4847-9bec-4c56ccfec677", - "name": "news-media" -} + "version": 2 +} \ No newline at end of file diff --git a/objects/organization/definition.json b/objects/organization/definition.json index 4e39398..d1d622a 100644 --- a/objects/organization/definition.json +++ b/objects/organization/definition.json @@ -1,65 +1,63 @@ { - "requiredOneOf": [ - "name", - "alias" - ], "attributes": { - "name": { - "description": "Name of the organization", - "disable_correlation": false, - "ui-priority": 100, - "misp-attribute": "text" - }, - "alias": { - "description": "Alias of the organization", - "ui-priority": 99, + "VAT": { + "description": "VAT or TAX-ID of the organization", "misp-attribute": "text", - "multiple": true - }, - "type-of-organization": { - "description": "Type of the organization", - "ui-priority": 97, - "misp-attribute": "text" - }, - "description": { - "description": "Description of the organization", - "ui-priority": 96, - "misp-attribute": "text" - }, - "date-of-inception": { - "description": "Date of inception of the organization", - "ui-priority": 0, - "misp-attribute": "date-of-birth" - }, - "phone-number": { - "description": "Phone number of the organization.", - "ui-priority": 10, - "misp-attribute": "phone-number", - "multiple": true - }, - "fax-number": { - "description": "Fax number of the organization.", - "ui-priority": 10, - "misp-attribute": "phone-number", - "multiple": true + "multiple": true, + "ui-priority": 0 }, "address": { "description": "Postal address of the organization.", - "ui-priority": 10, "misp-attribute": "text", - "multiple": true + "multiple": true, + "ui-priority": 10 + }, + "alias": { + "description": "Alias of the organization", + "misp-attribute": "text", + "multiple": true, + "ui-priority": 99 + }, + "date-of-inception": { + "description": "Date of inception of the organization", + "misp-attribute": "date-of-birth", + "ui-priority": 0 + }, + "description": { + "description": "Description of the organization", + "misp-attribute": "text", + "ui-priority": 96 }, "e-mail": { "description": "Email address of the organization.", - "ui-priority": 10, "misp-attribute": "email-src", - "multiple": true + "multiple": true, + "ui-priority": 10 + }, + "fax-number": { + "description": "Fax number of the organization.", + "misp-attribute": "phone-number", + "multiple": true, + "ui-priority": 10 + }, + "name": { + "description": "Name of the organization", + "disable_correlation": false, + "misp-attribute": "text", + "ui-priority": 100 + }, + "phone-number": { + "description": "Phone number of the organization.", + "misp-attribute": "phone-number", + "multiple": true, + "ui-priority": 10 }, "role": { "description": "The role of the organization.", - "ui-priority": 0, + "disable_correlation": true, "misp-attribute": "text", "multiple": true, + "ui-priority": 0, "values_list": [ "Suspect", "Victim", @@ -68,19 +66,21 @@ "Culprit", "Accomplice", "Target" - ], - "disable_correlation": true + ] }, - "VAT": { - "description": "VAT or TAX-ID of the organization", - "ui-priority": 0, + "type-of-organization": { + "description": "Type of the organization", "misp-attribute": "text", - "multiple": true + "ui-priority": 97 } }, - "version": 4, "description": "An object which describes an organization.", "meta-category": "misc", + "name": "organization", + "requiredOneOf": [ + "name", + "alias" + ], "uuid": "f750e12b-127a-432c-b022-b3f9153c4e2a", - "name": "organization" -} + "version": 4 +} \ No newline at end of file diff --git a/objects/original-imported-file/definition.json b/objects/original-imported-file/definition.json index 6436924..72142cb 100644 --- a/objects/original-imported-file/definition.json +++ b/objects/original-imported-file/definition.json @@ -1,18 +1,7 @@ { - "requiredOneOf": [ - "imported-sample", - "format" - ], "attributes": { - "imported-sample": { - "description": "The original imported file itself (binary).", - "ui-priority": 1, - "disable_correlation": true, - "misp-attribute": "attachment" - }, "format": { "description": "Format of data imported.", - "ui-priority": 1, "disable_correlation": true, "misp-attribute": "text", "sane_default": [ @@ -21,17 +10,28 @@ "STIX 1.2", "STIX 2.0", "OpenIOC" - ] + ], + "ui-priority": 1 + }, + "imported-sample": { + "description": "The original imported file itself (binary).", + "disable_correlation": true, + "misp-attribute": "attachment", + "ui-priority": 1 }, "uri": { "description": "URI related to the imported file.", - "ui-priority": 0, - "misp-attribute": "uri" + "misp-attribute": "uri", + "ui-priority": 0 } }, - "version": 2, "description": "Object describing the original file used to import data in MISP.", "meta-category": "file", + "name": "original-imported-file", + "requiredOneOf": [ + "imported-sample", + "format" + ], "uuid": "4cd560e9-2cfe-40a1-9964-7b2e797ecac5", - "name": "original-imported-file" -} + "version": 2 +} \ No newline at end of file diff --git a/objects/passive-dns/definition.json b/objects/passive-dns/definition.json index 38994ee..147fafa 100644 --- a/objects/passive-dns/definition.json +++ b/objects/passive-dns/definition.json @@ -1,44 +1,44 @@ { - "required": [ - "rrtype", - "rrname", - "rdata" - ], "attributes": { - "zone_time_last": { - "description": "Last time that the unique tuple (rrname, rrtype, rdata) record has been seen via master file import.", - "ui-priority": 0, - "misp-attribute": "datetime", - "disable_correlation": true - }, - "text": { - "description": "Description of the passive DNS record.", - "ui-priority": 0, + "bailiwick": { + "description": "Best estimate of the apex of the zone where this data is authoritative", + "disable_correlation": true, "misp-attribute": "text", - "disable_correlation": true + "ui-priority": 0 }, "count": { "description": "How many authoritative DNS answers were received at the Passive DNS Server's collectors with exactly the given set of values as answers.", - "ui-priority": 0, + "disable_correlation": true, "misp-attribute": "counter", - "disable_correlation": true + "ui-priority": 0 + }, + "origin": { + "description": "Origin of the Passive DNS response", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 0 + }, + "rdata": { + "description": "Resource records of the queried resource", + "misp-attribute": "text", + "ui-priority": 1 }, "rrname": { - "description": "Resource Record name of the queried resource.", "categories": [ "Network activity", "External analysis" ], - "ui-priority": 1, - "misp-attribute": "text" + "description": "Resource Record name of the queried resource.", + "misp-attribute": "text", + "ui-priority": 1 }, "rrtype": { - "description": "Resource Record type as seen by the passive DNS.", "categories": [ "Network activity", "External analysis" ], - "ui-priority": 1, + "description": "Resource Record type as seen by the passive DNS.", + "disable_correlation": true, "misp-attribute": "text", "sane_default": [ "A", @@ -55,53 +55,53 @@ "HINFO", "A6" ], - "disable_correlation": true - }, - "rdata": { - "description": "Resource records of the queried resource", - "ui-priority": 1, - "misp-attribute": "text" - }, - "zone_time_first": { - "description": "First time that the unique tuple (rrname, rrtype, rdata) record has been seen via master file import", - "ui-priority": 0, - "misp-attribute": "datetime", - "disable_correlation": true - }, - "origin": { - "description": "Origin of the Passive DNS response", - "ui-priority": 0, - "misp-attribute": "text", - "disable_correlation": true - }, - "time_last": { - "description": "Last time that the unique tuple (rrname, rrtype, rdata) record has been seen by the passive DNS", - "ui-priority": 0, - "misp-attribute": "datetime", - "disable_correlation": true - }, - "time_first": { - "description": "First time that the unique tuple (rrname, rrtype, rdata) has been seen by the passive DNS", - "ui-priority": 0, - "misp-attribute": "datetime", - "disable_correlation": true - }, - "bailiwick": { - "description": "Best estimate of the apex of the zone where this data is authoritative", - "ui-priority": 0, - "misp-attribute": "text", - "disable_correlation": true + "ui-priority": 1 }, "sensor_id": { "description": "Sensor information where the record was seen", - "ui-priority": 0, + "disable_correlation": true, "misp-attribute": "text", - "disable_correlation": true + "ui-priority": 0 + }, + "text": { + "description": "Description of the passive DNS record.", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 0 + }, + "time_first": { + "description": "First time that the unique tuple (rrname, rrtype, rdata) has been seen by the passive DNS", + "disable_correlation": true, + "misp-attribute": "datetime", + "ui-priority": 0 + }, + "time_last": { + "description": "Last time that the unique tuple (rrname, rrtype, rdata) record has been seen by the passive DNS", + "disable_correlation": true, + "misp-attribute": "datetime", + "ui-priority": 0 + }, + "zone_time_first": { + "description": "First time that the unique tuple (rrname, rrtype, rdata) record has been seen via master file import", + "disable_correlation": true, + "misp-attribute": "datetime", + "ui-priority": 0 + }, + "zone_time_last": { + "description": "Last time that the unique tuple (rrname, rrtype, rdata) record has been seen via master file import.", + "disable_correlation": true, + "misp-attribute": "datetime", + "ui-priority": 0 } }, - "version": 3, "description": "Passive DNS records as expressed in draft-dulaunoy-dnsop-passive-dns-cof-01", "meta-category": "network", + "name": "passive-dns", + "required": [ + "rrtype", + "rrname", + "rdata" + ], "uuid": "b77b7b1c-66ab-4a41-8da4-83810f6d2d6c", - "name": "passive-dns" -} + "version": 3 +} \ No newline at end of file diff --git a/objects/paste/definition.json b/objects/paste/definition.json index e78808f..f5f8ee1 100644 --- a/objects/paste/definition.json +++ b/objects/paste/definition.json @@ -1,15 +1,27 @@ { - "requiredOneOf": [ - "origin", - "paste" - ], "attributes": { - "paste": { - "description": "Raw text of the paste or post", - "ui-priority": 1, - "misp-attribute": "text" + "first-seen": { + "description": "When the paste has been accessible or seen for the first time.", + "disable_correlation": true, + "misp-attribute": "datetime", + "ui-priority": 0 + }, + "last-seen": { + "description": "When the paste has been accessible or seen for the last time.", + "disable_correlation": true, + "misp-attribute": "datetime", + "ui-priority": 0 + }, + "link": { + "description": "Link to the original source of the source or post (when used legitimately for OSINT source or alike).", + "misp-attribute": "link", + "ui-priority": 0 }, "origin": { + "description": "Original source of the paste or post.", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 0, "values_list": [ "pastebin.com", "pastebin.com_pro", @@ -22,48 +34,36 @@ "ghostbin.com", "paste.ee", "0bin.net" - ], - "description": "Original source of the paste or post.", - "ui-priority": 0, + ] + }, + "paste": { + "description": "Raw text of the paste or post", "misp-attribute": "text", - "disable_correlation": true + "ui-priority": 1 }, "title": { + "description": "Title of the paste or post.", "misp-attribute": "text", - "ui-priority": 0, - "description": "Title of the paste or post." - }, - "username": { - "misp-attribute": "text", - "ui-priority": 0, - "description": "User who posted the post." + "ui-priority": 0 }, "url": { + "description": "Link to the original source of the paste or post (when used maliciously).", "misp-attribute": "url", - "ui-priority": 0, - "description": "Link to the original source of the paste or post (when used maliciously)." + "ui-priority": 0 }, - "link": { - "misp-attribute": "link", - "ui-priority": 0, - "description": "Link to the original source of the source or post (when used legitimately for OSINT source or alike)." - }, - "last-seen": { - "description": "When the paste has been accessible or seen for the last time.", - "disable_correlation": true, - "ui-priority": 0, - "misp-attribute": "datetime" - }, - "first-seen": { - "description": "When the paste has been accessible or seen for the first time.", - "disable_correlation": true, - "ui-priority": 0, - "misp-attribute": "datetime" + "username": { + "description": "User who posted the post.", + "misp-attribute": "text", + "ui-priority": 0 } }, - "version": 5, "description": "Paste or similar post from a website allowing to share privately or publicly posts.", "meta-category": "misc", + "name": "paste", + "requiredOneOf": [ + "origin", + "paste" + ], "uuid": "cedc055c-78aa-49a4-bfd7-4cc30cecef12", - "name": "paste" -} + "version": 5 +} \ No newline at end of file diff --git a/objects/pcap-metadata/definition.json b/objects/pcap-metadata/definition.json index c454f26..36d6594 100644 --- a/objects/pcap-metadata/definition.json +++ b/objects/pcap-metadata/definition.json @@ -1,26 +1,32 @@ { - "requiredOneOf": [ - "text", - "first-packet-seen", - "last-packet-seen" - ], "attributes": { - "capture-length": { - "description": "Capture length set on the captured interface.", - "disable_correlation": true, - "ui-priority": 1, - "misp-attribute": "text" - }, "capture-interface": { "description": "Interface name where the packet capture was running.", "disable_correlation": true, - "ui-priority": 1, - "misp-attribute": "text" + "misp-attribute": "text", + "ui-priority": 1 + }, + "capture-length": { + "description": "Capture length set on the captured interface.", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 1 + }, + "first-packet-seen": { + "description": "When the first packet has been seen.", + "disable_correlation": true, + "misp-attribute": "datetime", + "ui-priority": 0 + }, + "last-packet-seen": { + "description": "When the last packet has been seen.", + "disable_correlation": true, + "misp-attribute": "datetime", + "ui-priority": 0 }, "protocol": { "description": "Capture protocol (linktype name).", "disable_correlation": true, - "ui-priority": 1, "misp-attribute": "text", "sane_default": [ "PER_PACKET", @@ -224,30 +230,24 @@ "JUNIPER_ST", "ETHERNET_MPACKET", "DOCSIS31_XRA31" - ] + ], + "ui-priority": 1 }, "text": { "description": "A description of the packet capture.", "disable_correlation": true, - "ui-priority": 1, - "misp-attribute": "text" - }, - "first-packet-seen": { - "description": "When the first packet has been seen.", - "disable_correlation": true, - "ui-priority": 0, - "misp-attribute": "datetime" - }, - "last-packet-seen": { - "description": "When the last packet has been seen.", - "disable_correlation": true, - "ui-priority": 0, - "misp-attribute": "datetime" + "misp-attribute": "text", + "ui-priority": 1 } }, - "version": 2, "description": "Network packet capture metadata", "meta-category": "network", + "name": "pcap-metadata", + "requiredOneOf": [ + "text", + "first-packet-seen", + "last-packet-seen" + ], "uuid": "0784aefa-ec3a-4eca-a431-c31ed7058bd3", - "name": "pcap-metadata" -} + "version": 2 +} \ No newline at end of file diff --git a/objects/pe-section/definition.json b/objects/pe-section/definition.json index 2ef4c3c..e70c362 100644 --- a/objects/pe-section/definition.json +++ b/objects/pe-section/definition.json @@ -1,4 +1,120 @@ { + "attributes": { + "characteristic": { + "description": "Characteristic of the section", + "misp-attribute": "text", + "sane_default": [ + "read", + "write", + "executable" + ], + "ui-priority": 0 + }, + "entropy": { + "description": "Entropy of the whole section", + "disable_correlation": true, + "misp-attribute": "float", + "ui-priority": 0 + }, + "md5": { + "description": "[Insecure] MD5 hash (128 bits)", + "misp-attribute": "md5", + "recommended": false, + "ui-priority": 1 + }, + "name": { + "description": "Name of the section", + "disable_correlation": true, + "misp-attribute": "text", + "sane_default": [ + ".rsrc", + ".reloc", + ".rdata", + ".data", + ".text" + ], + "ui-priority": 1 + }, + "offset": { + "description": "Section’s offset", + "disable_correlation": true, + "misp-attribute": "hex", + "ui-priority": 1 + }, + "sha1": { + "description": "[Insecure] Secure Hash Algorithm 1 (160 bits)", + "misp-attribute": "sha1", + "recommended": false, + "ui-priority": 1 + }, + "sha224": { + "description": "Secure Hash Algorithm 2 (224 bits)", + "misp-attribute": "sha224", + "recommended": false, + "ui-priority": 0 + }, + "sha256": { + "description": "Secure Hash Algorithm 2 (256 bits)", + "misp-attribute": "sha256", + "ui-priority": 1 + }, + "sha384": { + "description": "Secure Hash Algorithm 2 (384 bits)", + "misp-attribute": "sha384", + "recommended": false, + "ui-priority": 0 + }, + "sha512": { + "description": "Secure Hash Algorithm 2 (512 bits)", + "misp-attribute": "sha512", + "ui-priority": 1 + }, + "sha512/224": { + "description": "Secure Hash Algorithm 2 (224 bits)", + "misp-attribute": "sha512/224", + "recommended": false, + "ui-priority": 0 + }, + "sha512/256": { + "description": "Secure Hash Algorithm 2 (256 bits)", + "misp-attribute": "sha512/256", + "recommended": false, + "ui-priority": 0 + }, + "size-in-bytes": { + "description": "Size of the section, in bytes", + "disable_correlation": true, + "misp-attribute": "size-in-bytes", + "ui-priority": 1 + }, + "ssdeep": { + "description": "Fuzzy hash using context triggered piecewise hashes (CTPH)", + "misp-attribute": "ssdeep", + "ui-priority": 0 + }, + "text": { + "description": "Free text value to attach to the section", + "disable_correlation": true, + "misp-attribute": "text", + "recommended": false, + "ui-priority": 1 + }, + "virtual_address": { + "description": "Section’s virtual address", + "disable_correlation": true, + "misp-attribute": "hex", + "ui-priority": 1 + }, + "virtual_size": { + "description": "Section’s virtual size", + "disable_correlation": true, + "misp-attribute": "size-in-bytes", + "ui-priority": 1 + } + }, + "description": "Object describing a section of a Portable Executable", + "meta-category": "file", + "name": "pe-section", "requiredOneOf": [ "text", "name", @@ -11,122 +127,6 @@ "sha512/224", "sha512/256" ], - "attributes": { - "md5": { - "description": "[Insecure] MD5 hash (128 bits)", - "ui-priority": 1, - "misp-attribute": "md5", - "recommended": false - }, - "sha1": { - "description": "[Insecure] Secure Hash Algorithm 1 (160 bits)", - "ui-priority": 1, - "misp-attribute": "sha1", - "recommended": false - }, - "sha224": { - "description": "Secure Hash Algorithm 2 (224 bits)", - "ui-priority": 0, - "misp-attribute": "sha224", - "recommended": false - }, - "sha256": { - "description": "Secure Hash Algorithm 2 (256 bits)", - "ui-priority": 1, - "misp-attribute": "sha256" - }, - "sha384": { - "description": "Secure Hash Algorithm 2 (384 bits)", - "ui-priority": 0, - "misp-attribute": "sha384", - "recommended": false - }, - "sha512": { - "description": "Secure Hash Algorithm 2 (512 bits)", - "ui-priority": 1, - "misp-attribute": "sha512" - }, - "sha512/224": { - "description": "Secure Hash Algorithm 2 (224 bits)", - "ui-priority": 0, - "misp-attribute": "sha512/224", - "recommended": false - }, - "sha512/256": { - "description": "Secure Hash Algorithm 2 (256 bits)", - "ui-priority": 0, - "misp-attribute": "sha512/256", - "recommended": false - }, - "ssdeep": { - "description": "Fuzzy hash using context triggered piecewise hashes (CTPH)", - "ui-priority": 0, - "misp-attribute": "ssdeep" - }, - "entropy": { - "description": "Entropy of the whole section", - "disable_correlation": true, - "ui-priority": 0, - "misp-attribute": "float" - }, - "name": { - "description": "Name of the section", - "disable_correlation": true, - "sane_default": [ - ".rsrc", - ".reloc", - ".rdata", - ".data", - ".text" - ], - "ui-priority": 1, - "misp-attribute": "text" - }, - "size-in-bytes": { - "description": "Size of the section, in bytes", - "disable_correlation": true, - "ui-priority": 1, - "misp-attribute": "size-in-bytes" - }, - "offset": { - "description": "Section’s offset", - "disable_correlation": true, - "ui-priority": 1, - "misp-attribute": "hex" - }, - "virtual_address": { - "description": "Section’s virtual address", - "disable_correlation": true, - "ui-priority": 1, - "misp-attribute": "hex" - }, - "virtual_size": { - "description": "Section’s virtual size", - "disable_correlation": true, - "ui-priority": 1, - "misp-attribute": "size-in-bytes" - }, - "text": { - "description": "Free text value to attach to the section", - "disable_correlation": true, - "ui-priority": 1, - "misp-attribute": "text", - "recommended": false - }, - "characteristic": { - "description": "Characteristic of the section", - "sane_default": [ - "read", - "write", - "executable" - ], - "ui-priority": 0, - "misp-attribute": "text" - } - }, - "version": 3, - "description": "Object describing a section of a Portable Executable", - "meta-category": "file", "uuid": "198a17d2-a135-4b25-9a32-5aa4e632014a", - "name": "pe-section" -} + "version": 3 +} \ No newline at end of file diff --git a/objects/pe/definition.json b/objects/pe/definition.json index 5b0c0e4..463c679 100644 --- a/objects/pe/definition.json +++ b/objects/pe/definition.json @@ -1,4 +1,120 @@ { + "attributes": { + "company-name": { + "description": "CompanyName in the resources", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 0 + }, + "compilation-timestamp": { + "description": "Compilation timestamp defined in the PE header", + "misp-attribute": "datetime", + "ui-priority": 1 + }, + "entrypoint-address": { + "description": "Address of the entry point", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 0 + }, + "entrypoint-section-at-position": { + "description": "Name of the section and position of the section in the PE", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 0 + }, + "file-description": { + "description": "FileDescription in the resources", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 0 + }, + "file-version": { + "description": "FileVersion in the resources", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 0 + }, + "impfuzzy": { + "description": "Fuzzy Hash (ssdeep) calculated from the import table", + "misp-attribute": "impfuzzy", + "ui-priority": 0 + }, + "imphash": { + "description": "Hash (md5) calculated from the import table", + "misp-attribute": "imphash", + "ui-priority": 0 + }, + "internal-filename": { + "description": "InternalFilename in the resources", + "disable_correlation": true, + "misp-attribute": "filename", + "ui-priority": 0 + }, + "lang-id": { + "description": "Lang ID in the resources", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 0 + }, + "legal-copyright": { + "description": "LegalCopyright in the resources", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 0 + }, + "number-sections": { + "description": "Number of sections", + "disable_correlation": true, + "misp-attribute": "counter", + "ui-priority": 0 + }, + "original-filename": { + "description": "OriginalFilename in the resources", + "disable_correlation": true, + "misp-attribute": "filename", + "ui-priority": 1 + }, + "pehash": { + "description": "Hash of the structural information about a sample. See https://www.usenix.org/legacy/event/leet09/tech/full_papers/wicherski/wicherski_html/", + "misp-attribute": "pehash", + "ui-priority": 0 + }, + "product-name": { + "description": "ProductName in the resources", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 0 + }, + "product-version": { + "description": "ProductVersion in the resources", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 0 + }, + "text": { + "description": "Free text value to attach to the PE", + "disable_correlation": true, + "misp-attribute": "text", + "recommended": false, + "ui-priority": 1 + }, + "type": { + "description": "Type of PE", + "disable_correlation": true, + "misp-attribute": "text", + "sane_default": [ + "exe", + "dll", + "driver", + "unknown" + ], + "ui-priority": 1 + } + }, + "description": "Object describing a Portable Executable", + "meta-category": "file", + "name": "pe", "requiredOneOf": [ "text", "type", @@ -8,122 +124,6 @@ "imphash", "impfuzzy" ], - "attributes": { - "pehash": { - "description": "Hash of the structural information about a sample. See https://www.usenix.org/legacy/event/leet09/tech/full_papers/wicherski/wicherski_html/", - "ui-priority": 0, - "misp-attribute": "pehash" - }, - "impfuzzy": { - "description": "Fuzzy Hash (ssdeep) calculated from the import table", - "ui-priority": 0, - "misp-attribute": "impfuzzy" - }, - "internal-filename": { - "description": "InternalFilename in the resources", - "ui-priority": 0, - "misp-attribute": "filename", - "disable_correlation": true - }, - "original-filename": { - "description": "OriginalFilename in the resources", - "ui-priority": 1, - "misp-attribute": "filename", - "disable_correlation": true - }, - "number-sections": { - "description": "Number of sections", - "disable_correlation": true, - "ui-priority": 0, - "misp-attribute": "counter" - }, - "text": { - "description": "Free text value to attach to the PE", - "disable_correlation": true, - "ui-priority": 1, - "misp-attribute": "text", - "recommended": false - }, - "type": { - "description": "Type of PE", - "sane_default": [ - "exe", - "dll", - "driver", - "unknown" - ], - "disable_correlation": true, - "ui-priority": 1, - "misp-attribute": "text" - }, - "imphash": { - "description": "Hash (md5) calculated from the import table", - "ui-priority": 0, - "misp-attribute": "imphash" - }, - "compilation-timestamp": { - "description": "Compilation timestamp defined in the PE header", - "ui-priority": 1, - "misp-attribute": "datetime" - }, - "entrypoint-section-at-position": { - "description": "Name of the section and position of the section in the PE", - "disable_correlation": true, - "ui-priority": 0, - "misp-attribute": "text" - }, - "entrypoint-address": { - "description": "Address of the entry point", - "disable_correlation": true, - "ui-priority": 0, - "misp-attribute": "text" - }, - "file-description": { - "description": "FileDescription in the resources", - "disable_correlation": true, - "ui-priority": 0, - "misp-attribute": "text" - }, - "file-version": { - "description": "FileVersion in the resources", - "disable_correlation": true, - "ui-priority": 0, - "misp-attribute": "text" - }, - "lang-id": { - "description": "Lang ID in the resources", - "disable_correlation": true, - "ui-priority": 0, - "misp-attribute": "text" - }, - "product-name": { - "description": "ProductName in the resources", - "disable_correlation": true, - "ui-priority": 0, - "misp-attribute": "text" - }, - "product-version": { - "description": "ProductVersion in the resources", - "disable_correlation": true, - "ui-priority": 0, - "misp-attribute": "text" - }, - "company-name": { - "description": "CompanyName in the resources", - "disable_correlation": true, - "ui-priority": 0, - "misp-attribute": "text" - }, - "legal-copyright": { - "description": "LegalCopyright in the resources", - "disable_correlation": true, - "ui-priority": 0, - "misp-attribute": "text" - } - }, - "version": 5, - "description": "Object describing a Portable Executable", - "meta-category": "file", "uuid": "cf7adecc-d4f0-4e88-9d90-f978ee151a07", - "name": "pe" -} + "version": 5 +} \ No newline at end of file diff --git a/objects/person/definition.json b/objects/person/definition.json index 2a0befe..2392889 100644 --- a/objects/person/definition.json +++ b/objects/person/definition.json @@ -1,181 +1,160 @@ { - "requiredOneOf": [ - "first-name", - "last-name", - "alias" - ], "attributes": { - "text": { - "description": "A description of the person or identity.", - "disable_correlation": true, - "ui-priority": 1, - "misp-attribute": "text" - }, - "last-name": { - "description": "Last name of a natural person.", - "ui-priority": 100, - "misp-attribute": "last-name" - }, - "middle-name": { - "description": "Middle name of a natural person.", - "ui-priority": 99, - "misp-attribute": "middle-name" - }, - "first-name": { - "description": "First name of a natural person.", - "ui-priority": 98, - "misp-attribute": "first-name", - "disable_correlation": true - }, - "mothers-name": { - "description": "Mother name, father, second name or other names following country's regulation.", - "ui-priority": 1, - "misp-attribute": "text" - }, - "title": { - "description": "Title of the natural person such as Dr. or equivalent.", - "ui-priority": 101, + "address": { + "description": "Postal address of the person.", "misp-attribute": "text", - "disable_correlation": true + "multiple": true, + "ui-priority": 10 }, "alias": { "description": "Alias name or known as.", - "ui-priority": 97, "misp-attribute": "text", - "multiple": true + "multiple": true, + "ui-priority": 97 + }, + "birth-certificate-number": { + "description": "Birth Certificate Number", + "misp-attribute": "text", + "ui-priority": 0 }, "date-of-birth": { "description": "Date of birth of a natural person (in YYYY-MM-DD format).", - "ui-priority": 0, - "misp-attribute": "date-of-birth" + "misp-attribute": "date-of-birth", + "ui-priority": 0 }, - "place-of-birth": { - "description": "Place of birth of a natural person.", - "ui-priority": 0, - "misp-attribute": "place-of-birth", - "disable_correlation": true + "dni": { + "description": "Spanish National ID", + "misp-attribute": "text", + "multiple": true, + "ui-priority": 10 + }, + "e-mail": { + "description": "Email address of the person.", + "misp-attribute": "email-src", + "multiple": true, + "ui-priority": 10 + }, + "fax-number": { + "description": "Fax number of the person.", + "misp-attribute": "phone-number", + "multiple": true, + "ui-priority": 10 + }, + "first-name": { + "description": "First name of a natural person.", + "disable_correlation": true, + "misp-attribute": "first-name", + "ui-priority": 98 }, "gender": { "description": "The gender of a natural person.", - "ui-priority": 0, + "disable_correlation": true, "misp-attribute": "gender", + "ui-priority": 0, "values_list": [ "Male", "Female", "Other", "Prefer not to say", "Unknown" - ], - "disable_correlation": true + ] }, "identity-card-number": { "description": "The identity card number of a natural person.", - "ui-priority": 0, - "misp-attribute": "identity-card-number" + "misp-attribute": "identity-card-number", + "ui-priority": 0 }, - "passport-number": { - "description": "The passport number of a natural person.", - "ui-priority": 0, - "misp-attribute": "passport-number" + "last-name": { + "description": "Last name of a natural person.", + "misp-attribute": "last-name", + "ui-priority": 100 }, - "passport-country": { - "description": "The country in which the passport was issued.", - "ui-priority": 0, - "misp-attribute": "passport-country", - "disable_correlation": true + "middle-name": { + "description": "Middle name of a natural person.", + "misp-attribute": "middle-name", + "ui-priority": 99 }, - "passport-expiration": { - "description": "The expiration date of a passport.", - "ui-priority": 0, - "misp-attribute": "passport-expiration", - "disable_correlation": true - }, - "redress-number": { - "description": "The Redress Control Number is the record identifier for people who apply for redress through the DHS Travel Redress Inquiry Program (DHS TRIP). DHS TRIP is for travelers who have been repeatedly identified for additional screening and who want to file an inquiry to have erroneous information corrected in DHS systems.", - "ui-priority": 0, - "misp-attribute": "redress-number" - }, - "social-security-number": { - "description": "Social security number.", - "ui-priority": 0, - "misp-attribute": "text" - }, - "birth-certificate-number": { - "description": "Birth Certificate Number", - "ui-priority": 0, - "misp-attribute": "text" - }, - "ofac-identification-number": { - "description": "ofac-identification Number", - "ui-priority": 0, - "misp-attribute": "text" + "mothers-name": { + "description": "Mother name, father, second name or other names following country's regulation.", + "misp-attribute": "text", + "ui-priority": 1 }, "nationality": { "description": "The nationality of a natural person.", - "ui-priority": 0, + "disable_correlation": true, "misp-attribute": "nationality", "multiple": true, - "disable_correlation": true + "ui-priority": 0 }, "nic-hdl": { "description": "NIC Handle (Network Information Centre handle) of the person.", - "ui-priority": 10, "misp-attribute": "text", - "multiple": true - }, - "phone-number": { - "description": "Phone number of the person.", - "ui-priority": 10, - "misp-attribute": "phone-number", - "multiple": true - }, - "fax-number": { - "description": "Fax number of the person.", - "ui-priority": 10, - "misp-attribute": "phone-number", - "multiple": true - }, - "address": { - "description": "Postal address of the person.", - "ui-priority": 10, - "misp-attribute": "text", - "multiple": true - }, - "dni": { - "description": "Spanish National ID", - "ui-priority": 10, - "misp-attribute": "text", - "multiple": true + "multiple": true, + "ui-priority": 10 }, "nie": { "description": "Foreign National ID (Spain)", - "ui-priority": 10, "misp-attribute": "text", - "multiple": true + "multiple": true, + "ui-priority": 10 }, "nif": { "description": "Tax ID Number (Spain)", - "ui-priority": 10, "misp-attribute": "text", - "multiple": true + "multiple": true, + "ui-priority": 10 }, - "e-mail": { - "description": "Email address of the person.", - "ui-priority": 10, - "misp-attribute": "email-src", - "multiple": true + "ofac-identification-number": { + "description": "ofac-identification Number", + "misp-attribute": "text", + "ui-priority": 0 + }, + "passport-country": { + "description": "The country in which the passport was issued.", + "disable_correlation": true, + "misp-attribute": "passport-country", + "ui-priority": 0 + }, + "passport-expiration": { + "description": "The expiration date of a passport.", + "disable_correlation": true, + "misp-attribute": "passport-expiration", + "ui-priority": 0 + }, + "passport-number": { + "description": "The passport number of a natural person.", + "misp-attribute": "passport-number", + "ui-priority": 0 + }, + "phone-number": { + "description": "Phone number of the person.", + "misp-attribute": "phone-number", + "multiple": true, + "ui-priority": 10 + }, + "place-of-birth": { + "description": "Place of birth of a natural person.", + "disable_correlation": true, + "misp-attribute": "place-of-birth", + "ui-priority": 0 }, "portrait": { "description": "Portrait of the person.", - "ui-priority": 10, "misp-attribute": "attachment", - "multiple": true + "multiple": true, + "ui-priority": 10 + }, + "redress-number": { + "description": "The Redress Control Number is the record identifier for people who apply for redress through the DHS Travel Redress Inquiry Program (DHS TRIP). DHS TRIP is for travelers who have been repeatedly identified for additional screening and who want to file an inquiry to have erroneous information corrected in DHS systems.", + "misp-attribute": "redress-number", + "ui-priority": 0 }, "role": { "description": "The role of a person.", - "ui-priority": 0, + "disable_correlation": true, "misp-attribute": "text", "multiple": true, + "ui-priority": 0, "values_list": [ "Suspect", "Victim", @@ -185,13 +164,34 @@ "Accomplice", "Witness", "Target" - ], - "disable_correlation": true + ] + }, + "social-security-number": { + "description": "Social security number.", + "misp-attribute": "text", + "ui-priority": 0 + }, + "text": { + "description": "A description of the person or identity.", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 1 + }, + "title": { + "description": "Title of the natural person such as Dr. or equivalent.", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 101 } }, - "version": 10, "description": "An object which describes a person or an identity.", "meta-category": "misc", + "name": "person", + "requiredOneOf": [ + "first-name", + "last-name", + "alias" + ], "uuid": "a15b0477-e9d1-4b9c-9546-abe78a4f4248", - "name": "person" -} + "version": 10 +} \ No newline at end of file diff --git a/objects/pgp-meta/definition.json b/objects/pgp-meta/definition.json index c040538..d5c4914 100644 --- a/objects/pgp-meta/definition.json +++ b/objects/pgp-meta/definition.json @@ -1,30 +1,30 @@ { - "required": [ - "key-id" - ], "attributes": { "key-id": { "description": "Key ID in hexadecimal", - "ui-priority": 1, "misp-attribute": "text", - "multiple": true + "multiple": true, + "ui-priority": 1 }, "user-id-email": { "description": "User ID packet, email address of the key holder (UTF-8 text)", - "ui-priority": 1, "misp-attribute": "text", - "multiple": true + "multiple": true, + "ui-priority": 1 }, "user-id-name": { "description": "User ID packet, name of the key holder", - "ui-priority": 1, "misp-attribute": "text", - "multiple": true + "multiple": true, + "ui-priority": 1 } }, - "version": 1, "description": "Metadata extracted from a PGP keyblock, message or signature", "meta-category": "misc", + "name": "pgp-meta", + "required": [ + "key-id" + ], "uuid": "4c9134c4-b3e8-4d9f-b3c0-c683e70ec1dd", - "name": "pgp-meta" -} + "version": 1 +} \ No newline at end of file diff --git a/objects/phishing-kit/definition.json b/objects/phishing-kit/definition.json index 2112d20..c183c3b 100644 --- a/objects/phishing-kit/definition.json +++ b/objects/phishing-kit/definition.json @@ -1,95 +1,95 @@ { - "name": "phishing-kit", - "uuid": "f452c16b-12fa-4f87-84a2-15a9e8ca6e7c", - "meta-category": "network", - "description": "Object to describe a phishing-kit.", - "version": 3, "attributes": { + "date-found": { + "description": "Date when the phishing kit was found", + "disable_correlation": true, + "misp-attribute": "datetime", + "multiple": true, + "to_ids": false, + "ui-priority": 0 + }, + "email-type": { + "description": "Type of the Email", + "disable_correlation": true, + "misp-attribute": "text", + "multiple": false, + "ui-priority": 0 + }, "internal reference": { "categories": [ "Internal reference" ], + "description": "Internal reference such as ticket ID", "misp-attribute": "text", - "ui-priority": 1, - "description": "Internal reference such as ticket ID" - }, - "date-found": { - "multiple": true, - "misp-attribute": "datetime", - "ui-priority": 0, - "description": "Date when the phishing kit was found", - "to_ids": false, - "disable_correlation": true - }, - "reference-link": { - "to_ids": false, - "multiple": true, - "ui-priority": 1, - "misp-attribute": "link", - "description": "Link where the Phishing Kit was observed" - }, - "threat-actor-email": { - "description": "Email of the Threat Actor", - "multiple": true, - "ui-priority": 0, - "misp-attribute": "email-src" - }, - "email-type": { - "description": "Type of the Email", - "multiple": false, - "ui-priority": 0, - "misp-attribute": "text", - "disable_correlation": true + "ui-priority": 1 }, "kit-mailer": { "description": "Mailer Kit Used", - "multiple": true, - "ui-priority": 0, - "misp-attribute": "text", - "disable_correlation": true - }, - "target": { - "description": "What was targeted using this phishing kit", - "multiple": true, - "ui-priority": 1, - "misp-attribute": "text" - }, - "phishing-domain": { - "description": "Domain used for Phishing", - "multiple": true, - "ui-priority": 1, - "misp-attribute": "url" - }, - "online": { "disable_correlation": true, "misp-attribute": "text", - "values_list": [ - "Yes", - "No" - ], - "ui-priority": 0, - "description": "If the phishing kit is online and operational, by default is yes" - }, - "kit-url": { - "misp-attribute": "url", - "ui-priority": 1, - "description": "URL of Phishing Kit" - }, - "threat-actor": { - "description": "Identified threat actor", - "ui-priority": 0, "multiple": true, - "misp-attribute": "text" + "ui-priority": 0 }, "kit-name": { "description": "Name of the Phishing Kit", - "ui-priority": 10, - "misp-attribute": "text" + "misp-attribute": "text", + "ui-priority": 10 + }, + "kit-url": { + "description": "URL of Phishing Kit", + "misp-attribute": "url", + "ui-priority": 1 + }, + "online": { + "description": "If the phishing kit is online and operational, by default is yes", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 0, + "values_list": [ + "Yes", + "No" + ] + }, + "phishing-domain": { + "description": "Domain used for Phishing", + "misp-attribute": "url", + "multiple": true, + "ui-priority": 1 + }, + "reference-link": { + "description": "Link where the Phishing Kit was observed", + "misp-attribute": "link", + "multiple": true, + "to_ids": false, + "ui-priority": 1 + }, + "target": { + "description": "What was targeted using this phishing kit", + "misp-attribute": "text", + "multiple": true, + "ui-priority": 1 + }, + "threat-actor": { + "description": "Identified threat actor", + "misp-attribute": "text", + "multiple": true, + "ui-priority": 0 + }, + "threat-actor-email": { + "description": "Email of the Threat Actor", + "misp-attribute": "email-src", + "multiple": true, + "ui-priority": 0 } }, + "description": "Object to describe a phishing-kit.", + "meta-category": "network", + "name": "phishing-kit", "requiredOneOf": [ "kit-url", "reference-link", "kit-name" - ] -} + ], + "uuid": "f452c16b-12fa-4f87-84a2-15a9e8ca6e7c", + "version": 3 +} \ No newline at end of file diff --git a/objects/phishing/definition.json b/objects/phishing/definition.json index deadb3c..806f200 100644 --- a/objects/phishing/definition.json +++ b/objects/phishing/definition.json @@ -1,117 +1,117 @@ { - "name": "phishing", - "uuid": "2dad6f9d-d425-4217-8fda-0b0a2d815307", - "meta-category": "network", - "description": "Phishing template to describe a phishing website and its analysis.", - "version": 5, "attributes": { + "hostname": { + "description": "host of the phishing website", + "misp-attribute": "hostname", + "multiple": true, + "ui-priority": 1 + }, "internal reference": { "categories": [ "Internal reference" ], + "description": "Internal reference such as ticket ID", "misp-attribute": "text", - "ui-priority": 1, - "description": "Internal reference such as ticket ID" - }, - "screenshot": { - "multiple": true, - "categories": [ - "External analysis" - ], - "ui-priority": 1, - "disable_correlation": true, - "misp-attribute": "attachment", - "description": "Screenshot of phishing site" - }, - "target": { - "multiple": true, - "misp-attribute": "text", - "ui-priority": 0, - "description": "Targeted organisation by the phishing" - }, - "takedown-request-to": { - "to_ids": false, - "multiple": true, - "categories": [ - "Other" - ], - "ui-priority": 1, - "disable_correlation": true, - "misp-attribute": "text", - "description": "Destination email address for take-down request" - }, - "takedown-request": { - "disable_correlation": true, - "misp-attribute": "datetime", - "ui-priority": 0, - "description": "When the phishing was requested to be taken down" - }, - "takedown-time": { - "disable_correlation": true, - "misp-attribute": "datetime", - "ui-priority": 0, - "description": "When the phishing was taken down" + "ui-priority": 1 }, "online": { + "description": "If the phishing is online and operational, by default is yes", "disable_correlation": true, "misp-attribute": "text", + "ui-priority": 0, "values_list": [ "Yes", "No" - ], - "ui-priority": 0, - "description": "If the phishing is online and operational, by default is yes" - }, - "url": { - "misp-attribute": "url", - "ui-priority": 1, - "description": "Original URL of the phishing website" - }, - "url-redirect": { - "multiple": true, - "misp-attribute": "url", - "ui-priority": 1, - "description": "Redirect URL of the phishing website" - }, - "hostname": { - "multiple": true, - "misp-attribute": "hostname", - "ui-priority": 1, - "description": "host of the phishing website" - }, - "phishtank-id": { - "misp-attribute": "text", - "ui-priority": 1, - "description": "Phishtank ID of the reported phishing" + ] }, "phishtank-detail-url": { - "ui-priority": 1, + "description": "Phishtank detail URL to the reported phishing", "misp-attribute": "link", - "description": "Phishtank detail URL to the reported phishing" + "ui-priority": 1 + }, + "phishtank-id": { + "description": "Phishtank ID of the reported phishing", + "misp-attribute": "text", + "ui-priority": 1 + }, + "screenshot": { + "categories": [ + "External analysis" + ], + "description": "Screenshot of phishing site", + "disable_correlation": true, + "misp-attribute": "attachment", + "multiple": true, + "ui-priority": 1 }, "submission-time": { + "description": "When the phishing was submitted and/or reported", "misp-attribute": "datetime", - "ui-priority": 0, - "description": "When the phishing was submitted and/or reported" + "ui-priority": 0 }, - "verified": { + "takedown-request": { + "description": "When the phishing was requested to be taken down", + "disable_correlation": true, + "misp-attribute": "datetime", + "ui-priority": 0 + }, + "takedown-request-to": { + "categories": [ + "Other" + ], + "description": "Destination email address for take-down request", "disable_correlation": true, "misp-attribute": "text", + "multiple": true, + "to_ids": false, + "ui-priority": 1 + }, + "takedown-time": { + "description": "When the phishing was taken down", + "disable_correlation": true, + "misp-attribute": "datetime", + "ui-priority": 0 + }, + "target": { + "description": "Targeted organisation by the phishing", + "misp-attribute": "text", + "multiple": true, + "ui-priority": 0 + }, + "url": { + "description": "Original URL of the phishing website", + "misp-attribute": "url", + "ui-priority": 1 + }, + "url-redirect": { + "description": "Redirect URL of the phishing website", + "misp-attribute": "url", + "multiple": true, + "ui-priority": 1 + }, + "verification-time": { + "description": "When the phishing was verified", + "disable_correlation": true, + "misp-attribute": "datetime", + "ui-priority": 0 + }, + "verified": { + "description": "The phishing has been verified by the team handling the phishing", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 0, "values_list": [ "No", "Yes" - ], - "ui-priority": 0, - "description": "The phishing has been verified by the team handling the phishing" - }, - "verification-time": { - "disable_correlation": true, - "misp-attribute": "datetime", - "ui-priority": 0, - "description": "When the phishing was verified" + ] } }, + "description": "Phishing template to describe a phishing website and its analysis.", + "meta-category": "network", + "name": "phishing", "requiredOneOf": [ "url" - ] -} + ], + "uuid": "2dad6f9d-d425-4217-8fda-0b0a2d815307", + "version": 5 +} \ No newline at end of file diff --git a/objects/phone/definition.json b/objects/phone/definition.json index 0f2c0d7..b25a2c2 100644 --- a/objects/phone/definition.json +++ b/objects/phone/definition.json @@ -1,33 +1,15 @@ { - "requiredOneOf": [ - "text", - "first-seen", - "last-seen", - "imei", - "imsi", - "msisdn", - "tmsi", - "guti" - ], "attributes": { - "imei": { - "description": "International Mobile Equipment Identity (IMEI) is a number, usually unique, to identify 3GPP and iDEN mobile phones, as well as some satellite phones.", + "brand": { + "description": "Brand of the phone.", + "disable_correlation": true, "misp-attribute": "text", "ui-priority": 1 }, - "imsi": { - "description": "A usually unique International Mobile Subscriber Identity (IMSI) is allocated to each mobile subscriber in the GSM/UMTS/EPS system. IMSI can also refer to International Mobile Station Identity in the ITU nomenclature.", - "misp-attribute": "text", - "ui-priority": 1 - }, - "msisdn": { - "description": "MSISDN (pronounced as /'em es ai es di en/ or misden) is a number uniquely identifying a subscription in a GSM or a UMTS mobile network. Simply put, it is the mapping of the telephone number to the SIM card in a mobile/cellular phone. This abbreviation has a several interpretations, the most common one being Mobile Station International Subscriber Directory Number.", - "misp-attribute": "text", - "ui-priority": 1 - }, - "tmsi": { - "description": "Temporary Mobile Subscriber Identities (TMSI) to visiting mobile subscribers can be allocated.", - "misp-attribute": "text", + "first-seen": { + "description": "When the phone has been accessible or seen for the first time.", + "disable_correlation": true, + "misp-attribute": "datetime", "ui-priority": 0 }, "gummei": { @@ -40,6 +22,33 @@ "misp-attribute": "text", "ui-priority": 0 }, + "imei": { + "description": "International Mobile Equipment Identity (IMEI) is a number, usually unique, to identify 3GPP and iDEN mobile phones, as well as some satellite phones.", + "misp-attribute": "text", + "ui-priority": 1 + }, + "imsi": { + "description": "A usually unique International Mobile Subscriber Identity (IMSI) is allocated to each mobile subscriber in the GSM/UMTS/EPS system. IMSI can also refer to International Mobile Station Identity in the ITU nomenclature.", + "misp-attribute": "text", + "ui-priority": 1 + }, + "last-seen": { + "description": "When the phone has been accessible or seen for the last time.", + "disable_correlation": true, + "misp-attribute": "datetime", + "ui-priority": 0 + }, + "model": { + "description": "Model of the phone.", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 1 + }, + "msisdn": { + "description": "MSISDN (pronounced as /'em es ai es di en/ or misden) is a number uniquely identifying a subscription in a GSM or a UMTS mobile network. Simply put, it is the mapping of the telephone number to the SIM card in a mobile/cellular phone. This abbreviation has a several interpretations, the most common one being Mobile Station International Subscriber Directory Number.", + "misp-attribute": "text", + "ui-priority": 1 + }, "serial-number": { "description": "Serial Number.", "misp-attribute": "text", @@ -48,37 +57,28 @@ "text": { "description": "A description of the phone.", "disable_correlation": true, - "ui-priority": 1, - "misp-attribute": "text" + "misp-attribute": "text", + "ui-priority": 1 }, - "brand": { - "description": "Brand of the phone.", - "disable_correlation": true, - "ui-priority": 1, - "misp-attribute": "text" - }, - "model": { - "description": "Model of the phone.", - "disable_correlation": true, - "ui-priority": 1, - "misp-attribute": "text" - }, - "last-seen": { - "description": "When the phone has been accessible or seen for the last time.", - "disable_correlation": true, - "ui-priority": 0, - "misp-attribute": "datetime" - }, - "first-seen": { - "description": "When the phone has been accessible or seen for the first time.", - "disable_correlation": true, - "ui-priority": 0, - "misp-attribute": "datetime" + "tmsi": { + "description": "Temporary Mobile Subscriber Identities (TMSI) to visiting mobile subscribers can be allocated.", + "misp-attribute": "text", + "ui-priority": 0 } }, - "version": 4, "description": "A phone or mobile phone object which describe a phone.", "meta-category": "misc", + "name": "phone", + "requiredOneOf": [ + "text", + "first-seen", + "last-seen", + "imei", + "imsi", + "msisdn", + "tmsi", + "guti" + ], "uuid": "d7e4fbdd-b551-4862-bddb-a0b470a38509", - "name": "phone" -} + "version": 4 +} \ No newline at end of file diff --git a/objects/process/definition.json b/objects/process/definition.json index 9e3146b..c6698ae 100644 --- a/objects/process/definition.json +++ b/objects/process/definition.json @@ -1,142 +1,142 @@ { - "name": "process", - "uuid": "02aeef94-ac23-455c-addb-731757ceafb5", - "meta-category": "misc", - "description": "Object describing a system process.", - "version": 7, "attributes": { - "creation-time": { - "description": "Local date/time at which the process was created", - "ui-priority": 0, - "misp-attribute": "datetime", - "disable_correlation": true - }, - "start-time": { - "description": "Local date/time at which the process was started", - "ui-priority": 0, - "misp-attribute": "datetime", - "disable_correlation": true - }, - "name": { - "description": "Name of the process", - "ui-priority": 1, - "misp-attribute": "text" - }, - "pid": { - "description": "Process ID of the process", - "ui-priority": 1, + "args": { + "description": "Arguments of the process", + "disable_correlation": true, "misp-attribute": "text", - "disable_correlation": true - }, - "pgid": { - "description": "Identifier of the group of processes the process belong to", - "ui-priority": 1, - "misp-attribute": "text", - "disable_correlation": true - }, - "guid": { - "description": "The globally unique identifier of the assigned by the vendor product", - "ui-priority": 1, - "misp-attribute": "text" - }, - "parent-pid": { - "description": "Process ID of the parent process", - "ui-priority": 1, - "misp-attribute": "text", - "disable_correlation": true - }, - "parent-guid": { - "description": "The globally unique idenifier of the parent process assigned by the vendor product", - "ui-priority": 1, - "misp-attribute": "text" + "ui-priority": 1 }, "child-pid": { "description": "Process ID of the child(ren) process", - "ui-priority": 1, + "disable_correlation": true, "misp-attribute": "text", "multiple": true, - "disable_correlation": true - }, - "port": { - "description": "Port(s) owned by the process", - "ui-priority": 1, - "misp-attribute": "port", - "multiple": true, - "disable_correlation": true + "ui-priority": 1 }, "command-line": { "description": "Command line of the process", - "ui-priority": 1, - "misp-attribute": "text" - }, - "args": { - "description": "Arguments of the process", - "ui-priority": 1, "misp-attribute": "text", - "disable_correlation": true + "ui-priority": 1 + }, + "creation-time": { + "description": "Local date/time at which the process was created", + "disable_correlation": true, + "misp-attribute": "datetime", + "ui-priority": 0 }, "current-directory": { "description": "Current working directory of the process", - "ui-priority": 2, + "disable_correlation": true, "misp-attribute": "text", - "disable_correlation": true + "ui-priority": 2 + }, + "guid": { + "description": "The globally unique identifier of the assigned by the vendor product", + "misp-attribute": "text", + "ui-priority": 1 + }, + "hidden": { + "description": "Specifies whether the process is hidden", + "disable_correlation": true, + "misp-attribute": "boolean", + "ui-priority": 1 }, "image": { "description": "Path of process image", - "ui-priority": 1, - "misp-attribute": "filename" - }, - "parent-command-line": { - "description": "Command line of the parent process", - "ui-priority": 1, - "misp-attribute": "text" - }, - "parent-image": { - "description": "Path of parent process image", - "ui-priority": 1, - "misp-attribute": "filename" - }, - "parent-process-name": { - "description": "Process name of the parent", - "ui-priority": 1, - "misp-attribute": "text" - }, - "parent-process-path": { - "description": "Parent process path of the parent", - "ui-priority": 1, - "misp-attribute": "text" - }, - "user": { - "description": "User context of the process", - "ui-priority": 2, - "misp-attribute": "text", - "disable_correlation": true + "misp-attribute": "filename", + "ui-priority": 1 }, "integrity-level": { "description": "Integrity level of the process", - "ui-priority": 2, - "misp-attribute": "text", "disable_correlation": true, + "misp-attribute": "text", "sane_default": [ "system", "high", "medium", "low", "untrusted" - ] + ], + "ui-priority": 2 }, - "hidden": { - "description": "Specifies whether the process is hidden", - "ui-priority": 1, - "misp-attribute": "boolean", - "disable_correlation": true + "name": { + "description": "Name of the process", + "misp-attribute": "text", + "ui-priority": 1 + }, + "parent-command-line": { + "description": "Command line of the parent process", + "misp-attribute": "text", + "ui-priority": 1 + }, + "parent-guid": { + "description": "The globally unique idenifier of the parent process assigned by the vendor product", + "misp-attribute": "text", + "ui-priority": 1 + }, + "parent-image": { + "description": "Path of parent process image", + "misp-attribute": "filename", + "ui-priority": 1 + }, + "parent-pid": { + "description": "Process ID of the parent process", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 1 + }, + "parent-process-name": { + "description": "Process name of the parent", + "misp-attribute": "text", + "ui-priority": 1 + }, + "parent-process-path": { + "description": "Parent process path of the parent", + "misp-attribute": "text", + "ui-priority": 1 + }, + "pgid": { + "description": "Identifier of the group of processes the process belong to", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 1 + }, + "pid": { + "description": "Process ID of the process", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 1 + }, + "port": { + "description": "Port(s) owned by the process", + "disable_correlation": true, + "misp-attribute": "port", + "multiple": true, + "ui-priority": 1 + }, + "start-time": { + "description": "Local date/time at which the process was started", + "disable_correlation": true, + "misp-attribute": "datetime", + "ui-priority": 0 + }, + "user": { + "description": "User context of the process", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 2 } }, + "description": "Object describing a system process.", + "meta-category": "misc", + "name": "process", "requiredOneOf": [ "name", "pid", "image", "command-line", "current-directory" - ] -} + ], + "uuid": "02aeef94-ac23-455c-addb-731757ceafb5", + "version": 7 +} \ No newline at end of file diff --git a/objects/python-etvx-event-log/definition.json b/objects/python-etvx-event-log/definition.json index a2f9a7b..9505a44 100644 --- a/objects/python-etvx-event-log/definition.json +++ b/objects/python-etvx-event-log/definition.json @@ -1,40 +1,104 @@ { - "required": [ - "source", - "event-type", - "name" - ], "attributes": { - "event-id": { - "description": "A unique number which identifies the event.", - "ui-priority": 1, + "Computer": { + "description": "Computer name on which the event occurred", + "disable_correlation": true, "misp-attribute": "text", - "disable_correlation": true + "ui-priority": 0 }, - "name": { - "description": "Name of the event.", - "ui-priority": 2, + "Correlation-ID": { + "description": "Unique activity identity which relates the event to a process. ", "misp-attribute": "text", - "disable_correlation": true + "ui-priority": 0 + }, + "Event-data": { + "description": "Event data description.", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 0 + }, + "Keywords": { + "description": "Tags used for the event for the purpose of filtering or searching.", + "misp-attribute": "text", + "sane_default": [ + "Network", + "Security", + "Resource not found", + "other" + ], + "ui-priority": 0 + }, + "Operational-code": { + "description": "The opcode (numeric value or name) associated with the activity carried out by the event.", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 0 + }, + "Processor-ID": { + "description": "ID of the processor that processed the event.", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 0 + }, + "Relative-Correlation-ID": { + "description": "Related activity ID which identity similar activities which occurred as a part of the event.", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 0 + }, + "Session-ID": { + "description": "Terminal server session ID.", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 0 + }, + "Thread-ID": { + "description": "Thread id that generated the event.", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 0 + }, + "User": { + "description": "Name or the User ID the event is associated with.", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 0 + }, + "comment": { + "description": "Additional comments.", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 0 }, "event-channel": { "description": " Channel through which the event occurred", - "ui-priority": 3, - "misp-attribute": "text", "disable_correlation": true, + "misp-attribute": "text", "sane_default": [ "Application", "System", "Security", "Setup", "other" - ] + ], + "ui-priority": 3 + }, + "event-date-time": { + "description": "Date and time when the event was logged.", + "disable_correlation": true, + "misp-attribute": "datetime", + "ui-priority": 0 + }, + "event-id": { + "description": "A unique number which identifies the event.", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 1 }, "event-type": { "description": "Event-type assigned to the event", - "ui-priority": 0, - "misp-attribute": "text", "disable_correlation": true, + "misp-attribute": "text", "sane_default": [ "Admin", "Operational", @@ -42,22 +106,17 @@ "Analytic", "Debug", "other" - ] + ], + "ui-priority": 0 }, - "source": { - "description": "The source of the event log - application/software that logged the event.", - "ui-priority": 0, - "misp-attribute": "text" - }, - "event-date-time": { - "description": "Date and time when the event was logged.", - "ui-priority": 0, + "kernel-time": { + "description": "Execution time of the kernel mode instruction.", + "disable_correlation": true, "misp-attribute": "datetime", - "disable_correlation": true + "ui-priority": 0 }, "level": { "description": "Determines the event severity.", - "ui-priority": 0, "misp-attribute": "text", "sane_default": [ "Information", @@ -66,106 +125,47 @@ "Critical", "Success Audit", "Failure Audit" - ] - }, - "Computer": { - "description": "Computer name on which the event occurred", - "ui-priority": 0, - "misp-attribute": "text", - "disable_correlation": true - }, - "User": { - "description": "Name or the User ID the event is associated with.", - "ui-priority": 0, - "misp-attribute": "text", - "disable_correlation": true - }, - "Operational-code": { - "description": "The opcode (numeric value or name) associated with the activity carried out by the event.", - "ui-priority": 0, - "misp-attribute": "text", - "disable_correlation": true + ], + "ui-priority": 0 }, "log": { "description": "Log file where the event was recorded.", - "ui-priority": 0, + "disable_correlation": true, "misp-attribute": "text", - "disable_correlation": true + "ui-priority": 0 + }, + "name": { + "description": "Name of the event.", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 2 + }, + "source": { + "description": "The source of the event log - application/software that logged the event.", + "misp-attribute": "text", + "ui-priority": 0 }, "task-category": { "description": "Activity by the event publisher", - "ui-priority": 0, + "disable_correlation": true, "misp-attribute": "text", - "disable_correlation": true - }, - "Keywords": { - "description": "Tags used for the event for the purpose of filtering or searching.", - "ui-priority": 0, - "misp-attribute": "text", - "sane_default": [ - "Network", - "Security", - "Resource not found", - "other" - ] - }, - "Processor-ID": { - "description": "ID of the processor that processed the event.", - "ui-priority": 0, - "misp-attribute": "text", - "disable_correlation": true - }, - "Thread-ID": { - "description": "Thread id that generated the event.", - "ui-priority": 0, - "misp-attribute": "text", - "disable_correlation": true - }, - "Session-ID": { - "description": "Terminal server session ID.", - "ui-priority": 0, - "misp-attribute": "text", - "disable_correlation": true - }, - "Correlation-ID": { - "description": "Unique activity identity which relates the event to a process. ", - "ui-priority": 0, - "misp-attribute": "text" - }, - "Relative-Correlation-ID": { - "description": "Related activity ID which identity similar activities which occurred as a part of the event.", - "ui-priority": 0, - "misp-attribute": "text", - "disable_correlation": true - }, - "kernel-time": { - "description": "Execution time of the kernel mode instruction.", - "ui-priority": 0, - "misp-attribute": "datetime", - "disable_correlation": true + "ui-priority": 0 }, "user-time": { "description": "Date and time when the user instruction was executed.", - "ui-priority": 0, + "disable_correlation": true, "misp-attribute": "datetime", - "disable_correlation": true - }, - "Event-data": { - "description": "Event data description.", - "ui-priority": 0, - "misp-attribute": "text", - "disable_correlation": true - }, - "comment": { - "description": "Additional comments.", - "ui-priority": 0, - "misp-attribute": "text", - "disable_correlation": true + "ui-priority": 0 } }, - "version": 1, "description": "Event log object template to share information of the activities conducted on a system. ", "meta-category": "misc", + "name": "python-etvx-event-log", + "required": [ + "source", + "event-type", + "name" + ], "uuid": "94e3aee9-cb99-4503-9bf6-7da3db5de55e", - "name": "python-etvx-event-log" -} + "version": 1 +} \ No newline at end of file diff --git a/objects/r2graphity/definition.json b/objects/r2graphity/definition.json index 5f3f9ce..bb95ee9 100644 --- a/objects/r2graphity/definition.json +++ b/objects/r2graphity/definition.json @@ -1,144 +1,144 @@ { - "requiredOneOf": [ - "r2-commit-version" - ], "attributes": { "callback-average": { "description": "Average size of a callback", "disable_correlation": true, - "ui-priority": 0, - "misp-attribute": "counter" - }, - "callbacks": { - "description": "Amount of callbacks (functions started as thread)", - "disable_correlation": true, - "ui-priority": 0, - "misp-attribute": "counter" - }, - "shortest-path-to-create-thread": { - "description": "Shortest path to the first time the binary calls CreateThread", - "disable_correlation": true, - "ui-priority": 0, - "misp-attribute": "counter" - }, - "create-thread": { - "description": "Amount of calls to CreateThread", - "disable_correlation": true, - "ui-priority": 0, - "misp-attribute": "counter" - }, - "memory-allocations": { - "description": "Amount of memory allocations", - "disable_correlation": true, - "ui-priority": 0, - "misp-attribute": "counter" - }, - "get-proc-address": { - "description": "Amount of calls to GetProcAddress", - "disable_correlation": true, - "ui-priority": 0, - "misp-attribute": "counter" - }, - "dangling-strings": { - "description": "Amount of dangling strings (string with a code cross reference, that is not within a function. Radare2 failed to detect that function.)", - "disable_correlation": true, - "ui-priority": 0, - "misp-attribute": "counter" - }, - "referenced-strings": { - "description": "Amount of referenced strings", - "disable_correlation": true, - "ui-priority": 0, - "misp-attribute": "counter" + "misp-attribute": "counter", + "ui-priority": 0 }, "callback-largest": { "description": "Largest callback", "disable_correlation": true, - "ui-priority": 0, - "misp-attribute": "counter" + "misp-attribute": "counter", + "ui-priority": 0 + }, + "callbacks": { + "description": "Amount of callbacks (functions started as thread)", + "disable_correlation": true, + "misp-attribute": "counter", + "ui-priority": 0 + }, + "create-thread": { + "description": "Amount of calls to CreateThread", + "disable_correlation": true, + "misp-attribute": "counter", + "ui-priority": 0 + }, + "dangling-strings": { + "description": "Amount of dangling strings (string with a code cross reference, that is not within a function. Radare2 failed to detect that function.)", + "disable_correlation": true, + "misp-attribute": "counter", + "ui-priority": 0 + }, + "get-proc-address": { + "description": "Amount of calls to GetProcAddress", + "disable_correlation": true, + "misp-attribute": "counter", + "ui-priority": 0 }, "gml": { "description": "Graph export in G>raph Modelling Language format", "disable_correlation": true, - "ui-priority": 0, - "misp-attribute": "attachment" - }, - "r2-commit-version": { - "description": "Radare2 commit ID used to generate this object", - "disable_correlation": true, - "ui-priority": 0, - "misp-attribute": "text" - }, - "text": { - "description": "Description of the r2graphity object", - "disable_correlation": true, - "ui-priority": 1, - "misp-attribute": "text" - }, - "miss-api": { - "description": "Amount of API call reference that does not resolve to a function offset", - "disable_correlation": true, - "ui-priority": 0, - "misp-attribute": "counter" - }, - "total-api": { - "description": "Total amount of API calls", - "disable_correlation": true, - "ui-priority": 0, - "misp-attribute": "counter" - }, - "unknown-references": { - "description": "Amount of API calls not ending in a function (Radare2 bug, probalby)", - "disable_correlation": true, - "ui-priority": 0, - "misp-attribute": "counter" - }, - "refsglobalvar": { - "description": "Amount of API calls outside of code section (glob var, dynamic API)", - "disable_correlation": true, - "ui-priority": 0, - "misp-attribute": "counter" + "misp-attribute": "attachment", + "ui-priority": 0 }, "local-references": { "description": "Amount of API calls inside a code section", "disable_correlation": true, - "ui-priority": 0, - "misp-attribute": "counter" + "misp-attribute": "counter", + "ui-priority": 0 }, - "total-functions": { - "description": "Total amount of functions in the file.", + "memory-allocations": { + "description": "Amount of memory allocations", "disable_correlation": true, - "ui-priority": 0, - "misp-attribute": "counter" + "misp-attribute": "counter", + "ui-priority": 0 + }, + "miss-api": { + "description": "Amount of API call reference that does not resolve to a function offset", + "disable_correlation": true, + "misp-attribute": "counter", + "ui-priority": 0 }, "not-referenced-strings": { "description": "Amount of not referenced strings", "disable_correlation": true, - "ui-priority": 0, - "misp-attribute": "counter" + "misp-attribute": "counter", + "ui-priority": 0 }, - "ratio-functions": { - "description": "Ratio: amount of functions per kilobyte of code section", + "r2-commit-version": { + "description": "Radare2 commit ID used to generate this object", "disable_correlation": true, - "ui-priority": 0, - "misp-attribute": "float" + "misp-attribute": "text", + "ui-priority": 0 }, "ratio-api": { "description": "Ratio: amount of API calls per kilobyte of code section", "disable_correlation": true, - "ui-priority": 0, - "misp-attribute": "float" + "misp-attribute": "float", + "ui-priority": 0 + }, + "ratio-functions": { + "description": "Ratio: amount of functions per kilobyte of code section", + "disable_correlation": true, + "misp-attribute": "float", + "ui-priority": 0 }, "ratio-string": { "description": "Ratio: amount of referenced strings per kilobyte of code section", "disable_correlation": true, - "ui-priority": 0, - "misp-attribute": "float" + "misp-attribute": "float", + "ui-priority": 0 + }, + "referenced-strings": { + "description": "Amount of referenced strings", + "disable_correlation": true, + "misp-attribute": "counter", + "ui-priority": 0 + }, + "refsglobalvar": { + "description": "Amount of API calls outside of code section (glob var, dynamic API)", + "disable_correlation": true, + "misp-attribute": "counter", + "ui-priority": 0 + }, + "shortest-path-to-create-thread": { + "description": "Shortest path to the first time the binary calls CreateThread", + "disable_correlation": true, + "misp-attribute": "counter", + "ui-priority": 0 + }, + "text": { + "description": "Description of the r2graphity object", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 1 + }, + "total-api": { + "description": "Total amount of API calls", + "disable_correlation": true, + "misp-attribute": "counter", + "ui-priority": 0 + }, + "total-functions": { + "description": "Total amount of functions in the file.", + "disable_correlation": true, + "misp-attribute": "counter", + "ui-priority": 0 + }, + "unknown-references": { + "description": "Amount of API calls not ending in a function (Radare2 bug, probalby)", + "disable_correlation": true, + "misp-attribute": "counter", + "ui-priority": 0 } }, - "version": 2, "description": "Indicators extracted from files using radare2 and graphml", "meta-category": "file", + "name": "r2graphity", + "requiredOneOf": [ + "r2-commit-version" + ], "uuid": "b6abe0e0-52ea-4424-ba42-761c2e027b76", - "name": "r2graphity" -} + "version": 2 +} \ No newline at end of file diff --git a/objects/regexp/definition.json b/objects/regexp/definition.json index 5322b71..fc77bb0 100644 --- a/objects/regexp/definition.json +++ b/objects/regexp/definition.json @@ -1,18 +1,20 @@ { - "requiredOneOf": [ - "regexp" - ], "attributes": { "comment": { "description": "A description of the regular expression.", - "ui-priority": 0, - "misp-attribute": "comment" + "misp-attribute": "comment", + "ui-priority": 0 + }, + "regexp": { + "description": "regexp", + "misp-attribute": "text", + "ui-priority": 0 }, "regexp-type": { "description": "Type of the regular expression syntax.", "disable_correlation": true, - "ui-priority": 0, "misp-attribute": "text", + "ui-priority": 0, "values_list": [ "PCRE", "PCRE2", @@ -20,12 +22,10 @@ "POSIX ERE" ] }, - "regexp": { - "description": "regexp", - "ui-priority": 0, - "misp-attribute": "text" - }, "type": { + "description": "Specify which type corresponds to this regex.", + "disable_correlation": true, + "misp-attribute": "text", "sane_default": [ "hostname", "domain", @@ -41,15 +41,15 @@ "windows-service-name", "windows-scheduled-task" ], - "description": "Specify which type corresponds to this regex.", - "disable_correlation": true, - "ui-priority": 0, - "misp-attribute": "text" + "ui-priority": 0 } }, - "version": 4, "description": "An object describing a regular expression (regex or regexp). The object can be linked via a relationship to other attributes or objects to describe how it can be represented as a regular expression.", "meta-category": "misc", + "name": "regexp", + "requiredOneOf": [ + "regexp" + ], "uuid": "ceffad66-71e5-4e20-9370-1b3fb694c648", - "name": "regexp" -} + "version": 4 +} \ No newline at end of file diff --git a/objects/registry-key/definition.json b/objects/registry-key/definition.json index ce8ca1c..0eea7a7 100644 --- a/objects/registry-key/definition.json +++ b/objects/registry-key/definition.json @@ -1,23 +1,20 @@ { - "requiredOneOf": [ - "key", - "name", - "data" - ], "attributes": { - "last-modified": { - "description": "Last time the registry key has been modified", - "categories": [ - "Other" - ], - "ui-priority": 0, - "misp-attribute": "datetime" - }, - "data-type": { - "description": "Registry value type", + "data": { "categories": [ "Persistence mechanism" ], + "description": "Data stored in the registry key", + "misp-attribute": "text", + "ui-priority": 1 + }, + "data-type": { + "categories": [ + "Persistence mechanism" + ], + "description": "Registry value type", + "disable_correlation": true, + "misp-attribute": "text", "sane_default": [ "REG_NONE", "REG_SZ", @@ -34,45 +31,45 @@ "REG_QWORD", "REG_QWORD_LITTLE_ENDIAN" ], - "ui-priority": 0, - "disable_correlation": true, - "misp-attribute": "text" - }, - "data": { - "description": "Data stored in the registry key", - "categories": [ - "Persistence mechanism" - ], - "ui-priority": 1, - "misp-attribute": "text" - }, - "name": { - "description": "Name of the registry key", - "categories": [ - "Persistence mechanism" - ], - "ui-priority": 1, - "misp-attribute": "text" - }, - "key": { - "description": "Full key path", - "categories": [ - "Persistence mechanism" - ], - "ui-priority": 1, - "misp-attribute": "regkey" + "ui-priority": 0 }, "hive": { - "description": "Hive used to store the registry key (file on disk)", "categories": [ "Persistence mechanism" ], - "ui-priority": 1, + "description": "Hive used to store the registry key (file on disk)", "disable_correlation": true, - "misp-attribute": "text" + "misp-attribute": "text", + "ui-priority": 1 + }, + "key": { + "categories": [ + "Persistence mechanism" + ], + "description": "Full key path", + "misp-attribute": "regkey", + "ui-priority": 1 + }, + "last-modified": { + "categories": [ + "Other" + ], + "description": "Last time the registry key has been modified", + "misp-attribute": "datetime", + "ui-priority": 0 + }, + "name": { + "categories": [ + "Persistence mechanism" + ], + "description": "Name of the registry key", + "misp-attribute": "text", + "ui-priority": 1 }, "root-keys": { "description": "Root key of the Windows registry (extracted from the key)", + "disable_correlation": true, + "misp-attribute": "text", "sane_default": [ "HKCC", "HKCR", @@ -89,14 +86,17 @@ "HKPD", "HKU" ], - "ui-priority": 0, - "misp-attribute": "text", - "disable_correlation": true + "ui-priority": 0 } }, - "version": 4, "description": "Registry key object describing a Windows registry key with value and last-modified timestamp", "meta-category": "file", + "name": "registry-key", + "requiredOneOf": [ + "key", + "name", + "data" + ], "uuid": "8b3228ad-6d82-4fe6-b2ae-05426308f1d5", - "name": "registry-key" -} + "version": 4 +} \ No newline at end of file diff --git a/objects/regripper-NTUser/definition.json b/objects/regripper-NTUser/definition.json index b9ed227..91087ac 100644 --- a/objects/regripper-NTUser/definition.json +++ b/objects/regripper-NTUser/definition.json @@ -1,98 +1,98 @@ { + "attributes": { + "applications-installed": { + "description": "List of applications installed.", + "misp-attribute": "text", + "multiple": true, + "ui-priority": 0 + }, + "applications-run": { + "description": "List of applications set to run on the system.", + "misp-attribute": "text", + "multiple": true, + "ui-priority": 0 + }, + "comments": { + "description": "Additional information related to the user profile", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 0 + }, + "external-devices": { + "description": "List of external devices connected to the system by the user.", + "misp-attribute": "text", + "multiple": true, + "ui-priority": 0 + }, + "key": { + "description": "Registry key where the information is retrieved from.", + "misp-attribute": "text", + "ui-priority": 0 + }, + "key-last-write-time": { + "description": "Date and time when the key was last updated.", + "disable_correlation": true, + "misp-attribute": "datetime", + "ui-priority": 0 + }, + "logon-user-name": { + "description": "Name assigned to the user profile.", + "misp-attribute": "text", + "ui-priority": 0 + }, + "mount-points": { + "description": "Details of the mount points created on the system.", + "disable_correlation": true, + "misp-attribute": "text", + "multiple": true, + "ui-priority": 0 + }, + "network-connected-to": { + "description": "List of networks the user connected the system to.", + "misp-attribute": "text", + "multiple": true, + "ui-priority": 0 + }, + "nukeOnDelete": { + "description": "Determines if the Recycle bin option has been disabled.", + "disable_correlation": true, + "misp-attribute": "boolean", + "ui-priority": 0 + }, + "recent-files-accessed": { + "description": "List of recent files accessed by the user.", + "misp-attribute": "text", + "multiple": true, + "ui-priority": 0 + }, + "recent-folders-accessed": { + "description": "List of recent folders accessed by the user.", + "misp-attribute": "text", + "multiple": true, + "ui-priority": 0 + }, + "typed-urls": { + "description": "Urls typed by the user in internet explorer", + "misp-attribute": "text", + "multiple": true, + "ui-priority": 0 + }, + "user-init": { + "description": "Applications or processes set to run when the user logs onto the windows system.", + "misp-attribute": "text", + "multiple": true, + "ui-priority": 0 + } + }, + "description": "Regripper Object template designed to present user specific configuration details extracted from the NTUSER.dat hive.", + "meta-category": "misc", + "name": "regripper-NTUser", "required": [ "key" ], "requiredOneOf": [ "logon-user-name" ], - "attributes": { - "key": { - "description": "Registry key where the information is retrieved from.", - "ui-priority": 0, - "misp-attribute": "text" - }, - "key-last-write-time": { - "description": "Date and time when the key was last updated.", - "ui-priority": 0, - "misp-attribute": "datetime", - "disable_correlation": true - }, - "logon-user-name": { - "description": "Name assigned to the user profile.", - "ui-priority": 0, - "misp-attribute": "text" - }, - "recent-folders-accessed": { - "description": "List of recent folders accessed by the user.", - "ui-priority": 0, - "misp-attribute": "text", - "multiple": true - }, - "recent-files-accessed": { - "description": "List of recent files accessed by the user.", - "ui-priority": 0, - "misp-attribute": "text", - "multiple": true - }, - "typed-urls": { - "description": "Urls typed by the user in internet explorer", - "ui-priority": 0, - "misp-attribute": "text", - "multiple": true - }, - "applications-installed": { - "description": "List of applications installed.", - "ui-priority": 0, - "misp-attribute": "text", - "multiple": true - }, - "applications-run": { - "description": "List of applications set to run on the system.", - "ui-priority": 0, - "misp-attribute": "text", - "multiple": true - }, - "external-devices": { - "description": "List of external devices connected to the system by the user.", - "ui-priority": 0, - "misp-attribute": "text", - "multiple": true - }, - "user-init": { - "description": "Applications or processes set to run when the user logs onto the windows system.", - "ui-priority": 0, - "misp-attribute": "text", - "multiple": true - }, - "nukeOnDelete": { - "description": "Determines if the Recycle bin option has been disabled.", - "ui-priority": 0, - "misp-attribute": "boolean", - "disable_correlation": true - }, - "network-connected-to": { - "description": "List of networks the user connected the system to.", - "ui-priority": 0, - "misp-attribute": "text", - "multiple": true - }, - "mount-points": { - "description": "Details of the mount points created on the system.", - "ui-priority": 0, - "misp-attribute": "text", - "multiple": true, - "disable_correlation": true - }, - "comments": { - "description": "Additional information related to the user profile", - "ui-priority": 0, - "misp-attribute": "text", - "disable_correlation": true - } - }, - "version": 1, - "description": "Regripper Object template designed to present user specific configuration details extracted from the NTUSER.dat hive.", - "meta-category": "misc", "uuid": "f9dc7b7e-8ab1-4dde-95d9-67e41b461c65", - "name": "regripper-NTUser" -} + "version": 1 +} \ No newline at end of file diff --git a/objects/regripper-sam-hive-single-user/definition.json b/objects/regripper-sam-hive-single-user/definition.json index 0bef376..82eb06a 100644 --- a/objects/regripper-sam-hive-single-user/definition.json +++ b/objects/regripper-sam-hive-single-user/definition.json @@ -1,4 +1,60 @@ { + "attributes": { + "comments": { + "description": "Full name assigned to the user profile.", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 0 + }, + "full-user-name": { + "description": "Full name assigned to the user profile.", + "misp-attribute": "text", + "ui-priority": 0 + }, + "key": { + "description": "Registry key where the information is retrieved from.", + "misp-attribute": "text", + "ui-priority": 0 + }, + "key-last-write-time": { + "description": "Date and time when the key was last updated.", + "disable_correlation": true, + "misp-attribute": "datetime", + "ui-priority": 0 + }, + "last-login-time": { + "description": "Date and time when the user last logged onto the system.", + "disable_correlation": true, + "misp-attribute": "datetime", + "ui-priority": 0 + }, + "login-count": { + "description": "Number of times the user logged-in onto the system.", + "disable_correlation": true, + "misp-attribute": "counter", + "ui-priority": 0 + }, + "pwd-fail-date": { + "description": "Date and time when a password last failed for this user profile.", + "disable_correlation": true, + "misp-attribute": "datetime", + "ui-priority": 0 + }, + "pwd-reset-time": { + "description": "Date and time when the password was last reset.", + "disable_correlation": true, + "misp-attribute": "datetime", + "ui-priority": 0 + }, + "user-name": { + "description": "User name assigned to the user profile.", + "misp-attribute": "text", + "ui-priority": 0 + } + }, + "description": "Regripper Object template designed to present user profile details extracted from the SAM hive.", + "meta-category": "misc", + "name": "regripper-sam-hive-single-user", "required": [ "key" ], @@ -7,62 +63,6 @@ "last-login-time", "login-count" ], - "attributes": { - "key": { - "description": "Registry key where the information is retrieved from.", - "ui-priority": 0, - "misp-attribute": "text" - }, - "key-last-write-time": { - "description": "Date and time when the key was last updated.", - "ui-priority": 0, - "misp-attribute": "datetime", - "disable_correlation": true - }, - "user-name": { - "description": "User name assigned to the user profile.", - "ui-priority": 0, - "misp-attribute": "text" - }, - "full-user-name": { - "description": "Full name assigned to the user profile.", - "ui-priority": 0, - "misp-attribute": "text" - }, - "last-login-time": { - "description": "Date and time when the user last logged onto the system.", - "ui-priority": 0, - "misp-attribute": "datetime", - "disable_correlation": true - }, - "pwd-reset-time": { - "description": "Date and time when the password was last reset.", - "ui-priority": 0, - "misp-attribute": "datetime", - "disable_correlation": true - }, - "pwd-fail-date": { - "description": "Date and time when a password last failed for this user profile.", - "ui-priority": 0, - "misp-attribute": "datetime", - "disable_correlation": true - }, - "login-count": { - "description": "Number of times the user logged-in onto the system.", - "ui-priority": 0, - "misp-attribute": "counter", - "disable_correlation": true - }, - "comments": { - "description": "Full name assigned to the user profile.", - "ui-priority": 0, - "misp-attribute": "text", - "disable_correlation": true - } - }, - "version": 1, - "description": "Regripper Object template designed to present user profile details extracted from the SAM hive.", - "meta-category": "misc", "uuid": "112efd9a-2137-4198-92ed-7c91043e2cd4", - "name": "regripper-sam-hive-single-user" -} + "version": 1 +} \ No newline at end of file diff --git a/objects/regripper-sam-hive-user-group/definition.json b/objects/regripper-sam-hive-user-group/definition.json index 55df836..d7652d5 100644 --- a/objects/regripper-sam-hive-user-group/definition.json +++ b/objects/regripper-sam-hive-user-group/definition.json @@ -1,54 +1,54 @@ { + "attributes": { + "full-name": { + "description": "Full name assigned to the profile.", + "misp-attribute": "text", + "ui-priority": 0 + }, + "group-comment": { + "description": "Any group comment added.", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 0 + }, + "group-name": { + "description": "Name assigned to the profile.", + "misp-attribute": "text", + "ui-priority": 0 + }, + "group-users": { + "description": "Users belonging to the group", + "misp-attribute": "text", + "multiple": true, + "ui-priority": 0 + }, + "key": { + "description": "Registry key where the information is retrieved from.", + "misp-attribute": "text", + "ui-priority": 0 + }, + "key-last-write-time": { + "description": "Date and time when the key was last updated.", + "disable_correlation": true, + "misp-attribute": "datetime", + "ui-priority": 0 + }, + "last-write-date-time": { + "description": "Date and time when the group key was updated.", + "disable_correlation": true, + "misp-attribute": "datetime", + "ui-priority": 0 + } + }, + "description": "Regripper Object template designed to present group profile details extracted from the SAM hive.", + "meta-category": "misc", + "name": "regripper-sam-hive-user-group", "required": [ "key" ], "requiredOneOf": [ "group-name" ], - "attributes": { - "key": { - "description": "Registry key where the information is retrieved from.", - "ui-priority": 0, - "misp-attribute": "text" - }, - "key-last-write-time": { - "description": "Date and time when the key was last updated.", - "ui-priority": 0, - "misp-attribute": "datetime", - "disable_correlation": true - }, - "group-name": { - "description": "Name assigned to the profile.", - "ui-priority": 0, - "misp-attribute": "text" - }, - "full-name": { - "description": "Full name assigned to the profile.", - "ui-priority": 0, - "misp-attribute": "text" - }, - "last-write-date-time": { - "description": "Date and time when the group key was updated.", - "ui-priority": 0, - "misp-attribute": "datetime", - "disable_correlation": true - }, - "group-comment": { - "description": "Any group comment added.", - "ui-priority": 0, - "misp-attribute": "text", - "disable_correlation": true - }, - "group-users": { - "description": "Users belonging to the group", - "ui-priority": 0, - "misp-attribute": "text", - "multiple": true - } - }, - "version": 1, - "description": "Regripper Object template designed to present group profile details extracted from the SAM hive.", - "meta-category": "misc", "uuid": "b924bae1-2dec-4d2d-a8c2-b03305222b7c", - "name": "regripper-sam-hive-user-group" -} + "version": 1 +} \ No newline at end of file diff --git a/objects/regripper-software-hive-BHO/definition.json b/objects/regripper-software-hive-BHO/definition.json index 3c392f6..9c08d02 100644 --- a/objects/regripper-software-hive-BHO/definition.json +++ b/objects/regripper-software-hive-BHO/definition.json @@ -1,59 +1,59 @@ { + "attributes": { + "BHO-key-last-write-time": { + "description": "Date and time when the BHO key was last updated.", + "disable_correlation": true, + "misp-attribute": "datetime", + "ui-priority": 0 + }, + "BHO-name": { + "description": "Name of the browser helper object.", + "misp-attribute": "text", + "ui-priority": 0 + }, + "class": { + "description": "Class to which the BHO belongs to.", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 0 + }, + "comments": { + "description": "Additional comments.", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 0 + }, + "key": { + "description": "Software hive key where the information is retrieved from.", + "misp-attribute": "text", + "ui-priority": 0 + }, + "last-write-time": { + "description": "Date and time when the key was last updated.", + "disable_correlation": true, + "misp-attribute": "datetime", + "ui-priority": 0 + }, + "module": { + "description": "DLL module the BHO belongs to.", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 0 + }, + "references": { + "description": "References to the BHO.", + "misp-attribute": "link", + "multiple": true, + "ui-priority": 0 + } + }, + "description": "Regripper Object template designed to gather information of the browser helper objects installed on the system.", + "meta-category": "misc", + "name": "regripper-software-hive-BHO", "required": [ "key", "BHO-name" ], - "attributes": { - "key": { - "description": "Software hive key where the information is retrieved from.", - "ui-priority": 0, - "misp-attribute": "text" - }, - "last-write-time": { - "description": "Date and time when the key was last updated.", - "ui-priority": 0, - "misp-attribute": "datetime", - "disable_correlation": true - }, - "BHO-name": { - "description": "Name of the browser helper object.", - "ui-priority": 0, - "misp-attribute": "text" - }, - "BHO-key-last-write-time": { - "description": "Date and time when the BHO key was last updated.", - "ui-priority": 0, - "misp-attribute": "datetime", - "disable_correlation": true - }, - "class": { - "description": "Class to which the BHO belongs to.", - "ui-priority": 0, - "misp-attribute": "text", - "disable_correlation": true - }, - "module": { - "description": "DLL module the BHO belongs to.", - "ui-priority": 0, - "misp-attribute": "text", - "disable_correlation": true - }, - "comments": { - "description": "Additional comments.", - "ui-priority": 0, - "misp-attribute": "text", - "disable_correlation": true - }, - "references": { - "description": "References to the BHO.", - "ui-priority": 0, - "misp-attribute": "link", - "multiple": true - } - }, - "version": 1, - "description": "Regripper Object template designed to gather information of the browser helper objects installed on the system.", - "meta-category": "misc", "uuid": "e7b46b5a-d2d2-4a05-bc25-2ac8d4683ae2", - "name": "regripper-software-hive-BHO" -} + "version": 1 +} \ No newline at end of file diff --git a/objects/regripper-software-hive-appInit-DLLS/definition.json b/objects/regripper-software-hive-appInit-DLLS/definition.json index 7bd9395..8e03ffa 100644 --- a/objects/regripper-software-hive-appInit-DLLS/definition.json +++ b/objects/regripper-software-hive-appInit-DLLS/definition.json @@ -1,53 +1,53 @@ { + "attributes": { + "DLL-last-write-time": { + "description": "Date and time when the DLL file was last updated.", + "disable_correlation": true, + "misp-attribute": "datetime", + "ui-priority": 0 + }, + "DLL-name": { + "description": "Name of the DLL file.", + "misp-attribute": "text", + "ui-priority": 0 + }, + "DLL-path": { + "description": "Path where the DLL file is stored.", + "misp-attribute": "text", + "ui-priority": 0 + }, + "comments": { + "description": "Additional comments.", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 0 + }, + "key": { + "description": "Software hive key where the information is retrieved from.", + "misp-attribute": "text", + "ui-priority": 0 + }, + "last-write-time": { + "description": "Date and time when the key was last updated.", + "disable_correlation": true, + "misp-attribute": "datetime", + "ui-priority": 0 + }, + "references": { + "description": "References to the DLL file.", + "misp-attribute": "link", + "multiple": true, + "ui-priority": 0 + } + }, + "description": "Regripper Object template designed to gather information of the DLL files installed on the system.", + "meta-category": "misc", + "name": "regripper-software-hive-appInit-DLLS", "required": [ "key", "DLL-name", "DLL-path" ], - "attributes": { - "key": { - "description": "Software hive key where the information is retrieved from.", - "ui-priority": 0, - "misp-attribute": "text" - }, - "last-write-time": { - "description": "Date and time when the key was last updated.", - "ui-priority": 0, - "misp-attribute": "datetime", - "disable_correlation": true - }, - "DLL-name": { - "description": "Name of the DLL file.", - "ui-priority": 0, - "misp-attribute": "text" - }, - "DLL-path": { - "description": "Path where the DLL file is stored.", - "ui-priority": 0, - "misp-attribute": "text" - }, - "DLL-last-write-time": { - "description": "Date and time when the DLL file was last updated.", - "ui-priority": 0, - "misp-attribute": "datetime", - "disable_correlation": true - }, - "comments": { - "description": "Additional comments.", - "ui-priority": 0, - "misp-attribute": "text", - "disable_correlation": true - }, - "references": { - "description": "References to the DLL file.", - "ui-priority": 0, - "misp-attribute": "link", - "multiple": true - } - }, - "version": 1, - "description": "Regripper Object template designed to gather information of the DLL files installed on the system.", - "meta-category": "misc", "uuid": "7893be05-8398-451e-ab1e-5e25ea4a8859", - "name": "regripper-software-hive-appInit-DLLS" -} + "version": 1 +} \ No newline at end of file diff --git a/objects/regripper-software-hive-application-paths/definition.json b/objects/regripper-software-hive-application-paths/definition.json index 62aacc5..0bb988f 100644 --- a/objects/regripper-software-hive-application-paths/definition.json +++ b/objects/regripper-software-hive-application-paths/definition.json @@ -1,49 +1,49 @@ { + "attributes": { + "comments": { + "description": "Additional comments.", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 0 + }, + "executable-file-name": { + "description": "Name of the executable file.", + "misp-attribute": "text", + "multiple": true, + "ui-priority": 0 + }, + "key": { + "description": "Software hive key where the information is retrieved from.", + "misp-attribute": "text", + "ui-priority": 0 + }, + "last-write-time": { + "description": "Date and time when the key was last updated.", + "disable_correlation": true, + "misp-attribute": "datetime", + "ui-priority": 0 + }, + "path": { + "description": "Path of the executable file.", + "misp-attribute": "text", + "multiple": true, + "ui-priority": 0 + }, + "references": { + "description": "References to the application installed.", + "misp-attribute": "link", + "multiple": true, + "ui-priority": 0 + } + }, + "description": "Regripper Object template designed to gather information of the application paths.", + "meta-category": "misc", + "name": "regripper-software-hive-application-paths", "required": [ "key", "executable-file-name", "path" ], - "attributes": { - "key": { - "description": "Software hive key where the information is retrieved from.", - "ui-priority": 0, - "misp-attribute": "text" - }, - "last-write-time": { - "description": "Date and time when the key was last updated.", - "ui-priority": 0, - "misp-attribute": "datetime", - "disable_correlation": true - }, - "executable-file-name": { - "description": "Name of the executable file.", - "ui-priority": 0, - "misp-attribute": "text", - "multiple": true - }, - "path": { - "description": "Path of the executable file.", - "ui-priority": 0, - "misp-attribute": "text", - "multiple": true - }, - "comments": { - "description": "Additional comments.", - "ui-priority": 0, - "misp-attribute": "text", - "disable_correlation": true - }, - "references": { - "description": "References to the application installed.", - "ui-priority": 0, - "misp-attribute": "link", - "multiple": true - } - }, - "version": 1, - "description": "Regripper Object template designed to gather information of the application paths.", - "meta-category": "misc", "uuid": "9f2d3c9b-9a82-42a7-82c2-733115d101c8", - "name": "regripper-software-hive-application-paths" -} + "version": 1 +} \ No newline at end of file diff --git a/objects/regripper-software-hive-applications-installed/definition.json b/objects/regripper-software-hive-applications-installed/definition.json index 2b7d153..1d2edbe 100644 --- a/objects/regripper-software-hive-applications-installed/definition.json +++ b/objects/regripper-software-hive-applications-installed/definition.json @@ -1,57 +1,57 @@ { + "attributes": { + "app-last-write-time": { + "description": "Date and time when the application key was last updated.", + "disable_correlation": true, + "misp-attribute": "datetime", + "ui-priority": 0 + }, + "app-name": { + "description": "Name of the application.", + "misp-attribute": "text", + "ui-priority": 0 + }, + "comments": { + "description": "Additional comments.", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 0 + }, + "key": { + "description": "Software hive key where the information is retrieved from.", + "misp-attribute": "text", + "ui-priority": 0 + }, + "key-path": { + "description": "Path of the key.", + "misp-attribute": "text", + "ui-priority": 0 + }, + "last-write-time": { + "description": "Date and time when the key was last updated.", + "disable_correlation": true, + "misp-attribute": "datetime", + "ui-priority": 0 + }, + "references": { + "description": "References to the application installed.", + "misp-attribute": "link", + "multiple": true, + "ui-priority": 0 + }, + "version": { + "description": "Version of the application.", + "misp-attribute": "text", + "ui-priority": 0 + } + }, + "description": "Regripper Object template designed to gather information of the applications installed on the system.", + "meta-category": "misc", + "name": "regripper-software-hive-applications-installed", "required": [ "key", "app-name" ], - "attributes": { - "key": { - "description": "Software hive key where the information is retrieved from.", - "ui-priority": 0, - "misp-attribute": "text" - }, - "key-path": { - "description": "Path of the key.", - "ui-priority": 0, - "misp-attribute": "text" - }, - "last-write-time": { - "description": "Date and time when the key was last updated.", - "ui-priority": 0, - "misp-attribute": "datetime", - "disable_correlation": true - }, - "app-name": { - "description": "Name of the application.", - "ui-priority": 0, - "misp-attribute": "text" - }, - "app-last-write-time": { - "description": "Date and time when the application key was last updated.", - "ui-priority": 0, - "misp-attribute": "datetime", - "disable_correlation": true - }, - "version": { - "description": "Version of the application.", - "ui-priority": 0, - "misp-attribute": "text" - }, - "comments": { - "description": "Additional comments.", - "ui-priority": 0, - "misp-attribute": "text", - "disable_correlation": true - }, - "references": { - "description": "References to the application installed.", - "ui-priority": 0, - "misp-attribute": "link", - "multiple": true - } - }, - "version": 1, - "description": "Regripper Object template designed to gather information of the applications installed on the system.", - "meta-category": "misc", "uuid": "7a8fb6b4-cbbd-4de5-b893-7b0a5c4858cd", - "name": "regripper-software-hive-applications-installed" -} + "version": 1 +} \ No newline at end of file diff --git a/objects/regripper-software-hive-command-shell/definition.json b/objects/regripper-software-hive-command-shell/definition.json index 0245221..3fa138c 100644 --- a/objects/regripper-software-hive-command-shell/definition.json +++ b/objects/regripper-software-hive-command-shell/definition.json @@ -1,24 +1,30 @@ { - "required": [ - "key", - "shell", - "shell-path" - ], "attributes": { + "command": { + "description": "Command executed.", + "misp-attribute": "text", + "ui-priority": 0 + }, + "comments": { + "description": "Additional comments.", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 0 + }, "key": { "description": "Software hive key where the information is retrieved from.", - "ui-priority": 0, - "misp-attribute": "text" + "misp-attribute": "text", + "ui-priority": 0 }, "last-write-time": { "description": "Date and time when the key was last updated.", - "ui-priority": 0, + "disable_correlation": true, "misp-attribute": "datetime", - "disable_correlation": true + "ui-priority": 0 }, "shell": { "description": "Type of shell used to execute the command.", - "ui-priority": 0, + "disable_correlation": true, "misp-attribute": "text", "sane_default": [ "exe", @@ -28,28 +34,22 @@ "pif", "Other" ], - "disable_correlation": true + "ui-priority": 0 }, "shell-path": { "description": "Path of the shell.", - "ui-priority": 0, - "misp-attribute": "text" - }, - "command": { - "description": "Command executed.", - "ui-priority": 0, - "misp-attribute": "text" - }, - "comments": { - "description": "Additional comments.", - "ui-priority": 0, "misp-attribute": "text", - "disable_correlation": true + "ui-priority": 0 } }, - "version": 1, "description": "Regripper Object template designed to gather information of the shell commands executed on the system.", "meta-category": "misc", + "name": "regripper-software-hive-command-shell", + "required": [ + "key", + "shell", + "shell-path" + ], "uuid": "a7dc3697-89ce-46dc-a64d-0b1015457978", - "name": "regripper-software-hive-command-shell" -} + "version": 1 +} \ No newline at end of file diff --git a/objects/regripper-software-hive-software-run/definition.json b/objects/regripper-software-hive-software-run/definition.json index 5e26a8a..969d6db 100644 --- a/objects/regripper-software-hive-software-run/definition.json +++ b/objects/regripper-software-hive-software-run/definition.json @@ -1,13 +1,27 @@ { - "required": [ - "key", - "application-name", - "application-path" - ], "attributes": { + "application-name": { + "description": "Name of the application run.", + "misp-attribute": "text", + "multiple": true, + "ui-priority": 0 + }, + "application-path": { + "description": "Path where the application is installed.", + "misp-attribute": "text", + "multiple": true, + "ui-priority": 0 + }, + "comments": { + "description": "Additional comments.", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 0 + }, "key": { "description": "Software hive key where the information is retrieved from.", - "ui-priority": 0, + "disable_correlation": true, + "misp-attribute": "text", "sane_default": [ "Run", "RunOnce", @@ -15,49 +29,35 @@ "Terminal", "Other" ], - "misp-attribute": "text", - "disable_correlation": true + "ui-priority": 0 }, "key-path": { "description": "Path of the key.", - "ui-priority": 0, + "disable_correlation": true, "misp-attribute": "text", - "disable_correlation": true + "ui-priority": 0 }, "last-write-time": { "description": "Date and time when the key was last updated.", - "ui-priority": 0, + "disable_correlation": true, "misp-attribute": "datetime", - "disable_correlation": true - }, - "application-name": { - "description": "Name of the application run.", - "ui-priority": 0, - "misp-attribute": "text", - "multiple": true - }, - "application-path": { - "description": "Path where the application is installed.", - "ui-priority": 0, - "misp-attribute": "text", - "multiple": true - }, - "comments": { - "description": "Additional comments.", - "ui-priority": 0, - "misp-attribute": "text", - "disable_correlation": true + "ui-priority": 0 }, "references": { "description": "References to the applications.", - "ui-priority": 0, "misp-attribute": "link", - "multiple": true + "multiple": true, + "ui-priority": 0 } }, - "version": 1, "description": "Regripper Object template designed to gather information of the applications set to run on the system.", "meta-category": "misc", + "name": "regripper-software-hive-software-run", + "required": [ + "key", + "application-name", + "application-path" + ], "uuid": "4bae06d1-3996-4028-88ec-7c7d54cc1d94", - "name": "regripper-software-hive-software-run" -} + "version": 1 +} \ No newline at end of file diff --git a/objects/regripper-software-hive-userprofile-winlogon/definition.json b/objects/regripper-software-hive-userprofile-winlogon/definition.json index 15a3efc..b4c4bb1 100644 --- a/objects/regripper-software-hive-userprofile-winlogon/definition.json +++ b/objects/regripper-software-hive-userprofile-winlogon/definition.json @@ -1,160 +1,160 @@ { + "attributes": { + "AutoAdminLogon": { + "description": "Flag value to determine if autologon is enabled for a user without entering the password.", + "disable_correlation": true, + "misp-attribute": "boolean", + "ui-priority": 0 + }, + "AutoRestartShell": { + "description": "Value of the flag set to auto restart the shell if it crashes or shuts down automatically.", + "disable_correlation": true, + "misp-attribute": "boolean", + "ui-priority": 0 + }, + "CachedLogonCount": { + "description": "Number of times the user has logged into the system.", + "disable_correlation": true, + "misp-attribute": "counter", + "ui-priority": 0 + }, + "Comments": { + "description": "Additional comments.", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 0 + }, + "DefaultUserName": { + "description": "user-name of the default user.", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 0 + }, + "DisableCAD": { + "description": "Flag to determine if user login is enabled by pressing Ctrl+ALT+Delete.", + "disable_correlation": true, + "misp-attribute": "boolean", + "ui-priority": 0 + }, + "Legal-notice-caption": { + "description": "Message title set to display when the user logs-in.", + "disable_correlation": true, + "misp-attribute": "text", + "multiple": true, + "ui-priority": 0 + }, + "Legal-notice-text": { + "description": "Message set to display when the user logs-in.", + "disable_correlation": true, + "misp-attribute": "text", + "multiple": true, + "ui-priority": 0 + }, + "PasswordExpiryWarining": { + "description": "Number of times the password expiry warning appeared.", + "disable_correlation": true, + "misp-attribute": "counter", + "ui-priority": 0 + }, + "PowerdownAfterShutDown": { + "description": "Flag value- if the system is set to power down after it is shutdown.", + "disable_correlation": true, + "misp-attribute": "boolean", + "ui-priority": 0 + }, + "PreCreateKnownFolders": { + "description": "create known folders key", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 0 + }, + "ReportBootOk": { + "description": "Flag to check if the reboot was successful.", + "disable_correlation": true, + "misp-attribute": "boolean", + "ui-priority": 0 + }, + "SID": { + "description": "Security identifier assigned to the user profile.", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 0 + }, + "Shell": { + "description": "Shell set to run when the user logs onto the system.", + "disable_correlation": true, + "misp-attribute": "text", + "multiple": true, + "ui-priority": 0 + }, + "ShutdownFlags": { + "description": "Number of times shutdown is initiated from a process when the user is logged-in.", + "disable_correlation": true, + "misp-attribute": "counter", + "ui-priority": 0 + }, + "ShutdownWithoutLogon": { + "description": "Value of the flag set to enable shutdown without requiring a user to login.", + "disable_correlation": true, + "misp-attribute": "boolean", + "ui-priority": 0 + }, + "UserInit": { + "description": "Applications and files set to run when the user logs onto the system (User logon activity).", + "misp-attribute": "text", + "multiple": true, + "ui-priority": 0 + }, + "WinStationsDisabled": { + "description": "Flag value set to enable/disable logons to the system.", + "disable_correlation": true, + "misp-attribute": "boolean", + "ui-priority": 0 + }, + "user-profile-key-last-write-time": { + "description": "Date and time when the key was last updated.", + "disable_correlation": true, + "misp-attribute": "datetime", + "ui-priority": 0 + }, + "user-profile-key-path": { + "description": "key where the user-profile information is retrieved from.", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 0 + }, + "user-profile-last-write-time": { + "description": "Date and time when the user profile was last updated.", + "disable_correlation": true, + "misp-attribute": "datetime", + "ui-priority": 0 + }, + "user-profile-path": { + "description": "Path of the user profile on the system", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 0 + }, + "winlogon-key-last-write-time": { + "description": "Date and time when the winlogon key was last updated.", + "disable_correlation": true, + "misp-attribute": "datetime", + "ui-priority": 0 + }, + "winlogon-key-path": { + "description": "winlogon key referred in order to retrieve default user information", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 0 + } + }, + "description": "Regripper Object template designed to gather user profile information when the user logs onto the system, gathered from the software hive.", + "meta-category": "misc", + "name": "regripper-software-hive-userprofile-winlogon", "required": [ "user-profile-key-path", "SID" ], - "attributes": { - "user-profile-key-path": { - "description": "key where the user-profile information is retrieved from.", - "ui-priority": 0, - "misp-attribute": "text", - "disable_correlation": true - }, - "user-profile-key-last-write-time": { - "description": "Date and time when the key was last updated.", - "ui-priority": 0, - "misp-attribute": "datetime", - "disable_correlation": true - }, - "user-profile-path": { - "description": "Path of the user profile on the system", - "ui-priority": 0, - "misp-attribute": "text", - "disable_correlation": true - }, - "SID": { - "description": "Security identifier assigned to the user profile.", - "ui-priority": 0, - "misp-attribute": "text", - "disable_correlation": true - }, - "user-profile-last-write-time": { - "description": "Date and time when the user profile was last updated.", - "ui-priority": 0, - "misp-attribute": "datetime", - "disable_correlation": true - }, - "winlogon-key-path": { - "description": "winlogon key referred in order to retrieve default user information", - "ui-priority": 0, - "misp-attribute": "text", - "disable_correlation": true - }, - "winlogon-key-last-write-time": { - "description": "Date and time when the winlogon key was last updated.", - "ui-priority": 0, - "misp-attribute": "datetime", - "disable_correlation": true - }, - "DefaultUserName": { - "description": "user-name of the default user.", - "ui-priority": 0, - "misp-attribute": "text", - "disable_correlation": true - }, - "Shell": { - "description": "Shell set to run when the user logs onto the system.", - "ui-priority": 0, - "misp-attribute": "text", - "disable_correlation": true, - "multiple": true - }, - "UserInit": { - "description": "Applications and files set to run when the user logs onto the system (User logon activity).", - "ui-priority": 0, - "misp-attribute": "text", - "multiple": true - }, - "Legal-notice-caption": { - "description": "Message title set to display when the user logs-in.", - "ui-priority": 0, - "misp-attribute": "text", - "multiple": true, - "disable_correlation": true - }, - "Legal-notice-text": { - "description": "Message set to display when the user logs-in.", - "ui-priority": 0, - "misp-attribute": "text", - "multiple": true, - "disable_correlation": true - }, - "PreCreateKnownFolders": { - "description": "create known folders key", - "ui-priority": 0, - "misp-attribute": "text", - "disable_correlation": true - }, - "ReportBootOk": { - "description": "Flag to check if the reboot was successful.", - "ui-priority": 0, - "misp-attribute": "boolean", - "disable_correlation": true - }, - "AutoRestartShell": { - "description": "Value of the flag set to auto restart the shell if it crashes or shuts down automatically.", - "ui-priority": 0, - "misp-attribute": "boolean", - "disable_correlation": true - }, - "PasswordExpiryWarining": { - "description": "Number of times the password expiry warning appeared.", - "ui-priority": 0, - "misp-attribute": "counter", - "disable_correlation": true - }, - "PowerdownAfterShutDown": { - "description": "Flag value- if the system is set to power down after it is shutdown.", - "ui-priority": 0, - "misp-attribute": "boolean", - "disable_correlation": true - }, - "ShutdownWithoutLogon": { - "description": "Value of the flag set to enable shutdown without requiring a user to login.", - "ui-priority": 0, - "misp-attribute": "boolean", - "disable_correlation": true - }, - "WinStationsDisabled": { - "description": "Flag value set to enable/disable logons to the system.", - "ui-priority": 0, - "misp-attribute": "boolean", - "disable_correlation": true - }, - "DisableCAD": { - "description": "Flag to determine if user login is enabled by pressing Ctrl+ALT+Delete.", - "ui-priority": 0, - "misp-attribute": "boolean", - "disable_correlation": true - }, - "AutoAdminLogon": { - "description": "Flag value to determine if autologon is enabled for a user without entering the password.", - "ui-priority": 0, - "misp-attribute": "boolean", - "disable_correlation": true - }, - "CachedLogonCount": { - "description": "Number of times the user has logged into the system.", - "ui-priority": 0, - "misp-attribute": "counter", - "disable_correlation": true - }, - "ShutdownFlags": { - "description": "Number of times shutdown is initiated from a process when the user is logged-in.", - "ui-priority": 0, - "misp-attribute": "counter", - "disable_correlation": true - }, - "Comments": { - "description": "Additional comments.", - "ui-priority": 0, - "misp-attribute": "text", - "disable_correlation": true - } - }, - "version": 1, - "description": "Regripper Object template designed to gather user profile information when the user logs onto the system, gathered from the software hive.", - "meta-category": "misc", "uuid": "df03d0e4-3e6b-4e56-951a-142eae4cad59", - "name": "regripper-software-hive-userprofile-winlogon" -} + "version": 1 +} \ No newline at end of file diff --git a/objects/regripper-software-hive-windows-general-info/definition.json b/objects/regripper-software-hive-windows-general-info/definition.json index e1ed4d5..d0aad96 100644 --- a/objects/regripper-software-hive-windows-general-info/definition.json +++ b/objects/regripper-software-hive-windows-general-info/definition.json @@ -1,126 +1,126 @@ { - "required": [ - "win-cv-path", - "CurrentVersion" - ], "attributes": { - "win-cv-path": { - "description": "key where the windows information is retrieved from", - "ui-priority": 0, - "misp-attribute": "text" + "BuildGUID": { + "description": "Build ID.", + "misp-attribute": "text", + "ui-priority": 0 }, - "last-write-time": { - "description": "Date and time when the key was last updated.", - "ui-priority": 0, - "misp-attribute": "datetime", - "disable_correlation": true + "BuildLab": { + "description": "Windows BuildLab string.", + "misp-attribute": "text", + "ui-priority": 0 }, - "RegisteredOrganization": { - "description": "Name of the registered organization.", - "ui-priority": 0, - "misp-attribute": "text" + "BuildLabEx": { + "description": "Windows BuildLabEx string.", + "misp-attribute": "text", + "ui-priority": 0 }, - "RegisteredOwner": { - "description": "Name of the registered owner.", - "ui-priority": 0, - "misp-attribute": "text" - }, - "CurrentVersion": { - "description": "Current version of windows", - "ui-priority": 0, - "disable_correlation": true, - "misp-attribute": "text" + "CSDVersion": { + "description": "Version of the service pack installed.", + "misp-attribute": "text", + "ui-priority": 0 }, "CurrentBuild": { "description": "Build number of the windows OS.", - "ui-priority": 0, - "misp-attribute": "text" + "misp-attribute": "text", + "ui-priority": 0 + }, + "CurrentBuildType": { + "description": "Current build type of the OS.", + "misp-attribute": "text", + "ui-priority": 0 + }, + "CurrentVersion": { + "description": "Current version of windows", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 0 + }, + "EditionID": { + "description": "Windows edition.", + "misp-attribute": "text", + "ui-priority": 0 + }, + "InstallDate": { + "description": "Date when windows was installed.", + "disable_correlation": true, + "misp-attribute": "datetime", + "ui-priority": 0 + }, + "InstallationType": { + "description": "Type of windows installation.", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 0 + }, + "PathName": { + "description": "Path to the root directory.", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 0 + }, + "ProductID": { + "description": "ID of the product version.", + "misp-attribute": "text", + "ui-priority": 0 + }, + "ProductName": { + "description": "Name of the windows version.", + "misp-attribute": "text", + "ui-priority": 0 + }, + "RegisteredOrganization": { + "description": "Name of the registered organization.", + "misp-attribute": "text", + "ui-priority": 0 + }, + "RegisteredOwner": { + "description": "Name of the registered owner.", + "misp-attribute": "text", + "ui-priority": 0 }, "SoftwareType": { "description": "Software type of windows.", - "ui-priority": 0, + "disable_correlation": true, + "misp-attribute": "text", "sane_default": [ "System", "Application", "other" ], - "misp-attribute": "text", - "disable_correlation": true - }, - "InstallationType": { - "description": "Type of windows installation.", - "ui-priority": 0, - "misp-attribute": "text", - "disable_correlation": true - }, - "InstallDate": { - "description": "Date when windows was installed.", - "ui-priority": 0, - "misp-attribute": "datetime", - "disable_correlation": true + "ui-priority": 0 }, "SystemRoot": { "description": "Root directory.", - "ui-priority": 0, + "disable_correlation": true, "misp-attribute": "text", - "disable_correlation": true - }, - "PathName": { - "description": "Path to the root directory.", - "ui-priority": 0, - "misp-attribute": "text", - "disable_correlation": true - }, - "EditionID": { - "description": "Windows edition.", - "ui-priority": 0, - "misp-attribute": "text" - }, - "ProductName": { - "description": "Name of the windows version.", - "ui-priority": 0, - "misp-attribute": "text" - }, - "ProductID": { - "description": "ID of the product version.", - "ui-priority": 0, - "misp-attribute": "text" - }, - "CSDVersion": { - "description": "Version of the service pack installed.", - "ui-priority": 0, - "misp-attribute": "text" - }, - "CurrentBuildType": { - "description": "Current build type of the OS.", - "ui-priority": 0, - "misp-attribute": "text" - }, - "BuildLab": { - "description": "Windows BuildLab string.", - "ui-priority": 0, - "misp-attribute": "text" - }, - "BuildGUID": { - "description": "Build ID.", - "ui-priority": 0, - "misp-attribute": "text" - }, - "BuildLabEx": { - "description": "Windows BuildLabEx string.", - "ui-priority": 0, - "misp-attribute": "text" + "ui-priority": 0 }, "comment": { "description": "Additional comments.", - "ui-priority": 0, + "disable_correlation": true, "misp-attribute": "comment", - "disable_correlation": true + "ui-priority": 0 + }, + "last-write-time": { + "description": "Date and time when the key was last updated.", + "disable_correlation": true, + "misp-attribute": "datetime", + "ui-priority": 0 + }, + "win-cv-path": { + "description": "key where the windows information is retrieved from", + "misp-attribute": "text", + "ui-priority": 0 } }, - "version": 1, "description": "Regripper Object template designed to gather general windows information extracted from the software-hive.", "meta-category": "misc", + "name": "regripper-software-hive-windows-general-info", + "required": [ + "win-cv-path", + "CurrentVersion" + ], "uuid": "03200c25-4bf5-4282-9852-001a51ab20f1", - "name": "regripper-software-hive-windows-general-info" -} + "version": 1 +} \ No newline at end of file diff --git a/objects/regripper-system-hive-firewall-configuration/definition.json b/objects/regripper-system-hive-firewall-configuration/definition.json index b7e5fb6..72fd527 100644 --- a/objects/regripper-system-hive-firewall-configuration/definition.json +++ b/objects/regripper-system-hive-firewall-configuration/definition.json @@ -1,11 +1,33 @@ { - "required": [ - "profile" - ], "attributes": { + "comment": { + "description": "Additional comments.", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 0 + }, + "disable-notification": { + "description": "Boolean flag to determine if firewall notifications are enabled.", + "disable_correlation": true, + "misp-attribute": "boolean", + "ui-priority": 0 + }, + "enbled-firewall": { + "description": "Boolean flag to determine if the firewall is enabled.", + "disable_correlation": true, + "misp-attribute": "boolean", + "ui-priority": 0 + }, + "last-write-time": { + "description": "Date and time when the firewall profile policy was last updated.", + "disable_correlation": true, + "misp-attribute": "datetime", + "ui-priority": 0 + }, "profile": { "description": "Firewall Profile type", - "ui-priority": 0, + "disable_correlation": true, + "misp-attribute": "text", "sane_default": [ "Domain Profile", "Standard Profile", @@ -14,37 +36,15 @@ "Private Profile", "other" ], - "misp-attribute": "text", - "disable_correlation": true - }, - "last-write-time": { - "description": "Date and time when the firewall profile policy was last updated.", - "ui-priority": 0, - "misp-attribute": "datetime", - "disable_correlation": true - }, - "enbled-firewall": { - "description": "Boolean flag to determine if the firewall is enabled.", - "ui-priority": 0, - "misp-attribute": "boolean", - "disable_correlation": true - }, - "disable-notification": { - "description": "Boolean flag to determine if firewall notifications are enabled.", - "ui-priority": 0, - "misp-attribute": "boolean", - "disable_correlation": true - }, - "comment": { - "description": "Additional comments.", - "ui-priority": 0, - "misp-attribute": "text", - "disable_correlation": true + "ui-priority": 0 } }, - "version": 1, "description": "Regripper Object template designed to present firewall configuration information extracted from the system-hive.", "meta-category": "misc", + "name": "regripper-system-hive-firewall-configuration", + "required": [ + "profile" + ], "uuid": "d9839b3c-c013-4ba7-b5e5-2787198b9e07", - "name": "regripper-system-hive-firewall-configuration" -} + "version": 1 +} \ No newline at end of file diff --git a/objects/regripper-system-hive-general-configuration/definition.json b/objects/regripper-system-hive-general-configuration/definition.json index 2851077..72efd8b 100644 --- a/objects/regripper-system-hive-general-configuration/definition.json +++ b/objects/regripper-system-hive-general-configuration/definition.json @@ -1,89 +1,89 @@ { - "required": [ - "computer-name" - ], "attributes": { + "comment": { + "description": "Additional comments.", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 0 + }, "computer-name": { "description": "name of the computer under analysis", - "ui-priority": 0, - "misp-attribute": "text" - }, - "last-write-time": { - "description": "Date and time when the key was last updated.", - "ui-priority": 0, - "misp-attribute": "datetime", - "disable_correlation": true - }, - "shutdown-time": { - "description": "Date and time when the system was shutdown.", - "ui-priority": 0, - "misp-attribute": "datetime", - "disable_correlation": true - }, - "timezone-last-write-time": { - "description": "Date and time when the timezone key was last updated.", - "ui-priority": 0, - "misp-attribute": "datetime", - "disable_correlation": true - }, - "timezone-bias": { - "description": "Offset in minutes from UTC. Offset added to the local time to get a UTC value.", - "ui-priority": 0, "misp-attribute": "text", - "disable_correlation": true - }, - "timezone-standard-name": { - "description": "Timezone standard name used during non-daylight saving months.", - "ui-priority": 0, - "misp-attribute": "text", - "disable_correlation": true - }, - "timezone-standard-date": { - "description": "Standard date - non daylight saving months", - "ui-priority": 0, - "misp-attribute": "datetime", - "disable_correlation": true - }, - "timezone-standard-bias": { - "description": "value in minutes to be added to the value of timezone-bias to generate the bias used during standard time.", - "ui-priority": 0, - "misp-attribute": "text", - "disable_correlation": true - }, - "timezone-daylight-name": { - "description": "Timezone name used during daylight saving months.", - "ui-priority": 0, - "misp-attribute": "text", - "disable_correlation": true - }, - "timezone-daylight-date": { - "description": "Daylight date - daylight saving months", - "ui-priority": 0, - "misp-attribute": "datetime", - "disable_correlation": true - }, - "timezone-daylight-bias": { - "description": "value in minutes to be added to the value of timezone-bias to generate the bias used during daylight time.", - "ui-priority": 0, - "misp-attribute": "text", - "disable_correlation": true + "ui-priority": 0 }, "fDenyTSConnections:": { "description": "Specifies whether remote connections are enabled or disabled on the system.", - "ui-priority": 0, + "disable_correlation": true, "misp-attribute": "boolean", - "disable_correlation": true + "ui-priority": 0 }, - "comment": { - "description": "Additional comments.", - "ui-priority": 0, + "last-write-time": { + "description": "Date and time when the key was last updated.", + "disable_correlation": true, + "misp-attribute": "datetime", + "ui-priority": 0 + }, + "shutdown-time": { + "description": "Date and time when the system was shutdown.", + "disable_correlation": true, + "misp-attribute": "datetime", + "ui-priority": 0 + }, + "timezone-bias": { + "description": "Offset in minutes from UTC. Offset added to the local time to get a UTC value.", + "disable_correlation": true, "misp-attribute": "text", - "disable_correlation": true + "ui-priority": 0 + }, + "timezone-daylight-bias": { + "description": "value in minutes to be added to the value of timezone-bias to generate the bias used during daylight time.", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 0 + }, + "timezone-daylight-date": { + "description": "Daylight date - daylight saving months", + "disable_correlation": true, + "misp-attribute": "datetime", + "ui-priority": 0 + }, + "timezone-daylight-name": { + "description": "Timezone name used during daylight saving months.", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 0 + }, + "timezone-last-write-time": { + "description": "Date and time when the timezone key was last updated.", + "disable_correlation": true, + "misp-attribute": "datetime", + "ui-priority": 0 + }, + "timezone-standard-bias": { + "description": "value in minutes to be added to the value of timezone-bias to generate the bias used during standard time.", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 0 + }, + "timezone-standard-date": { + "description": "Standard date - non daylight saving months", + "disable_correlation": true, + "misp-attribute": "datetime", + "ui-priority": 0 + }, + "timezone-standard-name": { + "description": "Timezone standard name used during non-daylight saving months.", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 0 } }, - "version": 2, "description": "Regripper Object template designed to present general system properties extracted from the system-hive.", "meta-category": "misc", + "name": "regripper-system-hive-general-configuration", + "required": [ + "computer-name" + ], "uuid": "5ac85401-cbf1-4d05-a85e-1784546881e4", - "name": "regripper-system-hive-general-configuration" -} + "version": 2 +} \ No newline at end of file diff --git a/objects/regripper-system-hive-network-information/definition.json b/objects/regripper-system-hive-network-information/definition.json index 7676c59..845cd3d 100644 --- a/objects/regripper-system-hive-network-information/definition.json +++ b/objects/regripper-system-hive-network-information/definition.json @@ -1,106 +1,106 @@ { - "required": [ - "network-key" - ], "attributes": { - "network-key": { - "description": "Registry key assigned to the network", - "ui-priority": 0, - "misp-attribute": "text" - }, - "network-key-last-write-time": { - "description": "Date and time when the network key was last updated.", - "ui-priority": 0, - "misp-attribute": "datetime", - "disable_correlation": true - }, - "network-key-path": { - "description": "Path of the key where the information is retrieved from.", - "ui-priority": 0, - "misp-attribute": "text", - "disable_correlation": true - }, - "TCPIP-key": { - "description": "TCPIP key", - "ui-priority": 0, - "misp-attribute": "text" - }, - "TCPIP-key-last-write-time": { - "description": "Datetime when the key was last updated.", - "ui-priority": 0, - "misp-attribute": "datetime", - "disable_correlation": true + "DHCP-IP-address": { + "description": "DHCP service - IP address", + "misp-attribute": "ip-dst", + "ui-priority": 0 }, "DHCP-domain": { "description": "Name of the DHCP domain service", - "ui-priority": 0, - "misp-attribute": "text" - }, - "DHCP-IP-address": { - "description": "DHCP service - IP address", - "ui-priority": 0, - "misp-attribute": "ip-dst" - }, - "DHCP-subnet-mask": { - "description": "DHCP subnet mask - IP address.", - "ui-priority": 0, - "misp-attribute": "ip-dst" + "misp-attribute": "text", + "ui-priority": 0 }, "DHCP-name-server": { "description": "DHCP Name server - IP address.", - "ui-priority": 0, - "misp-attribute": "ip-dst" + "misp-attribute": "ip-dst", + "ui-priority": 0 }, "DHCP-server": { "description": "DHCP server - IP address.", - "ui-priority": 0, - "misp-attribute": "ip-dst" + "misp-attribute": "ip-dst", + "ui-priority": 0 }, - "interface-GUID": { - "description": "GUID value assigned to the interface.", - "ui-priority": 0, + "DHCP-subnet-mask": { + "description": "DHCP subnet mask - IP address.", + "misp-attribute": "ip-dst", + "ui-priority": 0 + }, + "TCPIP-key": { + "description": "TCPIP key", "misp-attribute": "text", - "disable_correlation": true + "ui-priority": 0 }, - "interface-last-write-time": { - "description": "Last date and time when the interface key was updated.", - "ui-priority": 0, + "TCPIP-key-last-write-time": { + "description": "Datetime when the key was last updated.", + "disable_correlation": true, "misp-attribute": "datetime", - "disable_correlation": true - }, - "interface-name": { - "description": "Name of the interface.", - "ui-priority": 0, - "misp-attribute": "text" - }, - "interface-PnpInstanceID": { - "description": "Plug and Play instance ID assigned to the interface.", - "ui-priority": 0, - "misp-attribute": "text", - "disable_correlation": true - }, - "interface-MediaSubType": { - "description": "", - "ui-priority": 0, - "misp-attribute": "text", - "disable_correlation": true - }, - "interface-IPcheckingEnabled": { - "description": "", - "ui-priority": 0, - "misp-attribute": "boolean", - "disable_correlation": true + "ui-priority": 0 }, "additional-comments": { "description": "Comments.", - "ui-priority": 0, + "disable_correlation": true, "misp-attribute": "text", - "disable_correlation": true + "ui-priority": 0 + }, + "interface-GUID": { + "description": "GUID value assigned to the interface.", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 0 + }, + "interface-IPcheckingEnabled": { + "description": "", + "disable_correlation": true, + "misp-attribute": "boolean", + "ui-priority": 0 + }, + "interface-MediaSubType": { + "description": "", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 0 + }, + "interface-PnpInstanceID": { + "description": "Plug and Play instance ID assigned to the interface.", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 0 + }, + "interface-last-write-time": { + "description": "Last date and time when the interface key was updated.", + "disable_correlation": true, + "misp-attribute": "datetime", + "ui-priority": 0 + }, + "interface-name": { + "description": "Name of the interface.", + "misp-attribute": "text", + "ui-priority": 0 + }, + "network-key": { + "description": "Registry key assigned to the network", + "misp-attribute": "text", + "ui-priority": 0 + }, + "network-key-last-write-time": { + "description": "Date and time when the network key was last updated.", + "disable_correlation": true, + "misp-attribute": "datetime", + "ui-priority": 0 + }, + "network-key-path": { + "description": "Path of the key where the information is retrieved from.", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 0 } }, - "version": 1, "description": "Regripper object template designed to gather network information from the system-hive.", "meta-category": "misc", + "name": "regripper-system-hive-network-information", + "required": [ + "network-key" + ], "uuid": "a5a3ba3a-ba2e-42a4-be45-b36809ae56f0", - "name": "regripper-system-hive-network-information." -} + "version": 1 +} \ No newline at end of file diff --git a/objects/regripper-system-hive-services-drivers/definition.json b/objects/regripper-system-hive-services-drivers/definition.json index 38a560a..3f60f13 100644 --- a/objects/regripper-system-hive-services-drivers/definition.json +++ b/objects/regripper-system-hive-services-drivers/definition.json @@ -1,59 +1,20 @@ { - "required": [ - "name" - ], "attributes": { - "name": { - "description": "name of the key", - "ui-priority": 0, - "misp-attribute": "text" - }, - "last-write-time": { - "description": "Date and time when the key was last updated.", - "ui-priority": 0, - "misp-attribute": "datetime", - "disable_correlation": true + "comment": { + "description": "Additional comments.", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 0 }, "display": { "description": "Display name/information of the service or the driver.", - "ui-priority": 0, - "misp-attribute": "text" - }, - "image-path": { - "description": "Path of the service/drive", - "ui-priority": 0, - "misp-attribute": "text" - }, - "type": { - "description": "Service/driver type.", - "ui-priority": 0, - "sane_default": [ - "Kernel driver", - "File system driver", - "Own process", - "Share process", - "Interactive", - "Other" - ], "misp-attribute": "text", - "disable_correlation": true - }, - "start": { - "description": "When the service/driver starts or executes.", - "ui-priority": 0, - "sane_default": [ - "Boot start", - "System start", - "Auto start", - "Manual", - "Disabled" - ], - "misp-attribute": "text", - "disable_correlation": true + "ui-priority": 0 }, "group": { "description": "Group to which the system/driver belong to.", - "ui-priority": 0, + "disable_correlation": true, + "misp-attribute": "text", "sane_default": [ "Base", "Boot Bus Extender", @@ -80,19 +41,58 @@ "Video Save", "other" ], - "misp-attribute": "text", - "disable_correlation": true + "ui-priority": 0 }, - "comment": { - "description": "Additional comments.", - "ui-priority": 0, + "image-path": { + "description": "Path of the service/drive", "misp-attribute": "text", - "disable_correlation": true + "ui-priority": 0 + }, + "last-write-time": { + "description": "Date and time when the key was last updated.", + "disable_correlation": true, + "misp-attribute": "datetime", + "ui-priority": 0 + }, + "name": { + "description": "name of the key", + "misp-attribute": "text", + "ui-priority": 0 + }, + "start": { + "description": "When the service/driver starts or executes.", + "disable_correlation": true, + "misp-attribute": "text", + "sane_default": [ + "Boot start", + "System start", + "Auto start", + "Manual", + "Disabled" + ], + "ui-priority": 0 + }, + "type": { + "description": "Service/driver type.", + "disable_correlation": true, + "misp-attribute": "text", + "sane_default": [ + "Kernel driver", + "File system driver", + "Own process", + "Share process", + "Interactive", + "Other" + ], + "ui-priority": 0 } }, - "version": 2, "description": "Regripper Object template designed to gather information regarding the services/drivers from the system-hive.", "meta-category": "misc", + "name": "regripper-system-hive-services-drivers", + "required": [ + "name" + ], "uuid": "78cdae45-2061-4b49-b1d6-71f562094a73", - "name": "regripper-system-hive-services-drivers" -} + "version": 2 +} \ No newline at end of file diff --git a/objects/report/definition.json b/objects/report/definition.json index 053677d..316823f 100644 --- a/objects/report/definition.json +++ b/objects/report/definition.json @@ -1,37 +1,37 @@ { - "required": [ - "summary" - ], "attributes": { - "summary": { - "description": "Free text summary of the report", - "ui-priority": 100, + "case-number": { + "categories": [ + "Internal reference", + "Other" + ], + "description": "Case number", "misp-attribute": "text", + "ui-priority": 1 + }, + "report-file(s)": { + "description": "Attachment(s) that is related to the report", + "misp-attribute": "attachment", + "multiple": true, + "ui-priority": 99 + }, + "summary": { "categories": [ "Other", "Internal reference" ], - "multiple": true - }, - "case-number": { - "description": "Case number", - "ui-priority": 1, + "description": "Free text summary of the report", "misp-attribute": "text", - "categories": [ - "Internal reference", - "Other" - ] - }, - "report-file(s)": { - "description": "Attachment(s) that is related to the report", - "ui-priority": 99, - "misp-attribute": "attachment", - "multiple": true + "multiple": true, + "ui-priority": 100 } }, - "version": 1, "description": "Metadata used to generate an executive level report", "meta-category": "misc", + "name": "report", + "required": [ + "summary" + ], "uuid": "70a68471-df22-4e3f-aa1a-5a3be19f82df", - "name": "report" -} + "version": 1 +} \ No newline at end of file diff --git a/objects/research-scanner/definition.json b/objects/research-scanner/definition.json index 8822c4e..2cb71c1 100644 --- a/objects/research-scanner/definition.json +++ b/objects/research-scanner/definition.json @@ -1,80 +1,80 @@ { - "required": [ - "project", - "scanning_ip" - ], "attributes": { - "project": { - "description": "Description of scanning project", - "ui-priority": 1, - "disable_correlation": true, - "misp-attribute": "text" - }, - "scanning_ip": { - "description": "IP address used by project", - "categories": [ - "Network activity", - "External analysis" - ], - "ui-priority": 1, - "misp-attribute": "ip-src", - "multiple": true - }, - "domain": { - "description": "Domain related to project", - "ui-priority": 1, - "multiple": true, - "misp-attribute": "domain" - }, "asn": { "description": "Autonomous System Number related to project", - "ui-priority": 0, "disable_correlation": true, - "misp-attribute": "AS" - }, - "scheduled_start": { - "description": "Scheduled start of scanning activity", - "disable_correlation": true, - "ui-priority": 1, - "multiple": true, - "misp-attribute": "datetime" - }, - "scheduled_end": { - "description": "Scheduled end of scanning activity", - "disable_correlation": true, - "ui-priority": 0, - "multiple": true, - "misp-attribute": "datetime" + "misp-attribute": "AS", + "ui-priority": 0 }, "contact_email": { - "description": "Project contact information", - "disable_correlation": true, "categories": [ "Network activity", "Social network" ], - "ui-priority": 1, + "description": "Project contact information", + "disable_correlation": true, "misp-attribute": "email-dst", - "multiple": true + "multiple": true, + "ui-priority": 1 }, "contact_phone": { "description": "Phone number related to project", "disable_correlation": true, - "ui-priority": 0, "misp-attribute": "phone-number", - "multiple": true + "multiple": true, + "ui-priority": 0 + }, + "domain": { + "description": "Domain related to project", + "misp-attribute": "domain", + "multiple": true, + "ui-priority": 1 + }, + "project": { + "description": "Description of scanning project", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 1 }, "project_url": { "description": "URL related to project", "disable_correlation": true, - "ui-priority": 1, "misp-attribute": "link", - "multiple": true + "multiple": true, + "ui-priority": 1 + }, + "scanning_ip": { + "categories": [ + "Network activity", + "External analysis" + ], + "description": "IP address used by project", + "misp-attribute": "ip-src", + "multiple": true, + "ui-priority": 1 + }, + "scheduled_end": { + "description": "Scheduled end of scanning activity", + "disable_correlation": true, + "misp-attribute": "datetime", + "multiple": true, + "ui-priority": 0 + }, + "scheduled_start": { + "description": "Scheduled start of scanning activity", + "disable_correlation": true, + "misp-attribute": "datetime", + "multiple": true, + "ui-priority": 1 } }, - "version": 20190102, "description": "Information related to known scanning activity (e.g. from research projects)", "meta-category": "network", + "name": "research-scanner", + "required": [ + "project", + "scanning_ip" + ], "uuid": "d690e956-fc8a-11e8-8eb2-f2801f1b9fd1", - "name": "research-scanner" -} + "version": 20190102 +} \ No newline at end of file diff --git a/objects/rogue-dns/definition.json b/objects/rogue-dns/definition.json index 3e6e4a9..9198de5 100644 --- a/objects/rogue-dns/definition.json +++ b/objects/rogue-dns/definition.json @@ -1,46 +1,46 @@ { - "required": [ - "rogue-dns" - ], "attributes": { - "timestamp": { - "description": "Last time that the rogue DNS value was seen.", - "ui-priority": 0, - "misp-attribute": "datetime", - "disable_correlation": true + "hijacked-domain": { + "categories": [ + "Network activity" + ], + "description": "Domain/hostname hijacked by the the rogue DNS", + "misp-attribute": "hostname", + "ui-priority": 1 + }, + "phishing-ip": { + "description": "Resource records returns by the rogue DNS", + "misp-attribute": "ip-dst", + "ui-priority": 1 }, "rogue-dns": { "description": "IP address of the rogue DNS", - "ui-priority": 0, - "misp-attribute": "ip-dst" + "misp-attribute": "ip-dst", + "ui-priority": 0 }, "status": { "description": "How many authoritative DNS answers were received at the Passive DNS Server's collectors with exactly the given set of values as answers.", - "ui-priority": 0, + "disable_correlation": true, "misp-attribute": "text", "sane_default": [ "ROGUE DNS", "Unknown" ], - "disable_correlation": true + "ui-priority": 0 }, - "hijacked-domain": { - "description": "Domain/hostname hijacked by the the rogue DNS", - "categories": [ - "Network activity" - ], - "ui-priority": 1, - "misp-attribute": "hostname" - }, - "phishing-ip": { - "description": "Resource records returns by the rogue DNS", - "ui-priority": 1, - "misp-attribute": "ip-dst" + "timestamp": { + "description": "Last time that the rogue DNS value was seen.", + "disable_correlation": true, + "misp-attribute": "datetime", + "ui-priority": 0 } }, - "version": 1, "description": "Rogue DNS as defined by CERT.br", "meta-category": "network", + "name": "rogue-dns", + "required": [ + "rogue-dns" + ], "uuid": "b7e7859b-6872-4fd2-ac49-f66ccb904505", - "name": "rogue-dns" -} + "version": 1 +} \ No newline at end of file diff --git a/objects/rtir/definition.json b/objects/rtir/definition.json index c705b47..be3f7c2 100644 --- a/objects/rtir/definition.json +++ b/objects/rtir/definition.json @@ -1,44 +1,36 @@ { - "requiredOneOf": [ - "ticket-number" - ], "attributes": { "classification": { "description": "Classification of the RTIR ticket", - "ui-priority": 1, "misp-attribute": "text", - "multiple": true - }, - "ip": { - "description": "IPs automatically extracted from the RTIR ticket", - "ui-priority": 0, - "misp-attribute": "ip-dst", - "multiple": true + "multiple": true, + "ui-priority": 1 }, "constituency": { "description": "Constituency of the RTIR ticket", - "ui-priority": 0, - "misp-attribute": "text" + "misp-attribute": "text", + "ui-priority": 0 + }, + "ip": { + "description": "IPs automatically extracted from the RTIR ticket", + "misp-attribute": "ip-dst", + "multiple": true, + "ui-priority": 0 }, "queue": { "description": "Queue of the RTIR ticket", - "ui-priority": 0, "misp-attribute": "text", "sane_default": [ "incident", "investigations", "blocks", "incident reports" - ] - }, - "subject": { - "description": "Subject of the RTIR ticket", - "ui-priority": 0, - "misp-attribute": "text" + ], + "ui-priority": 0 }, "status": { "description": "Status of the RTIR ticket", - "ui-priority": 0, + "disable_correlation": true, "misp-attribute": "text", "sane_default": [ "new", @@ -48,17 +40,25 @@ "rejected", "deleted" ], - "disable_correlation": true + "ui-priority": 0 + }, + "subject": { + "description": "Subject of the RTIR ticket", + "misp-attribute": "text", + "ui-priority": 0 }, "ticket-number": { "description": "ticket-number of the RTIR ticket", - "ui-priority": 0, - "misp-attribute": "text" + "misp-attribute": "text", + "ui-priority": 0 } }, - "version": 2, "description": "RTIR - Request Tracker for Incident Response", "meta-category": "misc", + "name": "rtir", + "requiredOneOf": [ + "ticket-number" + ], "uuid": "7534ee19-0a1f-4f46-a197-e6e73e457943", - "name": "rtir" -} + "version": 2 +} \ No newline at end of file diff --git a/objects/sandbox-report/definition.json b/objects/sandbox-report/definition.json index eeb637d..c0e38ab 100644 --- a/objects/sandbox-report/definition.json +++ b/objects/sandbox-report/definition.json @@ -1,75 +1,9 @@ { - "required": [ - "sandbox-type" - ], - "requiredOneOf": [ - "web-sandbox", - "on-premise-sandbox", - "saas-sandbox" - ], "attributes": { - "permalink": { - "description": "Permalink reference", - "categories": [ - "External analysis" - ], - "ui-priority": 2, - "misp-attribute": "link" - }, - "score": { - "description": "Score", - "disable_correlation": true, - "categories": [ - "External analysis" - ], - "ui-priority": 1, - "misp-attribute": "text" - }, - "results": { - "description": "Freetext result values", - "disable_correlation": true, - "categories": [ - "External analysis" - ], - "ui-priority": 1, - "misp-attribute": "text", - "multiple": true - }, - "raw-report": { - "description": "Raw report from sandbox", - "disable_correlation": true, - "categories": [ - "External analysis" - ], - "ui-priority": 0, - "misp-attribute": "text" - }, - "sandbox-file": { - "description": "File related to sandbox run", - "misp-attribute": "attachment", - "disable_correlation": true, - "ui-priority": 1, - "categories": [ - "External analysis" - ], - "multiple": true - }, - "sandbox-type": { - "description": "The type of sandbox used", - "misp-attribute": "text", - "disable_correlation": true, - "ui-priority": 1, - "sane_default": [ - "on-premise", - "web", - "saas" - ] - }, "on-premise-sandbox": { "description": "The on-premise sandbox used", - "misp-attribute": "text", "disable_correlation": true, - "ui-priority": 1, + "misp-attribute": "text", "sane_default": [ "cuckoo", "symantec-cas-on-premise", @@ -78,33 +12,99 @@ "fireeye-ax", "vmray", "joe-sandbox-on-premise" - ] + ], + "ui-priority": 1 }, - "web-sandbox": { - "description": "A web sandbox where results are publicly available via an URL", - "misp-attribute": "text", + "permalink": { + "categories": [ + "External analysis" + ], + "description": "Permalink reference", + "misp-attribute": "link", + "ui-priority": 2 + }, + "raw-report": { + "categories": [ + "External analysis" + ], + "description": "Raw report from sandbox", "disable_correlation": true, - "ui-priority": 1, - "sane_default": [ - "malwr", - "hybrid-analysis" - ] + "misp-attribute": "text", + "ui-priority": 0 + }, + "results": { + "categories": [ + "External analysis" + ], + "description": "Freetext result values", + "disable_correlation": true, + "misp-attribute": "text", + "multiple": true, + "ui-priority": 1 }, "saas-sandbox": { "description": "A non-on-premise sandbox, also results are not publicly available", - "misp-attribute": "text", "disable_correlation": true, - "ui-priority": 1, + "misp-attribute": "text", "sane_default": [ "forticloud-sandbox", "joe-sandbox-cloud", "symantec-cas-cloud" - ] + ], + "ui-priority": 1 + }, + "sandbox-file": { + "categories": [ + "External analysis" + ], + "description": "File related to sandbox run", + "disable_correlation": true, + "misp-attribute": "attachment", + "multiple": true, + "ui-priority": 1 + }, + "sandbox-type": { + "description": "The type of sandbox used", + "disable_correlation": true, + "misp-attribute": "text", + "sane_default": [ + "on-premise", + "web", + "saas" + ], + "ui-priority": 1 + }, + "score": { + "categories": [ + "External analysis" + ], + "description": "Score", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 1 + }, + "web-sandbox": { + "description": "A web sandbox where results are publicly available via an URL", + "disable_correlation": true, + "misp-attribute": "text", + "sane_default": [ + "malwr", + "hybrid-analysis" + ], + "ui-priority": 1 } }, - "version": 2, "description": "Sandbox report", "meta-category": "misc", + "name": "sandbox-report", + "required": [ + "sandbox-type" + ], + "requiredOneOf": [ + "web-sandbox", + "on-premise-sandbox", + "saas-sandbox" + ], "uuid": "4d3fffd2-cd07-4357-96e0-a51c988faaef", - "name": "sandbox-report" -} + "version": 2 +} \ No newline at end of file diff --git a/objects/sb-signature/definition.json b/objects/sb-signature/definition.json index 2ee7cde..ce59299 100644 --- a/objects/sb-signature/definition.json +++ b/objects/sb-signature/definition.json @@ -1,49 +1,49 @@ { + "attributes": { + "datetime": { + "categories": [ + "Other" + ], + "description": "Datetime", + "disable_correlation": true, + "misp-attribute": "datetime", + "ui-priority": 0 + }, + "signature": { + "categories": [ + "External analysis" + ], + "description": "Name of detection signature - set the description of the detection signature as a comment", + "misp-attribute": "text", + "multiple": true, + "ui-priority": 2 + }, + "software": { + "categories": [ + "External analysis" + ], + "description": "Name of Sandbox software", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 1 + }, + "text": { + "categories": [ + "Other" + ], + "description": "Additional signature description", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 0 + } + }, + "description": "Sandbox detection signature", + "meta-category": "misc", + "name": "sb-signature", "required": [ "software", "signature" ], - "attributes": { - "software": { - "description": "Name of Sandbox software", - "disable_correlation": true, - "categories": [ - "External analysis" - ], - "ui-priority": 1, - "misp-attribute": "text" - }, - "signature": { - "description": "Name of detection signature - set the description of the detection signature as a comment", - "categories": [ - "External analysis" - ], - "ui-priority": 2, - "misp-attribute": "text", - "multiple": true - }, - "text": { - "description": "Additional signature description", - "disable_correlation": true, - "categories": [ - "Other" - ], - "ui-priority": 0, - "misp-attribute": "text" - }, - "datetime": { - "description": "Datetime", - "disable_correlation": true, - "categories": [ - "Other" - ], - "ui-priority": 0, - "misp-attribute": "datetime" - } - }, - "version": 2, - "description": "Sandbox detection signature", - "meta-category": "misc", "uuid": "984c5c39-be7f-4e1e-b034-d3213bac51cb", - "name": "sb-signature" -} + "version": 2 +} \ No newline at end of file diff --git a/objects/scheduled-event/definition.json b/objects/scheduled-event/definition.json index b57c53b..f92201e 100644 --- a/objects/scheduled-event/definition.json +++ b/objects/scheduled-event/definition.json @@ -1,27 +1,58 @@ { - "requiredOneOf": [ - "event-name", - "event-alias", - "archive", - "attachment" - ], "attributes": { - "event-name": { - "description": "The name of the event.", - "ui-priority": 1, - "misp-attribute": "text" + "address": { + "description": "Postal address of the event.", + "misp-attribute": "text", + "multiple": true, + "ui-priority": 10 + }, + "administrator": { + "description": "A user account who is an owner or admin of the event.", + "misp-attribute": "text", + "multiple": true, + "ui-priority": 1 + }, + "archive": { + "description": "Archive of the original event (Internet Archive, Archive.is, etc).", + "misp-attribute": "link", + "multiple": true, + "ui-priority": 1 + }, + "attachment": { + "description": "A screen capture or other attachment relevant to the event.", + "misp-attribute": "attachment", + "multiple": true, + "ui-priority": 1 + }, + "e-mail": { + "description": "Email address of the event contact.", + "misp-attribute": "email-src", + "multiple": true, + "ui-priority": 10 + }, + "embedded-link": { + "description": "Link embedded in the event description (potentially malicious).", + "misp-attribute": "url", + "multiple": true, + "ui-priority": 0 + }, + "embedded-safe-link": { + "description": "Link embedded in the event description (supposed safe).", + "misp-attribute": "link", + "multiple": true, + "to_ids": false, + "ui-priority": 0 }, "event-alias": { "description": "Aliases of event.", - "ui-priority": 1, + "misp-attribute": "text", "multiple": true, - "misp-attribute": "text" + "ui-priority": 1 }, "event-listing": { "description": "Social media and other platforms on which the event is advertised.", - "ui-priority": 1, - "misp-attribute": "text", "disable_correlation": true, + "misp-attribute": "text", "multiple": true, "sane_default": [ "Twitter", @@ -29,101 +60,70 @@ "Meetup", "Eventbrite", "Other" - ] + ], + "ui-priority": 1 }, - "username": { - "description": "A user account who is going to the event.", - "ui-priority": 1, + "event-name": { + "description": "The name of the event.", "misp-attribute": "text", - "multiple": true - }, - "person-name": { - "description": "A person who is going to the event.", - "ui-priority": 1, - "misp-attribute": "text", - "multiple": true - }, - "administrator": { - "description": "A user account who is an owner or admin of the event.", - "ui-priority": 1, - "misp-attribute": "text", - "multiple": true - }, - "hashtag": { - "description": "Hashtag used to identify or promote the event.", - "ui-priority": 0, - "misp-attribute": "text", - "multiple": true - }, - "url": { - "description": "Original URL location of the event (potentially malicious).", - "ui-priority": 1, - "misp-attribute": "url" - }, - "link": { - "description": "Original link into the event (supposed harmless).", - "ui-priority": 1, - "misp-attribute": "link" - }, - "phone-number": { - "description": "Phone number of the event contact.", - "ui-priority": 10, - "misp-attribute": "phone-number", - "multiple": true + "ui-priority": 1 }, "fax-number": { "description": "Fax number of the event contact.", - "ui-priority": 10, "misp-attribute": "phone-number", - "multiple": true + "multiple": true, + "ui-priority": 10 }, - "address": { - "description": "Postal address of the event.", - "ui-priority": 10, + "hashtag": { + "description": "Hashtag used to identify or promote the event.", "misp-attribute": "text", - "multiple": true + "multiple": true, + "ui-priority": 0 }, - "e-mail": { - "description": "Email address of the event contact.", - "ui-priority": 10, - "misp-attribute": "email-src", - "multiple": true - }, - "embedded-link": { - "description": "Link embedded in the event description (potentially malicious).", - "ui-priority": 0, - "misp-attribute": "url", - "multiple": true - }, - "embedded-safe-link": { - "description": "Link embedded in the event description (supposed safe).", - "ui-priority": 0, + "link": { + "description": "Original link into the event (supposed harmless).", "misp-attribute": "link", - "multiple": true, - "to_ids": false + "ui-priority": 1 }, - "archive": { - "description": "Archive of the original event (Internet Archive, Archive.is, etc).", - "ui-priority": 1, + "person-name": { + "description": "A person who is going to the event.", + "misp-attribute": "text", "multiple": true, - "misp-attribute": "link" + "ui-priority": 1 }, - "attachment": { - "description": "A screen capture or other attachment relevant to the event.", - "ui-priority": 1, + "phone-number": { + "description": "Phone number of the event contact.", + "misp-attribute": "phone-number", "multiple": true, - "misp-attribute": "attachment" + "ui-priority": 10 }, "scheduled-date": { "description": "Initial creation of the microblog post", - "ui-priority": 0, + "misp-attribute": "datetime", "multiple": true, - "misp-attribute": "datetime" + "ui-priority": 0 + }, + "url": { + "description": "Original URL location of the event (potentially malicious).", + "misp-attribute": "url", + "ui-priority": 1 + }, + "username": { + "description": "A user account who is going to the event.", + "misp-attribute": "text", + "multiple": true, + "ui-priority": 1 } }, - "version": 1, "description": "Event object template describing a gathering of individuals in meatspace.", "meta-category": "misc", + "name": "scheduled-event", + "requiredOneOf": [ + "event-name", + "event-alias", + "archive", + "attachment" + ], "uuid": "40ba0098-cfd8-4b54-b5a8-9adcdf47533d", - "name": "scheduled-event" -} + "version": 1 +} \ No newline at end of file diff --git a/objects/scrippsco2-c13-daily/definition.json b/objects/scrippsco2-c13-daily/definition.json index 9c5d932..d89f572 100644 --- a/objects/scrippsco2-c13-daily/definition.json +++ b/objects/scrippsco2-c13-daily/definition.json @@ -1,4 +1,45 @@ { + "attributes": { + "c13-value": { + "description": "C13 value (ppm) - C13 concentrations are measured on the '08A' Calibration Scale", + "disable_correlation": true, + "misp-attribute": "float", + "ui-priority": 1 + }, + "flag": { + "description": "Flag (see taxonomy for details).", + "disable_correlation": true, + "misp-attribute": "counter", + "ui-priority": 0 + }, + "number-flask": { + "description": "Number of flasks used in daily average.", + "disable_correlation": true, + "misp-attribute": "counter", + "ui-priority": 1 + }, + "sample-date-excel": { + "description": "M$Excel spreadsheet date format.", + "disable_correlation": true, + "misp-attribute": "float", + "ui-priority": 1 + }, + "sample-date-fractional": { + "description": "Decimal year and fractional year.", + "disable_correlation": true, + "misp-attribute": "float", + "ui-priority": 1 + }, + "sample-datetime": { + "description": "Datetime the sample has been taken", + "disable_correlation": true, + "misp-attribute": "datetime", + "ui-priority": 1 + } + }, + "description": "Daily average C13 concentrations (ppm) derived from flask air samples.", + "meta-category": "climate", + "name": "scrippsco2-c13-daily", "requiredOneOf": [ "sample-datetime", "sample-date-excel", @@ -7,47 +48,6 @@ "flag", "c13-value" ], - "attributes": { - "sample-datetime": { - "description": "Datetime the sample has been taken", - "ui-priority": 1, - "misp-attribute": "datetime", - "disable_correlation": true - }, - "sample-date-excel": { - "description": "M$Excel spreadsheet date format.", - "ui-priority": 1, - "misp-attribute": "float", - "disable_correlation": true - }, - "sample-date-fractional": { - "description": "Decimal year and fractional year.", - "ui-priority": 1, - "misp-attribute": "float", - "disable_correlation": true - }, - "number-flask": { - "description": "Number of flasks used in daily average.", - "misp-attribute": "counter", - "disable_correlation": true, - "ui-priority": 1 - }, - "flag": { - "description": "Flag (see taxonomy for details).", - "misp-attribute": "counter", - "disable_correlation": true, - "ui-priority": 0 - }, - "c13-value": { - "description": "C13 value (ppm) - C13 concentrations are measured on the '08A' Calibration Scale", - "misp-attribute": "float", - "disable_correlation": true, - "ui-priority": 1 - } - }, - "version": 2, - "description": "Daily average C13 concentrations (ppm) derived from flask air samples.", - "meta-category": "climate", "uuid": "5f71a99e-4a56-45b5-b7d6-19949d22409a", - "name": "scrippsco2-c13-daily" -} + "version": 2 +} \ No newline at end of file diff --git a/objects/scrippsco2-c13-monthly/definition.json b/objects/scrippsco2-c13-monthly/definition.json index 65aaff2..2e8ed27 100644 --- a/objects/scrippsco2-c13-monthly/definition.json +++ b/objects/scrippsco2-c13-monthly/definition.json @@ -1,56 +1,56 @@ { + "attributes": { + "monthly-c13": { + "description": "Monthly C13 concentrations in micro-mol C13 per mole (ppm) reported on the 2008A SIO manometric mole fraction scale. This is the standard version of the data most often sought.", + "disable_correlation": true, + "misp-attribute": "float", + "ui-priority": 1 + }, + "monthly-c13-seasonal-adjustment": { + "description": "Same data after a seasonal adjustment to remove the quasi-regular seasonal cycle. The adjustment involves subtracting from the data a 4-harmonic fit with a linear gain factor.", + "disable_correlation": true, + "misp-attribute": "float", + "ui-priority": 0 + }, + "monthly-c13-smoothed": { + "description": "Smoothed version of the data generated from a stiff cubic spline function plus 4-harmonic functions with linear gain.", + "disable_correlation": true, + "misp-attribute": "float", + "ui-priority": 1 + }, + "monthly-c13-smoothed-seasonal-adjustment": { + "description": "Same smoothed version with the seasonal cycle removed.", + "disable_correlation": true, + "misp-attribute": "float", + "ui-priority": 1 + }, + "sample-date-excel": { + "description": "M$Excel spreadsheet date format.", + "disable_correlation": true, + "misp-attribute": "float", + "ui-priority": 1 + }, + "sample-date-fractional": { + "description": "Decimal year and fractional year.", + "disable_correlation": true, + "misp-attribute": "float", + "ui-priority": 1 + }, + "sample-datetime": { + "description": "The monthly values have been adjusted to 24:00 hours on the 15th of each month.", + "disable_correlation": true, + "misp-attribute": "datetime", + "ui-priority": 1 + } + }, + "description": "Monthly average C13 concentrations (ppm) derived from flask air samples.", + "meta-category": "climate", + "name": "scrippsco2-c13-monthly", "required": [ "sample-datetime", "sample-date-excel", "sample-date-fractional" ], - "attributes": { - "sample-datetime": { - "description": "The monthly values have been adjusted to 24:00 hours on the 15th of each month.", - "ui-priority": 1, - "misp-attribute": "datetime", - "disable_correlation": true - }, - "sample-date-excel": { - "description": "M$Excel spreadsheet date format.", - "ui-priority": 1, - "misp-attribute": "float", - "disable_correlation": true - }, - "sample-date-fractional": { - "description": "Decimal year and fractional year.", - "ui-priority": 1, - "misp-attribute": "float", - "disable_correlation": true - }, - "monthly-c13": { - "description": "Monthly C13 concentrations in micro-mol C13 per mole (ppm) reported on the 2008A SIO manometric mole fraction scale. This is the standard version of the data most often sought.", - "misp-attribute": "float", - "disable_correlation": true, - "ui-priority": 1 - }, - "monthly-c13-seasonal-adjustment": { - "description": "Same data after a seasonal adjustment to remove the quasi-regular seasonal cycle. The adjustment involves subtracting from the data a 4-harmonic fit with a linear gain factor.", - "misp-attribute": "float", - "disable_correlation": true, - "ui-priority": 0 - }, - "monthly-c13-smoothed": { - "description": "Smoothed version of the data generated from a stiff cubic spline function plus 4-harmonic functions with linear gain.", - "misp-attribute": "float", - "disable_correlation": true, - "ui-priority": 1 - }, - "monthly-c13-smoothed-seasonal-adjustment": { - "description": "Same smoothed version with the seasonal cycle removed.", - "misp-attribute": "float", - "disable_correlation": true, - "ui-priority": 1 - } - }, - "version": 2, - "description": "Monthly average C13 concentrations (ppm) derived from flask air samples.", - "meta-category": "climate", "uuid": "812125c7-47de-4503-8bbc-19067d3a1c38", - "name": "scrippsco2-c13-monthly" -} + "version": 2 +} \ No newline at end of file diff --git a/objects/scrippsco2-co2-daily/definition.json b/objects/scrippsco2-co2-daily/definition.json index ae44d9d..03dc7b1 100644 --- a/objects/scrippsco2-co2-daily/definition.json +++ b/objects/scrippsco2-co2-daily/definition.json @@ -1,4 +1,45 @@ { + "attributes": { + "co2-value": { + "description": "CO2 value (ppm) - CO2 concentrations are measured on the '08A' Calibration Scale", + "disable_correlation": true, + "misp-attribute": "float", + "ui-priority": 1 + }, + "flag": { + "description": "Flag (see taxonomy for details).", + "disable_correlation": true, + "misp-attribute": "counter", + "ui-priority": 0 + }, + "number-flask": { + "description": "Number of flasks used in daily average.", + "disable_correlation": true, + "misp-attribute": "counter", + "ui-priority": 1 + }, + "sample-date-excel": { + "description": "M$Excel spreadsheet date format.", + "disable_correlation": true, + "misp-attribute": "float", + "ui-priority": 1 + }, + "sample-date-fractional": { + "description": "Decimal year and fractional year.", + "disable_correlation": true, + "misp-attribute": "float", + "ui-priority": 1 + }, + "sample-datetime": { + "description": "Datetime the sample has been taken", + "disable_correlation": true, + "misp-attribute": "datetime", + "ui-priority": 1 + } + }, + "description": "Daily average CO2 concentrations (ppm) derived from flask air samples.", + "meta-category": "climate", + "name": "scrippsco2-co2-daily", "requiredOneOf": [ "sample-datetime", "sample-date-excel", @@ -7,47 +48,6 @@ "flag", "co2-value" ], - "attributes": { - "sample-datetime": { - "description": "Datetime the sample has been taken", - "ui-priority": 1, - "misp-attribute": "datetime", - "disable_correlation": true - }, - "sample-date-excel": { - "description": "M$Excel spreadsheet date format.", - "ui-priority": 1, - "misp-attribute": "float", - "disable_correlation": true - }, - "sample-date-fractional": { - "description": "Decimal year and fractional year.", - "ui-priority": 1, - "misp-attribute": "float", - "disable_correlation": true - }, - "number-flask": { - "description": "Number of flasks used in daily average.", - "misp-attribute": "counter", - "disable_correlation": true, - "ui-priority": 1 - }, - "flag": { - "description": "Flag (see taxonomy for details).", - "misp-attribute": "counter", - "disable_correlation": true, - "ui-priority": 0 - }, - "co2-value": { - "description": "CO2 value (ppm) - CO2 concentrations are measured on the '08A' Calibration Scale", - "misp-attribute": "float", - "disable_correlation": true, - "ui-priority": 1 - } - }, - "version": 2, - "description": "Daily average CO2 concentrations (ppm) derived from flask air samples.", - "meta-category": "climate", "uuid": "0779baca-06b9-491e-9ab7-ccc3e1538fd3", - "name": "scrippsco2-co2-daily" -} + "version": 2 +} \ No newline at end of file diff --git a/objects/scrippsco2-co2-monthly/definition.json b/objects/scrippsco2-co2-monthly/definition.json index 9363014..5e62947 100644 --- a/objects/scrippsco2-co2-monthly/definition.json +++ b/objects/scrippsco2-co2-monthly/definition.json @@ -1,56 +1,56 @@ { + "attributes": { + "monthly-co2": { + "description": "Monthly CO2 concentrations in micro-mol CO2 per mole (ppm) reported on the 2008A SIO manometric mole fraction scale. This is the standard version of the data most often sought.", + "disable_correlation": true, + "misp-attribute": "float", + "ui-priority": 1 + }, + "monthly-co2-seasonal-adjustment": { + "description": "Same data after a seasonal adjustment to remove the quasi-regular seasonal cycle. The adjustment involves subtracting from the data a 4-harmonic fit with a linear gain factor.", + "disable_correlation": true, + "misp-attribute": "float", + "ui-priority": 0 + }, + "monthly-co2-smoothed": { + "description": "Smoothed version of the data generated from a stiff cubic spline function plus 4-harmonic functions with linear gain.", + "disable_correlation": true, + "misp-attribute": "float", + "ui-priority": 1 + }, + "monthly-co2-smoothed-seasonal-adjustment": { + "description": "Same smoothed version with the seasonal cycle removed.", + "disable_correlation": true, + "misp-attribute": "float", + "ui-priority": 1 + }, + "sample-date-excel": { + "description": "M$Excel spreadsheet date format.", + "disable_correlation": true, + "misp-attribute": "float", + "ui-priority": 1 + }, + "sample-date-fractional": { + "description": "Decimal year and fractional year.", + "disable_correlation": true, + "misp-attribute": "float", + "ui-priority": 1 + }, + "sample-datetime": { + "description": "The monthly values have been adjusted to 24:00 hours on the 15th of each month.", + "disable_correlation": true, + "misp-attribute": "datetime", + "ui-priority": 1 + } + }, + "description": "Monthly average CO2 concentrations (ppm) derived from flask air samples.", + "meta-category": "climate", + "name": "scrippsco2-co2-monthly", "required": [ "sample-datetime", "sample-date-excel", "sample-date-fractional" ], - "attributes": { - "sample-datetime": { - "description": "The monthly values have been adjusted to 24:00 hours on the 15th of each month.", - "ui-priority": 1, - "misp-attribute": "datetime", - "disable_correlation": true - }, - "sample-date-excel": { - "description": "M$Excel spreadsheet date format.", - "ui-priority": 1, - "misp-attribute": "float", - "disable_correlation": true - }, - "sample-date-fractional": { - "description": "Decimal year and fractional year.", - "ui-priority": 1, - "misp-attribute": "float", - "disable_correlation": true - }, - "monthly-co2": { - "description": "Monthly CO2 concentrations in micro-mol CO2 per mole (ppm) reported on the 2008A SIO manometric mole fraction scale. This is the standard version of the data most often sought.", - "misp-attribute": "float", - "disable_correlation": true, - "ui-priority": 1 - }, - "monthly-co2-seasonal-adjustment": { - "description": "Same data after a seasonal adjustment to remove the quasi-regular seasonal cycle. The adjustment involves subtracting from the data a 4-harmonic fit with a linear gain factor.", - "misp-attribute": "float", - "disable_correlation": true, - "ui-priority": 0 - }, - "monthly-co2-smoothed": { - "description": "Smoothed version of the data generated from a stiff cubic spline function plus 4-harmonic functions with linear gain.", - "misp-attribute": "float", - "disable_correlation": true, - "ui-priority": 1 - }, - "monthly-co2-smoothed-seasonal-adjustment": { - "description": "Same smoothed version with the seasonal cycle removed.", - "misp-attribute": "float", - "disable_correlation": true, - "ui-priority": 1 - } - }, - "version": 2, - "description": "Monthly average CO2 concentrations (ppm) derived from flask air samples.", - "meta-category": "climate", "uuid": "3350fc46-7120-4fb1-b5b3-c931465c9b2a", - "name": "scrippsco2-co2-monthly" -} + "version": 2 +} \ No newline at end of file diff --git a/objects/scrippsco2-o18-daily/definition.json b/objects/scrippsco2-o18-daily/definition.json index 98ed102..06ca182 100644 --- a/objects/scrippsco2-o18-daily/definition.json +++ b/objects/scrippsco2-o18-daily/definition.json @@ -1,4 +1,45 @@ { + "attributes": { + "flag": { + "description": "Flag (see taxonomy for details).", + "disable_correlation": true, + "misp-attribute": "counter", + "ui-priority": 0 + }, + "number-flask": { + "description": "Number of flasks used in daily average.", + "disable_correlation": true, + "misp-attribute": "counter", + "ui-priority": 1 + }, + "o18-value": { + "description": "O18 value (ppm) - O18 concentrations are measured on the '08A' Calibration Scale", + "disable_correlation": true, + "misp-attribute": "float", + "ui-priority": 1 + }, + "sample-date-excel": { + "description": "M$Excel spreadsheet date format.", + "disable_correlation": true, + "misp-attribute": "float", + "ui-priority": 1 + }, + "sample-date-fractional": { + "description": "Decimal year and fractional year.", + "disable_correlation": true, + "misp-attribute": "float", + "ui-priority": 1 + }, + "sample-datetime": { + "description": "Datetime the sample has been taken", + "disable_correlation": true, + "misp-attribute": "datetime", + "ui-priority": 1 + } + }, + "description": "Daily average O18 concentrations (ppm) derived from flask air samples.", + "meta-category": "climate", + "name": "scrippsco2-o18-daily", "requiredOneOf": [ "sample-datetime", "sample-date-excel", @@ -7,47 +48,6 @@ "flag", "o18-value" ], - "attributes": { - "sample-datetime": { - "description": "Datetime the sample has been taken", - "ui-priority": 1, - "misp-attribute": "datetime", - "disable_correlation": true - }, - "sample-date-excel": { - "description": "M$Excel spreadsheet date format.", - "ui-priority": 1, - "misp-attribute": "float", - "disable_correlation": true - }, - "sample-date-fractional": { - "description": "Decimal year and fractional year.", - "ui-priority": 1, - "misp-attribute": "float", - "disable_correlation": true - }, - "number-flask": { - "description": "Number of flasks used in daily average.", - "misp-attribute": "counter", - "disable_correlation": true, - "ui-priority": 1 - }, - "flag": { - "description": "Flag (see taxonomy for details).", - "misp-attribute": "counter", - "disable_correlation": true, - "ui-priority": 0 - }, - "o18-value": { - "description": "O18 value (ppm) - O18 concentrations are measured on the '08A' Calibration Scale", - "misp-attribute": "float", - "disable_correlation": true, - "ui-priority": 1 - } - }, - "version": 2, - "description": "Daily average O18 concentrations (ppm) derived from flask air samples.", - "meta-category": "climate", "uuid": "8b6878a7-577d-4845-b165-ead6e58bec04", - "name": "scrippsco2-o18-daily" -} + "version": 2 +} \ No newline at end of file diff --git a/objects/scrippsco2-o18-monthly/definition.json b/objects/scrippsco2-o18-monthly/definition.json index 0782b5f..a27b459 100644 --- a/objects/scrippsco2-o18-monthly/definition.json +++ b/objects/scrippsco2-o18-monthly/definition.json @@ -1,56 +1,56 @@ { + "attributes": { + "monthly-o18": { + "description": "Monthly O18 concentrations in micro-mol O18 per mole (ppm) reported on the 2008A SIO manometric mole fraction scale. This is the standard version of the data most often sought.", + "disable_correlation": true, + "misp-attribute": "float", + "ui-priority": 1 + }, + "monthly-o18-seasonal-adjustment": { + "description": "Same data after a seasonal adjustment to remove the quasi-regular seasonal cycle. The adjustment involves subtracting from the data a 4-harmonic fit with a linear gain factor.", + "disable_correlation": true, + "misp-attribute": "float", + "ui-priority": 0 + }, + "monthly-o18-smoothed": { + "description": "Smoothed version of the data generated from a stiff cubic spline function plus 4-harmonic functions with linear gain.", + "disable_correlation": true, + "misp-attribute": "float", + "ui-priority": 1 + }, + "monthly-o18-smoothed-seasonal-adjustment": { + "description": "Same smoothed version with the seasonal cycle removed.", + "disable_correlation": true, + "misp-attribute": "float", + "ui-priority": 1 + }, + "sample-date-excel": { + "description": "M$Excel spreadsheet date format.", + "disable_correlation": true, + "misp-attribute": "float", + "ui-priority": 1 + }, + "sample-date-fractional": { + "description": "Decimal year and fractional year.", + "disable_correlation": true, + "misp-attribute": "float", + "ui-priority": 1 + }, + "sample-datetime": { + "description": "The monthly values have been adjusted to 24:00 hours on the 15th of each month.", + "disable_correlation": true, + "misp-attribute": "datetime", + "ui-priority": 1 + } + }, + "description": "Monthly average O18 concentrations (ppm) derived from flask air samples.", + "meta-category": "climate", + "name": "scrippsco2-o18-monthly", "required": [ "sample-datetime", "sample-date-excel", "sample-date-fractional" ], - "attributes": { - "sample-datetime": { - "description": "The monthly values have been adjusted to 24:00 hours on the 15th of each month.", - "ui-priority": 1, - "misp-attribute": "datetime", - "disable_correlation": true - }, - "sample-date-excel": { - "description": "M$Excel spreadsheet date format.", - "ui-priority": 1, - "misp-attribute": "float", - "disable_correlation": true - }, - "sample-date-fractional": { - "description": "Decimal year and fractional year.", - "ui-priority": 1, - "misp-attribute": "float", - "disable_correlation": true - }, - "monthly-o18": { - "description": "Monthly O18 concentrations in micro-mol O18 per mole (ppm) reported on the 2008A SIO manometric mole fraction scale. This is the standard version of the data most often sought.", - "misp-attribute": "float", - "disable_correlation": true, - "ui-priority": 1 - }, - "monthly-o18-seasonal-adjustment": { - "description": "Same data after a seasonal adjustment to remove the quasi-regular seasonal cycle. The adjustment involves subtracting from the data a 4-harmonic fit with a linear gain factor.", - "misp-attribute": "float", - "disable_correlation": true, - "ui-priority": 0 - }, - "monthly-o18-smoothed": { - "description": "Smoothed version of the data generated from a stiff cubic spline function plus 4-harmonic functions with linear gain.", - "misp-attribute": "float", - "disable_correlation": true, - "ui-priority": 1 - }, - "monthly-o18-smoothed-seasonal-adjustment": { - "description": "Same smoothed version with the seasonal cycle removed.", - "misp-attribute": "float", - "disable_correlation": true, - "ui-priority": 1 - } - }, - "version": 2, - "description": "Monthly average O18 concentrations (ppm) derived from flask air samples.", - "meta-category": "climate", "uuid": "86bd588b-cd0c-486a-8ea0-17fd95312fa0", - "name": "scrippsco2-o18-monthly" -} + "version": 2 +} \ No newline at end of file diff --git a/objects/script/definition.json b/objects/script/definition.json index 0b35fa8..35ee043 100644 --- a/objects/script/definition.json +++ b/objects/script/definition.json @@ -1,30 +1,21 @@ { - "requiredOneOf": [ - "script", - "filename", - "script-as-attachment" - ], "attributes": { - "script": { - "description": "Free text of the script.", - "ui-priority": 10, - "misp-attribute": "text" - }, - "script-as-attachment": { - "description": "Attachment of the script.", - "ui-priority": 10, - "misp-attribute": "attachment" - }, "comment": { "description": "Comment associated to the script.", - "ui-priority": 1, - "misp-attribute": "text" + "misp-attribute": "text", + "ui-priority": 1 + }, + "filename": { + "description": "Filename used for the script.", + "disable_correlation": true, + "misp-attribute": "filename", + "multiple": true, + "ui-priority": 8 }, "language": { "description": "Scripting language used for the script.", - "ui-priority": 9, - "misp-attribute": "text", "disable_correlation": true, + "misp-attribute": "text", "sane_default": [ "PowerShell", "VBScript", @@ -40,21 +31,25 @@ "AutoIt", "PHP", "Nim" - ] + ], + "ui-priority": 9 }, - "filename": { - "description": "Filename used for the script.", - "ui-priority": 8, - "misp-attribute": "filename", - "multiple": true, - "disable_correlation": true + "script": { + "description": "Free text of the script.", + "misp-attribute": "text", + "ui-priority": 10 + }, + "script-as-attachment": { + "description": "Attachment of the script.", + "misp-attribute": "attachment", + "ui-priority": 10 }, "state": { - "misp-attribute": "text", - "ui-priority": 0, "description": "Known state of the script.", - "multiple": true, "disable_correlation": true, + "misp-attribute": "text", + "multiple": true, + "ui-priority": 0, "values_list": [ "Malicious", "Unknown", @@ -63,9 +58,14 @@ ] } }, - "version": 7, "description": "Object describing a computer program written to be run in a special run-time environment. The script or shell script can be used for malicious activities but also as support tools for threat analysts.", "meta-category": "misc", + "name": "script", + "requiredOneOf": [ + "script", + "filename", + "script-as-attachment" + ], "uuid": "6bce7d01-dbec-4054-b3c2-3655a19382e2", - "name": "script" -} + "version": 7 +} \ No newline at end of file diff --git a/objects/shell-commands/definition.json b/objects/shell-commands/definition.json index 895eb24..91f4734 100644 --- a/objects/shell-commands/definition.json +++ b/objects/shell-commands/definition.json @@ -1,23 +1,14 @@ { - "required": [ - "shell-command" - ], "attributes": { - "script": { - "description": "Free text of the script if available which executed the shell commands.", - "ui-priority": 10, - "misp-attribute": "text" - }, "comment": { "description": "Comment associated to the shell commands executed.", - "ui-priority": 1, - "misp-attribute": "text" + "misp-attribute": "text", + "ui-priority": 1 }, "language": { "description": "Scripting language used for the shell commands executed.", - "ui-priority": 9, - "misp-attribute": "text", "disable_correlation": true, + "misp-attribute": "text", "sane_default": [ "PowerShell", "VBScript", @@ -32,20 +23,26 @@ "Winbatch", "AutoIt", "PHP" - ] + ], + "ui-priority": 9 + }, + "script": { + "description": "Free text of the script if available which executed the shell commands.", + "misp-attribute": "text", + "ui-priority": 10 }, "shell-command": { "description": "", - "ui-priority": 0, "misp-attribute": "text", - "multiple": true + "multiple": true, + "ui-priority": 0 }, "state": { - "misp-attribute": "text", - "ui-priority": 0, "description": "Known state of the script.", - "multiple": true, "disable_correlation": true, + "misp-attribute": "text", + "multiple": true, + "ui-priority": 0, "values_list": [ "Malicious", "Unknown", @@ -54,9 +51,12 @@ ] } }, - "version": 2, "description": "Object describing a series of shell commands executed. This object can be linked with malicious files in order to describe a specific execution of shell commands.", "meta-category": "misc", + "name": "shell-commands", + "required": [ + "shell-command" + ], "uuid": "fee65efa-eb64-4516-8611-1db76c589f79", - "name": "shell-commands" -} + "version": 2 +} \ No newline at end of file diff --git a/objects/shodan-report/definition.json b/objects/shodan-report/definition.json index 13cef41..cc3c444 100644 --- a/objects/shodan-report/definition.json +++ b/objects/shodan-report/definition.json @@ -1,4 +1,61 @@ { + "attributes": { + "banner": { + "categories": [ + "Network activity", + "External analysis" + ], + "description": "server banner reported", + "misp-attribute": "text", + "ui-priority": 1 + }, + "hostname": { + "categories": [ + "Network activity", + "External analysis" + ], + "description": "Hostnames found", + "misp-attribute": "domain", + "multiple": true, + "ui-priority": 1 + }, + "ip": { + "categories": [ + "Network activity", + "External analysis" + ], + "description": "IP Address Queried", + "misp-attribute": "ip-dst", + "ui-priority": 1 + }, + "org": { + "categories": [ + "Network activity", + "External analysis" + ], + "description": "Associated Organization", + "misp-attribute": "text", + "ui-priority": 1 + }, + "port": { + "categories": [ + "Network activity", + "External analysis" + ], + "description": "Listening Port", + "misp-attribute": "port", + "ui-priority": 1 + }, + "text": { + "description": "A description of the report", + "misp-attribute": "text", + "recommended": false, + "ui-priority": 1 + } + }, + "description": "Shodan Report for a given IP", + "meta-category": "network", + "name": "shodan-report", "required": [ "ip" ], @@ -8,63 +65,6 @@ "port", "banner" ], - "attributes": { - "text": { - "description": "A description of the report", - "ui-priority": 1, - "misp-attribute": "text", - "recommended": false - }, - "ip": { - "description": "IP Address Queried", - "categories": [ - "Network activity", - "External analysis" - ], - "ui-priority": 1, - "misp-attribute": "ip-dst" - }, - "hostname": { - "description": "Hostnames found", - "categories": [ - "Network activity", - "External analysis" - ], - "ui-priority": 1, - "misp-attribute": "domain", - "multiple": true - }, - "org": { - "description": "Associated Organization", - "categories": [ - "Network activity", - "External analysis" - ], - "ui-priority": 1, - "misp-attribute": "text" - }, - "port": { - "description": "Listening Port", - "categories": [ - "Network activity", - "External analysis" - ], - "ui-priority": 1, - "misp-attribute": "port" - }, - "banner": { - "description": "server banner reported", - "categories": [ - "Network activity", - "External analysis" - ], - "ui-priority": 1, - "misp-attribute": "text" - } - }, - "version": 1, - "description": "Shodan Report for a given IP", - "meta-category": "network", "uuid": "10b03d93-3694-4a79-9cd1-4a273746303a", - "name": "shodan-report" -} + "version": 1 +} \ No newline at end of file diff --git a/objects/short-message-service/definition.json b/objects/short-message-service/definition.json index 1475aa3..ec95603 100644 --- a/objects/short-message-service/definition.json +++ b/objects/short-message-service/definition.json @@ -1,57 +1,57 @@ { + "attributes": { + "body": { + "description": "Message body of the SMS", + "misp-attribute": "text", + "ui-priority": 1 + }, + "from": { + "description": "Phone number used to send the SMS", + "misp-attribute": "phone-number", + "multiple": true, + "ui-priority": 1 + }, + "name": { + "description": "Sender name", + "misp-attribute": "text", + "ui-priority": 0 + }, + "received-date": { + "description": "Received date of the SMS", + "disable_correlation": true, + "misp-attribute": "datetime", + "ui-priority": 0 + }, + "sent-date": { + "description": "Initial sent date of the SMS", + "disable_correlation": true, + "misp-attribute": "datetime", + "ui-priority": 0 + }, + "smsc": { + "description": "SMS Message Center", + "misp-attribute": "phone-number", + "ui-priority": 0 + }, + "to": { + "description": "Phone number receiving the SMS", + "misp-attribute": "phone-number", + "multiple": true, + "ui-priority": 1 + }, + "url-rfc5724": { + "description": "url representing SMS using RFC 5724 (not url contained in the SMS which should use an url object)", + "misp-attribute": "url", + "ui-priority": 6 + } + }, + "description": "Short Message Service (SMS) object template describing one or more SMS message. Restriction of the initial format 3GPP 23.038 GSM character set doesn't apply.", + "meta-category": "misc", + "name": "short-message-service", "requiredOneOf": [ "body", "from" ], - "attributes": { - "body": { - "description": "Message body of the SMS", - "ui-priority": 1, - "misp-attribute": "text" - }, - "url-rfc5724": { - "description": "url representing SMS using RFC 5724 (not url contained in the SMS which should use an url object)", - "ui-priority": 6, - "misp-attribute": "url" - }, - "from": { - "description": "Phone number used to send the SMS", - "ui-priority": 1, - "misp-attribute": "phone-number", - "multiple": true - }, - "to": { - "description": "Phone number receiving the SMS", - "ui-priority": 1, - "misp-attribute": "phone-number", - "multiple": true - }, - "sent-date": { - "description": "Initial sent date of the SMS", - "ui-priority": 0, - "misp-attribute": "datetime", - "disable_correlation": true - }, - "received-date": { - "description": "Received date of the SMS", - "ui-priority": 0, - "misp-attribute": "datetime", - "disable_correlation": true - }, - "smsc": { - "description": "SMS Message Center", - "ui-priority": 0, - "misp-attribute": "phone-number" - }, - "name": { - "description": "Sender name", - "ui-priority": 0, - "misp-attribute": "text" - } - }, - "version": 3, - "description": "Short Message Service (SMS) object template describing one or more SMS message. Restriction of the initial format 3GPP 23.038 GSM character set doesn't apply.", - "meta-category": "misc", "uuid": "4851a3dc-e1a6-43ac-9d97-f0d13a099fd2", - "name": "short-message-service" -} + "version": 3 +} \ No newline at end of file diff --git a/objects/shortened-link/definition.json b/objects/shortened-link/definition.json index a2a2ff6..0b90ad9 100644 --- a/objects/shortened-link/definition.json +++ b/objects/shortened-link/definition.json @@ -1,44 +1,44 @@ { + "attributes": { + "credential": { + "description": "Credential (username, password)", + "misp-attribute": "text", + "ui-priority": 0 + }, + "domain": { + "description": "Full domain", + "misp-attribute": "domain", + "ui-priority": 0 + }, + "first-seen": { + "description": "First time this shortened URL has been seen", + "disable_correlation": true, + "misp-attribute": "datetime", + "ui-priority": 0 + }, + "redirect-url": { + "description": "Redirected to URL", + "misp-attribute": "url", + "ui-priority": 1 + }, + "shortened-url": { + "description": "Shortened URL", + "misp-attribute": "url", + "ui-priority": 1 + }, + "text": { + "description": "Description and context of the shortened URL ", + "misp-attribute": "text", + "ui-priority": 0 + } + }, + "description": "Shortened link and its redirect target", + "meta-category": "network", + "name": "shortened-link", "required": [ "redirect-url", "shortened-url" ], - "attributes": { - "first-seen": { - "description": "First time this shortened URL has been seen", - "disable_correlation": true, - "ui-priority": 0, - "misp-attribute": "datetime" - }, - "redirect-url": { - "description": "Redirected to URL", - "ui-priority": 1, - "misp-attribute": "url" - }, - "shortened-url": { - "description": "Shortened URL", - "ui-priority": 1, - "misp-attribute": "url" - }, - "domain": { - "description": "Full domain", - "ui-priority": 0, - "misp-attribute": "domain" - }, - "credential": { - "description": "Credential (username, password)", - "ui-priority": 0, - "misp-attribute": "text" - }, - "text": { - "description": "Description and context of the shortened URL ", - "ui-priority": 0, - "misp-attribute": "text" - } - }, - "version": 2018060501, - "description": "Shortened link and its redirect target", - "meta-category": "network", "uuid": "361c0ae8-68bd-11e8-adc0-fa7ae01bbebc", - "name": "shortened-link" -} + "version": 2018060501 +} \ No newline at end of file diff --git a/objects/social-media-group/definition.json b/objects/social-media-group/definition.json index 25a9927..a005b05 100644 --- a/objects/social-media-group/definition.json +++ b/objects/social-media-group/definition.json @@ -1,102 +1,102 @@ { + "attributes": { + "administrator": { + "description": "A user account who is an owner or admin of the group.", + "misp-attribute": "text", + "multiple": true, + "ui-priority": 1 + }, + "archive": { + "description": "Archive of the original group (Internet Archive, Archive.is, etc).", + "disable_correlation": true, + "misp-attribute": "link", + "multiple": true, + "ui-priority": 1 + }, + "attachment": { + "description": "A screen capture or exported list of contacts, group members, etc.", + "misp-attribute": "attachment", + "multiple": true, + "ui-priority": 1 + }, + "description": { + "description": "A description of the group, channel or community.", + "misp-attribute": "text", + "ui-priority": 1 + }, + "embedded-link": { + "description": "Link embedded in the group description (potentially malicious).", + "misp-attribute": "url", + "multiple": true, + "ui-priority": 0 + }, + "embedded-safe-link": { + "description": "Link embedded in the group description (supposed safe).", + "misp-attribute": "link", + "multiple": true, + "to_ids": false, + "ui-priority": 0 + }, + "group-alias": { + "description": "Aliases of group, channel or community.", + "misp-attribute": "text", + "multiple": true, + "ui-priority": 1 + }, + "group-name": { + "description": "The name of the group, channel or community.", + "misp-attribute": "text", + "ui-priority": 1 + }, + "hashtag": { + "description": "Hashtag used to identify or promote the group.", + "misp-attribute": "text", + "multiple": true, + "ui-priority": 0 + }, + "link": { + "description": "Original link into the group (supposed harmless).", + "misp-attribute": "link", + "ui-priority": 1 + }, + "person-name": { + "description": "A person who is a member of the group.", + "misp-attribute": "text", + "multiple": true, + "ui-priority": 1 + }, + "platform": { + "description": "The social media platform used.", + "disable_correlation": true, + "misp-attribute": "text", + "multiple": true, + "sane_default": [ + "Facebook", + "Twitter" + ], + "ui-priority": 1 + }, + "url": { + "description": "Original URL location of the group (potentially malicious).", + "misp-attribute": "url", + "ui-priority": 1 + }, + "username": { + "description": "A user account who is a member of the group.", + "misp-attribute": "text", + "multiple": true, + "ui-priority": 1 + } + }, + "description": "Social media group object template describing a public or private group or channel.", + "meta-category": "misc", + "name": "social-media-group", "requiredOneOf": [ "group-name", "group-alias", "archive", "description" ], - "attributes": { - "group-name": { - "description": "The name of the group, channel or community.", - "ui-priority": 1, - "misp-attribute": "text" - }, - "description": { - "description": "A description of the group, channel or community.", - "ui-priority": 1, - "misp-attribute": "text" - }, - "group-alias": { - "description": "Aliases of group, channel or community.", - "ui-priority": 1, - "multiple": true, - "misp-attribute": "text" - }, - "platform": { - "description": "The social media platform used.", - "ui-priority": 1, - "misp-attribute": "text", - "disable_correlation": true, - "multiple": true, - "sane_default": [ - "Facebook", - "Twitter" - ] - }, - "username": { - "description": "A user account who is a member of the group.", - "ui-priority": 1, - "misp-attribute": "text", - "multiple": true - }, - "administrator": { - "description": "A user account who is an owner or admin of the group.", - "ui-priority": 1, - "misp-attribute": "text", - "multiple": true - }, - "person-name": { - "description": "A person who is a member of the group.", - "ui-priority": 1, - "misp-attribute": "text", - "multiple": true - }, - "hashtag": { - "description": "Hashtag used to identify or promote the group.", - "ui-priority": 0, - "misp-attribute": "text", - "multiple": true - }, - "url": { - "description": "Original URL location of the group (potentially malicious).", - "ui-priority": 1, - "misp-attribute": "url" - }, - "link": { - "description": "Original link into the group (supposed harmless).", - "ui-priority": 1, - "misp-attribute": "link" - }, - "embedded-link": { - "description": "Link embedded in the group description (potentially malicious).", - "ui-priority": 0, - "misp-attribute": "url", - "multiple": true - }, - "embedded-safe-link": { - "description": "Link embedded in the group description (supposed safe).", - "ui-priority": 0, - "misp-attribute": "link", - "multiple": true, - "to_ids": false - }, - "archive": { - "description": "Archive of the original group (Internet Archive, Archive.is, etc).", - "ui-priority": 1, - "multiple": true, - "disable_correlation": true, - "misp-attribute": "link" - }, - "attachment": { - "description": "A screen capture or exported list of contacts, group members, etc.", - "ui-priority": 1, - "multiple": true, - "misp-attribute": "attachment" - } - }, - "version": 1, - "description": "Social media group object template describing a public or private group or channel.", - "meta-category": "misc", "uuid": "c4939ec4-ab53-4c35-9a98-3d4d4caf5b6c", - "name": "social-media-group" -} + "version": 1 +} \ No newline at end of file diff --git a/objects/splunk/definition.json b/objects/splunk/definition.json index 2ebaff4..fb0c9cd 100644 --- a/objects/splunk/definition.json +++ b/objects/splunk/definition.json @@ -1,60 +1,60 @@ { - "version": 1, + "attributes": { + "description": { + "description": "Description", + "disable_correlation": true, + "misp-attribute": "comment", + "ui-priority": 0 + }, + "drill-down": { + "description": "Drilldown", + "disable_correlation": true, + "misp-attribute": "text", + "multiple": true, + "ui-priority": 0 + }, + "earliest": { + "description": "Earliest time", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 0 + }, + "latest": { + "description": "Latest time", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 0 + }, + "response-action": { + "description": "Response action", + "disable_correlation": true, + "misp-attribute": "text", + "multiple": true, + "sane_default": [ + "notable", + "risk" + ], + "ui-priority": 0 + }, + "schedule": { + "description": "Schedule", + "disable_correlation": true, + "misp-attribute": "other", + "ui-priority": 0 + }, + "search": { + "description": "Search / Correlation search", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 0 + } + }, "description": "Splunk / Splunk ES object", "meta-category": "misc", - "uuid": "fd9b7bf8-df7b-4df9-bcd8-28591edcaab8", "name": "splunk", "required": [ "search" ], - "attributes": { - "search": { - "description": "Search / Correlation search", - "ui-priority": 0, - "misp-attribute": "text", - "disable_correlation": true - }, - "drill-down": { - "description": "Drilldown", - "ui-priority": 0, - "misp-attribute": "text", - "disable_correlation": true, - "multiple": true - }, - "response-action": { - "description": "Response action", - "ui-priority": 0, - "misp-attribute": "text", - "multiple": true, - "disable_correlation": true, - "sane_default": [ - "notable", - "risk" - ] - }, - "schedule": { - "description": "Schedule", - "ui-priority": 0, - "misp-attribute": "other", - "disable_correlation": true - }, - "earliest": { - "description": "Earliest time", - "ui-priority": 0, - "misp-attribute": "text", - "disable_correlation": true - }, - "latest": { - "description": "Latest time", - "ui-priority": 0, - "misp-attribute": "text", - "disable_correlation": true - }, - "description": { - "description": "Description", - "ui-priority": 0, - "misp-attribute": "comment", - "disable_correlation": true - } - } -} + "uuid": "fd9b7bf8-df7b-4df9-bcd8-28591edcaab8", + "version": 1 +} \ No newline at end of file diff --git a/objects/ss7-attack/definition.json b/objects/ss7-attack/definition.json index 7f9b138..d3f6138 100644 --- a/objects/ss7-attack/definition.json +++ b/objects/ss7-attack/definition.json @@ -1,10 +1,10 @@ { - "requiredOneOf": [ - "text" - ], "attributes": { "Category": { "description": "Category", + "disable_correlation": true, + "misp-attribute": "text", + "multiple": true, "sane_default": [ "Cat0", "Cat1", @@ -16,162 +16,162 @@ "CatSMS", "CatSpoofing" ], - "misp-attribute": "text", - "disable_correlation": true, - "multiple": true, "ui-priority": 1 }, + "MapApplicationContext": { + "description": "MAP application context in OID format.", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 0 + }, + "MapGmlc": { + "description": "MAP GMLC. Phone number.", + "misp-attribute": "text", + "ui-priority": 0 + }, + "MapGsmscfGT": { + "description": "MAP GSMSCF GT. Phone number.", + "misp-attribute": "text", + "ui-priority": 0 + }, + "MapImsi": { + "description": "MAP IMSI. Phone number starting with MCC/MNC.", + "misp-attribute": "text", + "multiple": true, + "ui-priority": 0 + }, + "MapMscGT": { + "description": "MAP MSC GT. Phone number.", + "misp-attribute": "text", + "ui-priority": 0 + }, + "MapMsisdn": { + "description": "MAP MSISDN. Phone number.", + "misp-attribute": "text", + "multiple": true, + "ui-priority": 0 + }, + "MapOpCode": { + "description": "MAP operation codes - Decimal value between 0-99.", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 0 + }, + "MapSmsTP-DCS": { + "description": "MAP SMS TP-DCS.", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 0 + }, + "MapSmsTP-OA": { + "description": "MAP SMS TP-OA. Phone number.", + "misp-attribute": "text", + "ui-priority": 0 + }, + "MapSmsTP-PID": { + "description": "MAP SMS TP-PID.", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 0 + }, + "MapSmsText": { + "description": "MAP SMS Text. Important indicators in SMS text.", + "misp-attribute": "text", + "ui-priority": 0 + }, + "MapSmsTypeNumber": { + "description": "MAP SMS TypeNumber.", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 0 + }, + "MapSmscGT": { + "description": "MAP SMSC. Phone number.", + "misp-attribute": "text", + "multiple": true, + "ui-priority": 0 + }, + "MapUssdCoding": { + "description": "MAP USSD Content.", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 0 + }, + "MapUssdContent": { + "description": "MAP USSD Content.", + "misp-attribute": "text", + "ui-priority": 0 + }, "MapVersion": { "description": "Map version.", + "disable_correlation": true, + "misp-attribute": "text", "sane_default": [ "1", "2", "3" ], + "ui-priority": 0 + }, + "MapVlrGT": { + "description": "MAP VLR GT. Phone number.", "misp-attribute": "text", + "ui-priority": 0 + }, + "SccpCdGT": { + "description": "Signaling Connection Control Part (SCCP) CdGT - Phone number.", + "misp-attribute": "text", + "ui-priority": 0 + }, + "SccpCdPC": { + "description": "Signaling Connection Control Part (SCCP) CdPC - Phone number.", + "misp-attribute": "text", + "ui-priority": 0 + }, + "SccpCdSSN": { + "description": "Signaling Connection Control Part (SCCP) - Decimal value between 0-255.", "disable_correlation": true, + "misp-attribute": "text", "ui-priority": 0 }, "SccpCgGT": { "description": "Signaling Connection Control Part (SCCP) CgGT - Phone number.", + "misp-attribute": "text", "multiple": true, - "ui-priority": 0, - "misp-attribute": "text" - }, - "SccpCdGT": { - "description": "Signaling Connection Control Part (SCCP) CdGT - Phone number.", - "ui-priority": 0, - "misp-attribute": "text" + "ui-priority": 0 }, "SccpCgPC": { "description": "Signaling Connection Control Part (SCCP) CgPC - Phone number.", + "misp-attribute": "text", "multiple": true, - "ui-priority": 0, - "misp-attribute": "text" - }, - "SccpCdPC": { - "description": "Signaling Connection Control Part (SCCP) CdPC - Phone number.", - "ui-priority": 0, - "misp-attribute": "text" + "ui-priority": 0 }, "SccpCgSSN": { "description": "Signaling Connection Control Part (SCCP) - Decimal value between 0-255.", - "ui-priority": 0, - "misp-attribute": "text", - "disable_correlation": true - }, - "SccpCdSSN": { - "description": "Signaling Connection Control Part (SCCP) - Decimal value between 0-255.", - "ui-priority": 0, - "misp-attribute": "text", - "disable_correlation": true - }, - "MapOpCode": { - "description": "MAP operation codes - Decimal value between 0-99.", - "ui-priority": 0, - "misp-attribute": "text", - "disable_correlation": true - }, - "MapApplicationContext": { - "description": "MAP application context in OID format.", - "ui-priority": 0, - "misp-attribute": "text", - "disable_correlation": true - }, - "MapImsi": { - "description": "MAP IMSI. Phone number starting with MCC/MNC.", - "multiple": true, - "ui-priority": 0, - "misp-attribute": "text" - }, - "MapMsisdn": { - "description": "MAP MSISDN. Phone number.", - "multiple": true, - "ui-priority": 0, - "misp-attribute": "text" - }, - "MapMscGT": { - "description": "MAP MSC GT. Phone number.", - "ui-priority": 0, - "misp-attribute": "text" - }, - "MapGsmscfGT": { - "description": "MAP GSMSCF GT. Phone number.", - "ui-priority": 0, - "misp-attribute": "text" - }, - "MapVlrGT": { - "description": "MAP VLR GT. Phone number.", - "ui-priority": 0, - "misp-attribute": "text" - }, - "MapGmlc": { - "description": "MAP GMLC. Phone number.", - "ui-priority": 0, - "misp-attribute": "text" - }, - "MapSmscGT": { - "description": "MAP SMSC. Phone number.", - "ui-priority": 0, - "multiple": true, - "misp-attribute": "text" - }, - "MapSmsTP-OA": { - "description": "MAP SMS TP-OA. Phone number.", - "ui-priority": 0, - "misp-attribute": "text" - }, - "MapSmsText": { - "description": "MAP SMS Text. Important indicators in SMS text.", - "ui-priority": 0, - "misp-attribute": "text" - }, - "MapSmsTP-PID": { - "description": "MAP SMS TP-PID.", - "ui-priority": 0, - "misp-attribute": "text", - "disable_correlation": true - }, - "MapSmsTP-DCS": { - "description": "MAP SMS TP-DCS.", - "ui-priority": 0, - "misp-attribute": "text", - "disable_correlation": true - }, - "MapSmsTypeNumber": { - "description": "MAP SMS TypeNumber.", - "ui-priority": 0, - "misp-attribute": "text", - "disable_correlation": true - }, - "MapUssdContent": { - "description": "MAP USSD Content.", - "ui-priority": 0, - "misp-attribute": "text" - }, - "MapUssdCoding": { - "description": "MAP USSD Content.", - "ui-priority": 0, - "misp-attribute": "text", - "disable_correlation": true - }, - "text": { - "description": "A description of the attack seen via SS7 logging.", "disable_correlation": true, - "ui-priority": 0, - "multiple": true, - "misp-attribute": "text" + "misp-attribute": "text", + "ui-priority": 0 }, "first-seen": { "description": "When the attack has been seen for the first time.", "disable_correlation": true, - "ui-priority": 0, - "misp-attribute": "datetime" + "misp-attribute": "datetime", + "ui-priority": 0 + }, + "text": { + "description": "A description of the attack seen via SS7 logging.", + "disable_correlation": true, + "misp-attribute": "text", + "multiple": true, + "ui-priority": 0 } }, - "version": 2, "description": "SS7 object of an attack seen on a GSM, UMTS or LTE network via SS7 logging.", "meta-category": "network", + "name": "ss7-attack", + "requiredOneOf": [ + "text" + ], "uuid": "f3493d8b-a7ab-48d0-a775-046c4d64d782", - "name": "ss7-attack" -} + "version": 2 +} \ No newline at end of file diff --git a/objects/ssh-authorized-keys/definition.json b/objects/ssh-authorized-keys/definition.json index 3e6f047..18ae555 100644 --- a/objects/ssh-authorized-keys/definition.json +++ b/objects/ssh-authorized-keys/definition.json @@ -1,72 +1,72 @@ { + "attributes": { + "first-seen": { + "description": "First time the ssh authorized keys file has been seen", + "disable_correlation": true, + "misp-attribute": "datetime", + "ui-priority": 0 + }, + "full-line": { + "description": "One full-line of the authorized key file", + "misp-attribute": "text", + "multiple": true, + "ui-priority": 0 + }, + "hostname": { + "categories": [ + "Network activity", + "External analysis" + ], + "description": "hostname", + "misp-attribute": "hostname", + "multiple": true, + "ui-priority": 1 + }, + "ip": { + "categories": [ + "Network activity", + "External analysis" + ], + "description": "IP Address", + "misp-attribute": "ip-dst", + "multiple": true, + "ui-priority": 1 + }, + "key": { + "description": "Public key in base64 as found in the authorized key file", + "misp-attribute": "text", + "multiple": true, + "ui-priority": 0 + }, + "key-id": { + "description": "Key-id and option part of the public key line", + "misp-attribute": "text", + "multiple": true, + "ui-priority": 0 + }, + "last-seen": { + "description": "Last time the ssh authorized keys file has been seen", + "disable_correlation": true, + "misp-attribute": "datetime", + "ui-priority": 0 + }, + "text": { + "description": "A description of the ssh authorized keys", + "disable_correlation": true, + "misp-attribute": "text", + "recommended": false, + "ui-priority": 1 + } + }, + "description": "An object to store ssh authorized keys file.", + "meta-category": "network", + "name": "ssh-authorized-keys", "requiredOneOf": [ "ip", "hostname", "full-line", "key" ], - "attributes": { - "text": { - "description": "A description of the ssh authorized keys", - "disable_correlation": true, - "ui-priority": 1, - "misp-attribute": "text", - "recommended": false - }, - "last-seen": { - "description": "Last time the ssh authorized keys file has been seen", - "disable_correlation": true, - "ui-priority": 0, - "misp-attribute": "datetime" - }, - "first-seen": { - "description": "First time the ssh authorized keys file has been seen", - "disable_correlation": true, - "ui-priority": 0, - "misp-attribute": "datetime" - }, - "full-line": { - "description": "One full-line of the authorized key file", - "ui-priority": 0, - "misp-attribute": "text", - "multiple": true - }, - "key": { - "description": "Public key in base64 as found in the authorized key file", - "ui-priority": 0, - "misp-attribute": "text", - "multiple": true - }, - "key-id": { - "description": "Key-id and option part of the public key line", - "ui-priority": 0, - "misp-attribute": "text", - "multiple": true - }, - "hostname": { - "description": "hostname", - "categories": [ - "Network activity", - "External analysis" - ], - "ui-priority": 1, - "misp-attribute": "hostname", - "multiple": true - }, - "ip": { - "description": "IP Address", - "categories": [ - "Network activity", - "External analysis" - ], - "ui-priority": 1, - "misp-attribute": "ip-dst", - "multiple": true - } - }, - "version": 1, - "description": "An object to store ssh authorized keys file.", - "meta-category": "network", "uuid": "d1db3e4d-c932-4d8b-a915-4cff088cb678", - "name": "ssh-authorized-keys" -} + "version": 1 +} \ No newline at end of file diff --git a/objects/stix2-pattern/definition.json b/objects/stix2-pattern/definition.json index ab49a22..e2ed24e 100644 --- a/objects/stix2-pattern/definition.json +++ b/objects/stix2-pattern/definition.json @@ -1,30 +1,30 @@ { - "requiredOneOf": [ - "stix2-pattern" - ], "attributes": { "comment": { "description": "A description of the stix2-pattern.", - "ui-priority": 0, - "misp-attribute": "comment" + "misp-attribute": "comment", + "ui-priority": 0 }, "stix2-pattern": { "description": "STIX 2 pattern", - "ui-priority": 0, - "misp-attribute": "stix2-pattern" + "misp-attribute": "stix2-pattern", + "ui-priority": 0 }, "version": { "description": "Version of STIX 2 pattern.", - "ui-priority": 0, "misp-attribute": "text", "sane_default": [ "stix 2.0" - ] + ], + "ui-priority": 0 } }, - "version": 2, "description": "An object describing a STIX pattern. The object can be linked via a relationship to other attributes or objects to describe how it can be represented as a STIX pattern.", "meta-category": "misc", + "name": "stix2-pattern", + "requiredOneOf": [ + "stix2-pattern" + ], "uuid": "0c5bd072-7c3e-4d45-86f7-a8104d9143b9", - "name": "stix2-pattern" -} + "version": 2 +} \ No newline at end of file diff --git a/objects/suricata/definition.json b/objects/suricata/definition.json index dce6dea..2756d35 100644 --- a/objects/suricata/definition.json +++ b/objects/suricata/definition.json @@ -1,33 +1,33 @@ { - "requiredOneOf": [ - "suricata" - ], "attributes": { "comment": { "description": "A description of the Suricata rule(s).", - "ui-priority": 0, - "misp-attribute": "comment" - }, - "suricata": { - "description": "Suricata rule.", - "ui-priority": 0, - "misp-attribute": "snort", - "multiple": true - }, - "version": { - "description": "Version of the Suricata rule depending where the suricata rule is known to work as expected.", - "ui-priority": 0, - "misp-attribute": "text" + "misp-attribute": "comment", + "ui-priority": 0 }, "ref": { "description": "Reference to the Suricata rule such as origin of the rule or alike.", "misp-attribute": "link", "ui-priority": 0 + }, + "suricata": { + "description": "Suricata rule.", + "misp-attribute": "snort", + "multiple": true, + "ui-priority": 0 + }, + "version": { + "description": "Version of the Suricata rule depending where the suricata rule is known to work as expected.", + "misp-attribute": "text", + "ui-priority": 0 } }, - "version": 2, "description": "An object describing one or more Suricata rule(s) along with version and contextual information.", "meta-category": "network", + "name": "suricata", + "requiredOneOf": [ + "suricata" + ], "uuid": "3c177337-fb80-405a-a6c1-1b2ddea8684a", - "name": "suricata" -} + "version": 2 +} \ No newline at end of file diff --git a/objects/target-system/definition.json b/objects/target-system/definition.json index 6ed6cc0..b46210c 100644 --- a/objects/target-system/definition.json +++ b/objects/target-system/definition.json @@ -1,39 +1,39 @@ { - "name": "target-system", - "uuid": "3110944f-eca0-4c94-9d61-a84d022228a4", - "meta-category": "internal", - "description": "Description about an targeted system, this could potentially be a compromissed internal system", - "version": 1, "attributes": { - "targeted_machine": { - "description": "Targeted system", - "ui-priority": 1, - "misp-attribute": "target-machine", - "disable_correlation": true, - "categories": [ - "Targeting data" - ] - }, "targeted_ip_of_system": { - "description": "Targeted system IP address", - "ui-priority": 1, - "misp-attribute": "ip-src", - "disable_correlation": true, "categories": [ "Network activity" - ] + ], + "description": "Targeted system IP address", + "disable_correlation": true, + "misp-attribute": "ip-src", + "ui-priority": 1 + }, + "targeted_machine": { + "categories": [ + "Targeting data" + ], + "description": "Targeted system", + "disable_correlation": true, + "misp-attribute": "target-machine", + "ui-priority": 1 }, "timestamp_seen": { - "description": "Registered date and time", - "ui-priority": 1, - "misp-attribute": "datetime", - "disable_correlation": true, "categories": [ "Other" - ] + ], + "description": "Registered date and time", + "disable_correlation": true, + "misp-attribute": "datetime", + "ui-priority": 1 } }, + "description": "Description about an targeted system, this could potentially be a compromissed internal system", + "meta-category": "internal", + "name": "target-system", "requiredOneOf": [ "targeted_machine" - ] -} + ], + "uuid": "3110944f-eca0-4c94-9d61-a84d022228a4", + "version": 1 +} \ No newline at end of file diff --git a/objects/threatgrid-report/definition.json b/objects/threatgrid-report/definition.json index e98da6b..72df099 100644 --- a/objects/threatgrid-report/definition.json +++ b/objects/threatgrid-report/definition.json @@ -1,79 +1,79 @@ { + "attributes": { + "analysis_submitted_at": { + "categories": [ + "Other" + ], + "description": "Submission date", + "misp-attribute": "text", + "ui-priority": 0 + }, + "heuristic_raw_score": { + "categories": [ + "External analysis" + ], + "description": "heuristic_raw_score", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 1 + }, + "heuristic_score": { + "categories": [ + "Other" + ], + "description": "heuristic_score", + "misp-attribute": "text", + "ui-priority": 0 + }, + "id": { + "categories": [ + "Other" + ], + "description": "ThreatGrid ID", + "misp-attribute": "text", + "ui-priority": 0 + }, + "iocs": { + "categories": [ + "Other" + ], + "description": "iocs", + "misp-attribute": "text", + "multiple": true, + "ui-priority": 0 + }, + "original_filename": { + "categories": [ + "Other" + ], + "description": "Original filename", + "misp-attribute": "text", + "ui-priority": 0 + }, + "permalink": { + "categories": [ + "Other" + ], + "description": "permalink", + "misp-attribute": "text", + "ui-priority": 0 + }, + "threat_score": { + "categories": [ + "External analysis" + ], + "description": "threat_score", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 0 + } + }, + "description": "ThreatGrid report", + "meta-category": "misc", + "name": "threatgrid-report", "required": [ "threat_score" ], - "attributes": { - "threat_score": { - "description": "threat_score", - "disable_correlation": true, - "categories": [ - "External analysis" - ], - "ui-priority": 0, - "misp-attribute": "text" - }, - "heuristic_raw_score": { - "description": "heuristic_raw_score", - "disable_correlation": true, - "categories": [ - "External analysis" - ], - "ui-priority": 1, - "misp-attribute": "text" - }, - "heuristic_score": { - "description": "heuristic_score", - "categories": [ - "Other" - ], - "ui-priority": 0, - "misp-attribute": "text" - }, - "analysis_submitted_at": { - "description": "Submission date", - "categories": [ - "Other" - ], - "ui-priority": 0, - "misp-attribute": "text" - }, - "original_filename": { - "description": "Original filename", - "categories": [ - "Other" - ], - "ui-priority": 0, - "misp-attribute": "text" - }, - "permalink": { - "description": "permalink", - "categories": [ - "Other" - ], - "ui-priority": 0, - "misp-attribute": "text" - }, - "id": { - "description": "ThreatGrid ID", - "categories": [ - "Other" - ], - "ui-priority": 0, - "misp-attribute": "text" - }, - "iocs": { - "description": "iocs", - "categories": [ - "Other" - ], - "ui-priority": 0, - "multiple": true, - "misp-attribute": "text" - } - }, - "version": 6, - "description": "ThreatGrid report", - "meta-category": "misc", "uuid": "23b3576b-2e68-4a86-a103-68820daef1d5", - "name": "threatgrid-report" -} + "version": 6 +} \ No newline at end of file diff --git a/objects/timecode/definition.json b/objects/timecode/definition.json index 8a2c6ff..3c6b5e7 100644 --- a/objects/timecode/definition.json +++ b/objects/timecode/definition.json @@ -1,4 +1,44 @@ { + "attributes": { + "description": { + "description": "Description of the video sequence", + "misp-attribute": "text", + "ui-priority": 1 + }, + "end-marker-timecode": { + "description": "End marker timecode in the format hh:mm:ss;ff", + "misp-attribute": "text", + "multiple": true, + "ui-priority": 0 + }, + "end-timecode": { + "description": "End marker timecode in the format hh:mm:ss.mms", + "misp-attribute": "text", + "multiple": true, + "ui-priority": 0 + }, + "recording-date": { + "description": "Date of recording of the video sequence", + "misp-attribute": "datetime", + "multiple": true, + "ui-priority": 0 + }, + "start-marker-timecode": { + "description": "Start marker timecode in the format hh:mm:ss;ff", + "misp-attribute": "text", + "multiple": true, + "ui-priority": 0 + }, + "start-timecode": { + "description": "Start marker timecode in the format hh:mm:ss.mms", + "misp-attribute": "text", + "multiple": true, + "ui-priority": 0 + } + }, + "description": "Timecode object to describe a start of video sequence (e.g. CCTV evidence) and the end of the video sequence.", + "meta-category": "misc", + "name": "timecode", "requiredOneOf": [ "description", "start-marker-timecode", @@ -7,46 +47,6 @@ "end-timecode", "recording-date" ], - "attributes": { - "description": { - "description": "Description of the video sequence", - "ui-priority": 1, - "misp-attribute": "text" - }, - "start-marker-timecode": { - "description": "Start marker timecode in the format hh:mm:ss;ff", - "ui-priority": 0, - "misp-attribute": "text", - "multiple": true - }, - "end-marker-timecode": { - "description": "End marker timecode in the format hh:mm:ss;ff", - "ui-priority": 0, - "misp-attribute": "text", - "multiple": true - }, - "start-timecode": { - "description": "Start marker timecode in the format hh:mm:ss.mms", - "ui-priority": 0, - "misp-attribute": "text", - "multiple": true - }, - "end-timecode": { - "description": "End marker timecode in the format hh:mm:ss.mms", - "ui-priority": 0, - "misp-attribute": "text", - "multiple": true - }, - "recording-date": { - "description": "Date of recording of the video sequence", - "ui-priority": 0, - "misp-attribute": "datetime", - "multiple": true - } - }, - "version": 1, - "description": "Timecode object to describe a start of video sequence (e.g. CCTV evidence) and the end of the video sequence.", - "meta-category": "misc", "uuid": "60141eac-71d2-4173-930d-91dba8106c40", - "name": "timecode" -} + "version": 1 +} \ No newline at end of file diff --git a/objects/timesketch-timeline/definition.json b/objects/timesketch-timeline/definition.json index 02d76bd..16348f5 100644 --- a/objects/timesketch-timeline/definition.json +++ b/objects/timesketch-timeline/definition.json @@ -1,33 +1,33 @@ { + "attributes": { + "datetime": { + "description": "When the log entry was seen", + "misp-attribute": "datetime", + "ui-priority": 0 + }, + "message": { + "description": "Informative message of the event", + "misp-attribute": "text", + "ui-priority": 0 + }, + "timestamp": { + "description": "When the log entry was seen in microseconds since Unix epoch", + "misp-attribute": "text", + "ui-priority": 0 + }, + "timestamp_desc": { + "description": "Text explaining what type of timestamp is it", + "misp-attribute": "text", + "ui-priority": 0 + } + }, + "description": "A timesketch timeline object based on mandatory field in timesketch to describe a log entry.", + "meta-category": "misc", + "name": "timesketch-timeline", "requiredOneOf": [ "message", "datetime" ], - "attributes": { - "message": { - "description": "Informative message of the event", - "ui-priority": 0, - "misp-attribute": "text" - }, - "timestamp": { - "description": "When the log entry was seen in microseconds since Unix epoch", - "ui-priority": 0, - "misp-attribute": "text" - }, - "timestamp_desc": { - "description": "Text explaining what type of timestamp is it", - "ui-priority": 0, - "misp-attribute": "text" - }, - "datetime": { - "description": "When the log entry was seen", - "ui-priority": 0, - "misp-attribute": "datetime" - } - }, - "version": 3, - "description": "A timesketch timeline object based on mandatory field in timesketch to describe a log entry.", - "meta-category": "misc", "uuid": "06db0221-cbc0-4ffc-ad98-7f34549310f1", - "name": "timesketch-timeline" -} + "version": 3 +} \ No newline at end of file diff --git a/objects/timesketch_message/definition.json b/objects/timesketch_message/definition.json index 9185646..384faf8 100644 --- a/objects/timesketch_message/definition.json +++ b/objects/timesketch_message/definition.json @@ -1,26 +1,26 @@ { - "required": [ - "datetime", - "message" - ], "attributes": { "datetime": { "description": "datetime of the message", "disable_correlation": true, - "ui-priority": 1, "misp-attribute": "datetime", - "recommended": true + "recommended": true, + "ui-priority": 1 }, "message": { "description": "message", "disable_correlation": true, - "ui-priority": 0, - "misp-attribute": "text" + "misp-attribute": "text", + "ui-priority": 0 } }, - "version": 1, "description": "A timesketch message entry.", "meta-category": "misc", + "name": "timesketch_message", + "required": [ + "datetime", + "message" + ], "uuid": "ef27fb19-7e71-43e0-b6f6-6f03ab67666f", - "name": "timesketch_message" -} + "version": 1 +} \ No newline at end of file diff --git a/objects/timestamp/definition.json b/objects/timestamp/definition.json index c1a8da0..3cad3c5 100644 --- a/objects/timestamp/definition.json +++ b/objects/timestamp/definition.json @@ -1,18 +1,20 @@ { - "requiredOneOf": [ - "first-seen", - "last-seen" - ], "attributes": { - "text": { - "description": "Description of the time object.", - "ui-priority": 0, - "misp-attribute": "text", - "disable_correlation": true + "first-seen": { + "description": "First time that the linked object or attribute has been seen.", + "disable_correlation": true, + "misp-attribute": "datetime", + "ui-priority": 0 + }, + "last-seen": { + "description": "First time that the linked object or attribute has been seen.", + "disable_correlation": true, + "misp-attribute": "datetime", + "ui-priority": 0 }, "precision": { "description": "Timestamp precision represents the precision given to first_seen and/or last_seen in this object.", - "ui-priority": 0, + "disable_correlation": true, "misp-attribute": "text", "sane_default": [ "year", @@ -22,24 +24,22 @@ "minute", "full" ], - "disable_correlation": true + "ui-priority": 0 }, - "first-seen": { - "description": "First time that the linked object or attribute has been seen.", - "ui-priority": 0, - "misp-attribute": "datetime", - "disable_correlation": true - }, - "last-seen": { - "description": "First time that the linked object or attribute has been seen.", - "ui-priority": 0, - "misp-attribute": "datetime", - "disable_correlation": true + "text": { + "description": "Description of the time object.", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 0 } }, - "version": 1, "description": "A generic timestamp object to represent time including first time and last time seen. Relationship will then define the kind of time relationship.", "meta-category": "misc", + "name": "timestamp", + "requiredOneOf": [ + "first-seen", + "last-seen" + ], "uuid": "c8c91e23-4221-4533-8bf7-64e12b05f265", - "name": "timestamp" -} + "version": 1 +} \ No newline at end of file diff --git a/objects/tor-hiddenservice/definition.json b/objects/tor-hiddenservice/definition.json index 0ff9fa5..361c05b 100644 --- a/objects/tor-hiddenservice/definition.json +++ b/objects/tor-hiddenservice/definition.json @@ -1,41 +1,41 @@ { + "attributes": { + "address": { + "description": "onion address of the Tor node seen.", + "misp-attribute": "text", + "ui-priority": 1 + }, + "description": { + "description": "Tor onion service comment.", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 1 + }, + "first-seen": { + "description": "When the Tor hidden service was been seen for the first time.", + "disable_correlation": true, + "misp-attribute": "datetime", + "ui-priority": 0 + }, + "last-seen": { + "description": "When the Tor hidden service was seen for the last time.", + "disable_correlation": true, + "misp-attribute": "datetime", + "ui-priority": 0 + } + }, + "description": "Tor hidden service (onion service) object.", + "meta-category": "misc", + "name": "tor-hiddenservice", + "required": [ + "address" + ], "requiredOneOf": [ "address", "first-seen", "last-seen", "description" ], - "required": [ - "address" - ], - "attributes": { - "description": { - "description": "Tor onion service comment.", - "disable_correlation": true, - "ui-priority": 1, - "misp-attribute": "text" - }, - "address": { - "description": "onion address of the Tor node seen.", - "ui-priority": 1, - "misp-attribute": "text" - }, - "last-seen": { - "description": "When the Tor hidden service was seen for the last time.", - "disable_correlation": true, - "ui-priority": 0, - "misp-attribute": "datetime" - }, - "first-seen": { - "description": "When the Tor hidden service was been seen for the first time.", - "disable_correlation": true, - "ui-priority": 0, - "misp-attribute": "datetime" - } - }, - "version": 1, - "description": "Tor hidden service (onion service) object.", - "meta-category": "misc", "uuid": "cbac07d6-fbe9-43b8-8d91-d515812ce330", - "name": "tor-hiddenservice" -} + "version": 1 +} \ No newline at end of file diff --git a/objects/tor-node/definition.json b/objects/tor-node/definition.json index c5d218b..e8cb927 100644 --- a/objects/tor-node/definition.json +++ b/objects/tor-node/definition.json @@ -1,4 +1,80 @@ { + "attributes": { + "address": { + "description": "IP address of the Tor node seen.", + "misp-attribute": "ip-src", + "ui-priority": 1 + }, + "description": { + "description": "Tor node description.", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 1 + }, + "document": { + "description": "Raw document from the consensus.", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 0 + }, + "fingerprint": { + "description": "router's fingerprint.", + "disable_correlation": false, + "misp-attribute": "text", + "ui-priority": 0 + }, + "first-seen": { + "description": "When the Tor node designed by the IP address has been seen for the first time.", + "disable_correlation": true, + "misp-attribute": "datetime", + "ui-priority": 0 + }, + "flags": { + "description": "list of flag associated with the node.", + "misp-attribute": "text", + "ui-priority": 0 + }, + "last-seen": { + "description": "When the Tor node designed by the IP address has been seen for the last time.", + "disable_correlation": true, + "misp-attribute": "datetime", + "ui-priority": 0 + }, + "nickname": { + "description": "router's nickname.", + "disable_correlation": false, + "misp-attribute": "text", + "ui-priority": 0 + }, + "published": { + "description": "router's publication time. This can be different from first-seen and last-seen.", + "disable_correlation": true, + "misp-attribute": "datetime", + "ui-priority": 0 + }, + "text": { + "description": "Tor node comment.", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 1 + }, + "version": { + "description": "parsed version of tor, this is None if the relay's using a new versioning scheme.", + "misp-attribute": "text", + "ui-priority": 0 + }, + "version_line": { + "description": "versioning information reported by the node.", + "misp-attribute": "text", + "ui-priority": 0 + } + }, + "description": "Tor node (which protects your privacy on the internet by hiding the connection between users Internet address and the services used by the users) description which are part of the Tor network at a time.", + "meta-category": "misc", + "name": "tor-node", + "required": [ + "address" + ], "requiredOneOf": [ "address", "first-seen", @@ -6,82 +82,6 @@ "description", "text" ], - "required": [ - "address" - ], - "attributes": { - "description": { - "description": "Tor node description.", - "disable_correlation": true, - "ui-priority": 1, - "misp-attribute": "text" - }, - "nickname": { - "description": "router's nickname.", - "disable_correlation": false, - "ui-priority": 0, - "misp-attribute": "text" - }, - "fingerprint": { - "description": "router's fingerprint.", - "disable_correlation": false, - "ui-priority": 0, - "misp-attribute": "text" - }, - "text": { - "description": "Tor node comment.", - "disable_correlation": true, - "ui-priority": 1, - "misp-attribute": "text" - }, - "address": { - "description": "IP address of the Tor node seen.", - "ui-priority": 1, - "misp-attribute": "ip-src" - }, - "flags": { - "description": "list of flag associated with the node.", - "ui-priority": 0, - "misp-attribute": "text" - }, - "version": { - "description": "parsed version of tor, this is None if the relay's using a new versioning scheme.", - "ui-priority": 0, - "misp-attribute": "text" - }, - "version_line": { - "description": "versioning information reported by the node.", - "ui-priority": 0, - "misp-attribute": "text" - }, - "published": { - "description": "router's publication time. This can be different from first-seen and last-seen.", - "disable_correlation": true, - "ui-priority": 0, - "misp-attribute": "datetime" - }, - "last-seen": { - "description": "When the Tor node designed by the IP address has been seen for the last time.", - "disable_correlation": true, - "ui-priority": 0, - "misp-attribute": "datetime" - }, - "first-seen": { - "description": "When the Tor node designed by the IP address has been seen for the first time.", - "disable_correlation": true, - "ui-priority": 0, - "misp-attribute": "datetime" - }, - "document": { - "description": "Raw document from the consensus.", - "disable_correlation": true, - "ui-priority": 0, - "misp-attribute": "text" - } - }, - "version": 2, - "description": "Tor node (which protects your privacy on the internet by hiding the connection between users Internet address and the services used by the users) description which are part of the Tor network at a time.", - "meta-category": "misc", "uuid": "a5fde1c8-318e-4658-a3ea-85ea000bdd33", - "name": "tor-node" -} + "version": 2 +} \ No newline at end of file diff --git a/objects/tracking-id/definition.json b/objects/tracking-id/definition.json index 79c374a..0e7cb0e 100644 --- a/objects/tracking-id/definition.json +++ b/objects/tracking-id/definition.json @@ -1,16 +1,35 @@ { - "requiredOneOf": [ - "id" - ], "attributes": { + "description": { + "description": "Description of the tracking id", + "misp-attribute": "text", + "ui-priority": 1 + }, + "first-seen": { + "description": "First time the tracking code was seen", + "disable_correlation": true, + "misp-attribute": "datetime", + "ui-priority": 0 + }, + "hostname": { + "description": "hostname where the tracking id was found", + "misp-attribute": "hostname", + "multiple": true, + "ui-priority": 0 + }, "id": { "description": "Tracking code", - "ui-priority": 1, - "misp-attribute": "text" + "misp-attribute": "text", + "ui-priority": 1 + }, + "last-seen": { + "description": "Last time the tracking code was seen", + "disable_correlation": true, + "misp-attribute": "datetime", + "ui-priority": 0 }, "tracker": { "description": "Name of the tracker - organisation doing the tracking and/or analytics", - "ui-priority": 1, "misp-attribute": "text", "sane_default": [ "Google Analytics", @@ -18,41 +37,22 @@ "Kissmetrics", "Woopra", "Chartbeat" - ] - }, - "description": { - "description": "Description of the tracking id", - "ui-priority": 1, - "misp-attribute": "text" + ], + "ui-priority": 1 }, "url": { "description": "URL where the tracking id was found", - "ui-priority": 1, + "misp-attribute": "url", "multiple": true, - "misp-attribute": "url" - }, - "hostname": { - "description": "hostname where the tracking id was found", - "ui-priority": 0, - "misp-attribute": "hostname", - "multiple": true - }, - "first-seen": { - "description": "First time the tracking code was seen", - "disable_correlation": true, - "ui-priority": 0, - "misp-attribute": "datetime" - }, - "last-seen": { - "description": "Last time the tracking code was seen", - "disable_correlation": true, - "ui-priority": 0, - "misp-attribute": "datetime" + "ui-priority": 1 } }, - "version": 2, "description": "Analytics and tracking ID such as used in Google Analytics or other analytic platform.", "meta-category": "network", + "name": "tracking-id", + "requiredOneOf": [ + "id" + ], "uuid": "3681c62a-2c75-48d8-99f2-6a3444ce2393", - "name": "tracking-id" -} + "version": 2 +} \ No newline at end of file diff --git a/objects/transaction/definition.json b/objects/transaction/definition.json index 5dc404e..54a6e6a 100644 --- a/objects/transaction/definition.json +++ b/objects/transaction/definition.json @@ -1,116 +1,116 @@ { + "attributes": { + "amount": { + "description": "The value of the transaction in local currency.", + "misp-attribute": "text", + "ui-priority": 0 + }, + "authorized": { + "description": "Person who autorized the transaction.", + "misp-attribute": "text", + "ui-priority": 0 + }, + "date": { + "description": "Date and time of the transaction.", + "misp-attribute": "datetime", + "ui-priority": 0 + }, + "date-posting": { + "description": "Date of posting, if different from date of transaction.", + "misp-attribute": "datetime", + "ui-priority": 0 + }, + "from-country": { + "description": "Origin country of a transaction.", + "misp-attribute": "text", + "ui-priority": 0 + }, + "from-funds-code": { + "description": "Type of funds used to initiate a transaction.", + "disable_correlation": true, + "misp-attribute": "text", + "sane_default": [ + "A Deposit", + "C Currency exchange", + "D Casino chips", + "E Bank draft", + "F Money order", + "G Traveler’s cheques", + "H Life insurance policy", + "I Real estate", + "J Securities", + "K Cash", + "O Other", + "P Cheque" + ], + "ui-priority": 0 + }, + "location": { + "description": "Location where the transaction took place.", + "misp-attribute": "text", + "ui-priority": 0 + }, + "teller": { + "description": "Person who conducted the transaction.", + "misp-attribute": "text", + "ui-priority": 0 + }, + "text": { + "description": "A description of the transaction.", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 1 + }, + "to-country": { + "description": "Target country of a transaction.", + "misp-attribute": "text", + "ui-priority": 0 + }, + "to-funds-code": { + "description": "Type of funds used to finalize a transaction.", + "disable_correlation": true, + "misp-attribute": "text", + "sane_default": [ + "A Deposit", + "C Currency exchange", + "D Casino chips", + "E Bank draft", + "F Money order", + "G Traveler’s cheques", + "H Life insurance policy", + "I Real estate", + "J Securities", + "K Cash", + "O Other", + "P Cheque" + ], + "ui-priority": 0 + }, + "transaction-number": { + "description": "A unique number identifying a transaction.", + "misp-attribute": "text", + "ui-priority": 0 + }, + "transmode-code": { + "description": "How the transaction was conducted.", + "misp-attribute": "text", + "ui-priority": 0 + }, + "transmode-comment": { + "description": "Comment describing transmode-code, if needed.", + "misp-attribute": "text", + "ui-priority": 0 + } + }, + "description": "An object to describe a financial transaction.", + "meta-category": "financial", + "name": "transaction", "requiredOneOf": [ "transaction-number", "date", "amount", "transmode-code" ], - "attributes": { - "text": { - "description": "A description of the transaction.", - "disable_correlation": true, - "ui-priority": 1, - "misp-attribute": "text" - }, - "transaction-number": { - "description": "A unique number identifying a transaction.", - "ui-priority": 0, - "misp-attribute": "text" - }, - "location": { - "description": "Location where the transaction took place.", - "ui-priority": 0, - "misp-attribute": "text" - }, - "transmode-code": { - "description": "How the transaction was conducted.", - "ui-priority": 0, - "misp-attribute": "text" - }, - "transmode-comment": { - "description": "Comment describing transmode-code, if needed.", - "ui-priority": 0, - "misp-attribute": "text" - }, - "teller": { - "description": "Person who conducted the transaction.", - "ui-priority": 0, - "misp-attribute": "text" - }, - "authorized": { - "description": "Person who autorized the transaction.", - "ui-priority": 0, - "misp-attribute": "text" - }, - "date": { - "description": "Date and time of the transaction.", - "ui-priority": 0, - "misp-attribute": "datetime" - }, - "amount": { - "description": "The value of the transaction in local currency.", - "ui-priority": 0, - "misp-attribute": "text" - }, - "date-posting": { - "description": "Date of posting, if different from date of transaction.", - "ui-priority": 0, - "misp-attribute": "datetime" - }, - "from-funds-code": { - "description": "Type of funds used to initiate a transaction.", - "ui-priority": 0, - "misp-attribute": "text", - "disable_correlation": true, - "sane_default": [ - "A Deposit", - "C Currency exchange", - "D Casino chips", - "E Bank draft", - "F Money order", - "G Traveler’s cheques", - "H Life insurance policy", - "I Real estate", - "J Securities", - "K Cash", - "O Other", - "P Cheque" - ] - }, - "to-funds-code": { - "description": "Type of funds used to finalize a transaction.", - "ui-priority": 0, - "misp-attribute": "text", - "disable_correlation": true, - "sane_default": [ - "A Deposit", - "C Currency exchange", - "D Casino chips", - "E Bank draft", - "F Money order", - "G Traveler’s cheques", - "H Life insurance policy", - "I Real estate", - "J Securities", - "K Cash", - "O Other", - "P Cheque" - ] - }, - "from-country": { - "description": "Origin country of a transaction.", - "ui-priority": 0, - "misp-attribute": "text" - }, - "to-country": { - "description": "Target country of a transaction.", - "ui-priority": 0, - "misp-attribute": "text" - } - }, - "version": 1, - "description": "An object to describe a financial transaction.", - "meta-category": "financial", "uuid": "a47fa26a-01b6-4747-a394-5144e34456dc", - "name": "transaction" -} + "version": 1 +} \ No newline at end of file diff --git a/objects/translation/definition.json b/objects/translation/definition.json index 3733c09..5003746 100644 --- a/objects/translation/definition.json +++ b/objects/translation/definition.json @@ -1,122 +1,114 @@ { - "requiredOneOf": [ - "original-text", - "translated-text", - "original-language", - "translation-language", - "translation-type" - ], "attributes": { + "original-language": { + "description": "Language of the original text", + "misp-attribute": "text", + "sane_default": [ + "Mandarin (language family)", + "Spanish", + "English", + "Hindi", + "Bengali", + "Portuguese", + "Russian", + "Japanese", + "Western Punjabi", + "Marathi", + "Telugu", + "Wu (language family)", + "Turkish", + "Korean", + "French", + "German", + "Vietnamese", + "Tamil", + "Yue (language family)", + "Urdu", + "Javanese", + "Italian", + "Egyptian Arabic", + "Gujarati", + "Iranian Persian", + "Bhojpuri", + "Min Nan (language family)", + "Hakka", + "Jinyu", + "Hausa", + "Kannada", + "Indonesian (Indonesian Malay)", + "Polish", + "Yoruba", + "Xiang Chinese (language family)", + "Malayalam", + "Odia", + "Maithili", + "Burmese", + "Eastern Punjabi", + "Sunda", + "Sudanese Arabic", + "Algerian Arabic", + "Moroccan Arabic", + "Ukrainian", + "Igbo", + "Northern Uzbek", + "Sindhi", + "North Levantine Arabic", + "Romanian", + "Tagalog", + "Dutch", + "Saʽidi Arabic", + "Gan", + "Amharic", + "Northern Pashto", + "Magahi", + "Thai", + "Saraiki", + "Khmer", + "Chhattisgarhi", + "Somali", + "Malay (Malaysian Malay)", + "Cebuano", + "Nepali", + "Mesopotamian Arabic", + "Assamese", + "Sinhala", + "Northern Kurdish", + "Hejazi Arabic", + "Nigerian Fulfulde", + "South Azerbaijani", + "Greek", + "Chittagonian", + "Kazakh", + "Deccan", + "Hungarian", + "Kinyarwanda", + "Zulu", + "South Levantine Arabic", + "Tunisian Arabic", + "Sanaani Spoken Arabic", + "Min Bei Chinese (language family)", + "Southern Pashto", + "Rundi", + "Czech", + "Taʽizzi-Adeni Arabic", + "Uyghur", + "Min Dong Chinese (language family)", + "Sylheti " + ], + "ui-priority": 1 + }, "original-text": { "description": "Original text", - "ui-priority": 1, - "misp-attribute": "text" + "misp-attribute": "text", + "ui-priority": 1 }, "translated-text": { "description": "Text after translation", - "ui-priority": 1, - "misp-attribute": "text" - }, - "original-language": { - "description": "Language of the original text", - "ui-priority": 1, "misp-attribute": "text", - "sane_default": [ - "Mandarin (language family)", - "Spanish", - "English", - "Hindi", - "Bengali", - "Portuguese", - "Russian", - "Japanese", - "Western Punjabi", - "Marathi", - "Telugu", - "Wu (language family)", - "Turkish", - "Korean", - "French", - "German", - "Vietnamese", - "Tamil", - "Yue (language family)", - "Urdu", - "Javanese", - "Italian", - "Egyptian Arabic", - "Gujarati", - "Iranian Persian", - "Bhojpuri", - "Min Nan (language family)", - "Hakka", - "Jinyu", - "Hausa", - "Kannada", - "Indonesian (Indonesian Malay)", - "Polish", - "Yoruba", - "Xiang Chinese (language family)", - "Malayalam", - "Odia", - "Maithili", - "Burmese", - "Eastern Punjabi", - "Sunda", - "Sudanese Arabic", - "Algerian Arabic", - "Moroccan Arabic", - "Ukrainian", - "Igbo", - "Northern Uzbek", - "Sindhi", - "North Levantine Arabic", - "Romanian", - "Tagalog", - "Dutch", - "Saʽidi Arabic", - "Gan", - "Amharic", - "Northern Pashto", - "Magahi", - "Thai", - "Saraiki", - "Khmer", - "Chhattisgarhi", - "Somali", - "Malay (Malaysian Malay)", - "Cebuano", - "Nepali", - "Mesopotamian Arabic", - "Assamese", - "Sinhala", - "Northern Kurdish", - "Hejazi Arabic", - "Nigerian Fulfulde", - "South Azerbaijani", - "Greek", - "Chittagonian", - "Kazakh", - "Deccan", - "Hungarian", - "Kinyarwanda", - "Zulu", - "South Levantine Arabic", - "Tunisian Arabic", - "Sanaani Spoken Arabic", - "Min Bei Chinese (language family)", - "Southern Pashto", - "Rundi", - "Czech", - "Taʽizzi-Adeni Arabic", - "Uyghur", - "Min Dong Chinese (language family)", - "Sylheti " - ] + "ui-priority": 1 }, "translation-language": { "description": "Language of translation", - "ui-priority": 1, "misp-attribute": "text", "sane_default": [ "Mandarin (language family)", @@ -209,11 +201,11 @@ "Uyghur", "Min Dong Chinese (language family)", "Sylheti " - ] + ], + "ui-priority": 1 }, "translation-service": { "description": "translation service used for the translation", - "ui-priority": 1, "misp-attribute": "text", "sane_default": [ "Google Translate", @@ -223,21 +215,29 @@ "Dict.cc", "Linguee", "unknown" - ] + ], + "ui-priority": 1 }, "translation-type": { "description": "type of translation", - "ui-priority": 1, "misp-attribute": "text", "sane_default": [ "Automated translation", "Manual translation" - ] + ], + "ui-priority": 1 } }, - "version": 1, "description": "Used to keep a text and its translation", "meta-category": "misc", + "name": "translation", + "requiredOneOf": [ + "original-text", + "translated-text", + "original-language", + "translation-language", + "translation-type" + ], "uuid": "a43b54fa-dac9-11e9-9b0d-97296aceae1a", - "name": "translation" -} + "version": 1 +} \ No newline at end of file diff --git a/objects/trustar_report/definition.json b/objects/trustar_report/definition.json index a8dd5bb..6a529c0 100644 --- a/objects/trustar_report/definition.json +++ b/objects/trustar_report/definition.json @@ -78,4 +78,4 @@ "name": "trustar_report", "uuid": "8ff46cf1-db04-4453-ba46-d004e1ef6b7a", "version": 1 -} +} \ No newline at end of file diff --git a/objects/tsk-chats/definition.json b/objects/tsk-chats/definition.json index 05b18a2..40d16c3 100644 --- a/objects/tsk-chats/definition.json +++ b/objects/tsk-chats/definition.json @@ -1,12 +1,62 @@ { - "required": [ - "message-type", - "message" - ], "attributes": { + "Source": { + "description": "Source of the message.(Contact details)", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 0 + }, + "additional-comments": { + "categories": [ + "External analysis" + ], + "description": "Comments.", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 0 + }, + "app-used": { + "description": "Application used to send the message.", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 0 + }, + "attachments": { + "categories": [ + "External analysis" + ], + "description": "External references", + "misp-attribute": "link", + "multiple": true, + "ui-priority": 0 + }, + "datetime-received": { + "description": "date and time when the message was received.", + "disable_correlation": true, + "misp-attribute": "datetime", + "multiple": true, + "ui-priority": 0 + }, + "datetime-sent": { + "description": "date and the time when the message was sent.", + "disable_correlation": true, + "misp-attribute": "datetime", + "ui-priority": 0 + }, + "destination": { + "description": "Destination of the message.(Contact details)", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 0 + }, + "message": { + "description": "Message exchanged.", + "misp-attribute": "text", + "ui-priority": 0 + }, "message-type": { "description": "the type of message extracted from the forensic-evidence.", - "ui-priority": 0, + "disable_correlation": true, "misp-attribute": "text", "sane_default": [ "SMS", @@ -14,71 +64,21 @@ "Instant Message (IM)", "Voice Message" ], - "disable_correlation": true - }, - "datetime-sent": { - "description": "date and the time when the message was sent.", - "ui-priority": 0, - "misp-attribute": "datetime", - "disable_correlation": true - }, - "datetime-received": { - "description": "date and time when the message was received.", - "multiple": true, - "ui-priority": 0, - "misp-attribute": "datetime", - "disable_correlation": true - }, - "Source": { - "description": "Source of the message.(Contact details)", - "ui-priority": 0, - "misp-attribute": "text", - "disable_correlation": true - }, - "destination": { - "description": "Destination of the message.(Contact details)", - "ui-priority": 0, - "misp-attribute": "text", - "disable_correlation": true - }, - "app-used": { - "description": "Application used to send the message.", - "ui-priority": 0, - "misp-attribute": "text", - "disable_correlation": true + "ui-priority": 0 }, "subject": { "description": "Subject of the message if any.", - "ui-priority": 0, - "misp-attribute": "text" - }, - "message": { - "description": "Message exchanged.", - "ui-priority": 0, - "misp-attribute": "text" - }, - "attachments": { - "description": "External references", - "multiple": true, - "ui-priority": 0, - "categories": [ - "External analysis" - ], - "misp-attribute": "link" - }, - "additional-comments": { - "description": "Comments.", - "ui-priority": 0, "misp-attribute": "text", - "categories": [ - "External analysis" - ], - "disable_correlation": true + "ui-priority": 0 } }, - "version": 1, "description": "An Object Template to gather information from evidential or interesting exchange of messages identified during a digital forensic investigation.", "meta-category": "misc", + "name": "tsk-chats", + "required": [ + "message-type", + "message" + ], "uuid": "6b71f231-c502-467f-bc67-1423cd5bf800", - "name": "tsk-chats" -} + "version": 1 +} \ No newline at end of file diff --git a/objects/tsk-web-bookmark/definition.json b/objects/tsk-web-bookmark/definition.json index 28fca9e..df81e42 100644 --- a/objects/tsk-web-bookmark/definition.json +++ b/objects/tsk-web-bookmark/definition.json @@ -1,33 +1,22 @@ { - "required": [ - "URL" - ], "attributes": { "URL": { "description": "The URL saved as bookmark.", - "ui-priority": 0, - "misp-attribute": "link" + "misp-attribute": "link", + "ui-priority": 0 }, - "datetime-bookmarked": { - "description": "date and time when the URL was added to favorites.", - "ui-priority": 0, - "misp-attribute": "datetime", - "disable_correlation": true - }, - "name": { - "description": "Book mark name. ", - "ui-priority": 0, + "additional-comments": { + "categories": [ + "External analysis" + ], + "description": "Comments.", + "disable_correlation": true, "misp-attribute": "text", - "disable_correlation": true - }, - "title": { - "description": "Title of the web page", - "ui-priority": 0, - "misp-attribute": "text" + "ui-priority": 0 }, "browser": { "description": "Browser used to access the URL.", - "ui-priority": 0, + "disable_correlation": true, "misp-attribute": "text", "sane_default": [ "IE", @@ -37,31 +26,42 @@ "Opera mini", "Chromium" ], - "disable_correlation": true + "ui-priority": 0 }, - "domain-name": { - "description": "Domain of the URL.", - "ui-priority": 0, - "misp-attribute": "text" + "datetime-bookmarked": { + "description": "date and time when the URL was added to favorites.", + "disable_correlation": true, + "misp-attribute": "datetime", + "ui-priority": 0 }, "domain-ip": { "description": "IP of the URL domain.", - "ui-priority": 0, - "misp-attribute": "ip-src" + "misp-attribute": "ip-src", + "ui-priority": 0 }, - "additional-comments": { - "description": "Comments.", - "ui-priority": 0, + "domain-name": { + "description": "Domain of the URL.", "misp-attribute": "text", - "categories": [ - "External analysis" - ], - "disable_correlation": true + "ui-priority": 0 + }, + "name": { + "description": "Book mark name. ", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 0 + }, + "title": { + "description": "Title of the web page", + "misp-attribute": "text", + "ui-priority": 0 } }, - "version": 1, "description": "An Object Template to add evidential bookmarks identified during a digital forensic investigation.", "meta-category": "misc", + "name": "tsk-web-bookmark", + "required": [ + "URL" + ], "uuid": "7d9a88a8-9934-4caa-a85b-f76bc97d5373", - "name": "tsk-web-bookmark" -} + "version": 1 +} \ No newline at end of file diff --git a/objects/tsk-web-cookie/definition.json b/objects/tsk-web-cookie/definition.json index 03e841e..81a7833 100644 --- a/objects/tsk-web-cookie/definition.json +++ b/objects/tsk-web-cookie/definition.json @@ -1,34 +1,22 @@ { - "required": [ - "URL", - "name", - "value" - ], "attributes": { "URL": { "description": "The website URL that created the cookie.", - "ui-priority": 0, - "misp-attribute": "link" + "misp-attribute": "link", + "ui-priority": 0 }, - "datetime-created": { - "description": "date and time when the cookie was created.", - "ui-priority": 0, - "misp-attribute": "datetime", - "disable_correlation": true - }, - "name": { - "description": "Name of the cookie ", - "ui-priority": 0, - "misp-attribute": "text" - }, - "value": { - "description": "Value assigned to the cookie.", - "ui-priority": 0, - "misp-attribute": "text" + "additional-comments": { + "categories": [ + "External analysis" + ], + "description": "Comments.", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 0 }, "browser": { "description": "Browser on which the cookie was created.", - "ui-priority": 0, + "misp-attribute": "text", "sane_default": [ "IE", "Safari", @@ -37,31 +25,43 @@ "Opera mini", "Chromium" ], - "misp-attribute": "text" + "ui-priority": 0 }, - "domain-name": { - "description": "Domain of the URL that created the cookie.", - "ui-priority": 0, - "misp-attribute": "text" + "datetime-created": { + "description": "date and time when the cookie was created.", + "disable_correlation": true, + "misp-attribute": "datetime", + "ui-priority": 0 }, "domain-ip": { "description": "IP of the domain that created the URL.", - "ui-priority": 0, - "misp-attribute": "ip-src" + "misp-attribute": "ip-src", + "ui-priority": 0 }, - "additional-comments": { - "description": "Comments.", - "ui-priority": 0, + "domain-name": { + "description": "Domain of the URL that created the cookie.", "misp-attribute": "text", - "categories": [ - "External analysis" - ], - "disable_correlation": true + "ui-priority": 0 + }, + "name": { + "description": "Name of the cookie ", + "misp-attribute": "text", + "ui-priority": 0 + }, + "value": { + "description": "Value assigned to the cookie.", + "misp-attribute": "text", + "ui-priority": 0 } }, - "version": 1, "description": "An TSK-Autopsy Object Template to represent cookies identified during a forensic investigation.", "meta-category": "misc", + "name": "tsk-web-cookie", + "required": [ + "URL", + "name", + "value" + ], "uuid": "40d23a4f-43be-4c9e-8328-382a2188eb1d", - "name": "tsk-web-cookie" -} + "version": 1 +} \ No newline at end of file diff --git a/objects/tsk-web-downloads/definition.json b/objects/tsk-web-downloads/definition.json index ba60ce2..ea56feb 100644 --- a/objects/tsk-web-downloads/definition.json +++ b/objects/tsk-web-downloads/definition.json @@ -1,55 +1,55 @@ { + "attributes": { + "additional-comments": { + "categories": [ + "External analysis" + ], + "description": "Comments.", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 0 + }, + "attachment": { + "description": "The downloaded file itself.", + "disable_correlation": true, + "misp-attribute": "attachment", + "ui-priority": 1 + }, + "datetime-accessed": { + "description": "date and time when the file was downloaded.", + "disable_correlation": true, + "misp-attribute": "datetime", + "ui-priority": 0 + }, + "name": { + "description": "Name of the file downloaded.", + "misp-attribute": "text", + "ui-priority": 0 + }, + "path-downloadedTo": { + "description": "Location the file was downloaded to.", + "misp-attribute": "text", + "ui-priority": 0 + }, + "pathID": { + "description": "Id of the attribute file where the information is gathered from.", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 0 + }, + "url": { + "description": "The URL used to download the file.", + "misp-attribute": "url", + "ui-priority": 0 + } + }, + "description": "An Object Template to add web-downloads", + "meta-category": "file", + "name": "tsk-web-downloads", "required": [ "url", "name" ], - "attributes": { - "url": { - "description": "The URL used to download the file.", - "ui-priority": 0, - "misp-attribute": "url" - }, - "datetime-accessed": { - "description": "date and time when the file was downloaded.", - "ui-priority": 0, - "misp-attribute": "datetime", - "disable_correlation": true - }, - "name": { - "description": "Name of the file downloaded.", - "ui-priority": 0, - "misp-attribute": "text" - }, - "path-downloadedTo": { - "description": "Location the file was downloaded to.", - "ui-priority": 0, - "misp-attribute": "text" - }, - "pathID": { - "description": "Id of the attribute file where the information is gathered from.", - "ui-priority": 0, - "misp-attribute": "text", - "disable_correlation": true - }, - "attachment": { - "description": "The downloaded file itself.", - "ui-priority": 1, - "misp-attribute": "attachment", - "disable_correlation": true - }, - "additional-comments": { - "description": "Comments.", - "ui-priority": 0, - "misp-attribute": "text", - "categories": [ - "External analysis" - ], - "disable_correlation": true - } - }, - "version": 1, - "description": "An Object Template to add web-downloads", - "meta-category": "file", "uuid": "ab9603a1-9dcc-48e8-a51c-b8bccc7bcc26", - "name": "tsk-web-downloads" -} + "version": 1 +} \ No newline at end of file diff --git a/objects/tsk-web-history/definition.json b/objects/tsk-web-history/definition.json index b38fd8d..6dde384 100644 --- a/objects/tsk-web-history/definition.json +++ b/objects/tsk-web-history/definition.json @@ -1,44 +1,22 @@ { - "required": [ - "URL", - "datetime-accessed" - ], "attributes": { "URL": { "description": "The URL accessed.", - "ui-priority": 0, - "misp-attribute": "link" + "misp-attribute": "link", + "ui-priority": 0 }, - "datetime-accessed": { - "description": "date and the time when the URL was accessed.", - "ui-priority": 0, - "misp-attribute": "datetime", - "disable_correlation": true - }, - "referrer": { - "description": "where the URL was referred from ", - "ui-priority": 0, + "additional-comments": { + "categories": [ + "External analysis" + ], + "description": "Comments.", + "disable_correlation": true, "misp-attribute": "text", - "disable_correlation": true - }, - "title": { - "description": "Title of the web page", - "ui-priority": 0, - "misp-attribute": "text" - }, - "domain-name": { - "description": "Domain of the URL.", - "ui-priority": 0, - "misp-attribute": "text" - }, - "domain-ip": { - "description": "IP of the URL domain.", - "ui-priority": 0, - "misp-attribute": "ip-src" + "ui-priority": 0 }, "browser": { "description": "Browser used to access the URL.", - "ui-priority": 0, + "disable_correlation": true, "misp-attribute": "text", "sane_default": [ "IE", @@ -48,21 +26,43 @@ "Opera mini", "Chromium" ], - "disable_correlation": true + "ui-priority": 0 }, - "additional-comments": { - "description": "Comments.", - "ui-priority": 0, + "datetime-accessed": { + "description": "date and the time when the URL was accessed.", + "disable_correlation": true, + "misp-attribute": "datetime", + "ui-priority": 0 + }, + "domain-ip": { + "description": "IP of the URL domain.", + "misp-attribute": "ip-src", + "ui-priority": 0 + }, + "domain-name": { + "description": "Domain of the URL.", "misp-attribute": "text", - "categories": [ - "External analysis" - ], - "disable_correlation": true + "ui-priority": 0 + }, + "referrer": { + "description": "where the URL was referred from ", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 0 + }, + "title": { + "description": "Title of the web page", + "misp-attribute": "text", + "ui-priority": 0 } }, - "version": 1, "description": "An Object Template to share web history information", "meta-category": "misc", + "name": "tsk-web-history", + "required": [ + "URL", + "datetime-accessed" + ], "uuid": "e1325e52-e52e-49b1-89ad-d503c127c698", - "name": "tsk-web-history" -} + "version": 1 +} \ No newline at end of file diff --git a/objects/tsk-web-search-query/definition.json b/objects/tsk-web-search-query/definition.json index 0b0afdd..b4f7998 100644 --- a/objects/tsk-web-search-query/definition.json +++ b/objects/tsk-web-search-query/definition.json @@ -1,36 +1,17 @@ { - "required": [ - "domain", - "text" - ], "attributes": { - "domain": { - "description": "The domain of the search engine.", - "ui-priority": 0, - "misp-attribute": "link", - "sane_default": [ - "Google", - "Yahoo", - "Bing", - "Alta Vista", - "MSN" + "additional-comments": { + "categories": [ + "External analysis" ], - "disable_correlation": true - }, - "text": { - "description": "the search word or sentence.", - "ui-priority": 0, - "misp-attribute": "text" - }, - "datetime-searched": { - "description": "date and time when the search was conducted.", - "ui-priority": 0, - "misp-attribute": "datetime", - "disable_correlation": true + "description": "Comments.", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 0 }, "browser": { "description": "Browser used.", - "ui-priority": 0, + "disable_correlation": true, "misp-attribute": "text", "sane_default": [ "IE", @@ -40,27 +21,46 @@ "Opera mini", "Chromium" ], - "disable_correlation": true + "ui-priority": 0 + }, + "datetime-searched": { + "description": "date and time when the search was conducted.", + "disable_correlation": true, + "misp-attribute": "datetime", + "ui-priority": 0 + }, + "domain": { + "description": "The domain of the search engine.", + "disable_correlation": true, + "misp-attribute": "link", + "sane_default": [ + "Google", + "Yahoo", + "Bing", + "Alta Vista", + "MSN" + ], + "ui-priority": 0 + }, + "text": { + "description": "the search word or sentence.", + "misp-attribute": "text", + "ui-priority": 0 }, "username": { "description": "User name or ID associated with the search.", - "ui-priority": 0, + "disable_correlation": true, "misp-attribute": "text", - "disable_correlation": true - }, - "additional-comments": { - "description": "Comments.", - "ui-priority": 0, - "misp-attribute": "text", - "categories": [ - "External analysis" - ], - "disable_correlation": true + "ui-priority": 0 } }, - "version": 1, "description": "An Object Template to share web search query information", "meta-category": "misc", + "name": "tsk-web-search-query", + "required": [ + "domain", + "text" + ], "uuid": "16b3f8d0-fd09-4812-a42c-b5aeff2d4c2e", - "name": "tsk-web-search-query" -} + "version": 1 +} \ No newline at end of file diff --git a/objects/url/definition.json b/objects/url/definition.json index 29f8f40..b456cc0 100644 --- a/objects/url/definition.json +++ b/objects/url/definition.json @@ -1,29 +1,70 @@ { - "requiredOneOf": [ - "url", - "resource_path" - ], "attributes": { + "credential": { + "description": "Credential (username, password)", + "misp-attribute": "text", + "ui-priority": 0 + }, + "domain": { + "description": "Full domain", + "misp-attribute": "domain", + "ui-priority": 0 + }, + "domain_without_tld": { + "description": "Domain without Top-Level Domain", + "misp-attribute": "text", + "ui-priority": 0 + }, + "first-seen": { + "description": "First time this URL has been seen", + "disable_correlation": true, + "misp-attribute": "datetime", + "ui-priority": 0 + }, "fragment": { "description": "Fragment identifier is a short string of characters that refers to a resource that is subordinate to another, primary resource.", - "ui-priority": 0, "misp-attribute": "text", - "multiple": true + "multiple": true, + "ui-priority": 0 }, - "tld": { - "description": "Top-Level Domain", - "ui-priority": 0, - "misp-attribute": "text", - "disable_correlation": true + "host": { + "description": "Full hostname", + "misp-attribute": "hostname", + "ui-priority": 0 + }, + "ip": { + "description": "Better type when the host is an IP.", + "misp-attribute": "ip-dst", + "ui-priority": 0 + }, + "last-seen": { + "description": "Last time this URL has been seen", + "disable_correlation": true, + "misp-attribute": "datetime", + "ui-priority": 0 }, "port": { "description": "Port number", - "ui-priority": 0, + "disable_correlation": true, "misp-attribute": "port", - "disable_correlation": true + "ui-priority": 0 + }, + "query_string": { + "description": "Query (after path, preceded by '?')", + "misp-attribute": "text", + "multiple": true, + "ui-priority": 0 + }, + "resource_path": { + "description": "Path (between hostname:port and query)", + "misp-attribute": "text", + "multiple": true, + "ui-priority": 0 }, "scheme": { "description": "Scheme", + "disable_correlation": true, + "misp-attribute": "text", "sane_default": [ "http", "https", @@ -31,79 +72,38 @@ "gopher", "sip" ], - "ui-priority": 0, - "misp-attribute": "text", - "disable_correlation": true - }, - "first-seen": { - "description": "First time this URL has been seen", - "disable_correlation": true, - "ui-priority": 0, - "misp-attribute": "datetime" - }, - "resource_path": { - "description": "Path (between hostname:port and query)", - "ui-priority": 0, - "misp-attribute": "text", - "multiple": true - }, - "query_string": { - "description": "Query (after path, preceded by '?')", - "ui-priority": 0, - "misp-attribute": "text", - "multiple": true - }, - "url": { - "description": "Full URL", - "ui-priority": 1, - "misp-attribute": "url" - }, - "domain_without_tld": { - "description": "Domain without Top-Level Domain", - "ui-priority": 0, - "misp-attribute": "text" - }, - "domain": { - "description": "Full domain", - "ui-priority": 0, - "misp-attribute": "domain" + "ui-priority": 0 }, "subdomain": { "description": "Subdomain", - "ui-priority": 0, + "disable_correlation": true, "misp-attribute": "text", - "disable_correlation": true - }, - "credential": { - "description": "Credential (username, password)", - "ui-priority": 0, - "misp-attribute": "text" + "ui-priority": 0 }, "text": { "description": "Description of the URL ", - "ui-priority": 0, - "misp-attribute": "text" + "misp-attribute": "text", + "ui-priority": 0 }, - "last-seen": { - "description": "Last time this URL has been seen", + "tld": { + "description": "Top-Level Domain", "disable_correlation": true, - "ui-priority": 0, - "misp-attribute": "datetime" + "misp-attribute": "text", + "ui-priority": 0 }, - "ip": { - "description": "Better type when the host is an IP.", - "ui-priority": 0, - "misp-attribute": "ip-dst" - }, - "host": { - "description": "Full hostname", - "ui-priority": 0, - "misp-attribute": "hostname" + "url": { + "description": "Full URL", + "misp-attribute": "url", + "ui-priority": 1 } }, - "version": 8, "description": "url object describes an url along with its normalized field (like extracted using faup parsing library) and its metadata.", "meta-category": "network", + "name": "url", + "requiredOneOf": [ + "url", + "resource_path" + ], "uuid": "60efb77b-40b5-4c46-871b-ed1ed999fce5", - "name": "url" -} + "version": 8 +} \ No newline at end of file diff --git a/objects/user-account/definition.json b/objects/user-account/definition.json index 6f0e863..a0e70b9 100644 --- a/objects/user-account/definition.json +++ b/objects/user-account/definition.json @@ -1,50 +1,7 @@ { - "name": "user-account", - "uuid": "49606b06-22f0-4ac8-8eee-2f12ad46f3d3", - "meta-category": "misc", - "description": "", - "version": 3, - "requiredOneOf": [ - "password", - "username", - "user-id" - ], "attributes": { - "text": { - "description": "A description of the user account.", - "disable_correlation": true, - "ui-priority": 1, - "misp-attribute": "text" - }, - "username": { - "description": "Username related to the password.", - "ui-priority": 1, - "misp-attribute": "text" - }, - "user-id": { - "description": "Identifier of the account.", - "ui-priority": 1, - "misp-attribute": "text" - }, - "user-avatar": { - "description": "A user profile picture or avatar.", - "ui-priority": 1, - "multiple": true, - "misp-attribute": "attachment" - }, - "password": { - "description": "Password related to the username.", - "ui-priority": 1, - "misp-attribute": "text" - }, - "display-name": { - "description": "Display name of the account.", - "ui-priority": 1, - "misp-attribute": "text" - }, "account-type": { "description": "Type of the account.", - "ui-priority": 1, "misp-attribute": "text", "sane_default": [ "facebook", @@ -58,91 +15,134 @@ "unix", "windows-local", "windows-domain" - ] - }, - "link": { - "description": "Original link into the account page (Supposed harmless)", - "ui-priority": 1, - "misp-attribute": "link" - }, - "is_service_account": { - "description": "Specifies if the account is associated with a network service.", - "disable_correlation": true, - "ui-priority": 1, - "misp-attribute": "boolean" - }, - "privileged": { - "description": "Specifies if the account has privileges such as root rights.", - "disable_correlation": true, - "ui-priority": 1, - "misp-attribute": "boolean" + ], + "ui-priority": 1 }, "can_escalate_privs": { "description": "Specifies if the account has the ability to escalate privileges.", "disable_correlation": true, - "ui-priority": 1, - "misp-attribute": "boolean" - }, - "disabled": { - "description": "Specifies if the account is desabled.", - "disable_correlation": true, - "ui-priority": 1, - "misp-attribute": "boolean" + "misp-attribute": "boolean", + "ui-priority": 1 }, "created": { "description": "Creation time of the account.", "disable_correlation": true, - "ui-priority": 1, - "misp-attribute": "datetime" + "misp-attribute": "datetime", + "ui-priority": 1 + }, + "disabled": { + "description": "Specifies if the account is desabled.", + "disable_correlation": true, + "misp-attribute": "boolean", + "ui-priority": 1 + }, + "display-name": { + "description": "Display name of the account.", + "misp-attribute": "text", + "ui-priority": 1 }, "expires": { "description": "Expiration time of the account", "disable_correlation": true, - "ui-priority": 1, - "misp-attribute": "datetime" + "misp-attribute": "datetime", + "ui-priority": 1 }, "first_login": { "description": "First time someone logged in to the account.", "disable_correlation": true, - "ui-priority": 1, - "misp-attribute": "datetime" - }, - "last_login": { - "description": "Last time someone logged in to the account.", - "disable_correlation": true, - "ui-priority": 1, - "misp-attribute": "datetime" - }, - "password_last_changed": { - "description": "Last time the password has been changed.", - "disable_correlation": true, - "ui-priority": 1, - "misp-attribute": "datetime" - }, - "group-id": { - "description": "Identifier of the primary group of the account, in case of a UNIX account.", - "disable_correlation": true, - "ui-priority": 1, - "misp-attribute": "text" + "misp-attribute": "datetime", + "ui-priority": 1 }, "group": { "description": "UNIX group(s) the account is member of.", "disable_correlation": true, - "ui-priority": 1, "misp-attribute": "text", - "multiple": true + "multiple": true, + "ui-priority": 1 + }, + "group-id": { + "description": "Identifier of the primary group of the account, in case of a UNIX account.", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 1 }, "home_dir": { "description": "Home directory of the UNIX account.", "disable_correlation": true, - "ui-priority": 1, - "misp-attribute": "text" + "misp-attribute": "text", + "ui-priority": 1 + }, + "is_service_account": { + "description": "Specifies if the account is associated with a network service.", + "disable_correlation": true, + "misp-attribute": "boolean", + "ui-priority": 1 + }, + "last_login": { + "description": "Last time someone logged in to the account.", + "disable_correlation": true, + "misp-attribute": "datetime", + "ui-priority": 1 + }, + "link": { + "description": "Original link into the account page (Supposed harmless)", + "misp-attribute": "link", + "ui-priority": 1 + }, + "password": { + "description": "Password related to the username.", + "misp-attribute": "text", + "ui-priority": 1 + }, + "password_last_changed": { + "description": "Last time the password has been changed.", + "disable_correlation": true, + "misp-attribute": "datetime", + "ui-priority": 1 + }, + "privileged": { + "description": "Specifies if the account has privileges such as root rights.", + "disable_correlation": true, + "misp-attribute": "boolean", + "ui-priority": 1 }, "shell": { "description": "UNIX command shell of the account.", "disable_correlation": true, - "ui-priority": 1, - "misp-attribute": "text" + "misp-attribute": "text", + "ui-priority": 1 + }, + "text": { + "description": "A description of the user account.", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 1 + }, + "user-avatar": { + "description": "A user profile picture or avatar.", + "misp-attribute": "attachment", + "multiple": true, + "ui-priority": 1 + }, + "user-id": { + "description": "Identifier of the account.", + "misp-attribute": "text", + "ui-priority": 1 + }, + "username": { + "description": "Username related to the password.", + "misp-attribute": "text", + "ui-priority": 1 } - } -} + }, + "description": "", + "meta-category": "misc", + "name": "user-account", + "requiredOneOf": [ + "password", + "username", + "user-id" + ], + "uuid": "49606b06-22f0-4ac8-8eee-2f12ad46f3d3", + "version": 3 +} \ No newline at end of file diff --git a/objects/vehicle/definition.json b/objects/vehicle/definition.json index 9a6d1fc..9d68828 100644 --- a/objects/vehicle/definition.json +++ b/objects/vehicle/definition.json @@ -1,48 +1,86 @@ { - "requiredOneOf": [ - "description", - "make", - "model", - "license-plate-number", - "vin", - "dyno-power", - "date-first-registration", - "image-url", - "gearbox", - "exterior color", - "interior color", - "type", - "state", - "indicative-value" - ], "attributes": { + "date-first-registration": { + "description": "Date of first registration", + "misp-attribute": "text", + "multiple": true, + "ui-priority": 0 + }, "description": { "description": "Description of the vehicle", - "ui-priority": 1, + "disable_correlation": true, "misp-attribute": "text", - "disable_correlation": true + "ui-priority": 1 + }, + "dyno-power": { + "description": "Dyno power output", + "misp-attribute": "text", + "multiple": true, + "ui-priority": 0 }, "exterior color": { "description": "Exterior color of the vehicule", - "ui-priority": 0, + "disable_correlation": true, "misp-attribute": "text", - "disable_correlation": true + "ui-priority": 0 }, - "state": { - "description": "State of the vehicule (stolen or recovered)", - "ui-priority": 0, + "gearbox": { + "description": "Gearbox", "misp-attribute": "text", - "disable_correlation": true + "multiple": true, + "ui-priority": 0 + }, + "image": { + "description": "Image of the vehicle.", + "misp-attribute": "attachment", + "multiple": true, + "ui-priority": 0 + }, + "image-url": { + "description": "Image URL", + "misp-attribute": "text", + "multiple": true, + "ui-priority": 0 + }, + "indicative-value": { + "description": "Indicative value", + "misp-attribute": "text", + "multiple": true, + "ui-priority": 0 }, "interior color": { "description": "Interior color of the vehicule", - "ui-priority": 0, + "disable_correlation": true, "misp-attribute": "text", - "disable_correlation": true + "ui-priority": 0 + }, + "license-plate-number": { + "description": "License plate number", + "misp-attribute": "text", + "multiple": true, + "ui-priority": 0 + }, + "make": { + "description": "Manufacturer of the vehicle", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 0 + }, + "model": { + "description": "Model of the vehicle", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 0 + }, + "state": { + "description": "State of the vehicule (stolen or recovered)", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 0 }, "type": { "description": "Type of the vehicule", - "ui-priority": 0, + "disable_correlation": true, "misp-attribute": "text", "sane_default": [ "car", @@ -59,71 +97,33 @@ "trailer", "van" ], - "disable_correlation": true - }, - "make": { - "description": "Manufacturer of the vehicle", - "ui-priority": 0, - "misp-attribute": "text", - "disable_correlation": true - }, - "model": { - "description": "Model of the vehicle", - "ui-priority": 0, - "misp-attribute": "text", - "disable_correlation": true + "ui-priority": 0 }, "vin": { "description": "Vehicle identification number (VIN)", - "ui-priority": 0, - "misp-attribute": "text" - }, - "license-plate-number": { - "description": "License plate number", - "ui-priority": 0, "misp-attribute": "text", - "multiple": true - }, - "dyno-power": { - "description": "Dyno power output", - "ui-priority": 0, - "misp-attribute": "text", - "multiple": true - }, - "date-first-registration": { - "description": "Date of first registration", - "ui-priority": 0, - "misp-attribute": "text", - "multiple": true - }, - "image-url": { - "description": "Image URL", - "ui-priority": 0, - "misp-attribute": "text", - "multiple": true - }, - "image": { - "description": "Image of the vehicle.", - "ui-priority": 0, - "misp-attribute": "attachment", - "multiple": true - }, - "gearbox": { - "description": "Gearbox", - "ui-priority": 0, - "misp-attribute": "text", - "multiple": true - }, - "indicative-value": { - "description": "Indicative value", - "ui-priority": 0, - "misp-attribute": "text", - "multiple": true + "ui-priority": 0 } }, - "version": 3, "description": "Vehicle object template to describe a vehicle information and registration", "meta-category": "misc", + "name": "vehicle", + "requiredOneOf": [ + "description", + "make", + "model", + "license-plate-number", + "vin", + "dyno-power", + "date-first-registration", + "image-url", + "gearbox", + "exterior color", + "interior color", + "type", + "state", + "indicative-value" + ], "uuid": "683c076c-f695-4ff2-8efa-e98a418049f4", - "name": "vehicle" -} + "version": 3 +} \ No newline at end of file diff --git a/objects/victim/definition.json b/objects/victim/definition.json index f7259a5..c83972e 100644 --- a/objects/victim/definition.json +++ b/objects/victim/definition.json @@ -1,57 +1,81 @@ { - "requiredOneOf": [ - "name", - "regions", - "sectors" - ], "attributes": { - "description": { - "description": "Description of the victim", - "ui-priority": 1, - "misp-attribute": "text" - }, - "name": { - "description": "The name of the department(s) or organisation(s) targeted.", - "ui-priority": 1, - "misp-attribute": "target-org", - "multiple": true - }, - "external": { - "description": "External target organisations affected by this attack.", - "ui-priority": 1, - "misp-attribute": "target-external", - "multiple": true - }, - "reference": { - "description": "External reference to the victim/case.", - "ui-priority": 1, - "misp-attribute": "text", - "multiple": true - }, "classification": { "description": "The type of entity being targeted.", - "misp-attribute": "text", "disable_correlation": true, - "ui-priority": 1, + "misp-attribute": "text", "sane_default": [ "individual", "group", "organization", "class", "unknown" - ] + ], + "ui-priority": 1 + }, + "description": { + "description": "Description of the victim", + "misp-attribute": "text", + "ui-priority": 1 + }, + "domain": { + "description": "Domain name of the organisation targeted.", + "misp-attribute": "domain", + "multiple": true, + "ui-priority": 1 + }, + "email": { + "description": "The email address(es) of the user targeted.", + "misp-attribute": "target-email", + "multiple": true, + "ui-priority": 1 + }, + "external": { + "description": "External target organisations affected by this attack.", + "misp-attribute": "target-external", + "multiple": true, + "ui-priority": 1 + }, + "ip-address": { + "description": "IP address(es) of the node targeted.", + "misp-attribute": "ip-dst", + "multiple": true, + "ui-priority": 1 + }, + "name": { + "description": "The name of the department(s) or organisation(s) targeted.", + "misp-attribute": "target-org", + "multiple": true, + "ui-priority": 1 + }, + "node": { + "description": "Name(s) of node that was targeted.", + "misp-attribute": "target-machine", + "multiple": true, + "ui-priority": 1 + }, + "reference": { + "description": "External reference to the victim/case.", + "misp-attribute": "text", + "multiple": true, + "ui-priority": 1 + }, + "regions": { + "description": "The list of regions or locations from the victim targeted. ISO 3166 should be used.", + "misp-attribute": "target-location", + "multiple": true, + "ui-priority": 1 }, "roles": { "description": "The list of roles targeted within the victim.", - "multiple": true, "misp-attribute": "text", + "multiple": true, "ui-priority": 1 }, "sectors": { "description": "The list of sectors that the victim belong to", - "multiple": true, "misp-attribute": "text", - "ui-priority": 1, + "multiple": true, "sane_default": [ "agriculture", "aerospace", @@ -81,48 +105,24 @@ "telecommunications", "transportation", "utilities" - ] - }, - "regions": { - "description": "The list of regions or locations from the victim targeted. ISO 3166 should be used.", - "multiple": true, - "misp-attribute": "target-location", + ], "ui-priority": 1 }, "user": { "description": "The username(s) of the user targeted.", "misp-attribute": "target-user", - "ui-priority": 1, - "multiple": true - }, - "email": { - "description": "The email address(es) of the user targeted.", - "misp-attribute": "target-email", - "ui-priority": 1, - "multiple": true - }, - "node": { - "description": "Name(s) of node that was targeted.", - "misp-attribute": "target-machine", - "ui-priority": 1, - "multiple": true - }, - "ip-address": { - "description": "IP address(es) of the node targeted.", - "misp-attribute": "ip-dst", - "ui-priority": 1, - "multiple": true - }, - "domain": { - "description": "Domain name of the organisation targeted.", - "misp-attribute": "domain", - "ui-priority": 1, - "multiple": true + "multiple": true, + "ui-priority": 1 } }, - "version": 6, "description": "Victim object describes the target of an attack or abuse.", "meta-category": "misc", + "name": "victim", + "requiredOneOf": [ + "name", + "regions", + "sectors" + ], "uuid": "a8806e40-39ad-435f-be02-ac2a13d6fc7d", - "name": "victim" -} + "version": 6 +} \ No newline at end of file diff --git a/objects/virustotal-graph/definition.json b/objects/virustotal-graph/definition.json index 22ed6a5..aefcf54 100644 --- a/objects/virustotal-graph/definition.json +++ b/objects/virustotal-graph/definition.json @@ -1,52 +1,52 @@ { - "required": [ - "permalink" - ], "attributes": { "access": { - "description": "Access to the VirusTotal graph", - "disable_correlation": true, "categories": [ "External analysis" ], - "ui-priority": 1, + "description": "Access to the VirusTotal graph", + "disable_correlation": true, "misp-attribute": "text", + "ui-priority": 1, "values_list": [ "Private", "Public" ] }, - "permalink": { - "description": "Permalink Reference to the VirusTotal graph", - "categories": [ - "External analysis" - ], - "ui-priority": 2, - "misp-attribute": "link" - }, "comment": { - "description": "Comment related to this VirusTotal graph", "categories": [ "External analysis" ], + "description": "Comment related to this VirusTotal graph", + "disable_correlation": true, "misp-attribute": "text", - "ui-priority": 2, "multiple": true, - "disable_correlation": true + "ui-priority": 2 + }, + "permalink": { + "categories": [ + "External analysis" + ], + "description": "Permalink Reference to the VirusTotal graph", + "misp-attribute": "link", + "ui-priority": 2 }, "screenshot": { - "description": "Screenshot of the VirusTotal graph", - "misp-attribute": "attachment", - "disable_correlation": true, - "ui-priority": 1, "categories": [ "External analysis" - ] + ], + "description": "Screenshot of the VirusTotal graph", + "disable_correlation": true, + "misp-attribute": "attachment", + "ui-priority": 1 } }, - "version": 1, "description": "VirusTotal graph", "meta-category": "misc", + "name": "virustotal-graph", + "required": [ + "permalink" + ], "uuid": "9b421055-b1bb-4c33-9ead-7fa3f39e2232", - "name": "virustotal-graph" -} + "version": 1 +} \ No newline at end of file diff --git a/objects/virustotal-report/definition.json b/objects/virustotal-report/definition.json index bc07cca..0a85f4c 100644 --- a/objects/virustotal-report/definition.json +++ b/objects/virustotal-report/definition.json @@ -1,63 +1,63 @@ { + "attributes": { + "comment": { + "categories": [ + "External analysis" + ], + "description": "Comment related to this hash", + "misp-attribute": "text", + "multiple": true, + "ui-priority": 2 + }, + "community-score": { + "categories": [ + "External analysis" + ], + "description": "Community Score", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 0 + }, + "detection-ratio": { + "categories": [ + "External analysis" + ], + "description": "Detection Ratio", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 1 + }, + "first-submission": { + "categories": [ + "Other" + ], + "description": "First Submission", + "misp-attribute": "datetime", + "ui-priority": 0 + }, + "last-submission": { + "categories": [ + "Other" + ], + "description": "Last Submission", + "misp-attribute": "datetime", + "ui-priority": 0 + }, + "permalink": { + "categories": [ + "External analysis" + ], + "description": "Permalink Reference", + "misp-attribute": "link", + "ui-priority": 2 + } + }, + "description": "VirusTotal report", + "meta-category": "misc", + "name": "virustotal-report", "required": [ "permalink" ], - "attributes": { - "community-score": { - "description": "Community Score", - "disable_correlation": true, - "categories": [ - "External analysis" - ], - "ui-priority": 0, - "misp-attribute": "text" - }, - "detection-ratio": { - "description": "Detection Ratio", - "disable_correlation": true, - "categories": [ - "External analysis" - ], - "ui-priority": 1, - "misp-attribute": "text" - }, - "first-submission": { - "description": "First Submission", - "categories": [ - "Other" - ], - "ui-priority": 0, - "misp-attribute": "datetime" - }, - "last-submission": { - "description": "Last Submission", - "categories": [ - "Other" - ], - "ui-priority": 0, - "misp-attribute": "datetime" - }, - "permalink": { - "description": "Permalink Reference", - "categories": [ - "External analysis" - ], - "ui-priority": 2, - "misp-attribute": "link" - }, - "comment": { - "description": "Comment related to this hash", - "categories": [ - "External analysis" - ], - "misp-attribute": "text", - "ui-priority": 2, - "multiple": true - } - }, - "version": 3, - "description": "VirusTotal report", - "meta-category": "misc", "uuid": "d7dd0154-e04f-4c34-a2fb-79f3a3a52aa4", - "name": "virustotal-report" -} + "version": 3 +} \ No newline at end of file diff --git a/objects/vulnerability/definition.json b/objects/vulnerability/definition.json index d381ffd..1bfca53 100644 --- a/objects/vulnerability/definition.json +++ b/objects/vulnerability/definition.json @@ -1,4 +1,89 @@ { + "attributes": { + "created": { + "description": "First time when the vulnerability was discovered", + "disable_correlation": true, + "misp-attribute": "datetime", + "ui-priority": 0 + }, + "credit": { + "description": "Who reported/found the vulnerability such as an organisation, person or nickname.", + "disable_correlation": true, + "misp-attribute": "text", + "multiple": true, + "ui-priority": 0 + }, + "cvss-score": { + "description": "Score of the Common Vulnerability Scoring System (version 3).", + "disable_correlation": true, + "misp-attribute": "float", + "ui-priority": 1 + }, + "cvss-string": { + "description": "String of the Common Vulnerability Scoring System (version 3).", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 1 + }, + "description": { + "description": "Description of the vulnerability", + "misp-attribute": "text", + "ui-priority": 0 + }, + "id": { + "description": "Vulnerability ID (generally CVE, but not necessarely). The id is not required as the object itself has an UUID and the CVE id can be update or assigned later.", + "misp-attribute": "text", + "multiple": true, + "ui-priority": 0 + }, + "modified": { + "description": "Last modification date", + "disable_correlation": true, + "misp-attribute": "datetime", + "ui-priority": 0 + }, + "published": { + "description": "Initial publication date", + "disable_correlation": true, + "misp-attribute": "datetime", + "ui-priority": 0 + }, + "references": { + "description": "External references", + "misp-attribute": "link", + "multiple": true, + "ui-priority": 0 + }, + "state": { + "description": "State of the vulnerability. A vulnerability can have multiple states depending of the current actions performed.", + "disable_correlation": true, + "misp-attribute": "text", + "multiple": true, + "sane_default": [ + "Published", + "Embargo", + "Reviewed", + "Vulnerability ID Assigned", + "Reported", + "Fixed" + ], + "ui-priority": 0 + }, + "summary": { + "description": "Summary of the vulnerability", + "misp-attribute": "text", + "ui-priority": 0 + }, + "vulnerable-configuration": { + "description": "The vulnerable configuration is described in CPE format", + "misp-attribute": "text", + "multiple": true, + "ui-priority": 0 + } + }, + "description": "Vulnerability object describing a common vulnerability enumeration which can describe published, unpublished, under review or embargo vulnerability for software, equipments or hardware.", + "meta-category": "vulnerability", + "name": "vulnerability", "requiredOneOf": [ "published", "modified", @@ -8,91 +93,6 @@ "description", "id" ], - "attributes": { - "id": { - "description": "Vulnerability ID (generally CVE, but not necessarely). The id is not required as the object itself has an UUID and the CVE id can be update or assigned later.", - "ui-priority": 0, - "misp-attribute": "text", - "multiple": true - }, - "description": { - "description": "Description of the vulnerability", - "ui-priority": 0, - "misp-attribute": "text" - }, - "summary": { - "description": "Summary of the vulnerability", - "ui-priority": 0, - "misp-attribute": "text" - }, - "vulnerable-configuration": { - "description": "The vulnerable configuration is described in CPE format", - "multiple": true, - "ui-priority": 0, - "misp-attribute": "text" - }, - "modified": { - "description": "Last modification date", - "ui-priority": 0, - "misp-attribute": "datetime", - "disable_correlation": true - }, - "published": { - "description": "Initial publication date", - "ui-priority": 0, - "misp-attribute": "datetime", - "disable_correlation": true - }, - "created": { - "description": "First time when the vulnerability was discovered", - "ui-priority": 0, - "misp-attribute": "datetime", - "disable_correlation": true - }, - "references": { - "description": "External references", - "multiple": true, - "ui-priority": 0, - "misp-attribute": "link" - }, - "state": { - "description": "State of the vulnerability. A vulnerability can have multiple states depending of the current actions performed.", - "multiple": true, - "ui-priority": 0, - "sane_default": [ - "Published", - "Embargo", - "Reviewed", - "Vulnerability ID Assigned", - "Reported", - "Fixed" - ], - "disable_correlation": true, - "misp-attribute": "text" - }, - "cvss-score": { - "description": "Score of the Common Vulnerability Scoring System (version 3).", - "ui-priority": 1, - "disable_correlation": true, - "misp-attribute": "float" - }, - "cvss-string": { - "description": "String of the Common Vulnerability Scoring System (version 3).", - "ui-priority": 1, - "disable_correlation": true, - "misp-attribute": "text" - }, - "credit": { - "description": "Who reported/found the vulnerability such as an organisation, person or nickname.", - "ui-priority": 0, - "disable_correlation": true, - "misp-attribute": "text", - "multiple": true - } - }, - "version": 6, - "description": "Vulnerability object describing a common vulnerability enumeration which can describe published, unpublished, under review or embargo vulnerability for software, equipments or hardware.", - "meta-category": "vulnerability", "uuid": "81650945-f186-437b-8945-9f31715d32da", - "name": "vulnerability" -} + "version": 6 +} \ No newline at end of file diff --git a/objects/weakness/definition.json b/objects/weakness/definition.json index cc0c881..0ddf154 100644 --- a/objects/weakness/definition.json +++ b/objects/weakness/definition.json @@ -1,52 +1,52 @@ { - "requiredOneOf": [ - "id", - "name", - "description" - ], "attributes": { - "id": { - "description": "Weakness ID (generally CWE).", - "ui-priority": 0, - "misp-attribute": "text" - }, "description": { "description": "Description of the weakness.", - "ui-priority": 0, - "misp-attribute": "text" + "misp-attribute": "text", + "ui-priority": 0 + }, + "id": { + "description": "Weakness ID (generally CWE).", + "misp-attribute": "text", + "ui-priority": 0 }, "name": { "description": "Name of the weakness.", - "ui-priority": 0, - "misp-attribute": "text" + "misp-attribute": "text", + "ui-priority": 0 }, "status": { "description": "Status of the weakness.", - "ui-priority": 0, + "disable_correlation": true, + "misp-attribute": "text", "sane_default": [ "Incomplete", "Deprecated", "Draft", "Usable" ], - "disable_correlation": true, - "misp-attribute": "text" + "ui-priority": 0 }, "weakness-abs": { "description": "Abstraction of the weakness.", - "ui-priority": 0, + "disable_correlation": true, + "misp-attribute": "text", "sane_default": [ "Class", "Base", "Variant" ], - "disable_correlation": true, - "misp-attribute": "text" + "ui-priority": 0 } }, - "version": 1, "description": "Weakness object describing a common weakness enumeration which can describe usable, incomplete, draft or deprecated weakness for software, equipment of hardware.", "meta-category": "vulnerability", + "name": "weakness", + "requiredOneOf": [ + "id", + "name", + "description" + ], "uuid": "b8713fc0-d7a2-4b27-a182-38ed47966802", - "name": "weakness" -} + "version": 1 +} \ No newline at end of file diff --git a/objects/whois/definition.json b/objects/whois/definition.json index ed91c86..fc1bd3e 100644 --- a/objects/whois/definition.json +++ b/objects/whois/definition.json @@ -1,4 +1,87 @@ { + "attributes": { + "comment": { + "description": "Comment of the whois entry", + "misp-attribute": "text", + "ui-priority": 0 + }, + "creation-date": { + "description": "Initial creation of the whois entry", + "disable_correlation": true, + "misp-attribute": "datetime", + "ui-priority": 0 + }, + "domain": { + "categories": [ + "Network activity", + "External analysis" + ], + "description": "Domain of the whois entry", + "misp-attribute": "domain", + "multiple": true, + "ui-priority": 0 + }, + "expiration-date": { + "description": "Expiration of the whois entry", + "disable_correlation": true, + "misp-attribute": "datetime", + "ui-priority": 0 + }, + "ip-address": { + "description": "IP address of the whois entry", + "misp-attribute": "ip-src", + "multiple": true, + "ui-priority": 0 + }, + "modification-date": { + "description": "Last update of the whois entry", + "disable_correlation": true, + "misp-attribute": "datetime", + "ui-priority": 0 + }, + "nameserver": { + "description": "Nameserver", + "disable_correlation": true, + "misp-attribute": "hostname", + "multiple": true, + "to_ids": false, + "ui-priority": 0 + }, + "registrant-email": { + "description": "Registrant email address", + "misp-attribute": "whois-registrant-email", + "ui-priority": 1 + }, + "registrant-name": { + "description": "Registrant name", + "misp-attribute": "whois-registrant-name", + "ui-priority": 0 + }, + "registrant-org": { + "description": "Registrant organisation", + "misp-attribute": "whois-registrant-org", + "ui-priority": 1 + }, + "registrant-phone": { + "description": "Registrant phone number", + "misp-attribute": "whois-registrant-phone", + "ui-priority": 0 + }, + "registrar": { + "description": "Registrar of the whois entry", + "misp-attribute": "whois-registrar", + "ui-priority": 0 + }, + "text": { + "description": "Full whois entry", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 1 + } + }, + "description": "Whois records information for a domain name or an IP address.", + "meta-category": "network", + "name": "whois", "requiredOneOf": [ "registrant-email", "registrant-phone", @@ -9,89 +92,6 @@ "domain", "ip-address" ], - "attributes": { - "text": { - "description": "Full whois entry", - "disable_correlation": true, - "ui-priority": 1, - "misp-attribute": "text" - }, - "registrar": { - "description": "Registrar of the whois entry", - "ui-priority": 0, - "misp-attribute": "whois-registrar" - }, - "registrant-name": { - "description": "Registrant name", - "ui-priority": 0, - "misp-attribute": "whois-registrant-name" - }, - "registrant-phone": { - "description": "Registrant phone number", - "ui-priority": 0, - "misp-attribute": "whois-registrant-phone" - }, - "registrant-email": { - "description": "Registrant email address", - "ui-priority": 1, - "misp-attribute": "whois-registrant-email" - }, - "registrant-org": { - "description": "Registrant organisation", - "ui-priority": 1, - "misp-attribute": "whois-registrant-org" - }, - "creation-date": { - "description": "Initial creation of the whois entry", - "disable_correlation": true, - "ui-priority": 0, - "misp-attribute": "datetime" - }, - "modification-date": { - "description": "Last update of the whois entry", - "disable_correlation": true, - "ui-priority": 0, - "misp-attribute": "datetime" - }, - "expiration-date": { - "description": "Expiration of the whois entry", - "disable_correlation": true, - "ui-priority": 0, - "misp-attribute": "datetime" - }, - "nameserver": { - "description": "Nameserver", - "ui-priority": 0, - "misp-attribute": "hostname", - "disable_correlation": true, - "multiple": true, - "to_ids": false - }, - "domain": { - "description": "Domain of the whois entry", - "categories": [ - "Network activity", - "External analysis" - ], - "ui-priority": 0, - "multiple": true, - "misp-attribute": "domain" - }, - "comment": { - "description": "Comment of the whois entry", - "ui-priority": 0, - "misp-attribute": "text" - }, - "ip-address": { - "description": "IP address of the whois entry", - "ui-priority": 0, - "multiple": true, - "misp-attribute": "ip-src" - } - }, - "version": 10, - "description": "Whois records information for a domain name or an IP address.", - "meta-category": "network", "uuid": "429faea1-34ff-47af-8a00-7c62d3be5a6a", - "name": "whois" -} + "version": 10 +} \ No newline at end of file diff --git a/objects/x509/definition.json b/objects/x509/definition.json index f97b462..f292cda 100644 --- a/objects/x509/definition.json +++ b/objects/x509/definition.json @@ -1,4 +1,149 @@ { + "attributes": { + "dns_names": { + "description": "Subject Alternative Name - DNS names", + "misp-attribute": "hostname", + "multiple": true, + "ui-priority": 0 + }, + "email": { + "description": "Subject Alternative Name - emails", + "misp-attribute": "email-dst", + "multiple": true, + "ui-priority": 0 + }, + "ip": { + "description": "Subject Alternative Name - IP", + "misp-attribute": "ip-dst", + "multiple": true, + "ui-priority": 0 + }, + "is_ca": { + "description": "CA certificate", + "disable_correlation": true, + "misp-attribute": "boolean", + "ui-priority": 0 + }, + "issuer": { + "description": "Issuer of the certificate", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 0 + }, + "pem": { + "description": "Raw certificate in PEM formati (Unix-like newlines)", + "misp-attribute": "text", + "ui-priority": 0 + }, + "pubkey-info-algorithm": { + "description": "Algorithm of the public key", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 0 + }, + "pubkey-info-exponent": { + "description": "Exponent of the public key - in decimal", + "misp-attribute": "text", + "ui-priority": 0 + }, + "pubkey-info-modulus": { + "description": "Modulus of the public key - in Hexadecimal - no 0x, no :", + "misp-attribute": "text", + "ui-priority": 0 + }, + "pubkey-info-size": { + "description": "Length of the public key (in bits expressed in decimal: eg. 256 bits)", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 0 + }, + "raw-base64": { + "description": "Raw certificate base64 encoded (DER format)", + "misp-attribute": "text", + "ui-priority": 0 + }, + "rid": { + "description": "Subject Alternative Name - RID", + "misp-attribute": "text", + "multiple": true, + "ui-priority": 0 + }, + "self_signed": { + "description": "Self-signed certificate", + "disable_correlation": true, + "misp-attribute": "boolean", + "ui-priority": 0 + }, + "serial-number": { + "description": "Serial number of the certificate", + "misp-attribute": "text", + "ui-priority": 0 + }, + "signature_algorithm": { + "description": "Signature algorithm", + "disable_correlation": true, + "misp-attribute": "text", + "sane_default": [ + "SHA1_WITH_RSA_ENCRYPTION", + "SHA256_WITH_RSA_ENCRYPTION" + ], + "ui-priority": 0 + }, + "subject": { + "description": "Subject of the certificate", + "misp-attribute": "text", + "ui-priority": 1 + }, + "text": { + "description": "Free text description of the certificate", + "misp-attribute": "text", + "ui-priority": 1 + }, + "uri": { + "description": "Subject Alternative Name - URI", + "misp-attribute": "uri", + "multiple": true, + "ui-priority": 0 + }, + "validity-not-after": { + "description": "Certificate invalid after that date", + "disable_correlation": true, + "misp-attribute": "datetime", + "ui-priority": 0 + }, + "validity-not-before": { + "description": "Certificate invalid before that date", + "disable_correlation": true, + "misp-attribute": "datetime", + "ui-priority": 0 + }, + "version": { + "description": "Version of the certificate", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 0 + }, + "x509-fingerprint-md5": { + "description": "[Insecure] MD5 hash (128 bits)", + "misp-attribute": "x509-fingerprint-md5", + "recommended": false, + "ui-priority": 1 + }, + "x509-fingerprint-sha1": { + "description": "[Insecure] Secure Hash Algorithm 1 (160 bits)", + "misp-attribute": "x509-fingerprint-sha1", + "recommended": false, + "ui-priority": 1 + }, + "x509-fingerprint-sha256": { + "description": "Secure Hash Algorithm 2 (256 bits)", + "misp-attribute": "x509-fingerprint-sha256", + "ui-priority": 1 + } + }, + "description": "x509 object describing a X.509 certificate", + "meta-category": "network", + "name": "x509", "requiredOneOf": [ "x509-fingerprint-md5", "x509-fingerprint-sha1", @@ -6,151 +151,6 @@ "serial-number", "issuer" ], - "attributes": { - "subject": { - "description": "Subject of the certificate", - "ui-priority": 1, - "misp-attribute": "text" - }, - "pubkey-info-algorithm": { - "description": "Algorithm of the public key", - "ui-priority": 0, - "misp-attribute": "text", - "disable_correlation": true - }, - "pubkey-info-size": { - "description": "Length of the public key (in bits expressed in decimal: eg. 256 bits)", - "ui-priority": 0, - "misp-attribute": "text", - "disable_correlation": true - }, - "pubkey-info-exponent": { - "description": "Exponent of the public key - in decimal", - "ui-priority": 0, - "misp-attribute": "text" - }, - "pubkey-info-modulus": { - "description": "Modulus of the public key - in Hexadecimal - no 0x, no :", - "ui-priority": 0, - "misp-attribute": "text" - }, - "x509-fingerprint-md5": { - "description": "[Insecure] MD5 hash (128 bits)", - "ui-priority": 1, - "misp-attribute": "x509-fingerprint-md5", - "recommended": false - }, - "x509-fingerprint-sha1": { - "description": "[Insecure] Secure Hash Algorithm 1 (160 bits)", - "ui-priority": 1, - "misp-attribute": "x509-fingerprint-sha1", - "recommended": false - }, - "x509-fingerprint-sha256": { - "description": "Secure Hash Algorithm 2 (256 bits)", - "ui-priority": 1, - "misp-attribute": "x509-fingerprint-sha256" - }, - "raw-base64": { - "description": "Raw certificate base64 encoded (DER format)", - "ui-priority": 0, - "misp-attribute": "text" - }, - "pem": { - "description": "Raw certificate in PEM formati (Unix-like newlines)", - "ui-priority": 0, - "misp-attribute": "text" - }, - "text": { - "description": "Free text description of the certificate", - "ui-priority": 1, - "misp-attribute": "text" - }, - "validity-not-before": { - "description": "Certificate invalid before that date", - "ui-priority": 0, - "misp-attribute": "datetime", - "disable_correlation": true - }, - "validity-not-after": { - "description": "Certificate invalid after that date", - "ui-priority": 0, - "misp-attribute": "datetime", - "disable_correlation": true - }, - "issuer": { - "description": "Issuer of the certificate", - "ui-priority": 0, - "misp-attribute": "text", - "disable_correlation": true - }, - "serial-number": { - "description": "Serial number of the certificate", - "ui-priority": 0, - "misp-attribute": "text" - }, - "version": { - "description": "Version of the certificate", - "ui-priority": 0, - "misp-attribute": "text", - "disable_correlation": true - }, - "self_signed": { - "description": "Self-signed certificate", - "ui-priority": 0, - "misp-attribute": "boolean", - "disable_correlation": true - }, - "is_ca": { - "description": "CA certificate", - "ui-priority": 0, - "misp-attribute": "boolean", - "disable_correlation": true - }, - "dns_names": { - "description": "Subject Alternative Name - DNS names", - "multiple": true, - "misp-attribute": "hostname", - "ui-priority": 0 - }, - "email": { - "description": "Subject Alternative Name - emails", - "multiple": true, - "misp-attribute": "email-dst", - "ui-priority": 0 - }, - "ip": { - "description": "Subject Alternative Name - IP", - "multiple": true, - "misp-attribute": "ip-dst", - "ui-priority": 0 - }, - "uri": { - "description": "Subject Alternative Name - URI", - "multiple": true, - "misp-attribute": "uri", - "ui-priority": 0 - }, - "rid": { - "description": "Subject Alternative Name - RID", - "multiple": true, - "misp-attribute": "text", - "ui-priority": 0 - }, - "signature_algorithm": { - "description": "Signature algorithm", - "misp-attribute": "text", - "ui-priority": 0, - "disable_correlation": true, - "sane_default": [ - "SHA1_WITH_RSA_ENCRYPTION", - "SHA256_WITH_RSA_ENCRYPTION" - ] - } - }, - "version": 12, - "description": "x509 object describing a X.509 certificate", - "meta-category": "network", "uuid": "d1ab756a-26b5-4349-9f43-765630f0911c", - "name": "x509" -} + "version": 12 +} \ No newline at end of file diff --git a/objects/yabin/definition.json b/objects/yabin/definition.json index 6c0003d..836d77c 100644 --- a/objects/yabin/definition.json +++ b/objects/yabin/definition.json @@ -1,40 +1,40 @@ { - "requiredOneOf": [ - "yara", - "yara-hunt" - ], "attributes": { - "version": { - "description": "yabin.py and regex.txt version used for the generation of the yara rules.", - "ui-priority": 0, - "misp-attribute": "comment" - }, "comment": { "description": "A description of Yara rule generated.", - "ui-priority": 0, - "misp-attribute": "comment" + "misp-attribute": "comment", + "ui-priority": 0 + }, + "version": { + "description": "yabin.py and regex.txt version used for the generation of the yara rules.", + "misp-attribute": "comment", + "ui-priority": 0 }, "whitelist": { "description": "Whitelist name used to generate the rules.", - "ui-priority": 0, - "misp-attribute": "comment" - }, - "yara-hunt": { - "description": "Wide yara rule generated from -yh.", - "disable_correlation": true, - "ui-priority": 0, - "misp-attribute": "yara" + "misp-attribute": "comment", + "ui-priority": 0 }, "yara": { "description": "Yara rule generated from -y.", "disable_correlation": true, - "ui-priority": 0, - "misp-attribute": "yara" + "misp-attribute": "yara", + "ui-priority": 0 + }, + "yara-hunt": { + "description": "Wide yara rule generated from -yh.", + "disable_correlation": true, + "misp-attribute": "yara", + "ui-priority": 0 } }, - "version": 2, "description": "yabin.py generates Yara rules from function prologs, for matching and hunting binaries. ref: https://github.com/AlienVault-OTX/yabin", "meta-category": "file", + "name": "yabin", + "requiredOneOf": [ + "yara", + "yara-hunt" + ], "uuid": "35b4dd03-4fa9-4e0e-97d8-a2867b11c956", - "name": "yabin" -} + "version": 2 +} \ No newline at end of file diff --git a/objects/yara/definition.json b/objects/yara/definition.json index 4b9ba94..01d747c 100644 --- a/objects/yara/definition.json +++ b/objects/yara/definition.json @@ -1,47 +1,47 @@ { - "requiredOneOf": [ - "yara", - "yara-rule-name" - ], "attributes": { "comment": { "description": "A description of the YARA rule.", - "ui-priority": 0, - "misp-attribute": "comment" - }, - "yara": { - "description": "YARA rule.", - "ui-priority": 0, - "misp-attribute": "yara" - }, - "yara-rule-name": { - "description": "YARA rule name.", - "ui-priority": 0, - "misp-attribute": "text" - }, - "version": { - "sane_default": [ - "3.7.1" - ], - "description": "Version of the YARA rule depending where the yara rule is known to work as expected.", - "ui-priority": 0, - "misp-attribute": "text" + "misp-attribute": "comment", + "ui-priority": 0 }, "context": { "description": "Context where the YARA rule can be applied", + "misp-attribute": "text", "sane_default": [ "all", "disk", "memory", "network" ], + "ui-priority": 0 + }, + "version": { + "description": "Version of the YARA rule depending where the yara rule is known to work as expected.", + "misp-attribute": "text", + "sane_default": [ + "3.7.1" + ], + "ui-priority": 0 + }, + "yara": { + "description": "YARA rule.", + "misp-attribute": "yara", + "ui-priority": 0 + }, + "yara-rule-name": { + "description": "YARA rule name.", "misp-attribute": "text", "ui-priority": 0 } }, - "version": 4, "description": "An object describing a YARA rule (or a YARA rule name) along with its version.", "meta-category": "misc", + "name": "yara", + "requiredOneOf": [ + "yara", + "yara-rule-name" + ], "uuid": "b5acf82e-ecca-4868-82fe-9dbdf4d808c3", - "name": "yara" -} + "version": 4 +} \ No newline at end of file From 95a9d0abe1ef1ab782b96cf78465f90aa94eac2d Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Rapha=C3=ABl=20Vinot?= Date: Sun, 26 Apr 2020 02:14:00 +0200 Subject: [PATCH 149/155] chg: sort all entries in jq script --- jq_all_the_things.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/jq_all_the_things.sh b/jq_all_the_things.sh index ad80ca2..a7f6b7b 100755 --- a/jq_all_the_things.sh +++ b/jq_all_the_things.sh @@ -19,7 +19,7 @@ set -x for dir in objects/*/definition.json do - cat ${dir} | jq . | sponge ${dir} + cat ${dir} | jq -S -j . | sponge ${dir} done cat relationships/definition.json | jq . | sponge relationships/definition.json From f12b2ecf29a0fe7e73299943e45d1195d928459a Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Rapha=C3=ABl=20Vinot?= Date: Sun, 26 Apr 2020 03:02:02 +0200 Subject: [PATCH 150/155] chg: Sort relationships --- jq_all_the_things.sh | 2 +- relationships/definition.json | 558 +++++++++++++++++----------------- 2 files changed, 280 insertions(+), 280 deletions(-) diff --git a/jq_all_the_things.sh b/jq_all_the_things.sh index a7f6b7b..1d6cc73 100755 --- a/jq_all_the_things.sh +++ b/jq_all_the_things.sh @@ -22,7 +22,7 @@ do cat ${dir} | jq -S -j . | sponge ${dir} done -cat relationships/definition.json | jq . | sponge relationships/definition.json +cat relationships/definition.json | jq -S -j . | sponge relationships/definition.json cat schema_objects.json | jq . | sponge schema_objects.json cat schema_relationships.json | jq . | sponge schema_relationships.json diff --git a/relationships/definition.json b/relationships/definition.json index 763274f..1670a91 100644 --- a/relationships/definition.json +++ b/relationships/definition.json @@ -1,1006 +1,1006 @@ { - "version": 18, + "description": "Default type of relationships in MISP objects.", + "name": "relationships", + "uuid": "b002c0d6-320f-450d-82c4-b3aa15bbbd6c", "values": [ { - "name": "derived-from", "description": "The information in the target object is based on information from the source object.", "format": [ "misp", "stix-2.0", "alfred" - ] + ], + "name": "derived-from" }, { - "name": "executes", "description": "This relationship describes an object which executes another object", "format": [ "misp" - ] + ], + "name": "executes" }, { - "name": "duplicate-of", "description": "The referenced source and target objects are semantically duplicates of each other.", "format": [ "misp", "stix-2.0" - ] + ], + "name": "duplicate-of" }, { - "name": "related-to", "description": "The referenced source is related to the target object.", "format": [ "misp", "stix-2.0", "alfred" - ] + ], + "name": "related-to" }, { - "name": "connected-to", "description": "The referenced source is connected to the target object.", "format": [ "misp", "stix-1.1" - ] + ], + "name": "connected-to" }, { - "name": "connected-from", "description": "The referenced source is connected from the target object.", "format": [ "misp", "stix-1.1" - ] + ], + "name": "connected-from" }, { - "name": "contains", "description": "The referenced source is containing the target object.", "format": [ "misp", "stix-1.1", "alfred" - ] + ], + "name": "contains" }, { - "name": "contained-by", "description": "The referenced source is contained by the target object.", "format": [ "misp", "stix-1.1" - ] + ], + "name": "contained-by" }, { - "name": "contained-within", "description": "The referenced source is contained within the target object.", "format": [ "misp", "stix-1.1" - ] + ], + "name": "contained-within" }, { - "name": "characterized-by", "description": "The referenced source is characterized by the target object.", "format": [ "misp", "stix-1.1" - ] + ], + "name": "characterized-by" }, { - "name": "characterizes", "description": "The referenced source is characterizing the target object.", "format": [ "misp", "stix-1.1" - ] + ], + "name": "characterizes" }, { - "name": "properties-queried", "description": "The referenced source has queried the target object.", "format": [ "misp", "stix-1.1" - ] + ], + "name": "properties-queried" }, { - "name": "properties-queried-by", "description": "The referenced source is queried by the target object.", "format": [ "misp", "stix-1.1" - ] + ], + "name": "properties-queried-by" }, { - "name": "extracted-from", "description": "The referenced source is extracted from the target object.", "format": [ "misp", "stix-1.1" - ] + ], + "name": "extracted-from" }, { - "name": "supra-domain-of", "description": "The referenced source is a supra domain of the target object.", "format": [ "misp", "stix-1.1" - ] + ], + "name": "supra-domain-of" }, { - "name": "sub-domain-of", "description": "The referenced source is a sub domain of the target object.", "format": [ "misp", "stix-1.1" - ] + ], + "name": "sub-domain-of" }, { - "name": "dropped", "description": "The referenced source has dropped the target object.", "format": [ "misp", "stix-1.1" - ] + ], + "name": "dropped" }, { - "name": "dropped-by", "description": "The referenced source is dropped by the target object.", "format": [ "misp", "stix-1.1" - ] + ], + "name": "dropped-by" }, { - "name": "downloaded", "description": "The referenced source has downloaded the target object.", "format": [ "misp", "stix-1.1" - ] + ], + "name": "downloaded" }, { - "name": "downloaded-from", "description": "The referenced source has been downloaded from the target object.", "format": [ "misp", "stix-1.1" - ] + ], + "name": "downloaded-from" }, { - "name": "resolved-to", "description": "The referenced source is resolved to the target object.", "format": [ "misp", "stix-1.1" - ] + ], + "name": "resolved-to" }, { - "name": "attributed-to", "description": "This referenced source is attributed to the target object.", "format": [ "misp", "stix-2.0" - ] + ], + "name": "attributed-to" }, { - "name": "targets", "description": "This relationship describes that the source object targets the target object.", "format": [ "misp", "stix-2.0" - ] + ], + "name": "targets" }, { - "name": "uses", "description": "This relationship describes the use by the source object of the target object.", "format": [ "misp", "stix-2.0", "alfred" - ] + ], + "name": "uses" }, { - "name": "indicates", "description": "This relationship describes that the source object indicates the target object.", "format": [ "misp", "stix-2.0" - ] + ], + "name": "indicates" }, { - "name": "mentions", "description": "This relationship describes that the source object mentions the target object.", "format": [ "misp" - ] + ], + "name": "mentions" }, { - "name": "mitigates", "description": "This relationship describes a source object which mitigates the target object.", "format": [ "misp", "stix-2.0" - ] + ], + "name": "mitigates" }, { - "name": "variant-of", "description": "This relationship describes a source object which is a variant of the target object", "format": [ "misp", "stix-2.0", "alfred" - ] + ], + "name": "variant-of" }, { - "name": "impersonates", "description": "This relationship describes a source object which impersonates the target object", "format": [ "misp", "stix-2.0" - ] + ], + "name": "impersonates" }, { - "name": "retrieved-from", "description": "This relationship describes an object retrieved from the target object.", "format": [ "misp" - ] + ], + "name": "retrieved-from" }, { - "name": "authored-by", "description": "This relationship describes the author of a specific object.", "format": [ "misp" - ] + ], + "name": "authored-by" }, { - "name": "is-author-of", "description": "This relationship describes an object being author by someone.", "format": [ "misp" - ] + ], + "name": "is-author-of" }, { - "name": "located", "description": "This relationship describes the location (of any type) of a specific object.", "format": [ "misp" - ] + ], + "name": "located" }, { - "name": "included-in", "description": "This relationship describes an object included in another object.", "format": [ "misp" - ] + ], + "name": "included-in" }, { - "name": "includes", "description": "This relationship describes an object that includes an other object.", "format": [ "misp" - ] + ], + "name": "includes" }, { - "name": "analysed-with", "description": "This relationship describes an object analysed by another object.", "format": [ "misp" - ] + ], + "name": "analysed-with" }, { - "name": "claimed-by", "description": "This relationship describes an object claimed by another object.", "format": [ "misp" - ] + ], + "name": "claimed-by" }, { - "name": "communicates-with", "description": "This relationship describes an object communicating with another object.", "format": [ "misp" - ] + ], + "name": "communicates-with" }, { - "name": "drops", "description": "This relationship describes an object which drops another object", "format": [ "misp" - ] + ], + "name": "drops" }, { - "name": "executed-by", "description": "This relationship describes an object executed by another object.", "format": [ "misp" - ] + ], + "name": "executed-by" }, { - "name": "affects", "description": "This relationship describes an object affected by another object.", "format": [ "misp", "alfred" - ] + ], + "name": "affects" }, { - "name": "beacons-to", "description": "This relationship describes an object beaconing to another object.", "format": [ "misp", "alfred" - ] + ], + "name": "beacons-to" }, { - "name": "abuses", "description": "This relationship describes an object which abuses another object.", "format": [ "misp" - ] + ], + "name": "abuses" }, { - "name": "exfiltrates-to", "description": "This relationship describes an object exfiltrating to another object.", "format": [ "misp", "alfred" - ] + ], + "name": "exfiltrates-to" }, { - "name": "identifies", "description": "This relationship describes an object which identifies another object.", "format": [ "misp", "alfred" - ] + ], + "name": "identifies" }, { - "name": "intercepts", "description": "This relationship describes an object which intercepts another object.", "format": [ "misp", "alfred" - ] + ], + "name": "intercepts" }, { - "name": "calls", "description": "This relationship describes an object which calls another objects.", "format": [ "misp" - ] + ], + "name": "calls" }, { - "name": "detected-as", "description": "This relationship describes an object which is detected as another object.", "format": [ "misp" - ] + ], + "name": "detected-as" }, { - "name": "followed-by", "description": "This relationship describes an object which is followed by another object. This can be used when a time reference is missing but a sequence is known.", "format": [ "misp" - ] + ], + "name": "followed-by" }, { - "name": "preceding-by", "description": "This relationship describes an object which is preceded by another object. This can be used when a time reference is missing but a sequence is known.", "format": [ "misp" - ] + ], + "name": "preceding-by" }, { - "name": "triggers", "description": "This relationship describes an object which triggers another object.", "format": [ "misp" - ] + ], + "name": "triggers" }, { - "name": "vulnerability-of", "description": "This relationship describes an object which is a vulnerability of another object.", "format": [ "cert-eu" - ] + ], + "name": "vulnerability-of" }, { - "name": "works-like", "description": "This relationship describes an object which works like another object.", "format": [ "cert-eu" - ] + ], + "name": "works-like" }, { - "name": "seller-of", "description": "This relationship describes an object which is selling another object.", "format": [ "cert-eu" - ] + ], + "name": "seller-of" }, { - "name": "seller-on", "description": "This relationship describes an object which is selling on another object.", "format": [ "cert-eu" - ] + ], + "name": "seller-on" }, { - "name": "trying-to-obtain-the-exploit", "description": "This relationship describes an object which is trying to obtain the exploit described by another object", "format": [ "cert-eu" - ] + ], + "name": "trying-to-obtain-the-exploit" }, { - "name": "used-by", "description": "This relationship describes an object which is used by another object.", "format": [ "cert-eu" - ] + ], + "name": "used-by" }, { - "name": "affiliated", "description": "This relationship describes an object which is affiliated with another object.", "format": [ "cert-eu" - ] + ], + "name": "affiliated" }, { - "name": "alleged-founder-of", "description": "This relationship describes an object which is the alleged founder of another object.", "format": [ "cert-eu" - ] + ], + "name": "alleged-founder-of" }, { - "name": "attacking-other-group", "description": "This relationship describes an object which attacks another object.", "format": [ "cert-eu" - ] + ], + "name": "attacking-other-group" }, { - "name": "belongs-to", "description": "This relationship describes an object which belongs to another object.", "format": [ "cert-eu" - ] + ], + "name": "belongs-to" }, { - "name": "business-relations", "description": "This relationship describes an object which has business relations with another object.", "format": [ "cert-eu" - ] + ], + "name": "business-relations" }, { - "name": "claims-to-be-the-founder-of", "description": "This relationship describes an object which claims to be the founder of another object.", "format": [ "cert-eu" - ] + ], + "name": "claims-to-be-the-founder-of" }, { - "name": "cooperates-with", "description": "This relationship describes an object which cooperates with another object.", "format": [ "cert-eu" - ] + ], + "name": "cooperates-with" }, { - "name": "former-member-of", "description": "This relationship describes an object which is a former member of another object.", "format": [ "cert-eu" - ] + ], + "name": "former-member-of" }, { - "name": "successor-of", "description": "This relationship describes an object which is a successor of another object.", "format": [ "cert-eu" - ] + ], + "name": "successor-of" }, { - "name": "has-joined", "description": "This relationship describes an object which has joined another object.", "format": [ "cert-eu" - ] + ], + "name": "has-joined" }, { - "name": "member-of", "description": "This relationship describes an object which is a member of another object.", "format": [ "cert-eu" - ] + ], + "name": "member-of" }, { - "name": "primary-member-of", "description": "This relationship describes an object which is a primary member of another object.", "format": [ "cert-eu" - ] + ], + "name": "primary-member-of" }, { - "name": "administrator-of", "description": "This relationship describes an object which is an administrator of another object.", "format": [ "cert-eu" - ] + ], + "name": "administrator-of" }, { - "name": "is-in-relation-with", "description": "This relationship describes an object which is in relation with another object,", "format": [ "cert-eu" - ] + ], + "name": "is-in-relation-with" }, { - "name": "provide-support-to", "description": "This relationship describes an object which provides support to another object.", "format": [ "cert-eu" - ] + ], + "name": "provide-support-to" }, { - "name": "regional-branch", "description": "This relationship describes an object which is a regional branch of another object.", "format": [ "cert-eu" - ] + ], + "name": "regional-branch" }, { - "name": "similar", "description": "This relationship describes an object which is similar to another object.", "format": [ "cert-eu" - ] + ], + "name": "similar" }, { - "name": "subgroup", "description": "This relationship describes an object which is a subgroup of another object.", "format": [ "cert-eu" - ] + ], + "name": "subgroup" }, { - "name": "suspected-link", "description": "This relationship describes an object which is suspected to be linked with another object.", "format": [ "misp" - ] + ], + "name": "suspected-link" }, { - "name": "same-as", "description": "This relationship describes an object which is the same as another object.", "format": [ "misp" - ] + ], + "name": "same-as" }, { - "name": "creator-of", "description": "This relationship describes an object which is the creator of another object.", "format": [ "cert-eu" - ] + ], + "name": "creator-of" }, { - "name": "developer-of", "description": "This relationship describes an object which is a developer of another object.", "format": [ "cert-eu" - ] + ], + "name": "developer-of" }, { - "name": "uses-for-recon", "description": "This relationship describes an object which uses another object for recon.", "format": [ "cert-eu" - ] + ], + "name": "uses-for-recon" }, { - "name": "operator-of", "description": "This relationship describes an object which is an operator of another object.", "format": [ "cert-eu" - ] + ], + "name": "operator-of" }, { - "name": "overlaps", "description": "This relationship describes an object which overlaps another object.", "format": [ "cert-eu" - ] + ], + "name": "overlaps" }, { - "name": "owner-of", "description": "This relationship describes an object which owns another object.", "format": [ "cert-eu", "alfred" - ] + ], + "name": "owner-of" }, { - "name": "publishes-method-for", "description": "This relationship describes an object which publishes method for another object.", "format": [ "cert-eu" - ] + ], + "name": "publishes-method-for" }, { - "name": "recommends-use-of", "description": "This relationship describes an object which recommends the use of another object.", "format": [ "cert-eu" - ] + ], + "name": "recommends-use-of" }, { - "name": "released-source-code", "description": "This relationship describes an object which released source code of another object.", "format": [ "cert-eu" - ] + ], + "name": "released-source-code" }, { - "name": "released", "description": "This relationship describes an object which release another object.", "format": [ "cert-eu" - ] + ], + "name": "released" }, { - "name": "exploits", "description": "This relationship describes an object (like a PoC/exploit) which exploits another object (such as a vulnerability object).", "format": [ "misp" - ] + ], + "name": "exploits" }, { - "name": "signed-by", "description": "This relationship describes an object signed by another object.", "format": [ "misp" - ] + ], + "name": "signed-by" }, { - "name": "delivered-by", "description": "This relationship describes an object by another object (such as exploit kit, dropper).", "format": [ "misp" - ] + ], + "name": "delivered-by" }, { - "name": "controls", "description": "This relationship describes an object which controls another object.", "format": [ "misp" - ] + ], + "name": "controls" }, { - "name": "annotates", "description": "This relationships describes an object which annotates another object.", "format": [ "misp" - ] + ], + "name": "annotates" }, { - "name": "references", "description": "This relationships describes an object which references another object or attribute.", "format": [ "misp" - ] + ], + "name": "references" }, { - "name": "child-of", "description": "A child semantic link to a parent.", "format": [ "alfred" - ] + ], + "name": "child-of" }, { - "name": "compromised", "description": "Represents the semantic link of having compromised something.", "format": [ "alfred" - ] + ], + "name": "compromised" }, { - "name": "connects", "description": "The initiator of a connection.", "format": [ "alfred" - ] + ], + "name": "connects" }, { - "name": "connects-to", "description": "The destination or target of a connection.", "format": [ "alfred" - ] + ], + "name": "connects-to" }, { - "name": "cover-term-for", "description": "Represents the semantic link of one thing being the cover term for another.", "format": [ "alfred" - ] + ], + "name": "cover-term-for" }, { - "name": "disclosed-to", "description": "Semantic link indicating where information is disclosed to.", "format": [ "alfred" - ] + ], + "name": "disclosed-to" }, { - "name": "downloads", "description": "Represents the semantic link of one thing downloading another.", "format": [ "alfred" - ] + ], + "name": "downloads" }, { - "name": "downloads-from", "description": "Represents the semantic link of malware being downloaded from a location.", "format": [ "alfred" - ] + ], + "name": "downloads-from" }, { - "name": "generated", "description": "Represents the semantic link of an alert generated from a signature.", "format": [ "alfred" - ] + ], + "name": "generated" }, { - "name": "implements", "description": "One data object implements another.", "format": [ "alfred" - ] + ], + "name": "implements" }, { - "name": "initiates", "description": "Represents the semantic link of a communication initiating an event.", "format": [ "alfred" - ] + ], + "name": "initiates" }, { - "name": "instance-of", "description": "Represents the semantic link between a FILE and FILE_BINARY.", "format": [ "alfred" - ] + ], + "name": "instance-of" }, { - "name": "issuer-of", "description": "Represents the semantic link of being the issuer of something.", "format": [ "alfred" - ] + ], + "name": "issuer-of" }, { - "name": "linked-to", "description": "Represents the semantic link of being associated with something.", "format": [ "alfred" - ] + ], + "name": "linked-to" }, { - "name": "not-relevant-to", "description": "Represents the semantic link of a comm that is not relevant to an EVENT.", "format": [ "alfred" - ] + ], + "name": "not-relevant-to" }, { - "name": "part-of", "description": "Represents the semantic link that defines one thing to be part of another in a hierachial structure from the child to the parent.", "format": [ "alfred" - ] + ], + "name": "part-of" }, { - "name": "processed-by", "description": "Represents the semantic link of something has been processed by another program.", "format": [ "alfred" - ] + ], + "name": "processed-by" }, { - "name": "produced", "description": "Represents the semantic link of something having produced something else.", "format": [ "alfred" - ] + ], + "name": "produced" }, { - "name": "queried-for", "description": "The IP Address or domain being queried for.", "format": [ "alfred" - ] + ], + "name": "queried-for" }, { - "name": "query-returned", "description": "The IP Address or domain returned as the result of a query.", "format": [ "alfred" - ] + ], + "name": "query-returned" }, { - "name": "registered", "description": "Represents the semantic link of someone registered some thing.", "format": [ "alfred" - ] + ], + "name": "registered" }, { - "name": "registered-to", "description": "Represents the semantic link of something being registered to.", "format": [ "alfred" - ] + ], + "name": "registered-to" }, { - "name": "relates", "description": "Represents the semantic link between HBS Comms and communication addresses.", "format": [ "alfred" - ] + ], + "name": "relates" }, { - "name": "relevant-to", "description": "Represents the semantic link of a comm that is relevant to an EVENT.", "format": [ "alfred" - ] + ], + "name": "relevant-to" }, { - "name": "resolves-to", "description": "Represents the semantic link of resolving to something.", "format": [ "alfred" - ] + ], + "name": "resolves-to" }, { - "name": "responsible-for", "description": "Represents the semantic link of some entity being responsible for something.", "format": [ "alfred" - ] + ], + "name": "responsible-for" }, { - "name": "seeded", "description": "Represents the semantic link of a seeded domain redirecting to another site.", "format": [ "alfred" - ] + ], + "name": "seeded" }, { - "name": "sends", "description": "A sends semantic link meaning 'who sends what'.", "format": [ "alfred" - ] + ], + "name": "sends" }, { - "name": "sends-as-bcc-to", "description": "A sends to as BCC semantic link meaning 'what sends to who as BCC'.", "format": [ "alfred" - ] + ], + "name": "sends-as-bcc-to" }, { - "name": "sends-as-cc-to", "description": "A sends to as CC semantic link meaning 'what sends to who as CC'.", "format": [ "alfred" - ] + ], + "name": "sends-as-cc-to" }, { - "name": "sends-to", "description": "A sends to semantic link meaning 'what sends to who'.", "format": [ "alfred" - ] + ], + "name": "sends-to" }, { - "name": "spoofer-of", "description": "The represents the semantic link of having spoofed something.", "format": [ "alfred" - ] + ], + "name": "spoofer-of" }, { - "name": "subdomain-of", "description": "Represents a domain being a subdomain of another.", "format": [ "alfred" - ] + ], + "name": "subdomain-of" }, { - "name": "supersedes", "description": "One data object supersedes another.", "format": [ "alfred" - ] + ], + "name": "supersedes" }, { - "name": "triggered-on", "description": "Represents the semantic link of an alert triggered on an event.", "format": [ "alfred" - ] + ], + "name": "triggered-on" }, { - "name": "uploads", "description": "Represents the semantic link of one thing uploading another.", "format": [ "alfred" - ] + ], + "name": "uploads" }, { - "name": "user-of", "description": "The represents the semantic link of being the user of something.", "format": [ "alfred" - ] + ], + "name": "user-of" }, { - "name": "works-for", "description": "Represents the semantic link of working for something.", "format": [ "alfred" - ] + ], + "name": "works-for" }, { - "name": "witness-of", "description": "Represents an object being a witness of something.", "format": [ "misp" - ] + ], + "name": "witness-of" }, { - "name": "injects-into", "description": "Represents an object injecting something into something", "format": [ "misp" - ] + ], + "name": "injects-into" }, { - "name": "injected-into", "description": "Represents an object which is injected something into something", "format": [ "misp" - ] + ], + "name": "injected-into" }, { - "name": "creates", "description": "Represents an object that creates something.", "format": [ "misp", "haxpak" - ] + ], + "name": "creates" }, { - "name": "screenshot-of", "description": "Represents an object being the screenshot of something.", "format": [ "misp" - ] + ], + "name": "screenshot-of" }, { - "name": "knows", "description": "Represents an object having the knowledge of another object.", "format": [ "misp" - ] + ], + "name": "knows" } ], - "description": "Default type of relationships in MISP objects.", - "uuid": "b002c0d6-320f-450d-82c4-b3aa15bbbd6c", - "name": "relationships" -} + "version": 18 +} \ No newline at end of file From aa1a6add26ad50d1a44baad49a14fbe5d5b9da44 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Rapha=C3=ABl=20Vinot?= Date: Sun, 26 Apr 2020 03:08:45 +0200 Subject: [PATCH 151/155] fix: Python2 is dead dead dead --- unique_uuid.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/unique_uuid.py b/unique_uuid.py index 1c9171f..349447d 100755 --- a/unique_uuid.py +++ b/unique_uuid.py @@ -1,4 +1,4 @@ -#!/usr/bin/env python +#!/usr/bin/env python3 # -*- coding: utf-8 -*- from glob import glob From 866ea7e51f375a9f6a5364715990bcade92ef364 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Rapha=C3=ABl=20Vinot?= Date: Mon, 27 Apr 2020 15:50:10 +0200 Subject: [PATCH 152/155] new: Category FollowTheMoney To represent objects described there: https://docs.alephdata.org/developers/FollowTheMoney --- schema_objects.json | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/schema_objects.json b/schema_objects.json index 6c2f32a..e046803 100644 --- a/schema_objects.json +++ b/schema_objects.json @@ -262,7 +262,8 @@ "vulnerability", "climate", "iot", - "health" + "health", + "followthemoney" ], "type": "string" }, From 84633dbd32838bf5ce9dae3844613c7af11948b5 Mon Sep 17 00:00:00 2001 From: VVX7 Date: Tue, 28 Apr 2020 11:57:28 -0400 Subject: [PATCH 153/155] new: [publication] add object to describe academic journals, books, etc. --- objects/publication/definition.json | 129 ++++++++++++++++++++++++++++ 1 file changed, 129 insertions(+) create mode 100644 objects/publication/definition.json diff --git a/objects/publication/definition.json b/objects/publication/definition.json new file mode 100644 index 0000000..db980c4 --- /dev/null +++ b/objects/publication/definition.json @@ -0,0 +1,129 @@ +{ + "attributes": { + "publisher": { + "description": "Publisher of the document.", + "misp-attribute": "text", + "ui-priority": 0 + }, + "academic-institution": { + "description": "Academic institution associated with the publisher or authors.", + "misp-attribute": "text", + "multiple": true, + "ui-priority": 0 + }, + "author": { + "description": "Author of the publication.", + "misp-attribute": "text", + "multiple": true, + "ui-priority": 0 + }, + "contributor": { + "description": "Contributors include editors, compilers, and translators.", + "misp-attribute": "attachment", + "multiple": true, + "ui-priority": 0 + }, + "title": { + "description": "Content of the publication.", + "misp-attribute": "text", + "ui-priority": 0 + }, + "content": { + "description": "Content of the publication.", + "misp-attribute": "text", + "ui-priority": 0 + }, + "edition": { + "description": "Edition of the publication.", + "misp-attribute": "text", + "disable_correlation": true, + "ui-priority": 0 + }, + "series": { + "description": "Series of the publication.", + "misp-attribute": "text", + "disable_correlation": true, + "ui-priority": 0 + }, + "volume": { + "description": "Volume of the publication.", + "misp-attribute": "text", + "disable_correlation": true, + "ui-priority": 0 + }, + "year": { + "description": "Year of publication.", + "misp-attribute": "text", + "disable_correlation": true, + "ui-priority": 0 + }, + "ISBN": { + "description": "International Standard Book Number.", + "misp-attribute": "text", + "multiple": true, + "ui-priority": 0 + }, + "DOI": { + "description": "DOI System is used to identify digital resources.", + "misp-attribute": "text", + "multiple": true, + "ui-priority": 0 + }, + "archive": { + "description": "Archive of the original document (Internet Archive, Archive.is, etc).", + "misp-attribute": "link", + "multiple": true, + "ui-priority": 1 + }, + "attachment": { + "description": "The publication file or screen capture.", + "misp-attribute": "attachment", + "multiple": true, + "ui-priority": 1 + }, + "link": { + "description": "Original link to the publication (supposed harmless).", + "misp-attribute": "link", + "multiple": true, + "ui-priority": 1 + }, + "url": { + "description": "Original link to the publication (possibly malicious).", + "misp-attribute": "url", + "multiple": true, + "ui-priority": 1 + }, + "embedded-link": { + "description": "Link contained in the publication (possibly malicious).", + "misp-attribute": "url", + "multiple": true, + "ui-priority": 0 + }, + "embedded-safe-link": { + "description": "Link contained in the publication (assumed safe).", + "misp-attribute": "link", + "multiple": true, + "ui-priority": 0 + }, + "description": { + "description": "A description of the publication.", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 1 + }, + "website": { + "description": "Website of the publisher.", + "misp-attribute": "link", + "disable_correlation": true, + "ui-priority": 0 + } + }, + "description": "An object to describe a book, journal, or academic publication.", + "meta-category": "misc", + "name": "publication", + "requiredOneOf": [ + "name" + ], + "uuid": "8a86b056-7f2c-4c1b-b04e-a6bac4443068", + "version": 1 +} \ No newline at end of file From 738f32e27b4a66f3895bd6457fceec491ad1f370 Mon Sep 17 00:00:00 2001 From: VVX7 Date: Tue, 28 Apr 2020 15:46:13 -0400 Subject: [PATCH 154/155] new: [publication] jq'd the object --- objects/publication/definition.json | 132 ++++++++++++++-------------- 1 file changed, 66 insertions(+), 66 deletions(-) diff --git a/objects/publication/definition.json b/objects/publication/definition.json index db980c4..f7b354c 100644 --- a/objects/publication/definition.json +++ b/objects/publication/definition.json @@ -1,70 +1,19 @@ { "attributes": { - "publisher": { - "description": "Publisher of the document.", - "misp-attribute": "text", - "ui-priority": 0 - }, - "academic-institution": { - "description": "Academic institution associated with the publisher or authors.", + "DOI": { + "description": "DOI System is used to identify digital resources.", "misp-attribute": "text", "multiple": true, "ui-priority": 0 }, - "author": { - "description": "Author of the publication.", - "misp-attribute": "text", - "multiple": true, - "ui-priority": 0 - }, - "contributor": { - "description": "Contributors include editors, compilers, and translators.", - "misp-attribute": "attachment", - "multiple": true, - "ui-priority": 0 - }, - "title": { - "description": "Content of the publication.", - "misp-attribute": "text", - "ui-priority": 0 - }, - "content": { - "description": "Content of the publication.", - "misp-attribute": "text", - "ui-priority": 0 - }, - "edition": { - "description": "Edition of the publication.", - "misp-attribute": "text", - "disable_correlation": true, - "ui-priority": 0 - }, - "series": { - "description": "Series of the publication.", - "misp-attribute": "text", - "disable_correlation": true, - "ui-priority": 0 - }, - "volume": { - "description": "Volume of the publication.", - "misp-attribute": "text", - "disable_correlation": true, - "ui-priority": 0 - }, - "year": { - "description": "Year of publication.", - "misp-attribute": "text", - "disable_correlation": true, - "ui-priority": 0 - }, "ISBN": { "description": "International Standard Book Number.", "misp-attribute": "text", "multiple": true, "ui-priority": 0 }, - "DOI": { - "description": "DOI System is used to identify digital resources.", + "academic-institution": { + "description": "Academic institution associated with the publisher or authors.", "misp-attribute": "text", "multiple": true, "ui-priority": 0 @@ -81,17 +30,34 @@ "multiple": true, "ui-priority": 1 }, - "link": { - "description": "Original link to the publication (supposed harmless).", - "misp-attribute": "link", + "author": { + "description": "Author of the publication.", + "misp-attribute": "text", "multiple": true, + "ui-priority": 0 + }, + "content": { + "description": "Content of the publication.", + "misp-attribute": "text", + "ui-priority": 0 + }, + "contributor": { + "description": "Contributors include editors, compilers, and translators.", + "misp-attribute": "attachment", + "multiple": true, + "ui-priority": 0 + }, + "description": { + "description": "A description of the publication.", + "disable_correlation": true, + "misp-attribute": "text", "ui-priority": 1 }, - "url": { - "description": "Original link to the publication (possibly malicious).", - "misp-attribute": "url", - "multiple": true, - "ui-priority": 1 + "edition": { + "description": "Edition of the publication.", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 0 }, "embedded-link": { "description": "Link contained in the publication (possibly malicious).", @@ -105,16 +71,50 @@ "multiple": true, "ui-priority": 0 }, - "description": { - "description": "A description of the publication.", + "link": { + "description": "Original link to the publication (supposed harmless).", + "misp-attribute": "link", + "multiple": true, + "ui-priority": 1 + }, + "publisher": { + "description": "Publisher of the document.", + "misp-attribute": "text", + "ui-priority": 0 + }, + "series": { + "description": "Series of the publication.", "disable_correlation": true, "misp-attribute": "text", + "ui-priority": 0 + }, + "title": { + "description": "Content of the publication.", + "misp-attribute": "text", + "ui-priority": 0 + }, + "url": { + "description": "Original link to the publication (possibly malicious).", + "misp-attribute": "url", + "multiple": true, "ui-priority": 1 }, + "volume": { + "description": "Volume of the publication.", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 0 + }, "website": { "description": "Website of the publisher.", - "misp-attribute": "link", "disable_correlation": true, + "misp-attribute": "link", + "ui-priority": 0 + }, + "year": { + "description": "Year of publication.", + "disable_correlation": true, + "misp-attribute": "text", "ui-priority": 0 } }, From bb600ce6279dc60e8c3b431f9610a2f1479110b3 Mon Sep 17 00:00:00 2001 From: VVX7 Date: Tue, 28 Apr 2020 18:58:59 -0400 Subject: [PATCH 155/155] chg: [publication] modify requiredOneOf, contributor type to text attribute --- objects/publication/definition.json | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/objects/publication/definition.json b/objects/publication/definition.json index f7b354c..179b765 100644 --- a/objects/publication/definition.json +++ b/objects/publication/definition.json @@ -43,7 +43,7 @@ }, "contributor": { "description": "Contributors include editors, compilers, and translators.", - "misp-attribute": "attachment", + "misp-attribute": "text", "multiple": true, "ui-priority": 0 }, @@ -122,8 +122,11 @@ "meta-category": "misc", "name": "publication", "requiredOneOf": [ - "name" + "title", + "link", + "archive", + "ISBN" ], "uuid": "8a86b056-7f2c-4c1b-b04e-a6bac4443068", - "version": 1 + "version": 2 } \ No newline at end of file