From 45f6aec0f50c3246f4a279c0afb09205856c9f51 Mon Sep 17 00:00:00 2001
From: Sascha Rommelfangen <sascha@rommelfangen.de>
Date: Mon, 25 Feb 2019 09:29:15 +0100
Subject: [PATCH] corrected order

---
 objects/phishing/definition.json | 177 ++++++++++++++++---------------
 1 file changed, 93 insertions(+), 84 deletions(-)

diff --git a/objects/phishing/definition.json b/objects/phishing/definition.json
index 3b0c4d2..deadb3c 100644
--- a/objects/phishing/definition.json
+++ b/objects/phishing/definition.json
@@ -1,108 +1,117 @@
 {
-  "requiredOneOf": [
-    "url"
-  ],
+  "name": "phishing",
+  "uuid": "2dad6f9d-d425-4217-8fda-0b0a2d815307",
+  "meta-category": "network",
+  "description": "Phishing template to describe a phishing website and its analysis.",
+  "version": 5,
   "attributes": {
-    "url": {
-      "description": "Original url of the phishing website",
-      "ui-priority": 1,
-      "misp-attribute": "url"
-    },
-    "hostname": {
-      "description": "host of the phishing website",
-      "ui-priority": 1,
-      "misp-attribute": "hostname"
-    },
-    "phishtank-id": {
-      "description": "Phishtank ID of the reported phishing",
-      "ui-priority": 1,
-      "misp-attribute": "text"
-    },
-    "phishtank-detail-url": {
-      "description": "Phishtank detail URL to the reported phishing",
-      "misp-attribute": "link",
-      "ui-priority": 1
-    },
-    "submission-time": {
-      "description": "When the phishing was submitted and/or reported",
-      "ui-priority": 0,
-      "misp-attribute": "datetime"
-    },
-    "verified": {
-      "description": "The phishing has been verified by the team handling the phishing",
-      "ui-priority": 0,
-      "values_list": [
-        "No",
-        "Yes"
+    "internal reference": {
+      "categories": [
+        "Internal reference"
       ],
       "misp-attribute": "text",
-      "disable_correlation": true
+      "ui-priority": 1,
+      "description": "Internal reference such as ticket ID"
     },
-    "verification-time": {
-      "description": "When the phishing was verified",
+    "screenshot": {
+      "multiple": true,
+      "categories": [
+        "External analysis"
+      ],
+      "ui-priority": 1,
+      "disable_correlation": true,
+      "misp-attribute": "attachment",
+      "description": "Screenshot of phishing site"
+    },
+    "target": {
+      "multiple": true,
+      "misp-attribute": "text",
       "ui-priority": 0,
+      "description": "Targeted organisation by the phishing"
+    },
+    "takedown-request-to": {
+      "to_ids": false,
+      "multiple": true,
+      "categories": [
+        "Other"
+      ],
+      "ui-priority": 1,
+      "disable_correlation": true,
+      "misp-attribute": "text",
+      "description": "Destination email address for take-down request"
+    },
+    "takedown-request": {
+      "disable_correlation": true,
       "misp-attribute": "datetime",
-      "disable_correlation": true
+      "ui-priority": 0,
+      "description": "When the phishing was requested to be taken down"
+    },
+    "takedown-time": {
+      "disable_correlation": true,
+      "misp-attribute": "datetime",
+      "ui-priority": 0,
+      "description": "When the phishing was taken down"
     },
     "online": {
-      "description": "If the phishing is online and operational, by default is yes",
-      "ui-priority": 0,
+      "disable_correlation": true,
+      "misp-attribute": "text",
       "values_list": [
         "Yes",
         "No"
       ],
-      "misp-attribute": "text",
-      "disable_correlation": true
-    },
-    "takedown-time": {
-      "description": "When the phishing was taken down",
       "ui-priority": 0,
-      "misp-attribute": "datetime",
-      "disable_correlation": true
+      "description": "If the phishing is online and operational, by default is yes"
     },
-    "takedown-request": {
-      "description": "When the phishing was requested to be taken down",
-      "ui-priority": 0,
-      "misp-attribute": "datetime",
-      "disable_correlation": true
-    },
-    "takedown-request-to": {
-      "description": "Destination email address for take-down request",
-      "misp-attribute": "text",
-      "disable_correlation": true,
+    "url": {
+      "misp-attribute": "url",
       "ui-priority": 1,
-      "categories": [
-        "Other"
-      ],
+      "description": "Original URL of the phishing website"
+    },
+    "url-redirect": {
       "multiple": true,
-      "to_ids": false
-    },
-    "target": {
-      "description": "Targeted organisation by the phishing",
-      "ui-priority": 0,
-      "misp-attribute": "text"
-    },
-    "screenshot": {
-      "description": "Screenshot of phishing site",
-      "misp-attribute": "attachment",
-      "disable_correlation": true,
+      "misp-attribute": "url",
       "ui-priority": 1,
-      "categories": [
-        "External analysis"
-      ]
+      "description": "Redirect URL of the phishing website"
     },
-    "internal reference": {
-      "description": "Internal reference such as ticket ID",
+    "hostname": {
+      "multiple": true,
+      "misp-attribute": "hostname",
       "ui-priority": 1,
+      "description": "host of the phishing website"
+    },
+    "phishtank-id": {
       "misp-attribute": "text",
-      "categories": [
-        "Internal reference"
-      ]
+      "ui-priority": 1,
+      "description": "Phishtank ID of the reported phishing"
+    },
+    "phishtank-detail-url": {
+      "ui-priority": 1,
+      "misp-attribute": "link",
+      "description": "Phishtank detail URL to the reported phishing"
+    },
+    "submission-time": {
+      "misp-attribute": "datetime",
+      "ui-priority": 0,
+      "description": "When the phishing was submitted and/or reported"
+    },
+    "verified": {
+      "disable_correlation": true,
+      "misp-attribute": "text",
+      "values_list": [
+        "No",
+        "Yes"
+      ],
+      "ui-priority": 0,
+      "description": "The phishing has been verified by the team handling the phishing"
+    },
+    "verification-time": {
+      "disable_correlation": true,
+      "misp-attribute": "datetime",
+      "ui-priority": 0,
+      "description": "When the phishing was verified"
     }
   },
-  "version": 4,
-  "description": "Phishing template to describe a phishing website and its analysis.",
-  "meta-category": "network",
-  "uuid": "2dad6f9d-d425-4217-8fda-0b0a2d815307",
-  "name": "phishing"
+  "requiredOneOf": [
+    "url"
+  ]
 }