From 6bfa2797011a8d9888dc871c076a672619986a44 Mon Sep 17 00:00:00 2001
From: Alexandre Dulaunoy <a@foo.be>
Date: Wed, 18 Jul 2018 09:52:31 +0200
Subject: [PATCH] new: [short-message-service] Short Message Service (SMS)
 object template describing one or more SMS message added

---
 README.md                                     |  1 +
 objects/short-message-service/definition.json | 47 +++++++++++++++++++
 2 files changed, 48 insertions(+)
 create mode 100644 objects/short-message-service/definition.json

diff --git a/README.md b/README.md
index afb1b89..963e2f3 100644
--- a/README.md
+++ b/README.md
@@ -113,6 +113,7 @@ for a specific attribute.
 * [objects/sandbox-report](objects/sandbox-report/definition.json) - Sandbox report object.
 * [objects/sb-signature](objects/sb-signature/definition.json) - Sandbox detection signature object.
 * [objects/script](objects/script/definition.json) - Object describing a computer program written to be run in a special run-time environment. The script or shell script can be used for malicious activities but also as support tools for threat analysts.
+* [objects/short-message-service](objects/short-message-service/definition.json) - Short Message Service (SMS) object template describing one or more SMS message(s).
 * [objects/shortened-link](objects/shortened-link/definition.json) - Shortened link and its redirect target.
 * [objects/ss7-attack](objects/ss7-attack/definition.json) - SS7 object of an attack seen on a GSM, UMTS or LTE network via SS7 logging.
 * [objects/stix2-pattern](objects/stix2-pattern/definition.json) - An object describing a STIX pattern. The object can be linked via a relationship to other attributes or objects to describe how it can be represented as a STIX pattern.
diff --git a/objects/short-message-service/definition.json b/objects/short-message-service/definition.json
new file mode 100644
index 0000000..6ad1a92
--- /dev/null
+++ b/objects/short-message-service/definition.json
@@ -0,0 +1,47 @@
+{
+  "requiredOneOf": [
+    "body",
+    "from"
+  ],
+  "attributes": {
+    "body": {
+      "description": "Message body of the SMS",
+      "ui-priority": 1,
+      "misp-attribute": "text"
+    },
+    "url-rfc5724": {
+      "description": "url representing SMS using RFC 5724 (not url contained in the SMS which should use an url object)",
+      "ui-priority": 6,
+      "misp-attribute": "url"
+    },
+    "from": {
+      "description": "Phone number used to send the SMS",
+      "ui-priority": 1,
+      "misp-attribute": "phone-number",
+      "multiple": true
+    },
+    "to": {
+      "description": "Phone number receiving the SMS",
+      "ui-priority": 1,
+      "misp-attribute": "phone-number",
+      "multiple": true
+    },
+    "sent-date": {
+      "description": "Initial sent date of the SMS",
+      "ui-priority": 0,
+      "misp-attribute": "datetime",
+      "disable_correlation": true
+    },
+    "received-date": {
+      "description": "Received date of the SMS",
+      "ui-priority": 0,
+      "misp-attribute": "datetime",
+      "disable_correlation": true
+    }
+  },
+  "version": 1,
+  "description": "Short Message Service (SMS) object template describing one or more SMS message. Restriction of the initial format 3GPP 23.038 GSM character set doesn't apply.",
+  "meta-category": "misc",
+  "uuid": "4851a3dc-e1a6-43ac-9d97-f0d13a099fd2",
+  "name": "short-message-service"
+}