mirror of https://github.com/MISP/misp-objects
Add: python-etvx object
aksha
parent
f8226fc200
commit
711abb094a
|
|
@ -0,0 +1,177 @@
|
|||
{
|
||||
"required": [
|
||||
"source",
|
||||
"type",
|
||||
"name"
|
||||
],
|
||||
"attributes": {
|
||||
"event-id": {
|
||||
"description": "A unique number which identifies the event.",
|
||||
"ui-priority": 0,
|
||||
"misp-attribute": "text",
|
||||
"disable_correlation": true
|
||||
},
|
||||
"name": {
|
||||
"description": "Name of the event.",
|
||||
"ui-priority": 0,
|
||||
"misp-attribute": "text",
|
||||
"disable_correlation": true
|
||||
},
|
||||
"event-channel":
|
||||
{
|
||||
"description":" Channel through which the event occurred",
|
||||
"ui-priority": 0,
|
||||
"misp-attribute": "text",
|
||||
"disable_correlation": true,
|
||||
"sane-default":[
|
||||
"Application",
|
||||
"System",
|
||||
"Security",
|
||||
"Setup",
|
||||
"other"
|
||||
]
|
||||
},
|
||||
"event-type":
|
||||
{
|
||||
"description": "Event-type assigned to the event",
|
||||
"ui-priority": 0,
|
||||
"misp-attribute": "text",
|
||||
"disable_correlation": true,
|
||||
"sane-default":[
|
||||
"Admin",
|
||||
"Operational",
|
||||
"Audit",
|
||||
"Analytic",
|
||||
"Debug",
|
||||
"other"
|
||||
]
|
||||
},
|
||||
"source": {
|
||||
"description": "The source of the event log - application/software that logged the event.",
|
||||
"ui-priority": 0,
|
||||
"misp-attribute": "text"
|
||||
},
|
||||
"event-date-time":
|
||||
{
|
||||
"description": "Date and time when the event was logged.",
|
||||
"ui-priority": 0,
|
||||
"misp-attribute": "datetime",
|
||||
"disable_correlation": true
|
||||
},
|
||||
"level": {
|
||||
"description": "Determines the event severity.",
|
||||
"ui-priority": 0,
|
||||
"misp-attribute": "text",
|
||||
"sane_default":[
|
||||
"Information",
|
||||
"Warning",
|
||||
"Error",
|
||||
"Critical",
|
||||
"Success Audit",
|
||||
"Failure Audit"
|
||||
]
|
||||
},
|
||||
"Computer": {
|
||||
"description": "Computer name on which the event occurred",
|
||||
"ui-priority": 0,
|
||||
"misp-attribute": "text",
|
||||
"disable_correlation": true
|
||||
},
|
||||
"User": {
|
||||
"description": "Name or the User ID the event is associated with.",
|
||||
"ui-priority": 0,
|
||||
"misp-attribute": "text",
|
||||
"disable_correlation": true
|
||||
},
|
||||
"Operational-code": {
|
||||
"description": "The opcode (numeric value or name) associated with the activity carried out by the event.",
|
||||
"ui-priority": 0,
|
||||
"misp-attribute": "text",
|
||||
"disable_correlation": true
|
||||
},
|
||||
"log": {
|
||||
"description": "Log file where the event was recorded.",
|
||||
"ui-priority": 0,
|
||||
"misp-attribute": "text",
|
||||
"disable_correlation": true
|
||||
},
|
||||
"task-category":{
|
||||
"description": "Activity by the event publisher",
|
||||
"ui-priority": 0,
|
||||
"misp-attribute": "text",
|
||||
"disable_correlation": true
|
||||
},
|
||||
"Keywords":{
|
||||
"description" : "Tags used for the event for the purpose of filtering or searching.",
|
||||
"ui-priority": 0,
|
||||
"misp-attribute": "text",
|
||||
"sane_default":[
|
||||
"Network",
|
||||
"Security",
|
||||
"Resource not found",
|
||||
"other"
|
||||
]
|
||||
},
|
||||
"Processor-ID": {
|
||||
"description": "ID of the processor that processed the event.",
|
||||
"ui-priority": 0,
|
||||
"misp-attribute": "text",
|
||||
"disable_correlation": true
|
||||
},
|
||||
"Thread-ID": {
|
||||
"description": "Thread id that generated the event.",
|
||||
"ui-priority": 0,
|
||||
"misp-attribute": "text",
|
||||
"disable_correlation": true
|
||||
},
|
||||
"Session-ID": {
|
||||
"description": "Terminal server session ID.",
|
||||
"ui-priority": 0,
|
||||
"misp-attribute": "text",
|
||||
"disable_correlation": true
|
||||
},
|
||||
"Correlation-ID": {
|
||||
"description": "Unique activity identity which relates the event to a process. ",
|
||||
"ui-priority": 0,
|
||||
"misp-attribute": "text"
|
||||
},
|
||||
"Relative-Correlation-ID": {
|
||||
"description": "Related activity ID which identity similar activities which occurred as a part of the event.",
|
||||
"ui-priority": 0,
|
||||
"misp-attribute": "text",
|
||||
"disable_correlation": true
|
||||
},
|
||||
"kernel-time":
|
||||
{
|
||||
"description": "Execution time of the kernel mode instruction.",
|
||||
"ui-priority": 0,
|
||||
"misp-attribute": "datetime",
|
||||
"disable_correlation": true
|
||||
},
|
||||
"user-time":
|
||||
{
|
||||
"description": "Date and time when the user instruction was executed.",
|
||||
"ui-priority": 0,
|
||||
"misp-attribute": "datetime",
|
||||
"disable_correlation": true
|
||||
},
|
||||
"Event-data":
|
||||
{
|
||||
"description": "Event data description.",
|
||||
"ui-priority": 0,
|
||||
"misp-attribute": "text",
|
||||
"disable_correlation": true
|
||||
},
|
||||
"comment": {
|
||||
"description": "Additional comments.",
|
||||
"ui-priority": 0,
|
||||
"misp-attribute": "text",
|
||||
"disable_correlation": true
|
||||
}
|
||||
},
|
||||
"version": 1,
|
||||
"description": "Event log object template to share information of the activities conducted on a system. ",
|
||||
"meta-category": "misc",
|
||||
"uuid": "94e3aee9-cb99-4503-9bf6-7da3db5de55e",
|
||||
"name": "python-etvx-event-log"
|
||||
}
|
||||
Loading…
Reference in New Issue