From 0ba49095491e2be23f8b8ac8e58ea7e006852bf0 Mon Sep 17 00:00:00 2001 From: chrisr3d Date: Mon, 7 Sep 2020 23:56:10 +0200 Subject: [PATCH 1/5] add: First version of a BGP ranking object to represent the ranking of an ASN at a specific point of time - We can then associate as many bgp-ranking objects as we need to the corresponding ASN object, each one of them being the ranking of the ASN for a given day --- objects/bgp-ranking/definition.json | 28 ++++++++++++++++++++++++++++ 1 file changed, 28 insertions(+) create mode 100644 objects/bgp-ranking/definition.json diff --git a/objects/bgp-ranking/definition.json b/objects/bgp-ranking/definition.json new file mode 100644 index 0000000..4f38b5e --- /dev/null +++ b/objects/bgp-ranking/definition.json @@ -0,0 +1,28 @@ +{ + "attributes": { + "date": { + "description": "Date fo the ranking.", + "misp-attribute": "datetime", + "ui-priority": 1 + }, + "position": { + "description": "Position of the ASN for a given day.", + "misp-attribute": "float", + "ui-priority": 0 + }, + "ranking": { + "description": "Ranking of the Autonomous System number.", + "misp-attribute": "float", + "ui-priority": 1 + } + }, + "description": "BGP Ranking object describing the ranking of an ASN for a given day, along with its position, 1 being the most malicious ASN of the day, with the highest ranking. This object is meant to have a relationship with the corresponding ASN object and represents its ranking for a specific date.", + "meta-category": "network", + "name": "bgp-ranking", + "required": [ + "date", + "ranking" + ], + "uuid": "0cf87909-e44a-4426-8ebc-a250f932ce00", + "version": 1 +} From 33cf33dc24d178cccc6b909663a65d92105ebf33 Mon Sep 17 00:00:00 2001 From: chrisr3d Date: Tue, 8 Sep 2020 11:52:39 +0200 Subject: [PATCH 2/5] add: Added an IP address family attribute to describe the address family concerned by the BGP ranking --- objects/bgp-ranking/definition.json | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/objects/bgp-ranking/definition.json b/objects/bgp-ranking/definition.json index 4f38b5e..7d40d70 100644 --- a/objects/bgp-ranking/definition.json +++ b/objects/bgp-ranking/definition.json @@ -1,5 +1,14 @@ { "attributes": { + "address-family": { + "description": "The IP address family concerned by the ranking.", + "misp-attribute": "text", + "sane_default": [ + "v4", + "v6" + ], + "ui-priority": 0 + } "date": { "description": "Date fo the ranking.", "misp-attribute": "datetime", From 2671039cecff8803fa0b6f724ffb450f8f3a1095 Mon Sep 17 00:00:00 2001 From: chrisr3d Date: Tue, 8 Sep 2020 12:11:50 +0200 Subject: [PATCH 3/5] fix: JSON validation --- objects/bgp-ranking/definition.json | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/objects/bgp-ranking/definition.json b/objects/bgp-ranking/definition.json index 7d40d70..9eaa9e6 100644 --- a/objects/bgp-ranking/definition.json +++ b/objects/bgp-ranking/definition.json @@ -8,7 +8,7 @@ "v6" ], "ui-priority": 0 - } + }, "date": { "description": "Date fo the ranking.", "misp-attribute": "datetime", @@ -34,4 +34,4 @@ ], "uuid": "0cf87909-e44a-4426-8ebc-a250f932ce00", "version": 1 -} +} \ No newline at end of file From 34d4915a1dae14caf54e7e5e3058ce3b4701d43e Mon Sep 17 00:00:00 2001 From: chrisr3d Date: Tue, 8 Sep 2020 12:12:25 +0200 Subject: [PATCH 4/5] add: Added some relationships introduced recently in misp modules --- relationships/definition.json | 14 ++++++++++++++ 1 file changed, 14 insertions(+) diff --git a/relationships/definition.json b/relationships/definition.json index 4bb3015..79577d4 100644 --- a/relationships/definition.json +++ b/relationships/definition.json @@ -1004,6 +1004,20 @@ ], "name": "knows" }, + { + "description": "Represents the semantic link of describing another object.", + "format": [ + "misp" + ], + "name": "describes" + }, + { + "description": "Represents the semantic link of extending another object.", + "format": [ + "misp" + ], + "name": "extends" + }, { "description": "owns", "format": [ From c798055e5ed54b13f27beddfba5217e5d0b1c777 Mon Sep 17 00:00:00 2001 From: chrisr3d Date: Tue, 8 Sep 2020 12:12:59 +0200 Subject: [PATCH 5/5] add: Added specific relationship between an asn object and the recently added bgp-ranking object --- relationships/definition.json | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/relationships/definition.json b/relationships/definition.json index 79577d4..6a3c49a 100644 --- a/relationships/definition.json +++ b/relationships/definition.json @@ -1018,6 +1018,13 @@ ], "name": "extends" }, + { + "description": "Represents the semantic link of an asn object being ranked with a bgp-ranking object", + "format": [ + "misp" + ], + "name": "ranked-with" + }, { "description": "owns", "format": [