diff --git a/README.md b/README.md index 6a4ace3..f75f9f4 100644 --- a/README.md +++ b/README.md @@ -62,6 +62,7 @@ allowing advanced users to show all the attributes depending of their configurat * [objects/ip-port](objects/ip-port/definition.json) - An IP address and a port seen as a tuple (or as a triple) in a specific time frame. * [objects/passive-dns](objects/file/definition.json) - Passive DNS records as expressed in [draft-dulaunoy-dnsop-passive-dns-cof-01](https://tools.ietf.org/html/draft-dulaunoy-dnsop-passive-dns-cof-01). * [objects/whois](objects/whois/definition.json) - Whois records information for a domain name. +* [objects/x509](objects/x509/definition.json) - x509 object describing a X.509 certificate. ## How to contribute MISP objects? diff --git a/objects/x509/definition.json b/objects/x509/definition.json new file mode 100644 index 0000000..c28577f --- /dev/null +++ b/objects/x509/definition.json @@ -0,0 +1,63 @@ +{ + "name": "x509", + "meta-category": "network", + "description": "x509 object describing a X.509 certificate", + "version": 1, + "attributes" : + { + "version": { + "misp-attribute": "text", + "misp-usage-frequency": 0 + }, + "serial-number": { + "misp-attribute": "text", + "misp-usage-frequency": 0 + }, + "issuer": { + "misp-attribute": "text", + "misp-usage-frequency": 0 + }, + "validity-not-before": { + "misp-attribute": "datetime", + "misp-usage-frequency": 0 + }, + "validity-not-after": { + "misp-attribute": "datetime", + "misp-usage-frequency": 0 + }, + "subject": { + "misp-attribute": "text", + "misp-usage-frequency": 1 + }, + "pubkey-info-algorithm": { + "misp-attribute": "text", + "misp-usage-frequency": 0 + }, + "pubkey-info-seize": { + "misp-attribute": "text", + "misp-usage-frequency": 0 + }, + "pubkey-info-modulus": { + "misp-attribute": "text", + "misp-usage-frequency": 0 + }, + "pubkey-info-exponent": { + "misp-attribute": "text", + "misp-usage-frequency": 0 + }, + "x509-fingerprint-sha1": { + "misp-attribute": "sha1", + "misp-usage-frequency": 1 + }, + "raw-base64": { + "misp-attribute": "text", + "misp-usage-frequency": 0 + }, + "text": { + "misp-attribute": "text", + "misp-usage-frequency": 1 + } + + }, + "required": ["x509-fingerprint-sha1"] +}