MISP
/
misp-objects
mirror of https://github.com/MISP/misp-objects
2
0
Fork 0
Code Issues Releases Wiki Activity

Updated for support for msg format. 

Adding first class support for Emails in .msg format to the email definition.
This includes making the  attribute support multiple bodies. Msg formats
nearly always have at least 2, if not 3, versions of the body (plain text, rtf, html).
pull/303/head
seamus tuohy 2020-12-19 17:03:26 -05:00
parent 27a554ab12
commit 7e65e5dfaf
1 changed files with 10 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
objects/email/definition.json
View File

@ -26,6 +26,7 @@
"description": "Body of the email", "description": "Body of the email",
"disable_correlation": true, "disable_correlation": true,
"misp-attribute": "email-body", "misp-attribute": "email-body",
"multiple": true,
"ui-priority": 1 "ui-priority": 1
}, },
"eml": { "eml": {
@ -34,6 +35,12 @@
"misp-attribute": "attachment", "misp-attribute": "attachment",
"ui-priority": 1 "ui-priority": 1
}, },
"msg": {
"description": "Full MSG",
"disable_correlation": true,
"misp-attribute": "attachment",
"ui-priority": 1
},
"from": { "from": {
"categories": [ "categories": [
"Payload delivery" "Payload delivery"
@ -204,7 +211,8 @@
"x-mailer", "x-mailer",
"return-path", "return-path",
"email-body", "email-body",
"eml" "eml",
"msg"
], ],
"uuid": "a0c666e0-fc65-4be8-b48f-3423d788b552", "uuid": "a0c666e0-fc65-4be8-b48f-3423d788b552",
"version": 15 "version": 15