Merge from master

objects/attack-step/definition.json

@@ -1,35 +1,9 @@
 {
   "attributes": {
-    "source-ip": {
+    "command-line": {
-      "description": "IP source of the attack step, if any.",
+      "description": "Command line used to execute attack step, if any.",
-      "misp-attribute": "ip-src",
-      "ui-priority": 1
-    },
-    "source-domain": {
-      "description": "Domain source of the attack step, if any.",
-      "misp-attribute": "domain",
-      "ui-priority": 1
-    },
-    "source-misc": {
-      "description": "Other type of source of the attack step, if any. This can be e.g. rotating ip from cloud providers such as AWS, or localhost.",
-      "misp-attribute": "text",
-      "ui-priority": 1
-    },
-    "dst-ip": {
-      "description": "IP destination of the attack step, if any.",
-      "misp-attribute": "ip-dst",
-      "disable-correlation": true,
-      "ui-priority": 1
-    },
-    "dst-domain": {
-      "description": "Domain destination of the attack step, if any.",
-      "misp-attribute": "domain",
-      "disable-correlation": true,
-      "ui-priority": 1
-    },
-    "dst-misc": {
-      "description": "Other type of source of the attack step, if any. This can be e.g. localhost.",
       "misp-attribute": "text",
+      "multiple": true,
       "ui-priority": 1
     },
     "description": {
@@ -37,19 +11,31 @@
       "misp-attribute": "text",
       "ui-priority": 1
     },
-    "command-line": {
+    "detections": {
-      "description": "Command line used to execute attack step, if any.",
+      "description": "Detections by the victim's monitoring capabilities.",
-      "multiple": true,
       "misp-attribute": "text",
       "ui-priority": 1
     },
-    "succesful": {
+    "dst-domain": {
-      "description": "Was this attack step succesful?",
+      "description": "Domain destination of the attack step, if any.",
-      "misp-attribute": "boolean",
+      "disable-correlation": true,
-      "sane_default": [
+      "misp-attribute": "domain",
-        "True",
+      "ui-priority": 1
-        "False"
+    },
-      ],
+    "dst-ip": {
+      "description": "IP destination of the attack step, if any.",
+      "disable-correlation": true,
+      "misp-attribute": "ip-dst",
+      "ui-priority": 1
+    },
+    "dst-misc": {
+      "description": "Other type of source of the attack step, if any. This can be e.g. localhost.",
+      "misp-attribute": "text",
+      "ui-priority": 1
+    },
+    "expected-response": {
+      "description": "Response or detection expected (in case of purple teaming)",
+      "misp-attribute": "text",
       "ui-priority": 1
     },
     "key-step": {
@@ -61,14 +47,28 @@
       ],
       "ui-priority": 1
     },
-    "detections": {
+    "source-domain": {
-      "description": "Detections by the victim's monitoring capabilities.",
+      "description": "Domain source of the attack step, if any.",
+      "misp-attribute": "domain",
+      "ui-priority": 1
+    },
+    "source-ip": {
+      "description": "IP source of the attack step, if any.",
+      "misp-attribute": "ip-src",
+      "ui-priority": 1
+    },
+    "source-misc": {
+      "description": "Other type of source of the attack step, if any. This can be e.g. rotating ip from cloud providers such as AWS, or localhost.",
       "misp-attribute": "text",
       "ui-priority": 1
     },
-    "expected-response": {
+    "succesful": {
-      "description": "Response or detection expected (in case of purple teaming)",
+      "description": "Was this attack step succesful?",
-      "misp-attribute": "text",
+      "misp-attribute": "boolean",
+      "sane_default": [
+        "True",
+        "False"
+      ],
       "ui-priority": 1
     }
   },