From e455b178685b8554e33d867e927c8e4e15ad0435 Mon Sep 17 00:00:00 2001 From: Alexandre Dulaunoy Date: Sat, 12 Aug 2017 10:35:40 +0200 Subject: [PATCH 1/4] fix: communicate-with relationship added --- relationships/definition.json | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/relationships/definition.json b/relationships/definition.json index 06158da..e8e8906 100644 --- a/relationships/definition.json +++ b/relationships/definition.json @@ -1,5 +1,5 @@ { - "version": 2, + "version": 3, "values": [ { "name": "derived-from", @@ -115,6 +115,13 @@ "format": [ "misp" ] + }, + { + "name": "communicate-with", + "description": "This relationship describes an object communicating with another object", + "format": [ + "misp" + ] } ], "description": "Default type of relationships in MISP objects.", From 6ff2aad063b27ea2f8561d6502647849e1f7cfdf Mon Sep 17 00:00:00 2001 From: Alexandre Dulaunoy Date: Sat, 12 Aug 2017 14:20:21 +0200 Subject: [PATCH 2/4] Keep it consistent. --- relationships/definition.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/relationships/definition.json b/relationships/definition.json index e8e8906..6bca513 100644 --- a/relationships/definition.json +++ b/relationships/definition.json @@ -117,7 +117,7 @@ ] }, { - "name": "communicate-with", + "name": "communicates-with", "description": "This relationship describes an object communicating with another object", "format": [ "misp" From 01a23c205cf2a27a2351ae3fcc0f3735a8b436b1 Mon Sep 17 00:00:00 2001 From: Alexandre Dulaunoy Date: Sun, 13 Aug 2017 10:41:10 +0200 Subject: [PATCH 3/4] Often used relationships added used for malware analysis --- relationships/definition.json | 18 ++++++++++++++++-- 1 file changed, 16 insertions(+), 2 deletions(-) diff --git a/relationships/definition.json b/relationships/definition.json index 6bca513..c821485 100644 --- a/relationships/definition.json +++ b/relationships/definition.json @@ -1,5 +1,5 @@ { - "version": 3, + "version": 4, "values": [ { "name": "derived-from", @@ -118,7 +118,21 @@ }, { "name": "communicates-with", - "description": "This relationship describes an object communicating with another object", + "description": "This relationship describes an object communicating with another object.", + "format": [ + "misp" + ] + }, + { + "name": "dropped-by", + "description": "This relationship describes an object dropped by another object.", + "format": [ + "misp" + ] + }, + { + "name": "executed-by", + "description": "This relationship describes an objected executed by another object.", "format": [ "misp" ] From 30c4cea1f990fc5c4b03c379a81067e986574428 Mon Sep 17 00:00:00 2001 From: Alexandre Dulaunoy Date: Mon, 14 Aug 2017 22:07:09 +0200 Subject: [PATCH 4/4] relationships types added + target MISP version --- README.md | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/README.md b/README.md index c83773e..96907c6 100644 --- a/README.md +++ b/README.md @@ -2,7 +2,7 @@ [![Build Status](https://travis-ci.org/MISP/misp-objects.svg?branch=master)](https://travis-ci.org/MISP/misp-objects) -MISP objects to be used in MISP (3.0) system and can be used by other information sharing tool. MISP objects +MISP objects to be used in MISP (2.4.80 (TBC)) system and can be used by other information sharing tool. MISP objects are in addition to MISP attributes to allow advanced combinations of attributes. The creation of these objects and their associated attributes are based on real cyber security use-cases and existing practices in information sharing. @@ -84,6 +84,12 @@ for a specific attribute. * [objects/whois](objects/whois/definition.json) - Whois records information for a domain name. * [objects/x509](objects/x509/definition.json) - x509 object describing a X.509 certificate. +## MISP objects relationships + +The MISP object model is open and allows user to use their own relationships. MISP provides a list of default relationships that can be used if you plan to share your events with other MISP communities. + +- [relationships](relationships/definition.json) - list of predefined default relationships which can be used to link MISP objects together and explain the context of the relationship. + ## How to contribute MISP objects? Fork the project, create a new directory in the [objects directory](objects/) matching your object name. Objects must be composed