MISP
/
misp-objects
mirror of https://github.com/MISP/misp-objects
2
0
Fork 0
Code Issues Releases Wiki Activity

Merge branch 'master' of github.com:MISP/misp-objects

pull/26/merge
Raphaël Vinot 2017-08-23 11:01:56 +02:00
parent 49cd96aa2b 30c4cea1f9
commit 96d7aeb072
2 changed files with 29 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
README.md
View File

@ -2,7 +2,7 @@
[![Build Status](https://travis-ci.org/MISP/misp-objects.svg?branch=master)](https://travis-ci.org/MISP/misp-objects) [![Build Status](https://travis-ci.org/MISP/misp-objects.svg?branch=master)](https://travis-ci.org/MISP/misp-objects)
MISP objects to be used in MISP (3.0) system and can be used by other information sharing tool. MISP objects MISP objects to be used in MISP (2.4.80 (TBC)) system and can be used by other information sharing tool. MISP objects
are in addition to MISP attributes to allow advanced combinations of attributes. The creation of these objects are in addition to MISP attributes to allow advanced combinations of attributes. The creation of these objects
and their associated attributes are based on real cyber security use-cases and existing practices in information sharing. and their associated attributes are based on real cyber security use-cases and existing practices in information sharing.
@ -84,6 +84,12 @@ for a specific attribute.
* [objects/whois](objects/whois/definition.json) - Whois records information for a domain name. * [objects/whois](objects/whois/definition.json) - Whois records information for a domain name.
* [objects/x509](objects/x509/definition.json) - x509 object describing a X.509 certificate. * [objects/x509](objects/x509/definition.json) - x509 object describing a X.509 certificate.
## MISP objects relationships
The MISP object model is open and allows user to use their own relationships. MISP provides a list of default relationships that can be used if you plan to share your events with other MISP communities.
- [relationships](relationships/definition.json) - list of predefined default relationships which can be used to link MISP objects together and explain the context of the relationship.
## How to contribute MISP objects? ## How to contribute MISP objects?
Fork the project, create a new directory in the [objects directory](objects/) matching your object name. Objects must be composed Fork the project, create a new directory in the [objects directory](objects/) matching your object name. Objects must be composed

23
relationships/definition.json
View File

@ -1,5 +1,5 @@
{ {
"version": 2, "version": 4,
"values": [ "values": [
{ {
"name": "derived-from", "name": "derived-from",
@ -115,6 +115,27 @@
"format": [ "format": [
"misp" "misp"
] ]
},
{
"name": "communicates-with",
"description": "This relationship describes an object communicating with another object.",
"format": [
"misp"
]
},
{
"name": "dropped-by",
"description": "This relationship describes an object dropped by another object.",
"format": [
"misp"
]
},
{
"name": "executed-by",
"description": "This relationship describes an objected executed by another object.",
"format": [
"misp"
]
} }
], ],
"description": "Default type of relationships in MISP objects.", "description": "Default type of relationships in MISP objects.",