MISP
/
misp-objects
mirror of https://github.com/MISP/misp-objects
2
0
Fork 0
Code Issues Releases Wiki Activity

Update file/PE objects 

* Add sane defaults
* Disable correlation when it doesn't make sense
pull/7/head
Raphaël Vinot 2017-03-13 14:49:25 +01:00
parent face9af8b0
commit b90fd9ddc1
3 changed files with 45 additions and 20 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
objects/file/definition.json
View File

@ -16,7 +16,8 @@
},
"size-in-bytes": {
"misp-attribute": "size-in-bytes",
"misp-usage-frequency": 0
"misp-usage-frequency": 0,
"disable_correlation": true
},
"authentihash": {
"misp-attribute": "authentihash",
@ -68,7 +69,8 @@
},
"entropy": {
"misp-attribute": "float",
"misp-usage-frequency": 1
"misp-usage-frequency": 1,
"disable_correlation": true
},
"pattern-in-file": {
"misp-attribute": "pattern-in-file",
@ -81,7 +83,8 @@
},
"text": {
"misp-attribute": "text",
"misp-usage-frequency": 1
"misp-usage-frequency": 1,
"disable_correlation": true
}
},
"requiredOneOf": [

19
objects/pe-section/definition.json
View File

@ -6,19 +6,30 @@
"attributes": {
"name": {
"misp-attribute": "text",
"misp-usage-frequency": 1
"misp-usage-frequency": 1,
"sane_default": [
".rsrc",
".reloc",
".rdata",
".data",
".text"
],
"disable_correlation": true
},
"text": {
"misp-attribute": "text",
"misp-usage-frequency": 1
"misp-usage-frequency": 1,
"disable_correlation": true
},
"size-in-bytes": {
"misp-attribute": "size-in-bytes",
"misp-usage-frequency": 1
"misp-usage-frequency": 1,
"disable_correlation": true
},
"entropy": {
"misp-attribute": "float",
"misp-usage-frequency": 0
"misp-usage-frequency": 0,
"disable_correlation": true
},
"md5": {
"misp-attribute": "md5",

37
objects/pe/definition.json
View File

@ -10,14 +10,15 @@
},
"text": {
"misp-attribute": "text",
"misp-usage-frequency": 1
"misp-usage-frequency": 1,
"disable_correlation": true
},
"original-filename": {
"misp-attribute": "text",
"misp-attribute": "filename",
"misp-usage-frequency": 1
},
"internal-filename": {
"misp-attribute": "text",
"misp-attribute": "filename",
"misp-usage-frequency": 0
},
"compilation-timestamp": {
@ -26,43 +27,53 @@
},
"entrypoint-section|position": {
"misp-attribute": "text",
"misp-usage-frequency": 0
"misp-usage-frequency": 0,
"disable_correlation": true
},
"entrypoint-address": {
"misp-attribute": "text",
"misp-usage-frequency": 0
"misp-usage-frequency": 0,
"disable_correlation": true
},
"file-description": {
"misp-attribute": "text",
"misp-usage-frequency": 0
"misp-usage-frequency": 0,
"disable_correlation": true
},
"file-version": {
"misp-attribute": "text",
"misp-usage-frequency": 0
"misp-usage-frequency": 0,
"disable_correlation": true
},
"lang-id": {
"misp-attribute": "text",
"misp-usage-frequency": 0
"misp-usage-frequency": 0,
"disable_correlation": true
},
"product-name": {
"misp-attribute": "text",
"misp-usage-frequency": 0
"misp-usage-frequency": 0,
"disable_correlation": true
},
"product-version": {
"misp-attribute": "text",
"misp-usage-frequency": 0
"misp-usage-frequency": 0,
"disable_correlation": true
},
"company-name": {
"misp-attribute": "text",
"misp-usage-frequency": 0
"misp-usage-frequency": 0,
"disable_correlation": true
},
"legal-copyright": {
"misp-attribute": "text",
"misp-usage-frequency": 0
"misp-usage-frequency": 0,
"disable_correlation": true
},
"pe-type": {
"misp-attribute": "text",
"misp-usage-frequency": 0
"misp-usage-frequency": 0,
"disable_correlation": true
}
},
"requiredOneOf": [