MISP
/
misp-objects
mirror of https://github.com/MISP/misp-objects
2
0
Fork 0
Code Issues Releases Wiki Activity

Make relationship type more generic 

Make the relationship types more generic especially to avoid issue
with community-designed standards that might change later the types,
broke compatibility or decide to change their mind due to some
proprietary vendors trying to lock-in the users.
pull/26/merge
Alexandre Dulaunoy 2017-08-11 11:22:16 +02:00
parent 7573465e74
commit ba3c888af8
No known key found for this signature in database
GPG Key ID: 09E2CD4944E6CBCD
1 changed files with 71 additions and 16 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

87
relationships/definition.json
View File

@ -1,65 +1,120 @@
{ {
"version": 1, "version": 2,
"values": [ "values": [
{ {
"name": "derived-from", "name": "derived-from",
"description": "STIX 2.0: The information in the target object is based on information from the source object." "description": "The information in the target object is based on information from the source object.",
"format": [
"misp",
"stix-2.0"
]
}, },
{ {
"name": "duplicate-of", "name": "duplicate-of",
"description": "STIX 2.0: The referenced source and target objects are semantically duplicates of each other." "description": "The referenced source and target objects are semantically duplicates of each other.",
"format": [
"misp",
"stix-2.0"
]
}, },
{ {
"name": "related-to", "name": "related-to",
"description": "STIX 2.0: Asserts a non - specific relationship between two SDOs. This relationship ca n be used when none of the other predefined relationships are appropriate." "description": "The referenced source is related to the target object.",
"format": [
"misp",
"stix-2.0"
]
}, },
{ {
"name": "attributed-to", "name": "attributed-to",
"description": "STIX 2.0: This Relationship describes that the Intrusion Set or Threat Actor that is involved in carrying out the Campaign." "description": "This referenced source is attributed to the target object.",
"format": [
"misp",
"stix-2.0"
]
}, },
{ {
"name": "targets", "name": "targets",
"description": "STIX 2.0: This Relationship describes that the Campaign uses exploits of the related Vulnerability or targets the type of victims described by the related Identity." "description": "This relationship describes that the source object targets the target object.",
"format": [
"misp",
"stix-2.0"
]
}, },
{ {
"name": "uses", "name": "uses",
"description": "STIX 2.0: This Relationship describes that attacks carried out as part of the Campaign typically use the related Attack Pattern, Malware, or Tool." "description": "This relationship describes the use by the source object of the target object.",
"format": [
"misp",
"stix-2.0"
]
}, },
{ {
"name": "indicates", "name": "indicates",
"description": "STIX 2.0: This Relationship describes that the Indicator can detect evidence of the related Campaign, Intrusion, or Threat Actor. This evidence may not be direct: for example, the Indicator may detect secondary evidence of the Campaign, such as malware or behavior commonly used by that Campaign." "description": "This relationships describes that the source object indicates the target object.",
"format": [
"misp",
"stix-2.0"
]
}, },
{ {
"name": "mitigates", "name": "mitigates",
"description": "STIX 2.0: This Relationship describes that the Course of Action can mitigate the related Attack Pattern, Malware, Vulnerability, or Tool." "description": "This relationship describes a source object which mitigates the target object.",
"format": [
"misp",
"stix-2.0"
]
}, },
{ {
"name": "variant-of", "name": "variant-of",
"description": "STIX 2.0: This Relationship is used to document that one piece of Malware is a variant of another piece of Malware." "description": "This relationship describes a source object which is a variant of the target object",
"format": [
"misp",
"stix-2.0"
]
}, },
{ {
"name": "impersonates", "name": "impersonates",
"description": "STIX 2.0: This Relationship describes that the actor is the real identity represented in the related Identity." "description": "This relationship describe a source object which impersonates the target object",
"format": [
"misp",
"stix-2.0"
]
}, },
{ {
"name": "authored-by", "name": "authored-by",
"description": "This relationship describes the author of a specific object." "description": "This relationship describes the author of a specific object.",
"format": [
"misp"
]
}, },
{ {
"name": "located", "name": "located",
"description": "This relationship describes the location (of any type) of a specific object." "description": "This relationship describes the location (of any type) of a specific object.",
"format": [
"misp"
]
}, },
{ {
"name": "included-in", "name": "included-in",
"description": "This relationship describes an object included in another object." "description": "This relationship describes an object included in another object.",
"format": [
"misp"
]
}, },
{ {
"name": "analysed-with", "name": "analysed-with",
"description": "This relationship describes an object analysed by another object." "description": "This relationship describes an object analysed by another object.",
"format": [
"misp"
]
}, },
{ {
"name": "claimed-by", "name": "claimed-by",
"description": "This relationship describes an object claimed by another object." "description": "This relationship describes an object claimed by another object.",
"format": [
"misp"
]
} }
], ],
"description": "Default type of relationships in MISP objects.", "description": "Default type of relationships in MISP objects.",