mirror of https://github.com/MISP/misp-objects
Merge remote-tracking branch 'upstream/master'
kx1499
commit
bf64122d32
45
README.md
45
README.md
|
|
@ -2,7 +2,7 @@
|
|||
|
||||
[](https://travis-ci.org/MISP/misp-objects)
|
||||
|
||||
MISP objects to be used in MISP (2.4.80) system and can be used by other information sharing tool. MISP objects
|
||||
MISP objects used in MISP (starting from 2.4.80) system and can be used by other information sharing tool. MISP objects
|
||||
are in addition to MISP attributes to allow advanced combinations of attributes. The creation of these objects
|
||||
and their associated attributes are based on real cyber security use-cases and existing practices in information sharing.
|
||||
|
||||
|
|
@ -31,10 +31,12 @@ Feel free to propose your own MISP objects to be included in MISP. The system is
|
|||
},
|
||||
"first-seen": {
|
||||
"misp-attribute": "datetime",
|
||||
"disable_correlation": true,
|
||||
"ui-priority": 0
|
||||
},
|
||||
"last-seen": {
|
||||
"misp-attribute": "datetime",
|
||||
"disable_correlation": true,
|
||||
"ui-priority": 0
|
||||
}
|
||||
|
||||
|
|
@ -53,7 +55,7 @@ A MISP object is described in a simple JSON file containing the following elemen
|
|||
* **requiredOneOf** is an array containing the attributes where at least one need to be present to describe the object.
|
||||
* **attributes** contains another JSON object listing all the attributes composing the object.
|
||||
|
||||
Each attribute must contain a reference **misp-attribute** to reference an existing attribute definition in MISP.
|
||||
Each attribute must contain a reference **misp-attribute** to reference an existing attribute definition in MISP (MISP attributes types are case-sensitive).
|
||||
An array **categories** shall be used to described in which categories the attribute is. The **ui-priority**
|
||||
describes the usage frequency of an attribute. This helps to only display the most frequently used attributes and
|
||||
allowing advanced users to show all the attributes depending of their configuration. An optional **multiple** field
|
||||
|
|
@ -65,37 +67,70 @@ for a specific attribute.
|
|||
## Existing MISP objects
|
||||
|
||||
* [objects/ail-leak](objects/ail-leak/definition.json) - information leak object as defined by the [AIL Analysis Information Leak framework](https://www.github.com/CIRCL/AIL-framework).
|
||||
* [objects/android-permission](objects/android-permission/definition.json) - A set of android permissions - one or more permission(s) which can be linked to other objects (e.g. file).
|
||||
* [objects/asn](objects/asn/definition.json) - Autonomous system object describing a BGP autonomous system which can include one or more network operators management an entity (e.g. ISP) along with their routing policy, routing prefixes or alike.
|
||||
* [objects/av-signature](objects/av-signature/definition.json) - Antivirus detection signature.
|
||||
* [objects/bank-account](objects/bank-account/definition.json) - Object describing bank account information based on account description from goAML 4.0.
|
||||
* [objects/cap-alert](objects/cap-alert/definition.json) - Common Alerting Protocol Version (CAP) alert object.
|
||||
* [objects/cap-info](objects/cap-info/definition.json) - Common Alerting Protocol Version (CAP) info object.
|
||||
* [objects/cap-resource](objects/cap-resource/definition.json) - Common Alerting Protocol Version (CAP) resource object.
|
||||
* [objects/coin-address](objects/coin-address/definition.json) - An address used in a cryptocurrency.
|
||||
* [objects/cookie](objects/cookie/definition.json) - A cookie object describes an HTTP cookie including its use in malicious cases.
|
||||
* [objects/course-of-action](objects/course-of-action/definition.json) - An object describing a Course of Action such as a specific measure taken to prevent or respond to an attack.
|
||||
* [objects/cowrie](objects/cowrie/definition.json) - A cowrie object describes cowrie honeypot sessions.
|
||||
* [objects/credential](objects/credential/definition.json) - A credential object describes one or more credential(s) including password(s), api key(s) or decryption key(s).
|
||||
* [objects/ddos](objects/ddos/definition.json) - DDoS object describes a current DDoS activity from a specific or/and to a specific target.
|
||||
* [objects/diameter-attack](objects/diameter-attack/definition.json) - Attack as seen on diameter authentication against a GSM, UMTS or LTE network.
|
||||
* [objects/domain-ip](objects/domain-ip/definition.json) - A domain and IP address seen as a tuple in a specific time frame.
|
||||
* [objects/elf](objects/elf/definition.json) - Object describing an Executable and Linkable Format (ELF).
|
||||
* [objects/elf-section](objects/elf-section/definition.json) - Object describing a section of an Executable and Linkable Format (ELF).
|
||||
* [objects/email](objects/email/definition.json) - An email object.
|
||||
* [objects/exploit-poc](objects/exploit-poc/definition.json) - Exploit-poc object describing a proof of concept or exploit of a vulnerability. This object has often a relationship with a vulnerability object.
|
||||
* [objects/fail2ban](objects/fail2ban/definition.json) - A fail2ban object.
|
||||
* [objects/file](objects/file/definition.json) - File object describing a file with meta-information.
|
||||
* [objects/geolocation](objects/geolocation/definition.json) - A geolocation object to describe a location.
|
||||
* [objects/gtp-attack](objects/gtp-attack/definition.json) - GTP attack object as seen on a GSM, UMTS or LTE network.
|
||||
* [objects/http-request](objects/http-request/definition.json) - A single HTTP request header object.
|
||||
* [objects/ip-port](objects/ip-port/definition.json) - An IP address and a port seen as a tuple (or as a triple) in a specific time frame.
|
||||
* [objects/ja3](objects/ja3/definition.json) - A ja3 object which describes an SSL client fingerprint in an easy to produce and shareable way.
|
||||
* [objects/legal-entity](objects/legal-entity/definition.json) - Object describing a legal entity, such as an organisation.
|
||||
* [objects/macho](objects/macho/definition.json) - Object describing a Mach object file format.
|
||||
* [objects/macho-section](objects/macho-section/definition.json) - Object describing a section of a Mach object file format.
|
||||
* [objects/microblog](objects/microblog/definition.json) - Object describing microblog post like Twitter or Facebook.
|
||||
* [objects/mutex](objects/mutex/definition.json) - Object to describe mutual exclusion locks (mutex) as seen in memory or computer program.
|
||||
* [objects/netflow](objects/netflow/definition.json) - Netflow object describes an network object based on the Netflowv5/v9 minimal definition.
|
||||
* [objects/network-connection](objects/network-connection/definition.json) - Network object describes a local or remote network connection.
|
||||
* [objects/passive-dns](objects/passive-dns/definition.json) - Passive DNS records as expressed in [draft-dulaunoy-dnsop-passive-dns-cof-01](https://tools.ietf.org/html/draft-dulaunoy-dnsop-passive-dns-cof-01).
|
||||
* [objects/paste](objects/paste/definition.json) - Object describing a paste or similar post from a website allowing to share privately or publicly posts.
|
||||
* [objects/pe](objects/pe/definition.json) - Portable Executable (PE) object.
|
||||
* [objects/pe-section](objects/pe-section/definition.json) - Portable Executable (PE) object - section description.
|
||||
* [objects/person](objects/person/definition.json) - A person object which describes a person or an identity.
|
||||
* [objects/phone](objects/phone/definition.json) - A phone or mobile phone object.
|
||||
* [objects/process](objects/process/definition.json) - A process object.
|
||||
* [objects/registry-key](objects/registry-key/definition.json) - A registry-key object.
|
||||
* [objects/r2graphity](objects/r2graphity/definition.json) - Indicators extracted from binary files using radare2 and graphml.
|
||||
* [objects/rtir](objects/rtir/definition.json) - RTIR - Request Tracker for Incident Response.
|
||||
* [objects/sandbox-report](objects/sandbox-report/definition.json) - Sandbox report object.
|
||||
* [objects/sb-signature](objects/sb-signature/definition.json) - Sandbox detection signature object.
|
||||
* [objects/script](objects/script/definition.json) - Object describing a computer program written to be run in a special run-time environment. The script or shell script can be used for malicious activities but also as support tools for threat analysts.
|
||||
* [objects/short-message-service](objects/short-message-service/definition.json) - Short Message Service (SMS) object template describing one or more SMS message(s).
|
||||
* [objects/shortened-link](objects/shortened-link/definition.json) - Shortened link and its redirect target.
|
||||
* [objects/ss7-attack](objects/ss7-attack/definition.json) - SS7 object of an attack seen on a GSM, UMTS or LTE network via SS7 logging.
|
||||
* [objects/stix2-pattern](objects/stix2-pattern/definition.json) - An object describing a STIX pattern. The object can be linked via a relationship to other attributes or objects to describe how it can be represented as a STIX pattern.
|
||||
* [objects/suricata](objects/suricata/definition.json) - Suricata rule with context.
|
||||
* [objects/target-system](objects/target-system/definition.json) - Description about an targeted system, this could potentially be a compromissed internal system.
|
||||
* [objects/threatgrid-report](objects/threatgrid-report/definition.json) - A threatgrid report object.
|
||||
* [objects/timecode](objects/timecode/definition.json) - Timecode object to describe a start of video sequence (e.g. CCTV evidence) and the end of the video sequence.
|
||||
* [objects/timestamp](objects/timestamp/definition.json) - A generic timestamp object to represent time including first time and last time seen. Relationship will then define the kind of time relationship.
|
||||
* [objects/tor-node](objects/tor-node/definition.json) - Tor node description which are part of the Tor network at a time.
|
||||
* [objects/transaction](objects/transaction/definition.json) - Object describing a financial transaction.
|
||||
* [objects/virustotal-report](objects/virustotal-report/definition.json) - VirusTotal report.
|
||||
* [objects/vulnerability](objects/vulnerability/definition.json) - Vulnerability object to describe software or hardware vulnerability as described in a CVE.
|
||||
* [objects/url](objects/url/definition.json) - url object describes an url along with its normalized field (e.g. using faup parsing library) and its metadata.
|
||||
* [objects/victim](objects/victim/definition.json) - a victim object to describe the organisation being targeted or abused.
|
||||
* [objects/whois](objects/whois/definition.json) - Whois records information for a domain name.
|
||||
* [objects/x509](objects/x509/definition.json) - x509 object describing a X.509 certificate.
|
||||
* [objects/yara](objects/yara/definition.json) - YARA object describing a YARA rule along with the version supported and context (such as memory, network, disk).
|
||||
|
||||
## MISP objects relationships
|
||||
|
||||
|
|
@ -134,9 +169,9 @@ The MISP objects model allows to add new combined indicators format based on the
|
|||
|
||||
~~~~
|
||||
|
||||
Copyright (C) 2016-2017 Andras Iklody
|
||||
Copyright (C) 2016-2017 Alexandre Dulaunoy
|
||||
Copyright (C) 2016-2017 CIRCL - Computer Incident Response Center Luxembourg
|
||||
Copyright (C) 2016-2018 Andras Iklody
|
||||
Copyright (C) 2016-2018 Alexandre Dulaunoy
|
||||
Copyright (C) 2016-2018 CIRCL - Computer Incident Response Center Luxembourg
|
||||
|
||||
This program is free software: you can redistribute it and/or modify
|
||||
it under the terms of the GNU Affero General Public License as published by
|
||||
|
|
|
|||
|
|
@ -3,10 +3,11 @@
|
|||
"text",
|
||||
"first-seen",
|
||||
"last-seen",
|
||||
"origin"
|
||||
"origin",
|
||||
"raw-data"
|
||||
],
|
||||
"required": [
|
||||
"type"
|
||||
"sensor"
|
||||
],
|
||||
"attributes": {
|
||||
"sensor": {
|
||||
|
|
@ -14,10 +15,21 @@
|
|||
"ui-priority": 0,
|
||||
"misp-attribute": "text"
|
||||
},
|
||||
"duplicate": {
|
||||
"description": "Duplicate of the existing leaks.",
|
||||
"ui-priority": 0,
|
||||
"misp-attribute": "text",
|
||||
"multiple": true
|
||||
},
|
||||
"duplicate_number": {
|
||||
"description": "Number of known duplicates.",
|
||||
"ui-priority": 0,
|
||||
"misp-attribute": "counter"
|
||||
},
|
||||
"origin": {
|
||||
"description": "The link where the leak is (or was) accessible at first-seen.",
|
||||
"ui-priority": 1,
|
||||
"misp-attribute": "link"
|
||||
"misp-attribute": "text"
|
||||
},
|
||||
"text": {
|
||||
"description": "A description of the leak which could include the potential victim(s) or description of the leak.",
|
||||
|
|
@ -31,19 +43,6 @@
|
|||
"ui-priority": 0,
|
||||
"misp-attribute": "datetime"
|
||||
},
|
||||
"type": {
|
||||
"sane_default": [
|
||||
"Credential",
|
||||
"CreditCards",
|
||||
"Mail",
|
||||
"Onion",
|
||||
"Phone",
|
||||
"Keys"
|
||||
],
|
||||
"description": "Type of information leak as discovered and classified by an AIL module.",
|
||||
"ui-priority": 0,
|
||||
"misp-attribute": "text"
|
||||
},
|
||||
"last-seen": {
|
||||
"description": "When the leak has been accessible or seen for the last time.",
|
||||
"disable_correlation": true,
|
||||
|
|
@ -55,9 +54,15 @@
|
|||
"disable_correlation": true,
|
||||
"ui-priority": 0,
|
||||
"misp-attribute": "datetime"
|
||||
},
|
||||
"raw-data": {
|
||||
"description": "Raw data as received by the AIL sensor compressed and encoded in Base64.",
|
||||
"disable_correlation": true,
|
||||
"ui-priority": 0,
|
||||
"misp-attribute": "attachment"
|
||||
}
|
||||
},
|
||||
"version": 3,
|
||||
"version": 8,
|
||||
"description": "An information leak as defined by the AIL Analysis Information Leak framework.",
|
||||
"meta-category": "misc",
|
||||
"uuid": "dc6a8fa2-0a43-4a0c-a5aa-b1a5336ca80e",
|
||||
|
|
|
|||
|
|
@ -0,0 +1,55 @@
|
|||
{
|
||||
"requiredOneOf": [
|
||||
"organisation",
|
||||
"administrative-area",
|
||||
"industry",
|
||||
"country"
|
||||
],
|
||||
"attributes": {
|
||||
"organisation": {
|
||||
"description": "AIS Organisation Name.",
|
||||
"misp-attribute": "text",
|
||||
"ui-priority": 1
|
||||
},
|
||||
"administrative-area": {
|
||||
"description": "AIS Administrative Area represented using ISO-3166-2.",
|
||||
"misp-attribute": "text",
|
||||
"ui-priority": 1
|
||||
},
|
||||
"industry": {
|
||||
"description": "AIS IndustryType.",
|
||||
"misp-attribute": "text",
|
||||
"ui-priority": 1,
|
||||
"multiple": true,
|
||||
"sane_default": [
|
||||
"Chemical Sector",
|
||||
"Commercial Facilities Sector",
|
||||
"Communications Sector",
|
||||
"Critical Manufacturing Sector",
|
||||
"Dams Sector",
|
||||
"Defense Industrial Base Sector",
|
||||
"Emergency Services Sector",
|
||||
"Energy Sector",
|
||||
"Financial Services Sector",
|
||||
"Food and Agriculture Sector",
|
||||
"Government Facilities Sector",
|
||||
"Healthcare and Public Health Sector",
|
||||
"Information Technology Sector",
|
||||
"Nuclear Reactors, Materials, and Waste Sector",
|
||||
"Transportation Systems Sector",
|
||||
"Water and Wastewater Systems Sector",
|
||||
"Other"
|
||||
]
|
||||
},
|
||||
"country": {
|
||||
"description": "AIS Country represented using ISO-3166-1_alpha-2.",
|
||||
"misp-attribute": "text",
|
||||
"ui-priority": 1
|
||||
}
|
||||
},
|
||||
"version": 1,
|
||||
"description": "Automated Indicator Sharing (AIS) Information Source Markings.",
|
||||
"meta-category": "misc",
|
||||
"uuid": "1f3f466d-465f-4c3a-8cce-933642c9ea83",
|
||||
"name": "ais-info"
|
||||
}
|
||||
|
|
@ -0,0 +1,171 @@
|
|||
{
|
||||
"requiredOneOf": [
|
||||
"permission"
|
||||
],
|
||||
"attributes": {
|
||||
"permission": {
|
||||
"description": "Android permission",
|
||||
"ui-priority": 0,
|
||||
"misp-attribute": "text",
|
||||
"multiple": true,
|
||||
"sane_default": [
|
||||
"ACCESS_CHECKIN_PROPERTIES",
|
||||
"ACCESS_COARSE_LOCATION",
|
||||
"ACCESS_FINE_LOCATION",
|
||||
"ACCESS_LOCATION_EXTRA_COMMANDS",
|
||||
"ACCESS_NETWORK_STATE",
|
||||
"ACCESS_NOTIFICATION_POLICY",
|
||||
"ACCESS_WIFI_STATE",
|
||||
"ACCOUNT_MANAGER",
|
||||
"ADD_VOICEMAIL",
|
||||
"ANSWER_PHONE_CALLS",
|
||||
"BATTERY_STATS",
|
||||
"BIND_ACCESSIBILITY_SERVICE",
|
||||
"BIND_APPWIDGET",
|
||||
"BIND_AUTOFILL_SERVICE",
|
||||
"BIND_CARRIER_MESSAGING_SERVICE",
|
||||
"BIND_CHOOSER_TARGET_SERVICE",
|
||||
"BIND_CONDITION_PROVIDER_SERVICE",
|
||||
"BIND_DEVICE_ADMIN",
|
||||
"BIND_DREAM_SERVICE",
|
||||
"BIND_INCALL_SERVICE",
|
||||
"BIND_INPUT_METHOD",
|
||||
"BIND_MIDI_DEVICE_SERVICE",
|
||||
"BIND_NFC_SERVICE",
|
||||
"BIND_NOTIFICATION_LISTENER_SERVICE",
|
||||
"BIND_PRINT_SERVICE",
|
||||
"BIND_QUICK_SETTINGS_TILE",
|
||||
"BIND_REMOTEVIEWS",
|
||||
"BIND_SCREENING_SERVICE",
|
||||
"BIND_TELECOM_CONNECTION_SERVICE",
|
||||
"BIND_TEXT_SERVICE",
|
||||
"BIND_TV_INPUT",
|
||||
"BIND_VISUAL_VOICEMAIL_SERVICE",
|
||||
"BIND_VOICE_INTERACTION",
|
||||
"BIND_VPN_SERVICE",
|
||||
"BIND_VR_LISTENER_SERVICE",
|
||||
"BIND_WALLPAPER",
|
||||
"BLUETOOTH",
|
||||
"BLUETOOTH_ADMIN",
|
||||
"BLUETOOTH_PRIVILEGED",
|
||||
"BODY_SENSORS",
|
||||
"BROADCAST_PACKAGE_REMOVED",
|
||||
"BROADCAST_SMS",
|
||||
"BROADCAST_STICKY",
|
||||
"BROADCAST_WAP_PUSH",
|
||||
"CALL_PHONE",
|
||||
"CALL_PRIVILEGED",
|
||||
"CAMERA",
|
||||
"CAPTURE_AUDIO_OUTPUT",
|
||||
"CAPTURE_SECURE_VIDEO_OUTPUT",
|
||||
"CAPTURE_VIDEO_OUTPUT",
|
||||
"CHANGE_COMPONENT_ENABLED_STATE",
|
||||
"CHANGE_CONFIGURATION",
|
||||
"CHANGE_NETWORK_STATE",
|
||||
"CHANGE_WIFI_MULTICAST_STATE",
|
||||
"CHANGE_WIFI_STATE",
|
||||
"CLEAR_APP_CACHE",
|
||||
"CONTROL_LOCATION_UPDATES",
|
||||
"DELETE_CACHE_FILES",
|
||||
"DELETE_PACKAGES",
|
||||
"DIAGNOSTIC",
|
||||
"DISABLE_KEYGUARD",
|
||||
"DUMP",
|
||||
"EXPAND_STATUS_BAR",
|
||||
"FACTORY_TEST",
|
||||
"GET_ACCOUNTS",
|
||||
"GET_ACCOUNTS_PRIVILEGED",
|
||||
"GET_PACKAGE_SIZE",
|
||||
"GET_TASKS",
|
||||
"GLOBAL_SEARCH",
|
||||
"INSTALL_LOCATION_PROVIDER",
|
||||
"INSTALL_PACKAGES",
|
||||
"INSTALL_SHORTCUT",
|
||||
"INSTANT_APP_FOREGROUND_SERVICE",
|
||||
"INTERNET",
|
||||
"KILL_BACKGROUND_PROCESSES",
|
||||
"LOCATION_HARDWARE",
|
||||
"MANAGE_DOCUMENTS",
|
||||
"MANAGE_OWN_CALLS",
|
||||
"MASTER_CLEAR",
|
||||
"MEDIA_CONTENT_CONTROL",
|
||||
"MODIFY_AUDIO_SETTINGS",
|
||||
"MODIFY_PHONE_STATE",
|
||||
"MOUNT_FORMAT_FILESYSTEMS",
|
||||
"MOUNT_UNMOUNT_FILESYSTEMS",
|
||||
"NFC",
|
||||
"PACKAGE_USAGE_STATS",
|
||||
"PERSISTENT_ACTIVITY",
|
||||
"PROCESS_OUTGOING_CALLS",
|
||||
"READ_CALENDAR",
|
||||
"READ_CALL_LOG",
|
||||
"READ_CONTACTS",
|
||||
"READ_EXTERNAL_STORAGE",
|
||||
"READ_FRAME_BUFFER",
|
||||
"READ_INPUT_STATE",
|
||||
"READ_LOGS",
|
||||
"READ_PHONE_NUMBERS",
|
||||
"READ_PHONE_STATE",
|
||||
"READ_SMS",
|
||||
"READ_SYNC_SETTINGS",
|
||||
"READ_SYNC_STATS",
|
||||
"READ_VOICEMAIL",
|
||||
"REBOOT",
|
||||
"RECEIVE_BOOT_COMPLETED",
|
||||
"RECEIVE_MMS",
|
||||
"RECEIVE_SMS",
|
||||
"RECEIVE_WAP_PUSH",
|
||||
"RECORD_AUDIO",
|
||||
"REORDER_TASKS",
|
||||
"REQUEST_COMPANION_RUN_IN_BACKGROUND",
|
||||
"REQUEST_COMPANION_USE_DATA_IN_BACKGROUND",
|
||||
"REQUEST_DELETE_PACKAGES",
|
||||
"REQUEST_IGNORE_BATTERY_OPTIMIZATIONS",
|
||||
"REQUEST_INSTALL_PACKAGES",
|
||||
"RESTART_PACKAGES",
|
||||
"SEND_RESPOND_VIA_MESSAGE",
|
||||
"SEND_SMS",
|
||||
"SET_ALARM",
|
||||
"SET_ALWAYS_FINISH",
|
||||
"SET_ANIMATION_SCALE",
|
||||
"SET_DEBUG_APP",
|
||||
"SET_PREFERRED_APPLICATIONS",
|
||||
"SET_PROCESS_LIMIT",
|
||||
"SET_TIME",
|
||||
"SET_TIME_ZONE",
|
||||
"SET_WALLPAPER",
|
||||
"SET_WALLPAPER_HINTS",
|
||||
"SIGNAL_PERSISTENT_PROCESSES",
|
||||
"STATUS_BAR",
|
||||
"SYSTEM_ALERT_WINDOW",
|
||||
"TRANSMIT_IR",
|
||||
"UNINSTALL_SHORTCUT",
|
||||
"UPDATE_DEVICE_STATS",
|
||||
"USE_FINGERPRINT",
|
||||
"USE_SIP",
|
||||
"VIBRATE",
|
||||
"WAKE_LOCK",
|
||||
"WRITE_APN_SETTINGS",
|
||||
"WRITE_CALENDAR",
|
||||
"WRITE_CALL_LOG",
|
||||
"WRITE_CONTACTS",
|
||||
"WRITE_EXTERNAL_STORAGE",
|
||||
"WRITE_GSERVICES",
|
||||
"WRITE_SECURE_SETTINGS",
|
||||
"WRITE_SETTINGS",
|
||||
"WRITE_SYNC_SETTINGS",
|
||||
"WRITE_VOICEMAIL"
|
||||
]
|
||||
},
|
||||
"comment": {
|
||||
"description": "Comment about the set of android permission(s)",
|
||||
"ui-priority": 0,
|
||||
"misp-attribute": "comment"
|
||||
}
|
||||
},
|
||||
"version": 2,
|
||||
"description": "A set of android permissions - one or more permission(s) which can be linked to other objects (e.g. malware, app).",
|
||||
"meta-category": "misc",
|
||||
"uuid": "d81003b2-5c03-4d96-ae30-e6695de1aea2",
|
||||
"name": "android-permission"
|
||||
}
|
||||
|
|
@ -0,0 +1,71 @@
|
|||
{
|
||||
"requiredOneOf": [
|
||||
"text"
|
||||
],
|
||||
"attributes": {
|
||||
"text": {
|
||||
"description": "Raw text of the annotation",
|
||||
"ui-priority": 0,
|
||||
"misp-attribute": "text"
|
||||
},
|
||||
"ref": {
|
||||
"description": "Reference(s) to the annotation",
|
||||
"ui-priority": 0,
|
||||
"misp-attribute": "link",
|
||||
"multiple": true
|
||||
},
|
||||
"type": {
|
||||
"description": "Type of the annotation",
|
||||
"ui-priority": 0,
|
||||
"misp-attribute": "text",
|
||||
"disable_correlation": true,
|
||||
"sane_default": [
|
||||
"Annotation",
|
||||
"Executive Summary",
|
||||
"Introduction",
|
||||
"Conclusion",
|
||||
"Disclaimer",
|
||||
"Keywords",
|
||||
"Acknowledgement",
|
||||
"Other",
|
||||
"Copyright",
|
||||
"Authors",
|
||||
"Logo"
|
||||
]
|
||||
},
|
||||
"format": {
|
||||
"description": "Format of the annotation",
|
||||
"ui-priority": 0,
|
||||
"misp-attribute": "text",
|
||||
"disable_correlation": true,
|
||||
"sane_default": [
|
||||
"text",
|
||||
"markdown",
|
||||
"asciidoctor",
|
||||
"MultiMarkdown",
|
||||
"GFM",
|
||||
"pandoc",
|
||||
"Fountain",
|
||||
"CommonWork",
|
||||
"kramdown-rfc2629",
|
||||
"rfc7328",
|
||||
"Extra"
|
||||
]
|
||||
},
|
||||
"creation-date": {
|
||||
"description": "Initial creation of the annotation",
|
||||
"ui-priority": 0,
|
||||
"misp-attribute": "datetime"
|
||||
},
|
||||
"modification-date": {
|
||||
"description": "Last update of the annotation",
|
||||
"ui-priority": 0,
|
||||
"misp-attribute": "datetime"
|
||||
}
|
||||
},
|
||||
"version": 2,
|
||||
"description": "An annotation object allowing analysts to add annotations, comments, executive summary to a MISP event, objects or attributes.",
|
||||
"meta-category": "misc",
|
||||
"uuid": "5d8dc046-15a1-4ca3-a09f-ed4ede7c4487",
|
||||
"name": "annotation"
|
||||
}
|
||||
|
|
@ -6,7 +6,7 @@
|
|||
"asn": {
|
||||
"description": "Autonomous System Number",
|
||||
"ui-priority": 1,
|
||||
"misp-attribute": "as"
|
||||
"misp-attribute": "AS"
|
||||
},
|
||||
"description": {
|
||||
"description": "Description of the autonomous system",
|
||||
|
|
@ -26,11 +26,13 @@
|
|||
},
|
||||
"first-seen": {
|
||||
"description": "First time the ASN was seen",
|
||||
"disable_correlation": true,
|
||||
"ui-priority": 0,
|
||||
"misp-attribute": "datetime"
|
||||
},
|
||||
"last-seen": {
|
||||
"description": "Last time the ASN was seen",
|
||||
"disable_correlation": true,
|
||||
"ui-priority": 0,
|
||||
"misp-attribute": "datetime"
|
||||
},
|
||||
|
|
@ -59,7 +61,7 @@
|
|||
"multiple": true
|
||||
}
|
||||
},
|
||||
"version": 2,
|
||||
"version": 4,
|
||||
"description": "Autonomous system object describing an autonomous system which can include one or more network operators management an entity (e.g. ISP) along with their routing policy, routing prefixes or alike.",
|
||||
"meta-category": "network",
|
||||
"uuid": "4ec55cc6-9e49-4c64-b794-03c25c1a6587",
|
||||
|
|
|
|||
|
|
@ -0,0 +1,170 @@
|
|||
{
|
||||
"requiredOneOf": [
|
||||
"account"
|
||||
],
|
||||
"attributes": {
|
||||
"text": {
|
||||
"description": "A description of the bank account.",
|
||||
"disable_correlation": true,
|
||||
"ui-priority": 0,
|
||||
"misp-attribute": "text"
|
||||
},
|
||||
"institution-name": {
|
||||
"description": "Name of the bank or financial organisation.",
|
||||
"disable_correlation": true,
|
||||
"ui-priority": 0,
|
||||
"misp-attribute": "text"
|
||||
},
|
||||
"institution-code": {
|
||||
"description": "Institution code of the bank.",
|
||||
"disable_correlation": true,
|
||||
"ui-priority": 0,
|
||||
"misp-attribute": "text"
|
||||
},
|
||||
"swift": {
|
||||
"description": "SWIFT or BIC as defined in ISO 9362.",
|
||||
"disable_correlation": true,
|
||||
"ui-priority": 0,
|
||||
"misp-attribute": "bic"
|
||||
},
|
||||
"branch": {
|
||||
"description": "Branch code or name",
|
||||
"disable_correlation": true,
|
||||
"ui-priority": 0,
|
||||
"misp-attribute": "text"
|
||||
},
|
||||
"non-banking-institution": {
|
||||
"description": "A flag to define if this account belong to a non-banking organisation. If set to true, it's a non-banking organisation.",
|
||||
"disable_correlation": true,
|
||||
"ui-priority": 0,
|
||||
"misp-attribute": "boolean"
|
||||
},
|
||||
"account": {
|
||||
"description": "Account number",
|
||||
"ui-priority": 0,
|
||||
"misp-attribute": "bank-account-nr"
|
||||
},
|
||||
"currency-code": {
|
||||
"description": "Currency of the account.",
|
||||
"ui-priority": 0,
|
||||
"sane_default": [
|
||||
"USD",
|
||||
"EUR"
|
||||
],
|
||||
"disable_correlation": true,
|
||||
"misp-attribute": "text"
|
||||
},
|
||||
"aba-rtn": {
|
||||
"description": " ABA routing transit number",
|
||||
"ui-priority": 0,
|
||||
"misp-attribute": "aba-rtn"
|
||||
},
|
||||
"account-name": {
|
||||
"description": "A field to freely describe the bank account details.",
|
||||
"ui-priority": 0,
|
||||
"misp-attribute": "text"
|
||||
},
|
||||
"iban": {
|
||||
"description": "IBAN of the bank account.",
|
||||
"ui-priority": 0,
|
||||
"misp-attribute": "iban"
|
||||
},
|
||||
"client-number": {
|
||||
"description": "Client number as seen by the bank.",
|
||||
"ui-priority": 0,
|
||||
"misp-attribute": "text"
|
||||
},
|
||||
"personal-account-type": {
|
||||
"description": "Account type.",
|
||||
"ui-priority": 0,
|
||||
"sane_default": [
|
||||
"A - Business",
|
||||
"B - Personal Current",
|
||||
"C - Savings",
|
||||
"D - Trust Account",
|
||||
"E - Trading Account",
|
||||
"O - Other"
|
||||
],
|
||||
"disable_correlation": true,
|
||||
"misp-attribute": "text"
|
||||
},
|
||||
"opened": {
|
||||
"description": "When the account was opened.",
|
||||
"ui-priority": 0,
|
||||
"misp-attribute": "datetime",
|
||||
"disable_correlation": true
|
||||
},
|
||||
"closed": {
|
||||
"description": "When the account was closed.",
|
||||
"ui-priority": 0,
|
||||
"misp-attribute": "datetime",
|
||||
"disable_correlation": true
|
||||
},
|
||||
"balance": {
|
||||
"description": "The balance of the account after the suspicious transaction was processed.",
|
||||
"ui-priority": 0,
|
||||
"misp-attribute": "text",
|
||||
"disable_correlation": true
|
||||
},
|
||||
"date-balance": {
|
||||
"description": "When the balance was reported.",
|
||||
"ui-priority": 0,
|
||||
"misp-attribute": "datetime",
|
||||
"disable_correlation": true
|
||||
},
|
||||
"status-code": {
|
||||
"description": "Account status at the time of the transaction processed.",
|
||||
"ui-priority": 0,
|
||||
"misp-attribute": "text",
|
||||
"disable_correlation": true,
|
||||
"sane_default": [
|
||||
"A - Active",
|
||||
"B - Inactive",
|
||||
"C - Dormant"
|
||||
]
|
||||
},
|
||||
"beneficiary": {
|
||||
"description": "Final beneficiary of the bank account.",
|
||||
"ui-priority": 0,
|
||||
"misp-attribute": "text",
|
||||
"disable_correlation": true
|
||||
},
|
||||
"beneficiary-comment": {
|
||||
"description": "Comment about the final beneficiary.",
|
||||
"ui-priority": 0,
|
||||
"misp-attribute": "text",
|
||||
"disable_correlation": true
|
||||
},
|
||||
"comments": {
|
||||
"description": "Comments about the bank account.",
|
||||
"ui-priority": 0,
|
||||
"misp-attribute": "text",
|
||||
"disable_correlation": true
|
||||
},
|
||||
"report-code": {
|
||||
"description": "Report code of the bank account.",
|
||||
"ui-priority": 0,
|
||||
"misp-attribute": "text",
|
||||
"disable_correlation": true,
|
||||
"sane_default": [
|
||||
"CTR Cash Transaction Report",
|
||||
"STR Suspicious Transaction Report",
|
||||
"EFT Electronic Funds Transfer",
|
||||
"IFT International Funds Transfer",
|
||||
"TFR Terror Financing Report",
|
||||
"BCR Border Cash Report",
|
||||
"UTR Unusual Transaction Report",
|
||||
"AIF Additional Information File – Can be used for example to get full disclosure of transactions of an account for a period of time without reporting it as a CTR.",
|
||||
"IRI Incoming Request for Information – International",
|
||||
"ORI Outgoing Request for Information – International",
|
||||
"IRD Incoming Request for Information – Domestic",
|
||||
"ORD Outgoing Request for Information – Domestic"
|
||||
]
|
||||
}
|
||||
},
|
||||
"version": 1,
|
||||
"description": "An object describing bank account information based on account description from goAML 4.0.",
|
||||
"meta-category": "financial",
|
||||
"uuid": "b4712203-95a8-4883-80e9-b566f5df11c9",
|
||||
"name": "bank-account"
|
||||
}
|
||||
|
|
@ -0,0 +1,108 @@
|
|||
{
|
||||
"requiredOneOf": [
|
||||
"msgType"
|
||||
],
|
||||
"attributes": {
|
||||
"identifier": {
|
||||
"description": "The identifier of the alert message in a number or string uniquely identifying this message, assigned by the sender.",
|
||||
"disable_correlation": true,
|
||||
"ui-priority": 1,
|
||||
"misp-attribute": "text"
|
||||
},
|
||||
"sender": {
|
||||
"description": "The identifier of the sender of the alert message which identifies the originator of this alert. Guaranteed by assigner to be unique globally; e.g., may be based on an Internet domain name.",
|
||||
"disable_correlation": true,
|
||||
"ui-priority": 0,
|
||||
"misp-attribute": "text"
|
||||
},
|
||||
"sent": {
|
||||
"description": "The time and date of the origination of the alert message.",
|
||||
"disable_correlation": true,
|
||||
"ui-priority": 0,
|
||||
"misp-attribute": "datetime"
|
||||
},
|
||||
"status": {
|
||||
"description": "The code denoting the appropriate handling of the alert message.",
|
||||
"ui-priority": 0,
|
||||
"misp-attribute": "text",
|
||||
"sane_default": [
|
||||
"Actual",
|
||||
"Exercise",
|
||||
"System",
|
||||
"Test",
|
||||
"Draft"
|
||||
]
|
||||
},
|
||||
"msgType": {
|
||||
"description": "The code denoting the nature of the alert message.",
|
||||
"ui-priority": 0,
|
||||
"disable_correlation": true,
|
||||
"misp-attribute": "text",
|
||||
"sane_default": [
|
||||
"Alert",
|
||||
"Update",
|
||||
"Cancel",
|
||||
"Ack",
|
||||
"Error"
|
||||
]
|
||||
},
|
||||
"source": {
|
||||
"description": "The text identifying the source of the alert message. The particular source of this alert; e.g., an operator or a specific device.",
|
||||
"ui-priority": 0,
|
||||
"disable_correlation": true,
|
||||
"misp-attribute": "text"
|
||||
},
|
||||
"scope": {
|
||||
"description": "The code denoting the intended distribution of the alert message. ",
|
||||
"ui-priority": 0,
|
||||
"misp-attribute": "text",
|
||||
"disable_correlation": true,
|
||||
"sane_default": [
|
||||
"Public",
|
||||
"Restricted",
|
||||
"Private"
|
||||
]
|
||||
},
|
||||
"restriction": {
|
||||
"description": "The text describing the rule for limiting distribution of the restricted alert message.",
|
||||
"ui-priority": 0,
|
||||
"misp-attribute": "text",
|
||||
"disable_correlation": true
|
||||
},
|
||||
"addresses": {
|
||||
"description": "The group listing of intended recipients of the alert message. (1) Required when <scope> is “Private”, optional when <scope> is “Public” or “Restricted”. (2) Each recipient SHALL be identified by an identifier or an address. (3) Multiple space-delimited addresses MAY be included. Addresses including whitespace MUST be enclosed in double-quotes. ",
|
||||
"ui-priority": 0,
|
||||
"misp-attribute": "text",
|
||||
"disable_correlation": true
|
||||
},
|
||||
"code": {
|
||||
"description": "The code denoting the special handling of the alert message.",
|
||||
"ui-priority": 0,
|
||||
"misp-attribute": "text",
|
||||
"disable_correlation": true
|
||||
},
|
||||
"note": {
|
||||
"description": "The text describing the purpose or significance of the alert message.",
|
||||
"ui-priority": 0,
|
||||
"misp-attribute": "text",
|
||||
"disable_correlation": true
|
||||
},
|
||||
"references": {
|
||||
"description": "The group listing identifying earlier message(s) referenced by the alert message. (1) The extended message identifier(s) (in the form sender,identifier,sent) of an earlier CAP message or messages referenced by this one. (2) If multiple messages are referenced, they SHALL be separated by whitespace.",
|
||||
"ui-priority": 0,
|
||||
"misp-attribute": "text",
|
||||
"disable_correlation": true
|
||||
},
|
||||
"incident": {
|
||||
"description": "The group listing naming the referent incident(s) of the alert message. (1) Used to collate multiple messages referring to different aspects of the same incident. (2) If multiple incident identifiers are referenced, they SHALL be separated by whitespace. Incident names including whitespace SHALL be surrounded by double-quotes.",
|
||||
"ui-priority": 0,
|
||||
"misp-attribute": "text",
|
||||
"disable_correlation": true
|
||||
}
|
||||
},
|
||||
"version": 1,
|
||||
"description": "Common Alerting Protocol Version (CAP) alert object",
|
||||
"meta-category": "misc",
|
||||
"uuid": "03b107bb-133d-4180-87ff-e3dbe731f828",
|
||||
"name": "cap-alert"
|
||||
}
|
||||
|
|
@ -0,0 +1,171 @@
|
|||
{
|
||||
"requiredOneOf": [
|
||||
"category"
|
||||
],
|
||||
"attributes": {
|
||||
"language": {
|
||||
"description": "The code denoting the language of the info sub-element of the alert message. ",
|
||||
"ui-priority": 0,
|
||||
"disable_correlation": true,
|
||||
"misp-attribute": "text"
|
||||
},
|
||||
"category": {
|
||||
"description": "The code denoting the category of the subject event of the alert message.",
|
||||
"ui-priority": 0,
|
||||
"misp-attribute": "text",
|
||||
"sane_default": [
|
||||
"Geo",
|
||||
"Met",
|
||||
"Safety",
|
||||
"Security",
|
||||
"Rescue",
|
||||
"Fire",
|
||||
"Health",
|
||||
"Env",
|
||||
"Transport",
|
||||
"Infra",
|
||||
"CBRNE",
|
||||
"Other"
|
||||
],
|
||||
"disable_correlation": true
|
||||
},
|
||||
"event": {
|
||||
"description": "The text denoting the type of the subject event of the alert message.",
|
||||
"ui-priority": 0,
|
||||
"disable_correlation": true,
|
||||
"misp-attribute": "text"
|
||||
},
|
||||
"responseType": {
|
||||
"description": "The code denoting the type of action recommended for the target audience.",
|
||||
"ui-priority": 0,
|
||||
"disable_correlation": true,
|
||||
"misp-attribute": "text",
|
||||
"sane_default": [
|
||||
"Shelter",
|
||||
"Evacuate",
|
||||
"Prepare",
|
||||
"Execute",
|
||||
"Avoid",
|
||||
"Monitor",
|
||||
"Assess",
|
||||
"AllClear",
|
||||
"None"
|
||||
]
|
||||
},
|
||||
"urgency": {
|
||||
"description": "The code denoting the urgency of the subject event of the alert message.",
|
||||
"ui-priority": 0,
|
||||
"disable_correlation": true,
|
||||
"misp-attribute": "text",
|
||||
"sane_default": [
|
||||
"Immediate",
|
||||
"Expected",
|
||||
"Future",
|
||||
"Past",
|
||||
"Unknown"
|
||||
]
|
||||
},
|
||||
"severity": {
|
||||
"description": "The code denoting the severity of the subject event of the alert message.",
|
||||
"ui-priority": 0,
|
||||
"disable_correlation": true,
|
||||
"misp-attribute": "text",
|
||||
"sane_default": [
|
||||
"Extreme",
|
||||
"Severe",
|
||||
"Moderate",
|
||||
"Minor",
|
||||
"Unknown"
|
||||
]
|
||||
},
|
||||
"certainty": {
|
||||
"description": "The code denoting the certainty of the subject event of the alert message. For backward compatibility with CAP 1.0, the deprecated value of “Very Likely” SHOULD be treated as equivalent to “Likely”.",
|
||||
"ui-priority": 0,
|
||||
"disable_correlation": true,
|
||||
"misp-attribute": "text",
|
||||
"sane_default": [
|
||||
"Likely",
|
||||
"Possible",
|
||||
"Unlikely",
|
||||
"Unknown"
|
||||
]
|
||||
},
|
||||
"audience": {
|
||||
"description": "The text describing the intended audience of the alert message.",
|
||||
"ui-priority": 0,
|
||||
"disable_correlation": true,
|
||||
"misp-attribute": "text"
|
||||
},
|
||||
"eventCode": {
|
||||
"description": "A system-specific code identifying the event type of the alert message.",
|
||||
"ui-priority": 0,
|
||||
"disable_correlation": true,
|
||||
"misp-attribute": "text"
|
||||
},
|
||||
"effective": {
|
||||
"description": "The effective time of the information of the alert message.",
|
||||
"ui-priority": 0,
|
||||
"disable_correlation": true,
|
||||
"misp-attribute": "datetime"
|
||||
},
|
||||
"onset": {
|
||||
"description": "The expected time of the beginning of the subject event of the alert message.",
|
||||
"ui-priority": 0,
|
||||
"disable_correlation": true,
|
||||
"misp-attribute": "datetime"
|
||||
},
|
||||
"expires": {
|
||||
"description": "The expiry time of the information of the alert message.",
|
||||
"ui-priority": 0,
|
||||
"disable_correlation": true,
|
||||
"misp-attribute": "datetime"
|
||||
},
|
||||
"senderName": {
|
||||
"description": "The text naming the originator of the alert message.",
|
||||
"ui-priority": 0,
|
||||
"disable_correlation": true,
|
||||
"misp-attribute": "text"
|
||||
},
|
||||
"headline": {
|
||||
"description": "The text headline of the alert message.",
|
||||
"ui-priority": 0,
|
||||
"disable_correlation": true,
|
||||
"misp-attribute": "text"
|
||||
},
|
||||
"description": {
|
||||
"description": "The text describing the subject event of the alert message.",
|
||||
"ui-priority": 0,
|
||||
"disable_correlation": true,
|
||||
"misp-attribute": "text"
|
||||
},
|
||||
"instruction": {
|
||||
"description": "The text describing the recommended action to be taken by recipients of the alert message.",
|
||||
"ui-priority": 0,
|
||||
"disable_correlation": true,
|
||||
"misp-attribute": "text"
|
||||
},
|
||||
"web": {
|
||||
"description": "The identifier of the hyperlink associating additional information with the alert message.",
|
||||
"ui-priority": 0,
|
||||
"disable_correlation": true,
|
||||
"misp-attribute": "link"
|
||||
},
|
||||
"contact": {
|
||||
"description": "The text describing the contact for follow-up and confirmation of the alert message.",
|
||||
"ui-priority": 0,
|
||||
"disable_correlation": true,
|
||||
"misp-attribute": "text"
|
||||
},
|
||||
"parameter": {
|
||||
"description": "A system-specific additional parameter associated with the alert message.",
|
||||
"ui-priority": 0,
|
||||
"disable_correlation": true,
|
||||
"misp-attribute": "text"
|
||||
}
|
||||
},
|
||||
"version": 1,
|
||||
"description": "Common Alerting Protocol Version (CAP) info object",
|
||||
"meta-category": "misc",
|
||||
"uuid": "826c25e6-fdd5-4e4a-b081-be5ba3ac2c3d",
|
||||
"name": "cap-info"
|
||||
}
|
||||
|
|
@ -0,0 +1,46 @@
|
|||
{
|
||||
"requiredOneOf": [
|
||||
"resourceDesc"
|
||||
],
|
||||
"attributes": {
|
||||
"resourceDesc": {
|
||||
"description": "The text describing the type and content of the resource file.",
|
||||
"ui-priority": 0,
|
||||
"disable_correlation": true,
|
||||
"misp-attribute": "text"
|
||||
},
|
||||
"mimeType": {
|
||||
"description": "The identifier of the MIME content type and sub-type describing the resource file.",
|
||||
"ui-priority": 0,
|
||||
"disable_correlation": true,
|
||||
"misp-attribute": "mime-type"
|
||||
},
|
||||
"size": {
|
||||
"description": "The integer indicating the size of the resource file.",
|
||||
"ui-priority": 0,
|
||||
"disable_correlation": true,
|
||||
"misp-attribute": "text"
|
||||
},
|
||||
"uri": {
|
||||
"description": "The identifier of the hyperlink for the resource file.",
|
||||
"ui-priority": 0,
|
||||
"misp-attribute": "link"
|
||||
},
|
||||
"derefUri": {
|
||||
"description": "The base-64 encoded data content of the resource file.",
|
||||
"ui-priority": 0,
|
||||
"misp-attribute": "attachment",
|
||||
"disable_correlation": true
|
||||
},
|
||||
"digest": {
|
||||
"description": "The code representing the digital digest (“hash”) computed from the resource file (OPTIONAL).",
|
||||
"ui-priority": 0,
|
||||
"misp-attribute": "sha1"
|
||||
}
|
||||
},
|
||||
"version": 1,
|
||||
"description": "Common Alerting Protocol Version (CAP) resource object",
|
||||
"meta-category": "misc",
|
||||
"uuid": "6fddc76b-59fc-49f6-a673-52f8d15149c4",
|
||||
"name": "cap-resource"
|
||||
}
|
||||
|
|
@ -0,0 +1,76 @@
|
|||
{
|
||||
"requiredOneOf": [
|
||||
"address",
|
||||
"address-xmr"
|
||||
],
|
||||
"attributes": {
|
||||
"address": {
|
||||
"description": "Bitcoin address used as a payment destination in a cryptocurrency",
|
||||
"ui-priority": 1,
|
||||
"misp-attribute": "btc"
|
||||
},
|
||||
"address-xmr": {
|
||||
"description": "Monero address used as a payment destination in a cryptocurrency",
|
||||
"ui-priority": 1,
|
||||
"misp-attribute": "xmr"
|
||||
},
|
||||
"symbol": {
|
||||
"description": "The (uppercase) symbol of the cryptocurrency used. Symbol should be from https://coinmarketcap.com/all/views/all/",
|
||||
"misp-attribute": "text",
|
||||
"disable_correlation": true,
|
||||
"ui-priority": 1,
|
||||
"sane_default": [
|
||||
"BTC",
|
||||
"ETH",
|
||||
"BCH",
|
||||
"XRP",
|
||||
"MIOTA",
|
||||
"DASH",
|
||||
"BTG",
|
||||
"LTC",
|
||||
"ADA",
|
||||
"XMR",
|
||||
"ETC",
|
||||
"NEO",
|
||||
"NEM",
|
||||
"EOS",
|
||||
"XLM",
|
||||
"BCC",
|
||||
"LSK",
|
||||
"OMG",
|
||||
"QTUM",
|
||||
"ZEC",
|
||||
"USDT",
|
||||
"HSR",
|
||||
"STRAT",
|
||||
"WAVES",
|
||||
"PPT",
|
||||
"ETN"
|
||||
]
|
||||
},
|
||||
"last-seen": {
|
||||
"description": "Last time this payment destination address has been seen",
|
||||
"disable_correlation": true,
|
||||
"ui-priority": 0,
|
||||
"misp-attribute": "datetime"
|
||||
},
|
||||
"first-seen": {
|
||||
"description": "First time this payment destination address has been seen",
|
||||
"disable_correlation": true,
|
||||
"ui-priority": 0,
|
||||
"misp-attribute": "datetime"
|
||||
},
|
||||
"text": {
|
||||
"description": "Free text value",
|
||||
"disable_correlation": true,
|
||||
"ui-priority": 1,
|
||||
"misp-attribute": "text",
|
||||
"recommended": false
|
||||
}
|
||||
},
|
||||
"version": 4,
|
||||
"description": "An address used in a cryptocurrency",
|
||||
"meta-category": "financial",
|
||||
"uuid": "d0e6997e-78da-4815-a6a1-cfc1c1cb8a46",
|
||||
"name": "coin-address"
|
||||
}
|
||||
|
|
@ -0,0 +1,104 @@
|
|||
{
|
||||
"requiredOneOf": [
|
||||
"name",
|
||||
"type"
|
||||
],
|
||||
"attributes": {
|
||||
"name": {
|
||||
"description": "The name used to identify the course of action.",
|
||||
"misp-attribute": "text",
|
||||
"ui-priority": 0,
|
||||
"disable_correlation": true
|
||||
},
|
||||
"type": {
|
||||
"description": "The type of the course of action.",
|
||||
"misp-attribute": "text",
|
||||
"ui-priority": 0,
|
||||
"disable_correlation": true,
|
||||
"sane_default": [
|
||||
"Perimeter Blocking",
|
||||
"Internal Blocking",
|
||||
"Redirection",
|
||||
"Redirection (Honey Pot)",
|
||||
"Hardening",
|
||||
"Patching",
|
||||
"Eradication",
|
||||
"Rebuilding",
|
||||
"Training",
|
||||
"Monitoring",
|
||||
"Physical Access Restrictions",
|
||||
"Logical Access Restrictions",
|
||||
"Public Disclosure",
|
||||
"Diplomatic Actions",
|
||||
"Policy Actions",
|
||||
"Other"
|
||||
]
|
||||
},
|
||||
"description": {
|
||||
"description": "A description of the course of action.",
|
||||
"misp-attribute": "text",
|
||||
"ui-priority": 0,
|
||||
"disable_correlation": true
|
||||
},
|
||||
"objective": {
|
||||
"description": "The objective of the course of action.",
|
||||
"misp-attribute": "text",
|
||||
"ui-priority": 0,
|
||||
"disable_correlation": true
|
||||
},
|
||||
"stage": {
|
||||
"description": "The stage of the threat management lifecycle that the course of action is applicable to.",
|
||||
"misp-attribute": "text",
|
||||
"ui-priority": 0,
|
||||
"disable_correlation": true,
|
||||
"sane_default": [
|
||||
"Remedy",
|
||||
"Response"
|
||||
]
|
||||
},
|
||||
"cost": {
|
||||
"description": "The estimated cost of applying the course of action.",
|
||||
"misp-attribute": "text",
|
||||
"ui-priority": 0,
|
||||
"disable_correlation": true,
|
||||
"sane_default": [
|
||||
"High",
|
||||
"Medium",
|
||||
"Low",
|
||||
"None",
|
||||
"Unknown"
|
||||
]
|
||||
},
|
||||
"impact": {
|
||||
"description": "The estimated impact of applying the course of action.",
|
||||
"misp-attribute": "text",
|
||||
"ui-priority": 0,
|
||||
"disable_correlation": true,
|
||||
"sane_default": [
|
||||
"High",
|
||||
"Medium",
|
||||
"Low",
|
||||
"None",
|
||||
"Unknown"
|
||||
]
|
||||
},
|
||||
"efficacy": {
|
||||
"description": "The estimated efficacy of applying the course of action.",
|
||||
"misp-attribute": "text",
|
||||
"ui-priority": 0,
|
||||
"disable_correlation": true,
|
||||
"sane_default": [
|
||||
"High",
|
||||
"Medium",
|
||||
"Low",
|
||||
"None",
|
||||
"Unknown"
|
||||
]
|
||||
}
|
||||
},
|
||||
"version": 1,
|
||||
"description": "An object describing a specific measure taken to prevent or respond to an attack.",
|
||||
"meta-category": "misc",
|
||||
"uuid": "3d1c2c06-68a9-4394-8c8d-258d115f796f",
|
||||
"name": "course-of-action"
|
||||
}
|
||||
|
|
@ -0,0 +1,126 @@
|
|||
{
|
||||
"requiredOneOf": [
|
||||
"session"
|
||||
],
|
||||
"attributes": {
|
||||
"eventid": {
|
||||
"description": "Eventid of the session in the cowrie honeypot",
|
||||
"disable_correlation": true,
|
||||
"ui-priority": 1,
|
||||
"misp-attribute": "text"
|
||||
},
|
||||
"system": {
|
||||
"description": "System origin in cowrie honeypot",
|
||||
"disable_correlation": true,
|
||||
"ui-priority": 1,
|
||||
"misp-attribute": "text"
|
||||
},
|
||||
"username": {
|
||||
"description": "Username related to the password(s)",
|
||||
"ui-priority": 1,
|
||||
"misp-attribute": "text"
|
||||
},
|
||||
"password": {
|
||||
"description": "Password",
|
||||
"multiple": true,
|
||||
"ui-priority": 1,
|
||||
"misp-attribute": "text"
|
||||
},
|
||||
"session": {
|
||||
"description": "Session id",
|
||||
"ui-priority": 1,
|
||||
"misp-attribute": "text"
|
||||
},
|
||||
"timestamp": {
|
||||
"description": "When the event happened",
|
||||
"ui-priority": 1,
|
||||
"misp-attribute": "datetime",
|
||||
"disable_correlation": true
|
||||
},
|
||||
"message": {
|
||||
"description": "Message of the cowrie honeypot",
|
||||
"ui-priority": 1,
|
||||
"misp-attribute": "text",
|
||||
"disable_correlation": true
|
||||
},
|
||||
"protocol": {
|
||||
"description": "Protocol used in the cowrie honeypot",
|
||||
"ui-priority": 1,
|
||||
"misp-attribute": "text",
|
||||
"disable_correlation": true
|
||||
},
|
||||
"sensor": {
|
||||
"description": "Cowrie sensor name",
|
||||
"ui-priority": 1,
|
||||
"misp-attribute": "text",
|
||||
"disable_correlation": true
|
||||
},
|
||||
"src_ip": {
|
||||
"description": "Source IP address of the session",
|
||||
"ui-priority": 1,
|
||||
"misp-attribute": "ip-src"
|
||||
},
|
||||
"dst_ip": {
|
||||
"description": "Destination IP address of the session",
|
||||
"ui-priority": 1,
|
||||
"misp-attribute": "ip-dst",
|
||||
"disable_correlation": true
|
||||
},
|
||||
"src_port": {
|
||||
"description": "Source port of the session",
|
||||
"ui-priority": 1,
|
||||
"misp-attribute": "port",
|
||||
"disable_correlation": true
|
||||
},
|
||||
"dst_port": {
|
||||
"description": "Destination port of the session",
|
||||
"ui-priority": 1,
|
||||
"misp-attribute": "port",
|
||||
"disable_correlation": true
|
||||
},
|
||||
"isError": {
|
||||
"description": "isError",
|
||||
"ui-priority": 1,
|
||||
"misp-attribute": "text",
|
||||
"disable_correlation": true
|
||||
},
|
||||
"input": {
|
||||
"description": "Input of the session",
|
||||
"ui-priority": 1,
|
||||
"misp-attribute": "text"
|
||||
},
|
||||
"macCS": {
|
||||
"description": "SSH MAC supported in the sesssion",
|
||||
"multiple": true,
|
||||
"disable_correlation": true,
|
||||
"ui-priority": 1,
|
||||
"misp-attribute": "text"
|
||||
},
|
||||
"keyAlgs": {
|
||||
"description": "SSH public-key algorithm supported in the session",
|
||||
"multiple": true,
|
||||
"disable_correlation": true,
|
||||
"ui-priority": 1,
|
||||
"misp-attribute": "text"
|
||||
},
|
||||
"encCS": {
|
||||
"description": "SSH symmetric encryption algorithm supported in the session",
|
||||
"multiple": true,
|
||||
"disable_correlation": true,
|
||||
"ui-priority": 1,
|
||||
"misp-attribute": "text"
|
||||
},
|
||||
"compCS": {
|
||||
"description": "SSH compression algorithm supported in the session",
|
||||
"multiple": true,
|
||||
"ui-priority": 1,
|
||||
"misp-attribute": "text",
|
||||
"disable_correlation": true
|
||||
}
|
||||
},
|
||||
"version": 2,
|
||||
"description": "Cowrie honeypot object template",
|
||||
"meta-category": "network",
|
||||
"uuid": "ae085d32-6534-4d52-b3eb-063fccb753e7",
|
||||
"name": "cowrie"
|
||||
}
|
||||
|
|
@ -3,7 +3,7 @@
|
|||
"uuid": "e2f124d6-f57c-4f93-99e6-8450545fa05d",
|
||||
"meta-category": "network",
|
||||
"description": "DDoS object describes a current DDoS activity from a specific or/and to a specific target. Type of DDoS can be attached to the object as a taxonomy",
|
||||
"version": 4,
|
||||
"version": 6,
|
||||
"attributes": {
|
||||
"total-bps": {
|
||||
"description": "Bits per second",
|
||||
|
|
@ -12,11 +12,21 @@
|
|||
},
|
||||
"text": {
|
||||
"description": "Description of the DDoS",
|
||||
"disable_correlation": true,
|
||||
"misp-attribute": "text",
|
||||
"ui-priority": 0
|
||||
},
|
||||
"domain-dst": {
|
||||
"description": "Destination domain (victim)",
|
||||
"misp-attribute": "domain",
|
||||
"ui-priority": 1,
|
||||
"categories": [
|
||||
"Network activity",
|
||||
"External analysis"
|
||||
]
|
||||
},
|
||||
"ip-dst": {
|
||||
"description": "Destination ID (victim)",
|
||||
"description": "Destination IP (victim)",
|
||||
"misp-attribute": "ip-dst",
|
||||
"ui-priority": 1,
|
||||
"categories": [
|
||||
|
|
@ -53,6 +63,7 @@
|
|||
},
|
||||
"first-seen": {
|
||||
"description": "Beginning of the attack",
|
||||
"disable_correlation": true,
|
||||
"misp-attribute": "datetime",
|
||||
"ui-priority": 0
|
||||
},
|
||||
|
|
@ -74,12 +85,14 @@
|
|||
},
|
||||
"last-seen": {
|
||||
"description": "End of the attack",
|
||||
"disable_correlation": true,
|
||||
"misp-attribute": "datetime",
|
||||
"ui-priority": 0
|
||||
}
|
||||
},
|
||||
"requiredOneOf": [
|
||||
"ip-dst",
|
||||
"ip-src"
|
||||
"ip-src",
|
||||
"domain-dst"
|
||||
]
|
||||
}
|
||||
|
|
|
|||
|
|
@ -0,0 +1,89 @@
|
|||
{
|
||||
"requiredOneOf": [
|
||||
"text"
|
||||
],
|
||||
"attributes": {
|
||||
"category": {
|
||||
"description": "Category.",
|
||||
"sane_default": [
|
||||
"Cat0",
|
||||
"Cat1",
|
||||
"Cat2",
|
||||
"Cat3",
|
||||
"CatSMS"
|
||||
],
|
||||
"misp-attribute": "text",
|
||||
"disable_correlation": true,
|
||||
"ui-priority": 0
|
||||
},
|
||||
"ApplicationId": {
|
||||
"description": "Application-ID is used to identify for which Diameter application the message is applicable. Application-ID is a decimal representation.",
|
||||
"misp-attribute": "text",
|
||||
"ui-priority": 0
|
||||
},
|
||||
"SessionId": {
|
||||
"description": "Session-ID.",
|
||||
"misp-attribute": "text",
|
||||
"ui-priority": 0
|
||||
},
|
||||
"CmdCode": {
|
||||
"description": "A decimal representation of the diameter Command Code.",
|
||||
"disable_correlation": true,
|
||||
"misp-attribute": "text",
|
||||
"ui-priority": 0
|
||||
},
|
||||
"Origin-Host": {
|
||||
"description": "Origin-Host.",
|
||||
"misp-attribute": "text",
|
||||
"multiple": true,
|
||||
"ui-priority": 0
|
||||
},
|
||||
"Destination-Host": {
|
||||
"description": "Destination-Host.",
|
||||
"misp-attribute": "text",
|
||||
"multiple": true,
|
||||
"ui-priority": 0
|
||||
},
|
||||
"Origin-Realm": {
|
||||
"description": "Origin-Realm.",
|
||||
"misp-attribute": "text",
|
||||
"multiple": true,
|
||||
"ui-priority": 0
|
||||
},
|
||||
"Destination-Realm": {
|
||||
"description": "Destination-Realm.",
|
||||
"misp-attribute": "text",
|
||||
"multiple": true,
|
||||
"ui-priority": 0
|
||||
},
|
||||
"Username": {
|
||||
"description": "Username (in this case, usually the IMSI).",
|
||||
"misp-attribute": "text",
|
||||
"multiple": true,
|
||||
"ui-priority": 0
|
||||
},
|
||||
"IdrFlags": {
|
||||
"description": "IDR-Flags.",
|
||||
"misp-attribute": "text",
|
||||
"disable_correlation": true,
|
||||
"ui-priority": 0
|
||||
},
|
||||
"text": {
|
||||
"description": "A description of the attack seen.",
|
||||
"disable_correlation": true,
|
||||
"ui-priority": 0,
|
||||
"misp-attribute": "text"
|
||||
},
|
||||
"first-seen": {
|
||||
"description": "When the attack has been seen for the first time.",
|
||||
"disable_correlation": true,
|
||||
"ui-priority": 0,
|
||||
"misp-attribute": "datetime"
|
||||
}
|
||||
},
|
||||
"version": 1,
|
||||
"description": "Attack as seen on diameter authentication against a GSM, UMTS or LTE network",
|
||||
"meta-category": "network",
|
||||
"uuid": "a3fdce4c-8e21-4acc-ab8e-9976e9165a12",
|
||||
"name": "diameter-attack"
|
||||
}
|
||||
|
|
@ -6,17 +6,20 @@
|
|||
"attributes": {
|
||||
"text": {
|
||||
"description": "A description of the tuple",
|
||||
"disable_correlation": true,
|
||||
"ui-priority": 1,
|
||||
"misp-attribute": "text",
|
||||
"recommended": false
|
||||
},
|
||||
"last-seen": {
|
||||
"description": "Last time the tuple has been seen",
|
||||
"disable_correlation": true,
|
||||
"ui-priority": 0,
|
||||
"misp-attribute": "datetime"
|
||||
},
|
||||
"first-seen": {
|
||||
"description": "First time the tuple has been seen",
|
||||
"disable_correlation": true,
|
||||
"ui-priority": 0,
|
||||
"misp-attribute": "datetime"
|
||||
},
|
||||
|
|
@ -40,7 +43,7 @@
|
|||
"multiple": true
|
||||
}
|
||||
},
|
||||
"version": 4,
|
||||
"version": 5,
|
||||
"description": "A domain and IP address seen as a tuple in a specific time frame.",
|
||||
"meta-category": "network",
|
||||
"uuid": "43b3b146-77eb-4931-b4cc-b66c60f28734",
|
||||
|
|
|
|||
|
|
@ -210,7 +210,8 @@
|
|||
"AMDGPU"
|
||||
],
|
||||
"ui-priority": 0,
|
||||
"misp-attribute": "text"
|
||||
"misp-attribute": "text",
|
||||
"disable_correlation": true
|
||||
},
|
||||
"os_abi": {
|
||||
"description": "Header operating system application binary interface (ABI)",
|
||||
|
|
@ -238,7 +239,8 @@
|
|||
"TRU64"
|
||||
],
|
||||
"ui-priority": 0,
|
||||
"misp-attribute": "text"
|
||||
"misp-attribute": "text",
|
||||
"disable_correlation": true
|
||||
},
|
||||
"text": {
|
||||
"description": "Free text value to attach to the ELF",
|
||||
|
|
@ -248,7 +250,7 @@
|
|||
"recommended": false
|
||||
}
|
||||
},
|
||||
"version": 3,
|
||||
"version": 4,
|
||||
"description": "Object describing a Executable and Linkable Format",
|
||||
"meta-category": "file",
|
||||
"uuid": "fa6534ae-ad74-4ce0-8f23-15a66c82c7fa",
|
||||
|
|
|
|||
|
|
@ -3,7 +3,7 @@
|
|||
"uuid": "a0c666e0-fc65-4be8-b48f-3423d788b552",
|
||||
"meta-category": "network",
|
||||
"description": "Email object describing an email with meta-information",
|
||||
"version": 7,
|
||||
"version": 11,
|
||||
"attributes": {
|
||||
"reply-to": {
|
||||
"description": "Email address the reply will be sent to",
|
||||
|
|
@ -16,6 +16,7 @@
|
|||
"message-id": {
|
||||
"description": "Message ID",
|
||||
"misp-attribute": "email-message-id",
|
||||
"disable_correlation": true,
|
||||
"ui-priority": 0,
|
||||
"categories": [
|
||||
"Payload delivery"
|
||||
|
|
@ -24,6 +25,7 @@
|
|||
"to": {
|
||||
"description": "Destination email address",
|
||||
"misp-attribute": "email-dst",
|
||||
"disable_correlation": true,
|
||||
"ui-priority": 1,
|
||||
"categories": [
|
||||
"Payload delivery"
|
||||
|
|
@ -33,6 +35,7 @@
|
|||
"cc": {
|
||||
"description": "Carbon copy",
|
||||
"misp-attribute": "email-dst",
|
||||
"disable_correlation": true,
|
||||
"ui-priority": 1,
|
||||
"categories": [
|
||||
"Payload delivery"
|
||||
|
|
@ -59,6 +62,7 @@
|
|||
"screenshot": {
|
||||
"description": "Screenshot of email",
|
||||
"misp-attribute": "attachment",
|
||||
"disable_correlation": true,
|
||||
"ui-priority": 1,
|
||||
"categories": [
|
||||
"External analysis"
|
||||
|
|
@ -76,6 +80,7 @@
|
|||
"x-mailer": {
|
||||
"description": "X-Mailer generally tells the program that was used to draft and send the original email",
|
||||
"misp-attribute": "email-x-mailer",
|
||||
"disable_correlation": true,
|
||||
"ui-priority": 0,
|
||||
"categories": [
|
||||
"Payload delivery"
|
||||
|
|
@ -84,6 +89,7 @@
|
|||
"header": {
|
||||
"description": "Full headers",
|
||||
"misp-attribute": "email-header",
|
||||
"disable_correlation": true,
|
||||
"ui-priority": 0,
|
||||
"categories": [
|
||||
"Payload delivery"
|
||||
|
|
@ -102,6 +108,7 @@
|
|||
"mime-boundary": {
|
||||
"description": "MIME Boundary",
|
||||
"misp-attribute": "email-mime-boundary",
|
||||
"disable_correlation": true,
|
||||
"ui-priority": 0,
|
||||
"categories": [
|
||||
"Payload delivery"
|
||||
|
|
@ -110,6 +117,7 @@
|
|||
"thread-index": {
|
||||
"description": "Identifies a particular conversation thread",
|
||||
"misp-attribute": "email-thread-index",
|
||||
"disable_correlation": true,
|
||||
"ui-priority": 0,
|
||||
"categories": [
|
||||
"Payload delivery"
|
||||
|
|
@ -125,7 +133,7 @@
|
|||
},
|
||||
"return-path": {
|
||||
"description": "Message return path",
|
||||
"misp-attribute": "text",
|
||||
"misp-attribute": "email-src",
|
||||
"ui-priority": 1,
|
||||
"categories": [
|
||||
"Payload delivery"
|
||||
|
|
@ -138,6 +146,27 @@
|
|||
"categories": [
|
||||
"Payload delivery"
|
||||
]
|
||||
},
|
||||
"email-body": {
|
||||
"description": "Body of the email",
|
||||
"misp-attribute": "email-body",
|
||||
"disable_correlation": true,
|
||||
"ui-priority": 1,
|
||||
"categories": [
|
||||
"Payload delivery"
|
||||
]
|
||||
},
|
||||
"user-agent": {
|
||||
"description": "User Agent of the sender",
|
||||
"misp-attribute": "text",
|
||||
"ui-priority": 0,
|
||||
"disable_correlation": true
|
||||
},
|
||||
"eml": {
|
||||
"description": "Full EML",
|
||||
"misp-attribute": "attachment",
|
||||
"disable_correlation": true,
|
||||
"ui-priority": 1
|
||||
}
|
||||
},
|
||||
"requiredOneOf": [
|
||||
|
|
@ -155,6 +184,8 @@
|
|||
"thread-index",
|
||||
"header",
|
||||
"x-mailer",
|
||||
"return-path"
|
||||
"return-path",
|
||||
"email-body",
|
||||
"eml"
|
||||
]
|
||||
}
|
||||
|
|
|
|||
|
|
@ -0,0 +1,45 @@
|
|||
{
|
||||
"requiredOneOf": [
|
||||
"vulnerable_configuration",
|
||||
"description",
|
||||
"poc"
|
||||
],
|
||||
"attributes": {
|
||||
"description": {
|
||||
"description": "Description of the exploit - proof of concept",
|
||||
"ui-priority": 0,
|
||||
"misp-attribute": "text"
|
||||
},
|
||||
"vulnerable_configuration": {
|
||||
"description": "The vulnerable configuration described in CPE format where the exploit/proof of concept is valid",
|
||||
"multiple": true,
|
||||
"ui-priority": 0,
|
||||
"misp-attribute": "text"
|
||||
},
|
||||
"author": {
|
||||
"description": "Author of the exploit - proof of concept",
|
||||
"ui-priority": 0,
|
||||
"disable_correlation": true,
|
||||
"misp-attribute": "text",
|
||||
"multiple": true
|
||||
},
|
||||
"references": {
|
||||
"description": "External references",
|
||||
"multiple": true,
|
||||
"ui-priority": 0,
|
||||
"misp-attribute": "link"
|
||||
},
|
||||
"poc": {
|
||||
"description": "Proof of Concept or exploit (as a script, binary or described process)",
|
||||
"ui-priority": 0,
|
||||
"misp-attribute": "attachment",
|
||||
"disable_correlation": true,
|
||||
"multiple": true
|
||||
}
|
||||
},
|
||||
"version": 2,
|
||||
"description": "Exploit-poc object describing a proof of concept or exploit of a vulnerability. This object has often a relationship with a vulnerability object.",
|
||||
"meta-category": "vulnerability",
|
||||
"uuid": "e3bdeef8-78c3-48d8-9c2f-1be5e5bde93b",
|
||||
"name": "exploit-poc"
|
||||
}
|
||||
|
|
@ -0,0 +1,61 @@
|
|||
{
|
||||
"required": [
|
||||
"banned-ip",
|
||||
"processing-timestamp",
|
||||
"attack-type"
|
||||
],
|
||||
"attributes": {
|
||||
"banned-ip": {
|
||||
"description": "IP Address banned by fail2ban",
|
||||
"ui-priority": 1,
|
||||
"misp-attribute": "ip-src"
|
||||
},
|
||||
"processing-timestamp": {
|
||||
"description": "Timestamp of the report",
|
||||
"ui-priority": 1,
|
||||
"misp-attribute": "datetime",
|
||||
"disable_correlation": true
|
||||
},
|
||||
"attack-type": {
|
||||
"description": "Type of the attack",
|
||||
"ui-priority": 1,
|
||||
"misp-attribute": "text",
|
||||
"disable_correlation": true
|
||||
},
|
||||
"failures": {
|
||||
"description": "Amount of failures that lead to the ban.",
|
||||
"ui-priority": 1,
|
||||
"misp-attribute": "counter",
|
||||
"disable_correlation": true
|
||||
},
|
||||
"sensor": {
|
||||
"description": "Identifier of the sensor",
|
||||
"ui-priority": 1,
|
||||
"misp-attribute": "text",
|
||||
"disable_correlation": true
|
||||
},
|
||||
"victim": {
|
||||
"description": "Identifier of the victim",
|
||||
"ui-priority": 1,
|
||||
"misp-attribute": "text",
|
||||
"disable_correlation": true
|
||||
},
|
||||
"logline": {
|
||||
"description": "Example log line that caused the ban.",
|
||||
"ui-priority": 1,
|
||||
"misp-attribute": "text",
|
||||
"disable_correlation": true
|
||||
},
|
||||
"logfile": {
|
||||
"description": "Full logfile related to the attack.",
|
||||
"ui-priority": 1,
|
||||
"misp-attribute": "attachment",
|
||||
"disable_correlation": true
|
||||
}
|
||||
},
|
||||
"version": 5,
|
||||
"description": "Fail2ban event",
|
||||
"meta-category": "network",
|
||||
"uuid": "8be2271-7326-41a5-a0dd-9b4bec88e1ba",
|
||||
"name": "fail2ban"
|
||||
}
|
||||
|
|
@ -15,7 +15,10 @@
|
|||
"sha512/224",
|
||||
"sha512/256",
|
||||
"tlsh",
|
||||
"pattern-in-file"
|
||||
"pattern-in-file",
|
||||
"x509-fingerprint-sha1",
|
||||
"malware-sample",
|
||||
"path"
|
||||
],
|
||||
"attributes": {
|
||||
"md5": {
|
||||
|
|
@ -111,6 +114,8 @@
|
|||
},
|
||||
"filename": {
|
||||
"description": "Filename on disk",
|
||||
"disable_correlation": true,
|
||||
"multiple": true,
|
||||
"categories": [
|
||||
"Payload delivery",
|
||||
"Artifacts dropped",
|
||||
|
|
@ -120,23 +125,37 @@
|
|||
"ui-priority": 1,
|
||||
"misp-attribute": "filename"
|
||||
},
|
||||
"path": {
|
||||
"description": "Path of the filename complete or partial",
|
||||
"disable_correlation": true,
|
||||
"multiple": true,
|
||||
"ui-priority": 0,
|
||||
"misp-attribute": "text"
|
||||
},
|
||||
"tlsh": {
|
||||
"description": "Fuzzy hash by Trend Micro: Locality Sensitive Hash",
|
||||
"ui-priority": 0,
|
||||
"misp-attribute": "tlsh"
|
||||
},
|
||||
"certificate": {
|
||||
"description": "Certificate value if the binary is signed with another authentication scheme than authenticode",
|
||||
"ui-priority": 0,
|
||||
"misp-attribute": "x509-fingerprint-sha1"
|
||||
},
|
||||
"mimetype": {
|
||||
"description": "Mime type",
|
||||
"disable_correlation": true,
|
||||
"ui-priority": 0,
|
||||
"misp-attribute": "text"
|
||||
"misp-attribute": "mime-type"
|
||||
},
|
||||
"state": {
|
||||
"misp-attribute": "text",
|
||||
"ui-priority": 0,
|
||||
"description": "State of the file",
|
||||
"multiple": true,
|
||||
"disable_correlation": true,
|
||||
"values_list": [
|
||||
"Malicious",
|
||||
"Harmless",
|
||||
"Signed",
|
||||
"Revoked",
|
||||
|
|
@ -145,7 +164,7 @@
|
|||
]
|
||||
}
|
||||
},
|
||||
"version": 4,
|
||||
"version": 11,
|
||||
"description": "File object describing a file with meta-information",
|
||||
"meta-category": "file",
|
||||
"uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
||||
|
|
|
|||
|
|
@ -4,7 +4,8 @@
|
|||
"longitude",
|
||||
"city",
|
||||
"region",
|
||||
"country"
|
||||
"country",
|
||||
"epsg"
|
||||
],
|
||||
"attributes": {
|
||||
"first-seen": {
|
||||
|
|
@ -28,13 +29,13 @@
|
|||
"latitude": {
|
||||
"description": "The latitude is the decimal value of the latitude in the World Geodetic System 84 (WGS84) reference.",
|
||||
"disable_correlation": true,
|
||||
"ui-priority": 1,
|
||||
"ui-priority": 90,
|
||||
"misp-attribute": "float"
|
||||
},
|
||||
"longitude": {
|
||||
"description": "The longitude is the decimal value of the longitude in the World Geodetic System 84 (WGS84) reference",
|
||||
"disable_correlation": true,
|
||||
"ui-priority": 1,
|
||||
"ui-priority": 89,
|
||||
"misp-attribute": "float"
|
||||
},
|
||||
"altitude": {
|
||||
|
|
@ -42,6 +43,16 @@
|
|||
"ui-priority": 0,
|
||||
"misp-attribute": "float"
|
||||
},
|
||||
"address": {
|
||||
"description": "Address.",
|
||||
"misp-attribute": "text",
|
||||
"ui-priority": 1
|
||||
},
|
||||
"zipcode": {
|
||||
"description": "Zip Code.",
|
||||
"misp-attribute": "text",
|
||||
"ui-priority": 1
|
||||
},
|
||||
"city": {
|
||||
"description": "City.",
|
||||
"misp-attribute": "text",
|
||||
|
|
@ -56,9 +67,24 @@
|
|||
"description": "Country.",
|
||||
"misp-attribute": "text",
|
||||
"ui-priority": 1
|
||||
},
|
||||
"epsg": {
|
||||
"description": "EPSG Geodetic Parameter value. This is an integer value of the EPSG.",
|
||||
"misp-attribute": "text",
|
||||
"ui-priority": 70
|
||||
},
|
||||
"spacial-reference": {
|
||||
"description": "Default spacial or projection refence for this object.",
|
||||
"misp-attribute": "text",
|
||||
"ui-priority": 1,
|
||||
"disable_correlation": true,
|
||||
"values_list": [
|
||||
"WGS84 EPSG:4326",
|
||||
"Mercator EPSG:3857"
|
||||
]
|
||||
}
|
||||
},
|
||||
"version": 2,
|
||||
"version": 3,
|
||||
"description": "An object to describe a geographic location.",
|
||||
"meta-category": "misc",
|
||||
"uuid": "fdd30d5f-6752-45ed-bef2-25e8ce4d8a3",
|
||||
|
|
|
|||
|
|
@ -0,0 +1,99 @@
|
|||
{
|
||||
"requiredOneOf": [
|
||||
"text"
|
||||
],
|
||||
"attributes": {
|
||||
"GtpServingNetwork": {
|
||||
"description": "GTP Serving Network.",
|
||||
"misp-attribute": "text",
|
||||
"disable_correlation": true,
|
||||
"ui-priority": 1
|
||||
},
|
||||
"GtpImei": {
|
||||
"description": "GTP IMEI (International Mobile Equipment Identity).",
|
||||
"misp-attribute": "text",
|
||||
"ui-priority": 1
|
||||
},
|
||||
"GtpMsisdn": {
|
||||
"description": "GTP MSISDN.",
|
||||
"misp-attribute": "text",
|
||||
"ui-priority": 1
|
||||
},
|
||||
"GtpImsi": {
|
||||
"description": "GTP IMSI (International mobile subscriber identity).",
|
||||
"misp-attribute": "text",
|
||||
"ui-priority": 1
|
||||
},
|
||||
"GtpInterface": {
|
||||
"description": "GTP interface.",
|
||||
"sane_default": [
|
||||
"S5",
|
||||
"S11",
|
||||
"S10",
|
||||
"S8",
|
||||
"Gn",
|
||||
"Gp"
|
||||
],
|
||||
"misp-attribute": "text",
|
||||
"disable_correlation": true,
|
||||
"multiple": true,
|
||||
"ui-priority": 1
|
||||
},
|
||||
"GtpMessageType": {
|
||||
"description": "GTP defines a set of messages between two associated GSNs or an SGSN and an RNC. Message type is described as a decimal value.",
|
||||
"disable_correlation": true,
|
||||
"misp-attribute": "text",
|
||||
"ui-priority": 1
|
||||
},
|
||||
"PortDest": {
|
||||
"description": "Destination port.",
|
||||
"disable_correlation": true,
|
||||
"misp-attribute": "text",
|
||||
"ui-priority": 0
|
||||
},
|
||||
"PortSrc": {
|
||||
"description": "Source port.",
|
||||
"disable_correlation": true,
|
||||
"misp-attribute": "port",
|
||||
"ui-priority": 0
|
||||
},
|
||||
"ipDest": {
|
||||
"description": "IP destination address.",
|
||||
"misp-attribute": "ip-dst",
|
||||
"ui-priority": 0
|
||||
},
|
||||
"ipSrc": {
|
||||
"description": "IP source address.",
|
||||
"misp-attribute": "ip-src",
|
||||
"ui-priority": 0
|
||||
},
|
||||
"GtpVersion": {
|
||||
"description": "GTP version",
|
||||
"sane_default": [
|
||||
"0",
|
||||
"1",
|
||||
"2"
|
||||
],
|
||||
"misp-attribute": "text",
|
||||
"disable_correlation": true,
|
||||
"ui-priority": 0
|
||||
},
|
||||
"text": {
|
||||
"description": "A description of the GTP attack.",
|
||||
"disable_correlation": true,
|
||||
"ui-priority": 0,
|
||||
"misp-attribute": "text"
|
||||
},
|
||||
"first-seen": {
|
||||
"description": "When the attack has been seen for the first time.",
|
||||
"disable_correlation": true,
|
||||
"ui-priority": 0,
|
||||
"misp-attribute": "datetime"
|
||||
}
|
||||
},
|
||||
"version": 3,
|
||||
"description": "GTP attack object as seen on a GSM, UMTS or LTE network",
|
||||
"meta-category": "network",
|
||||
"uuid": "6b3c48d2-0ca6-4608-9c36-455105439145",
|
||||
"name": "gtp-attack"
|
||||
}
|
||||
|
|
@ -1,6 +1,6 @@
|
|||
{
|
||||
"required": [
|
||||
"method",
|
||||
"requiredOneOf": [
|
||||
"url",
|
||||
"uri"
|
||||
],
|
||||
"attributes": {
|
||||
|
|
@ -111,7 +111,7 @@
|
|||
"misp-attribute": "user-agent"
|
||||
}
|
||||
},
|
||||
"version": 1,
|
||||
"version": 2,
|
||||
"description": "A single HTTP request header",
|
||||
"meta-category": "network",
|
||||
"uuid": "b4a8d163-8110-4239-bfcf-e08f3a9fdf7b",
|
||||
|
|
|
|||
|
|
@ -1,24 +1,27 @@
|
|||
{
|
||||
"requiredOneOf": [
|
||||
"dst-port",
|
||||
"src-port"
|
||||
],
|
||||
"required": [
|
||||
"src-port",
|
||||
"domain",
|
||||
"hostname",
|
||||
"ip"
|
||||
],
|
||||
"attributes": {
|
||||
"text": {
|
||||
"description": "Description of the tuple",
|
||||
"disable_correlation": true,
|
||||
"ui-priority": 0,
|
||||
"misp-attribute": "text"
|
||||
},
|
||||
"last-seen": {
|
||||
"description": "Last time the tuple has been seen",
|
||||
"disable_correlation": true,
|
||||
"ui-priority": 0,
|
||||
"misp-attribute": "datetime"
|
||||
},
|
||||
"first-seen": {
|
||||
"description": "First time the tuple has been seen",
|
||||
"disable_correlation": true,
|
||||
"ui-priority": 0,
|
||||
"misp-attribute": "datetime"
|
||||
},
|
||||
|
|
@ -38,7 +41,29 @@
|
|||
"External analysis"
|
||||
],
|
||||
"ui-priority": 1,
|
||||
"misp-attribute": "port"
|
||||
"misp-attribute": "port",
|
||||
"disable_correlation": true,
|
||||
"multiple": true
|
||||
},
|
||||
"domain": {
|
||||
"description": "Domain",
|
||||
"categories": [
|
||||
"Network activity",
|
||||
"External analysis"
|
||||
],
|
||||
"ui-priority": 1,
|
||||
"misp-attribute": "domain",
|
||||
"multiple": true
|
||||
},
|
||||
"hostname": {
|
||||
"description": "Hostname",
|
||||
"categories": [
|
||||
"Network activity",
|
||||
"External analysis"
|
||||
],
|
||||
"ui-priority": 1,
|
||||
"misp-attribute": "hostname",
|
||||
"multiple": true
|
||||
},
|
||||
"ip": {
|
||||
"description": "IP Address",
|
||||
|
|
@ -47,11 +72,12 @@
|
|||
"External analysis"
|
||||
],
|
||||
"ui-priority": 1,
|
||||
"misp-attribute": "ip-dst"
|
||||
"misp-attribute": "ip-dst",
|
||||
"multiple": true
|
||||
}
|
||||
},
|
||||
"version": 4,
|
||||
"description": "An IP address and a port seen as a tuple (or as a triple) in a specific time frame.",
|
||||
"version": 7,
|
||||
"description": "An IP address (or domain or hostname) and a port seen as a tuple (or as a triple) in a specific time frame.",
|
||||
"meta-category": "network",
|
||||
"uuid": "9f8cea74-16fe-4968-a2b4-026676949ac6",
|
||||
"name": "ip-port"
|
||||
|
|
|
|||
|
|
@ -2,7 +2,7 @@
|
|||
"name": "ja3",
|
||||
"meta-category": "network",
|
||||
"description": "JA3 is a new technique for creating SSL client fingerprints that are easy to produce and can be easily shared for threat intelligence. Fingerprints are composed of Client Hello packet; SSL Version, Accepted Ciphers, List of Extensions, Elliptic Curves, and Elliptic Curve Formats. https://github.com/salesforce/ja3",
|
||||
"version": 1,
|
||||
"version": 2,
|
||||
"uuid": "09b45449-5d6e-492c-a68a-cb2e188cbfac",
|
||||
"attributes": {
|
||||
"ja3-fingerprint-md5": {
|
||||
|
|
@ -43,11 +43,13 @@
|
|||
},
|
||||
"first-seen": {
|
||||
"misp-attribute": "datetime",
|
||||
"disable_correlation": true,
|
||||
"ui-priority": 0,
|
||||
"description": "First seen of the SSL/TLS handshake"
|
||||
},
|
||||
"last-seen": {
|
||||
"misp-attribute": "datetime",
|
||||
"disable_correlation": true,
|
||||
"description": "Last seen of the SSL/TLS handshake",
|
||||
"ui-priority": 0
|
||||
}
|
||||
|
|
|
|||
|
|
@ -0,0 +1,48 @@
|
|||
{
|
||||
"requiredOneOf": [
|
||||
"name"
|
||||
],
|
||||
"attributes": {
|
||||
"text": {
|
||||
"description": "A description of the entity.",
|
||||
"disable_correlation": true,
|
||||
"ui-priority": 1,
|
||||
"misp-attribute": "text"
|
||||
},
|
||||
"name": {
|
||||
"description": "Name of an entity.",
|
||||
"ui-priority": 0,
|
||||
"misp-attribute": "text"
|
||||
},
|
||||
"commercial-name": {
|
||||
"description": "Commercial name of an entity.",
|
||||
"ui-priority": 0,
|
||||
"misp-attribute": "text"
|
||||
},
|
||||
"legal-form": {
|
||||
"description": "Legal form of an entity.",
|
||||
"ui-priority": 0,
|
||||
"misp-attribute": "text"
|
||||
},
|
||||
"registration-number": {
|
||||
"description": "Registration number of an entity in the relevant authority.",
|
||||
"ui-priority": 0,
|
||||
"misp-attribute": "text"
|
||||
},
|
||||
"business": {
|
||||
"description": "Business area of an entity.",
|
||||
"ui-priority": 0,
|
||||
"misp-attribute": "text"
|
||||
},
|
||||
"phone-number": {
|
||||
"description": "Phone number of an entity.",
|
||||
"ui-priority": 0,
|
||||
"misp-attribute": "phone-number"
|
||||
}
|
||||
},
|
||||
"version": 1,
|
||||
"description": "An object to describe a legal entity.",
|
||||
"meta-category": "misc",
|
||||
"uuid": "14f5688f-d89c-469f-9878-c48bf6c41c65",
|
||||
"name": "legal-entity"
|
||||
}
|
||||
|
|
@ -17,6 +17,7 @@
|
|||
"description": "Type of the microblog post",
|
||||
"ui-priority": 1,
|
||||
"misp-attribute": "text",
|
||||
"disable_correlation": true,
|
||||
"sane_default": [
|
||||
"Twitter",
|
||||
"Facebook",
|
||||
|
|
@ -61,7 +62,7 @@
|
|||
"misp-attribute": "text"
|
||||
}
|
||||
},
|
||||
"version": 3,
|
||||
"version": 4,
|
||||
"description": "Microblog post like a Twitter tweet or a post on a Facebook wall.",
|
||||
"meta-category": "misc",
|
||||
"uuid": "8ec8c911-ddbe-4f5b-895b-fbff70c42a60",
|
||||
|
|
|
|||
|
|
@ -0,0 +1,31 @@
|
|||
{
|
||||
"requiredOneOf": [
|
||||
"name"
|
||||
],
|
||||
"attributes": {
|
||||
"description": {
|
||||
"description": "Description",
|
||||
"ui-priority": 0,
|
||||
"misp-attribute": "text"
|
||||
},
|
||||
"operating-system": {
|
||||
"description": "Operating system where the mutex has been seen",
|
||||
"ui-priority": 0,
|
||||
"misp-attribute": "text",
|
||||
"sane_default": [
|
||||
"Windows",
|
||||
"Unix"
|
||||
]
|
||||
},
|
||||
"name": {
|
||||
"description": "name of the mutex",
|
||||
"ui-priority": 0,
|
||||
"misp-attribute": "text"
|
||||
}
|
||||
},
|
||||
"version": 1,
|
||||
"description": "Object to describe mutual exclusion locks (mutex) as seen in memory or computer program",
|
||||
"meta-category": "misc",
|
||||
"uuid": "9f5c1a68-2021-4faa-b409-61c899c86466",
|
||||
"name": "mutex"
|
||||
}
|
||||
|
|
@ -0,0 +1,96 @@
|
|||
{
|
||||
"name": "network-connection",
|
||||
"uuid": "af16764b-f8e5-4603-9de1-de34d272f80b",
|
||||
"meta-category": "network",
|
||||
"description": "A local or remote network connection.",
|
||||
"version": 1,
|
||||
"attributes": {
|
||||
"ip-src": {
|
||||
"description": "Source IP address of the nework connection.",
|
||||
"ui-priority": 1,
|
||||
"categories": [
|
||||
"Network activity",
|
||||
"External analysis"
|
||||
],
|
||||
"misp-attribute": "ip-src"
|
||||
},
|
||||
"ip-dst": {
|
||||
"description": "Destination IP address of the nework connection.",
|
||||
"ui-priority": 1,
|
||||
"categories": [
|
||||
"Network activity",
|
||||
"External analysis"
|
||||
],
|
||||
"misp-attribute": "ip-dst"
|
||||
},
|
||||
"src-port": {
|
||||
"description": "Source port of the nework connection.",
|
||||
"ui-priority": 1,
|
||||
"categories": [
|
||||
"Network activity",
|
||||
"External analysis"
|
||||
],
|
||||
"misp-attribute": "port"
|
||||
},
|
||||
"dst-port": {
|
||||
"description": "Destination port of the nework connection.",
|
||||
"ui-priority": 1,
|
||||
"categories": [
|
||||
"Network activity",
|
||||
"External analysis"
|
||||
],
|
||||
"misp-attribute": "port"
|
||||
},
|
||||
"hostname-src": {
|
||||
"description": "Source hostname of the network connection.",
|
||||
"ui-priority": 1,
|
||||
"misp-attribute": "hostname"
|
||||
},
|
||||
"hostname-dst": {
|
||||
"description": "Destination hostname of the network connection.",
|
||||
"ui-priority": 1,
|
||||
"misp-attribute": "hostname"
|
||||
},
|
||||
"layer3-protocol": {
|
||||
"description": "Layer 3 protocol of the network connection.",
|
||||
"ui-priority": 0,
|
||||
"sane_default": [
|
||||
"IP",
|
||||
"ICMP",
|
||||
"ARP"
|
||||
],
|
||||
"misp-attribute": "text"
|
||||
},
|
||||
"layer4-protocol": {
|
||||
"description": "Layer 4 protocol of the network connection.",
|
||||
"ui-priority": 0,
|
||||
"sane_default": [
|
||||
"TCP",
|
||||
"UDP"
|
||||
],
|
||||
"misp-attribute": "text"
|
||||
},
|
||||
"layer7-protocol": {
|
||||
"description": "Layer 7 protocol of the network connection.",
|
||||
"ui-priority": 0,
|
||||
"sane_default": [
|
||||
"HTTP",
|
||||
"HTTPS",
|
||||
"FTP"
|
||||
],
|
||||
"misp-attribute": "text"
|
||||
},
|
||||
"first-packet-seen": {
|
||||
"misp-attribute": "datetime",
|
||||
"ui-priority": 1,
|
||||
"description": "Datetime of the first packet seen."
|
||||
}
|
||||
},
|
||||
"requiredOneOf": [
|
||||
"first-packet-seen",
|
||||
"ip-src",
|
||||
"ip-dst",
|
||||
"src-port",
|
||||
"dst-port"
|
||||
]
|
||||
}
|
||||
|
|
@ -0,0 +1,194 @@
|
|||
{
|
||||
"name": "network-socket",
|
||||
"uuid": "48bbfd72-ef8e-4649-b14d-41b4b5a0eba2",
|
||||
"meta-category": "network",
|
||||
"description": "Network socket object describes a local or remote network connections based on the socket data structure.",
|
||||
"version": 1,
|
||||
"attributes": {
|
||||
"ip-src": {
|
||||
"description": "Source (local) IP address of the network socket connection.",
|
||||
"ui-priority": 1,
|
||||
"categories": [
|
||||
"Network activity",
|
||||
"External analysis"
|
||||
],
|
||||
"misp-attribute": "ip-src"
|
||||
},
|
||||
"hostname-src": {
|
||||
"description": "Source (local) hostname of the network socket connection.",
|
||||
"ui-priority": 1,
|
||||
"misp-attribute": "hostname"
|
||||
},
|
||||
"ip-dst": {
|
||||
"description": "Destination IP address of the network socket connection.",
|
||||
"ui-priority": 1,
|
||||
"categories": [
|
||||
"Network activity",
|
||||
"External analysis"
|
||||
],
|
||||
"misp-attribute": "ip-dst"
|
||||
},
|
||||
"hostname-dst": {
|
||||
"description": "Destination hostname of the network socket connection.",
|
||||
"ui-priority": 1,
|
||||
"misp-attribute": "hostname"
|
||||
},
|
||||
"src-port": {
|
||||
"description": "Source (local) port of the network socket connection.",
|
||||
"ui-priority": 1,
|
||||
"categories": [
|
||||
"Network activity",
|
||||
"External analysis"
|
||||
],
|
||||
"misp-attribute": "port"
|
||||
},
|
||||
"dst-port": {
|
||||
"description": "Destination port of the network socket connection.",
|
||||
"ui-priority": 1,
|
||||
"categories": [
|
||||
"Network activity",
|
||||
"External analysis"
|
||||
],
|
||||
"misp-attribute": "port"
|
||||
},
|
||||
"protocol": {
|
||||
"misp-attribute": "text",
|
||||
"ui-priority": 0,
|
||||
"values_list": [
|
||||
"TCP",
|
||||
"UDP",
|
||||
"ICMP",
|
||||
"IP"
|
||||
],
|
||||
"description": "Protocol used by the network socket."
|
||||
},
|
||||
"address-family": {
|
||||
"description": "Address family who specifies the address family type (AF_*) of the socket connection.",
|
||||
"ui-priority": 1,
|
||||
"sane_default": [
|
||||
"AF_UNSPEC",
|
||||
"AF_LOCAL",
|
||||
"AF_UNIX",
|
||||
"AF_FILE",
|
||||
"AF_INET",
|
||||
"AF_AX25",
|
||||
"AF_IPX",
|
||||
"AF_APPLETALK",
|
||||
"AF_NETROM",
|
||||
"AF_BRIDGE",
|
||||
"AF_ATMPVC",
|
||||
"AF_X25",
|
||||
"AF_INET6",
|
||||
"AF_ROSE",
|
||||
"AF_DECnet",
|
||||
"AF_NETBEUI",
|
||||
"AF_SECURITY",
|
||||
"AF_KEY",
|
||||
"AF_NETLINK",
|
||||
"AF_ROUTE",
|
||||
"AF_PACKET",
|
||||
"AF_ASH",
|
||||
"AF_ECONET",
|
||||
"AF_ATMSVC",
|
||||
"AF_RDS",
|
||||
"AF_SNA",
|
||||
"AF_IRDA",
|
||||
"AF_PPPOX",
|
||||
"AF_WANPIPE",
|
||||
"AF_LLC",
|
||||
"AF_IB",
|
||||
"AF_MPLS",
|
||||
"AF_CAN",
|
||||
"AF_TIPC",
|
||||
"AF_BLUETOOTH",
|
||||
"AF_IUCV",
|
||||
"AF_RXRPC",
|
||||
"AF_ISDN",
|
||||
"AF_PHONET",
|
||||
"AF_IEEE802154",
|
||||
"AF_CAIF",
|
||||
"AF_ALG",
|
||||
"AF_NFC",
|
||||
"AF_VSOCK",
|
||||
"AF_KCM",
|
||||
"AF_MAX"
|
||||
],
|
||||
"misp-attribute": "text"
|
||||
},
|
||||
"domain-family": {
|
||||
"description": "Domain family who specifies the communication domain (PF_*) of the socket connection.",
|
||||
"ui-priority": 1,
|
||||
"sane_default": [
|
||||
"PF_UNSPEC",
|
||||
"PF_LOCAL",
|
||||
"PF_UNIX",
|
||||
"PF_FILE",
|
||||
"PF_INET",
|
||||
"PF_AX25",
|
||||
"PF_IPX",
|
||||
"PF_APPLETALK",
|
||||
"PF_NETROM",
|
||||
"PF_BRIDGE",
|
||||
"PF_ATMPVC",
|
||||
"PF_X25",
|
||||
"PF_INET6",
|
||||
"PF_ROSE",
|
||||
"PF_DECnet",
|
||||
"PF_NETBEUI",
|
||||
"PF_SECURITY",
|
||||
"PF_KEY",
|
||||
"PF_NETLINK",
|
||||
"PF_ROUTE",
|
||||
"PF_PACKET",
|
||||
"PF_ASH",
|
||||
"PF_ECONET",
|
||||
"PF_ATMSVC",
|
||||
"PF_RDS",
|
||||
"PF_SNA",
|
||||
"PF_IRDA",
|
||||
"PF_PPPOX",
|
||||
"PF_WANPIPE",
|
||||
"PF_LLC",
|
||||
"PF_IB",
|
||||
"PF_MPLS",
|
||||
"PF_CAN",
|
||||
"PF_TIPC",
|
||||
"PF_BLUETOOTH",
|
||||
"PF_IUCV",
|
||||
"PF_RXRPC",
|
||||
"PF_ISDN",
|
||||
"PF_PHONET",
|
||||
"PF_IEEE802154",
|
||||
"PF_CAIF",
|
||||
"PF_ALG",
|
||||
"PF_NFC",
|
||||
"PF_VSOCK",
|
||||
"PF_KCM",
|
||||
"PF_MAX"
|
||||
],
|
||||
"misp-attribute": "text"
|
||||
},
|
||||
"state": {
|
||||
"description": "State of the socket connection.",
|
||||
"multiple": true,
|
||||
"sane_default": [
|
||||
"blocking",
|
||||
"listening"
|
||||
],
|
||||
"misp-attribute": "text",
|
||||
"ui-priority": 1
|
||||
},
|
||||
"option": {
|
||||
"description": "Option on the socket connection.",
|
||||
"multiple": true,
|
||||
"misp-attribute": "text",
|
||||
"ui-priority": 1
|
||||
}
|
||||
},
|
||||
"requiredOneOf": [
|
||||
"ip-src",
|
||||
"ip-dst",
|
||||
"src-port",
|
||||
"dst-port"
|
||||
]
|
||||
}
|
||||
|
|
@ -6,22 +6,25 @@
|
|||
],
|
||||
"attributes": {
|
||||
"zone_time_last": {
|
||||
"description": "Last time that the unique tuple (rrname, rrtype, rdata) record has been seen via master file import",
|
||||
"description": "Last time that the unique tuple (rrname, rrtype, rdata) record has been seen via master file import.",
|
||||
"ui-priority": 0,
|
||||
"misp-attribute": "datetime"
|
||||
"misp-attribute": "datetime",
|
||||
"disable_correlation": true
|
||||
},
|
||||
"text": {
|
||||
"description": "",
|
||||
"description": "Description of the passive DNS record.",
|
||||
"ui-priority": 0,
|
||||
"misp-attribute": "text"
|
||||
"misp-attribute": "text",
|
||||
"disable_correlation": true
|
||||
},
|
||||
"count": {
|
||||
"description": "How many authoritative DNS answers were received at the Passive DNS Server's collectors with exactly the given set of values as answers",
|
||||
"description": "How many authoritative DNS answers were received at the Passive DNS Server's collectors with exactly the given set of values as answers.",
|
||||
"ui-priority": 0,
|
||||
"misp-attribute": "counter"
|
||||
"misp-attribute": "counter",
|
||||
"disable_correlation": true
|
||||
},
|
||||
"rrname": {
|
||||
"description": "Resource Record name of the queried resource",
|
||||
"description": "Resource Record name of the queried resource.",
|
||||
"categories": [
|
||||
"Network activity",
|
||||
"External analysis"
|
||||
|
|
@ -30,7 +33,7 @@
|
|||
"misp-attribute": "text"
|
||||
},
|
||||
"rrtype": {
|
||||
"description": "Resource Record type as seen by the passive DNS",
|
||||
"description": "Resource Record type as seen by the passive DNS.",
|
||||
"categories": [
|
||||
"Network activity",
|
||||
"External analysis"
|
||||
|
|
@ -51,7 +54,8 @@
|
|||
"NAPTR",
|
||||
"HINFO",
|
||||
"A6"
|
||||
]
|
||||
],
|
||||
"disable_correlation": true
|
||||
},
|
||||
"rdata": {
|
||||
"description": "Resource records of the queried resource",
|
||||
|
|
@ -61,35 +65,41 @@
|
|||
"zone_time_first": {
|
||||
"description": "First time that the unique tuple (rrname, rrtype, rdata) record has been seen via master file import",
|
||||
"ui-priority": 0,
|
||||
"misp-attribute": "datetime"
|
||||
"misp-attribute": "datetime",
|
||||
"disable_correlation": true
|
||||
},
|
||||
"origin": {
|
||||
"description": "Origin of the Passive DNS response",
|
||||
"ui-priority": 0,
|
||||
"misp-attribute": "text"
|
||||
"misp-attribute": "text",
|
||||
"disable_correlation": true
|
||||
},
|
||||
"time_last": {
|
||||
"description": "Last time that the unique tuple (rrname, rrtype, rdata) record has been seen by the passive DNS",
|
||||
"ui-priority": 0,
|
||||
"misp-attribute": "datetime"
|
||||
"misp-attribute": "datetime",
|
||||
"disable_correlation": true
|
||||
},
|
||||
"time_first": {
|
||||
"description": "First time that the unique tuple (rrname, rrtype, rdata) has been seen by the passive DNS",
|
||||
"ui-priority": 0,
|
||||
"misp-attribute": "datetime"
|
||||
"misp-attribute": "datetime",
|
||||
"disable_correlation": true
|
||||
},
|
||||
"bailiwick": {
|
||||
"description": "Best estimate of the apex of the zone where this data is authoritative",
|
||||
"ui-priority": 0,
|
||||
"misp-attribute": "text"
|
||||
"misp-attribute": "text",
|
||||
"disable_correlation": true
|
||||
},
|
||||
"sensor_id": {
|
||||
"description": "Sensor information where the record was seen",
|
||||
"ui-priority": 0,
|
||||
"misp-attribute": "text"
|
||||
"misp-attribute": "text",
|
||||
"disable_correlation": true
|
||||
}
|
||||
},
|
||||
"version": 2,
|
||||
"version": 3,
|
||||
"description": "Passive DNS records as expressed in draft-dulaunoy-dnsop-passive-dns-cof-01",
|
||||
"meta-category": "network",
|
||||
"uuid": "b77b7b1c-66ab-4a41-8da4-83810f6d2d6c",
|
||||
|
|
|
|||
|
|
@ -23,13 +23,19 @@
|
|||
],
|
||||
"description": "Original source of the paste or post.",
|
||||
"ui-priority": 0,
|
||||
"misp-attribute": "text"
|
||||
"misp-attribute": "text",
|
||||
"disable_correlation": true
|
||||
},
|
||||
"title": {
|
||||
"misp-attribute": "text",
|
||||
"ui-priority": 0,
|
||||
"description": "Title of the paste or post."
|
||||
},
|
||||
"username": {
|
||||
"misp-attribute": "text",
|
||||
"ui-priority": 0,
|
||||
"description": "User who posted the post."
|
||||
},
|
||||
"url": {
|
||||
"misp-attribute": "url",
|
||||
"ui-priority": 0,
|
||||
|
|
@ -48,7 +54,7 @@
|
|||
"misp-attribute": "datetime"
|
||||
}
|
||||
},
|
||||
"version": 2,
|
||||
"version": 3,
|
||||
"description": "Paste or similar post from a website allowing to share privately or publicly posts.",
|
||||
"meta-category": "misc",
|
||||
"uuid": "cedc055c-78aa-49a4-bfd7-4cc30cecef12",
|
||||
|
|
|
|||
|
|
@ -19,12 +19,14 @@
|
|||
"internal-filename": {
|
||||
"description": "InternalFilename in the resources",
|
||||
"ui-priority": 0,
|
||||
"misp-attribute": "filename"
|
||||
"misp-attribute": "filename",
|
||||
"disable_correlation": true
|
||||
},
|
||||
"original-filename": {
|
||||
"description": "OriginalFilename in the resources",
|
||||
"ui-priority": 1,
|
||||
"misp-attribute": "filename"
|
||||
"misp-attribute": "filename",
|
||||
"disable_correlation": true
|
||||
},
|
||||
"number-sections": {
|
||||
"description": "Number of sections",
|
||||
|
|
@ -116,7 +118,7 @@
|
|||
"misp-attribute": "text"
|
||||
}
|
||||
},
|
||||
"version": 2,
|
||||
"version": 3,
|
||||
"description": "Object describing a Portable Executable",
|
||||
"meta-category": "file",
|
||||
"uuid": "cf7adecc-d4f0-4e88-9d90-f978ee151a07",
|
||||
|
|
|
|||
|
|
@ -16,14 +16,32 @@
|
|||
"misp-attribute": "last-name"
|
||||
},
|
||||
"middle-name": {
|
||||
"description": "Middle name of a natural person",
|
||||
"description": "Middle name of a natural person.",
|
||||
"ui-priority": 0,
|
||||
"misp-attribute": "middle-name"
|
||||
},
|
||||
"first-name": {
|
||||
"description": "First name of a natural person.",
|
||||
"ui-priority": 0,
|
||||
"misp-attribute": "first-name"
|
||||
"misp-attribute": "first-name",
|
||||
"disable_correlation": true
|
||||
},
|
||||
"mothers-name": {
|
||||
"description": "Mother name, father, second name or other names following country's regulation.",
|
||||
"ui-priority": 1,
|
||||
"misp-attribute": "text"
|
||||
},
|
||||
"title": {
|
||||
"description": "Title of the natural person such as Dr. or equivalent.",
|
||||
"ui-priority": 0,
|
||||
"misp-attribute": "text",
|
||||
"disable_correlation": true
|
||||
},
|
||||
"alias": {
|
||||
"description": "Alias name or known as.",
|
||||
"ui-priority": 0,
|
||||
"misp-attribute": "text",
|
||||
"multiple": true
|
||||
},
|
||||
"date-of-birth": {
|
||||
"description": "Date of birth of a natural person (in YYYY-MM-DD format).",
|
||||
|
|
@ -33,7 +51,8 @@
|
|||
"place-of-birth": {
|
||||
"description": "Place of birth of a natural person.",
|
||||
"ui-priority": 0,
|
||||
"misp-attribute": "place-of-birth"
|
||||
"misp-attribute": "place-of-birth",
|
||||
"disable_correlation": true
|
||||
},
|
||||
"gender": {
|
||||
"description": "The gender of a natural person.",
|
||||
|
|
@ -44,7 +63,13 @@
|
|||
"Female",
|
||||
"Other",
|
||||
"Prefer not to say"
|
||||
]
|
||||
],
|
||||
"disable_correlation": true
|
||||
},
|
||||
"identity-card-number": {
|
||||
"description": "The identity card number of a natural person.",
|
||||
"ui-priority": 0,
|
||||
"misp-attribute": "identity-card-number"
|
||||
},
|
||||
"passport-number": {
|
||||
"description": "The passport number of a natural person.",
|
||||
|
|
@ -54,26 +79,35 @@
|
|||
"passport-country": {
|
||||
"description": "The country in which the passport was issued.",
|
||||
"ui-priority": 0,
|
||||
"misp-attribute": "passport-country"
|
||||
"misp-attribute": "passport-country",
|
||||
"disable_correlation": true
|
||||
},
|
||||
"passport-expiration": {
|
||||
"description": "The expiration date of a passport.",
|
||||
"ui-priority": 0,
|
||||
"misp-attribute": "passport-expiration"
|
||||
"misp-attribute": "passport-expiration",
|
||||
"disable_correlation": true
|
||||
},
|
||||
"redress-number": {
|
||||
"description": "The Redress Control Number is the record identifier for people who apply for redress through the DHS Travel Redress Inquiry Program (DHS TRIP). DHS TRIP is for travelers who have been repeatedly identified for additional screening and who want to file an inquiry to have erroneous information corrected in DHS systems.",
|
||||
"ui-priority": 0,
|
||||
"misp-attribute": "redress-number"
|
||||
},
|
||||
"social-security-number": {
|
||||
"description": "Social security number",
|
||||
"ui-priority": 0,
|
||||
"misp-attribute": "text"
|
||||
},
|
||||
"nationality": {
|
||||
"description": "The nationality of a natural person.",
|
||||
"ui-priority": 0,
|
||||
"misp-attribute": "nationality"
|
||||
"misp-attribute": "nationality",
|
||||
"multiple": true,
|
||||
"disable_correlation": true
|
||||
}
|
||||
},
|
||||
"version": 2,
|
||||
"description": "An person which describes a person or an identity.",
|
||||
"version": 3,
|
||||
"description": "An object which describes a person or an identity.",
|
||||
"meta-category": "misc",
|
||||
"uuid": "a15b0477-e9d1-4b9c-9546-abe78a4f4248",
|
||||
"name": "person"
|
||||
|
|
|
|||
|
|
@ -0,0 +1,52 @@
|
|||
{
|
||||
"name": "process",
|
||||
"uuid": "02aeef94-ac23-455c-addb-731757ceafb5",
|
||||
"meta-category": "misc",
|
||||
"description": "Object describing a system process.",
|
||||
"version": 1,
|
||||
"attributes": {
|
||||
"creation-time": {
|
||||
"description": "Local date/time at which the process was created.",
|
||||
"ui-priority": 0,
|
||||
"misp-attribute": "datetime",
|
||||
"disable_correlation": true
|
||||
},
|
||||
"start-time": {
|
||||
"description": "Local date/time at which the process was started.",
|
||||
"ui-priority": 0,
|
||||
"misp-attribute": "datetime",
|
||||
"disable_correlation": true
|
||||
},
|
||||
"name": {
|
||||
"description": "Name of the process",
|
||||
"ui-priority": 1,
|
||||
"misp-attribute": "text"
|
||||
},
|
||||
"pid": {
|
||||
"description": "Process ID of the process.",
|
||||
"ui-priority": 1,
|
||||
"misp-attribute": "text"
|
||||
},
|
||||
"parent-pid": {
|
||||
"description": "Process ID of the parent process.",
|
||||
"ui-priority": 1,
|
||||
"misp-attribute": "text"
|
||||
},
|
||||
"child-pid": {
|
||||
"description": "Process ID of the child(ren) process.",
|
||||
"ui-priority": 1,
|
||||
"misp-attribute": "text",
|
||||
"multiple": true
|
||||
},
|
||||
"port": {
|
||||
"description": "Port(s) owned by the process.",
|
||||
"ui-priority": 1,
|
||||
"misp-attribute": "src-port",
|
||||
"multiple": true
|
||||
}
|
||||
},
|
||||
"requiredOneOf": [
|
||||
"name",
|
||||
"pid"
|
||||
]
|
||||
}
|
||||
|
|
@ -24,9 +24,30 @@
|
|||
"description": "regexp",
|
||||
"ui-priority": 0,
|
||||
"misp-attribute": "text"
|
||||
},
|
||||
"type": {
|
||||
"sane_default": [
|
||||
"hostname",
|
||||
"domain",
|
||||
"email-src",
|
||||
"email-dst",
|
||||
"email-subject",
|
||||
"url",
|
||||
"user-agent",
|
||||
"regkey",
|
||||
"cookie",
|
||||
"uri",
|
||||
"filename",
|
||||
"windows-service-name",
|
||||
"windows-scheduled-task"
|
||||
],
|
||||
"description": "Specify which type corresponds to this regex.",
|
||||
"disable_correlation": true,
|
||||
"ui-priority": 0,
|
||||
"misp-attribute": "text"
|
||||
}
|
||||
},
|
||||
"version": 2,
|
||||
"version": 4,
|
||||
"description": "An object describing a regular expression (regex or regexp). The object can be linked via a relationship to other attributes or objects to describe how it can be represented as a regular expression.",
|
||||
"meta-category": "misc",
|
||||
"uuid": "ceffad66-71e5-4e20-9370-1b3fb694c648",
|
||||
|
|
|
|||
|
|
@ -35,7 +35,8 @@
|
|||
"REG_QWORD_LITTLE_ENDIAN"
|
||||
],
|
||||
"ui-priority": 0,
|
||||
"misp-attribute": "reg-datatype"
|
||||
"disable_correlation": true,
|
||||
"misp-attribute": "text"
|
||||
},
|
||||
"data": {
|
||||
"description": "Data stored in the registry key",
|
||||
|
|
@ -43,7 +44,7 @@
|
|||
"Persistence mechanism"
|
||||
],
|
||||
"ui-priority": 1,
|
||||
"misp-attribute": "reg-data"
|
||||
"misp-attribute": "text"
|
||||
},
|
||||
"name": {
|
||||
"description": "Name of the registry key",
|
||||
|
|
@ -51,7 +52,7 @@
|
|||
"Persistence mechanism"
|
||||
],
|
||||
"ui-priority": 1,
|
||||
"misp-attribute": "reg-name"
|
||||
"misp-attribute": "text"
|
||||
},
|
||||
"key": {
|
||||
"description": "Full key path",
|
||||
|
|
@ -59,7 +60,7 @@
|
|||
"Persistence mechanism"
|
||||
],
|
||||
"ui-priority": 1,
|
||||
"misp-attribute": "reg-key"
|
||||
"misp-attribute": "regkey"
|
||||
},
|
||||
"hive": {
|
||||
"description": "Hive used to store the registry key (file on disk)",
|
||||
|
|
@ -67,10 +68,33 @@
|
|||
"Persistence mechanism"
|
||||
],
|
||||
"ui-priority": 1,
|
||||
"misp-attribute": "reg-hive"
|
||||
"disable_correlation": true,
|
||||
"misp-attribute": "text"
|
||||
},
|
||||
"root-keys": {
|
||||
"description": "Root key of the Windows registry (extracted from the key)",
|
||||
"sane_default": [
|
||||
"HKCC",
|
||||
"HKCR",
|
||||
"HKCU",
|
||||
"HKDD",
|
||||
"HKEY_CLASSES_ROOT",
|
||||
"HKEY_CURRENT_CONFIG",
|
||||
"HKEY_CURRENT_USER",
|
||||
"HKEY_DYN_DATA",
|
||||
"HKEY_LOCAL_MACHINE",
|
||||
"HKEY_PERFORMANCE_DATA",
|
||||
"HKEY_USERS",
|
||||
"HKLM",
|
||||
"HKPD",
|
||||
"HKU"
|
||||
],
|
||||
"ui-priority": 0,
|
||||
"misp-attribute": "text",
|
||||
"disable_correlation": true
|
||||
}
|
||||
},
|
||||
"version": 2,
|
||||
"version": 4,
|
||||
"description": "Registry key object describing a Windows registry key with value and last-modified timestamp",
|
||||
"meta-category": "file",
|
||||
"uuid": "8b3228ad-6d82-4fe6-b2ae-05426308f1d5",
|
||||
|
|
|
|||
|
|
@ -0,0 +1,100 @@
|
|||
{
|
||||
"required": [
|
||||
"sandbox-type"
|
||||
],
|
||||
"requiredOneOf": [
|
||||
"web-sandbox",
|
||||
"on-premise-sandbox",
|
||||
"saas-sandbox"
|
||||
],
|
||||
"attributes": {
|
||||
"permalink": {
|
||||
"description": "Permalink reference",
|
||||
"categories": [
|
||||
"External analysis"
|
||||
],
|
||||
"ui-priority": 2,
|
||||
"misp-attribute": "link"
|
||||
},
|
||||
"score": {
|
||||
"description": "Score",
|
||||
"disable_correlation": true,
|
||||
"categories": [
|
||||
"External analysis"
|
||||
],
|
||||
"ui-priority": 1,
|
||||
"misp-attribute": "text"
|
||||
},
|
||||
"results": {
|
||||
"description": "Freetext result values",
|
||||
"disable_correlation": true,
|
||||
"categories": [
|
||||
"External analysis"
|
||||
],
|
||||
"ui-priority": 1,
|
||||
"misp-attribute": "text",
|
||||
"multiple": true
|
||||
},
|
||||
"raw-report": {
|
||||
"description": "Raw report from sandbox",
|
||||
"disable_correlation": true,
|
||||
"categories": [
|
||||
"External analysis"
|
||||
],
|
||||
"ui-priority": 0,
|
||||
"misp-attribute": "text"
|
||||
},
|
||||
"sandbox-type": {
|
||||
"description": "The type of sandbox used",
|
||||
"misp-attribute": "text",
|
||||
"disable_correlation": true,
|
||||
"ui-priority": 1,
|
||||
"sane_default": [
|
||||
"on-premise",
|
||||
"web",
|
||||
"saas"
|
||||
]
|
||||
},
|
||||
"on-premise-sandbox": {
|
||||
"description": "The on-premise sandbox used",
|
||||
"misp-attribute": "text",
|
||||
"disable_correlation": true,
|
||||
"ui-priority": 1,
|
||||
"sane_default": [
|
||||
"cuckoo",
|
||||
"symantec-cas-on-premise",
|
||||
"bluecoat-maa",
|
||||
"trendmicro-deep-discovery-analyzer",
|
||||
"fireeye-ax",
|
||||
"vmray",
|
||||
"joe-sandbox-on-premise"
|
||||
]
|
||||
},
|
||||
"web-sandbox": {
|
||||
"description": "A web sandbox where results are publicly available via an URL",
|
||||
"misp-attribute": "text",
|
||||
"disable_correlation": true,
|
||||
"ui-priority": 1,
|
||||
"sane_default": [
|
||||
"malwr",
|
||||
"hybrid-analysis"
|
||||
]
|
||||
},
|
||||
"saas-sandbox": {
|
||||
"description": "A non-on-premise sandbox, also results are not publicly available",
|
||||
"misp-attribute": "text",
|
||||
"disable_correlation": true,
|
||||
"ui-priority": 1,
|
||||
"sane_default": [
|
||||
"forticloud-sandbox",
|
||||
"joe-sandbox-cloud",
|
||||
"symantec-cas-cloud"
|
||||
]
|
||||
}
|
||||
},
|
||||
"version": 1,
|
||||
"description": "Sandbox report",
|
||||
"meta-category": "misc",
|
||||
"uuid": "4d3fffd2-cd07-4357-96e0-a51c988faaef",
|
||||
"name": "sandbox-report"
|
||||
}
|
||||
|
|
@ -0,0 +1,49 @@
|
|||
{
|
||||
"required": [
|
||||
"software",
|
||||
"signature"
|
||||
],
|
||||
"attributes": {
|
||||
"software": {
|
||||
"description": "Name of Sandbox software",
|
||||
"disable_correlation": true,
|
||||
"categories": [
|
||||
"Sandbox detection"
|
||||
],
|
||||
"ui-priority": 1,
|
||||
"misp-attribute": "text"
|
||||
},
|
||||
"signature": {
|
||||
"description": "Name of detection signature - set the description of the detection signature as a comment",
|
||||
"categories": [
|
||||
"Sandbox detection"
|
||||
],
|
||||
"ui-priority": 2,
|
||||
"misp-attribute": "text",
|
||||
"multiple": true
|
||||
},
|
||||
"text": {
|
||||
"description": "Additional signature description",
|
||||
"disable_correlation": true,
|
||||
"categories": [
|
||||
"Other"
|
||||
],
|
||||
"ui-priority": 0,
|
||||
"misp-attribute": "text"
|
||||
},
|
||||
"datetime": {
|
||||
"description": "Datetime",
|
||||
"disable_correlation": true,
|
||||
"categories": [
|
||||
"Other"
|
||||
],
|
||||
"ui-priority": 0,
|
||||
"misp-attribute": "datetime"
|
||||
}
|
||||
},
|
||||
"version": 1,
|
||||
"description": "Sandbox detection signature",
|
||||
"meta-category": "misc",
|
||||
"uuid": "984c5c39-be7f-4e1e-b034-d3213bac51cb",
|
||||
"name": "sb-signature"
|
||||
}
|
||||
|
|
@ -0,0 +1,62 @@
|
|||
{
|
||||
"required": [
|
||||
"script"
|
||||
],
|
||||
"attributes": {
|
||||
"script": {
|
||||
"description": "Free text of the script.",
|
||||
"ui-priority": 10,
|
||||
"misp-attribute": "text"
|
||||
},
|
||||
"comment": {
|
||||
"description": "Comment associated to the script.",
|
||||
"ui-priority": 1,
|
||||
"misp-attribute": "text"
|
||||
},
|
||||
"language": {
|
||||
"description": "Scripting language used for the script.",
|
||||
"ui-priority": 9,
|
||||
"misp-attribute": "text",
|
||||
"disable_correlation": true,
|
||||
"sane_default": [
|
||||
"PowerShell",
|
||||
"VBScript",
|
||||
"Bash",
|
||||
"Lua",
|
||||
"JavaScript",
|
||||
"AppleScript",
|
||||
"AWK",
|
||||
"Python",
|
||||
"Perl",
|
||||
"Ruby",
|
||||
"Winbatch",
|
||||
"AutoIt"
|
||||
]
|
||||
},
|
||||
"filename": {
|
||||
"description": "Filename used for the script.",
|
||||
"ui-priority": 8,
|
||||
"misp-attribute": "filename",
|
||||
"multiple": true,
|
||||
"disable_correlation": true
|
||||
},
|
||||
"state": {
|
||||
"misp-attribute": "text",
|
||||
"ui-priority": 0,
|
||||
"description": "Known state of the script.",
|
||||
"multiple": true,
|
||||
"disable_correlation": true,
|
||||
"values_list": [
|
||||
"Malicious",
|
||||
"Unknown",
|
||||
"Harmless",
|
||||
"Trusted"
|
||||
]
|
||||
}
|
||||
},
|
||||
"version": 1,
|
||||
"description": "Object describing a computer program written to be run in a special run-time environment. The script or shell script can be used for malicious activities but also as support tools for threat analysts.",
|
||||
"meta-category": "misc",
|
||||
"uuid": "6bce7d01-dbec-4054-b3c2-3655a19382e2",
|
||||
"name": "script"
|
||||
}
|
||||
|
|
@ -0,0 +1,47 @@
|
|||
{
|
||||
"requiredOneOf": [
|
||||
"body",
|
||||
"from"
|
||||
],
|
||||
"attributes": {
|
||||
"body": {
|
||||
"description": "Message body of the SMS",
|
||||
"ui-priority": 1,
|
||||
"misp-attribute": "text"
|
||||
},
|
||||
"url-rfc5724": {
|
||||
"description": "url representing SMS using RFC 5724 (not url contained in the SMS which should use an url object)",
|
||||
"ui-priority": 6,
|
||||
"misp-attribute": "url"
|
||||
},
|
||||
"from": {
|
||||
"description": "Phone number used to send the SMS",
|
||||
"ui-priority": 1,
|
||||
"misp-attribute": "phone-number",
|
||||
"multiple": true
|
||||
},
|
||||
"to": {
|
||||
"description": "Phone number receiving the SMS",
|
||||
"ui-priority": 1,
|
||||
"misp-attribute": "phone-number",
|
||||
"multiple": true
|
||||
},
|
||||
"sent-date": {
|
||||
"description": "Initial sent date of the SMS",
|
||||
"ui-priority": 0,
|
||||
"misp-attribute": "datetime",
|
||||
"disable_correlation": true
|
||||
},
|
||||
"received-date": {
|
||||
"description": "Received date of the SMS",
|
||||
"ui-priority": 0,
|
||||
"misp-attribute": "datetime",
|
||||
"disable_correlation": true
|
||||
}
|
||||
},
|
||||
"version": 1,
|
||||
"description": "Short Message Service (SMS) object template describing one or more SMS message. Restriction of the initial format 3GPP 23.038 GSM character set doesn't apply.",
|
||||
"meta-category": "misc",
|
||||
"uuid": "4851a3dc-e1a6-43ac-9d97-f0d13a099fd2",
|
||||
"name": "short-message-service"
|
||||
}
|
||||
|
|
@ -0,0 +1,44 @@
|
|||
{
|
||||
"required": [
|
||||
"redirect-url",
|
||||
"shortened-url"
|
||||
],
|
||||
"attributes": {
|
||||
"first-seen": {
|
||||
"description": "First time this shortened URL has been seen",
|
||||
"disable_correlation": true,
|
||||
"ui-priority": 0,
|
||||
"misp-attribute": "datetime"
|
||||
},
|
||||
"redirect-url": {
|
||||
"description": "Redirected to URL",
|
||||
"ui-priority": 1,
|
||||
"misp-attribute": "url"
|
||||
},
|
||||
"shortened-url": {
|
||||
"description": "Shortened URL",
|
||||
"ui-priority": 1,
|
||||
"misp-attribute": "url"
|
||||
},
|
||||
"domain": {
|
||||
"description": "Full domain",
|
||||
"ui-priority": 0,
|
||||
"misp-attribute": "domain"
|
||||
},
|
||||
"credential": {
|
||||
"description": "Credential (username, password)",
|
||||
"ui-priority": 0,
|
||||
"misp-attribute": "text"
|
||||
},
|
||||
"text": {
|
||||
"description": "Description and context of the shortened URL ",
|
||||
"ui-priority": 0,
|
||||
"misp-attribute": "text"
|
||||
}
|
||||
},
|
||||
"version": 2018060501,
|
||||
"description": "Shortened link and its redirect target",
|
||||
"meta-category": "network",
|
||||
"uuid": "361c0ae8-68bd-11e8-adc0-fa7ae01bbebc",
|
||||
"name": "shortened-link"
|
||||
}
|
||||
|
|
@ -0,0 +1,177 @@
|
|||
{
|
||||
"requiredOneOf": [
|
||||
"text"
|
||||
],
|
||||
"attributes": {
|
||||
"Category": {
|
||||
"description": "Category",
|
||||
"sane_default": [
|
||||
"Cat0",
|
||||
"Cat1",
|
||||
"Cat2.1",
|
||||
"Cat2.2",
|
||||
"Cat3.1",
|
||||
"Cat3.2",
|
||||
"Cat3.3",
|
||||
"CatSMS",
|
||||
"CatSpoofing"
|
||||
],
|
||||
"misp-attribute": "text",
|
||||
"disable_correlation": true,
|
||||
"multiple": true,
|
||||
"ui-priority": 1
|
||||
},
|
||||
"MapVersion": {
|
||||
"description": "Map version.",
|
||||
"sane_default": [
|
||||
"1",
|
||||
"2",
|
||||
"3"
|
||||
],
|
||||
"misp-attribute": "text",
|
||||
"disable_correlation": true,
|
||||
"ui-priority": 0
|
||||
},
|
||||
"SccpCgGT": {
|
||||
"description": "Signaling Connection Control Part (SCCP) CgGT - Phone number.",
|
||||
"multiple": true,
|
||||
"ui-priority": 0,
|
||||
"misp-attribute": "text"
|
||||
},
|
||||
"SccpCdGT": {
|
||||
"description": "Signaling Connection Control Part (SCCP) CdGT - Phone number.",
|
||||
"ui-priority": 0,
|
||||
"misp-attribute": "text"
|
||||
},
|
||||
"SccpCgPC": {
|
||||
"description": "Signaling Connection Control Part (SCCP) CgPC - Phone number.",
|
||||
"multiple": true,
|
||||
"ui-priority": 0,
|
||||
"misp-attribute": "text"
|
||||
},
|
||||
"SccpCdPC": {
|
||||
"description": "Signaling Connection Control Part (SCCP) CdPC - Phone number.",
|
||||
"ui-priority": 0,
|
||||
"misp-attribute": "text"
|
||||
},
|
||||
"SccpCgSSN": {
|
||||
"description": "Signaling Connection Control Part (SCCP) - Decimal value between 0-255.",
|
||||
"ui-priority": 0,
|
||||
"misp-attribute": "text",
|
||||
"disable_correlation": true
|
||||
},
|
||||
"SccpCdSSN": {
|
||||
"description": "Signaling Connection Control Part (SCCP) - Decimal value between 0-255.",
|
||||
"ui-priority": 0,
|
||||
"misp-attribute": "text",
|
||||
"disable_correlation": true
|
||||
},
|
||||
"MapOpCode": {
|
||||
"description": "MAP operation codes - Decimal value between 0-99.",
|
||||
"ui-priority": 0,
|
||||
"misp-attribute": "text",
|
||||
"disable_correlation": true
|
||||
},
|
||||
"MapApplicationContext": {
|
||||
"description": "MAP application context in OID format.",
|
||||
"ui-priority": 0,
|
||||
"misp-attribute": "text",
|
||||
"disable_correlation": true
|
||||
},
|
||||
"MapImsi": {
|
||||
"description": "MAP IMSI. Phone number starting with MCC/MNC.",
|
||||
"multiple": true,
|
||||
"ui-priority": 0,
|
||||
"misp-attribute": "text"
|
||||
},
|
||||
"MapMsisdn": {
|
||||
"description": "MAP MSISDN. Phone number.",
|
||||
"multiple": true,
|
||||
"ui-priority": 0,
|
||||
"misp-attribute": "text"
|
||||
},
|
||||
"MapMscGT": {
|
||||
"description": "MAP MSC GT. Phone number.",
|
||||
"ui-priority": 0,
|
||||
"misp-attribute": "text"
|
||||
},
|
||||
"MapGsmscfGT": {
|
||||
"description": "MAP GSMSCF GT. Phone number.",
|
||||
"ui-priority": 0,
|
||||
"misp-attribute": "text"
|
||||
},
|
||||
"MapVlrGT": {
|
||||
"description": "MAP VLR GT. Phone number.",
|
||||
"ui-priority": 0,
|
||||
"misp-attribute": "text"
|
||||
},
|
||||
"MapGmlc": {
|
||||
"description": "MAP GMLC. Phone number.",
|
||||
"ui-priority": 0,
|
||||
"misp-attribute": "text"
|
||||
},
|
||||
"MapSmscGT": {
|
||||
"description": "MAP SMSC. Phone number.",
|
||||
"ui-priority": 0,
|
||||
"multiple": true,
|
||||
"misp-attribute": "text"
|
||||
},
|
||||
"MapSmsTP-OA": {
|
||||
"description": "MAP SMS TP-OA. Phone number.",
|
||||
"ui-priority": 0,
|
||||
"misp-attribute": "text"
|
||||
},
|
||||
"MapSmsText": {
|
||||
"description": "MAP SMS Text. Important indicators in SMS text.",
|
||||
"ui-priority": 0,
|
||||
"misp-attribute": "text"
|
||||
},
|
||||
"MapSmsTP-PID": {
|
||||
"description": "MAP SMS TP-PID.",
|
||||
"ui-priority": 0,
|
||||
"misp-attribute": "text",
|
||||
"disable_correlation": true
|
||||
},
|
||||
"MapSmsTP-DCS": {
|
||||
"description": "MAP SMS TP-DCS.",
|
||||
"ui-priority": 0,
|
||||
"misp-attribute": "text",
|
||||
"disable_correlation": true
|
||||
},
|
||||
"MapSmsTypeNumber": {
|
||||
"description": "MAP SMS TypeNumber.",
|
||||
"ui-priority": 0,
|
||||
"misp-attribute": "text",
|
||||
"disable_correlation": true
|
||||
},
|
||||
"MapUssdContent": {
|
||||
"description": "MAP USSD Content.",
|
||||
"ui-priority": 0,
|
||||
"misp-attribute": "text"
|
||||
},
|
||||
"MapUssdCoding": {
|
||||
"description": "MAP USSD Content.",
|
||||
"ui-priority": 0,
|
||||
"misp-attribute": "text",
|
||||
"disable_correlation": true
|
||||
},
|
||||
"text": {
|
||||
"description": "A description of the attack seen via SS7 logging.",
|
||||
"disable_correlation": true,
|
||||
"ui-priority": 0,
|
||||
"multiple": true,
|
||||
"misp-attribute": "text"
|
||||
},
|
||||
"first-seen": {
|
||||
"description": "When the attack has been seen for the first time.",
|
||||
"disable_correlation": true,
|
||||
"ui-priority": 0,
|
||||
"misp-attribute": "datetime"
|
||||
}
|
||||
},
|
||||
"version": 2,
|
||||
"description": "SS7 object of an attack seen on a GSM, UMTS or LTE network via SS7 logging.",
|
||||
"meta-category": "network",
|
||||
"uuid": "f3493d8b-a7ab-48d0-a775-046c4d64d782",
|
||||
"name": "ss7-attack"
|
||||
}
|
||||
|
|
@ -0,0 +1,30 @@
|
|||
{
|
||||
"requiredOneOf": [
|
||||
"stix2-pattern"
|
||||
],
|
||||
"attributes": {
|
||||
"comment": {
|
||||
"description": "A description of the stix2-pattern.",
|
||||
"ui-priority": 0,
|
||||
"misp-attribute": "comment"
|
||||
},
|
||||
"stix2-pattern": {
|
||||
"description": "STIX 2 pattern",
|
||||
"ui-priority": 0,
|
||||
"misp-attribute": "stix2-pattern"
|
||||
},
|
||||
"version": {
|
||||
"description": "Version of STIX 2 pattern.",
|
||||
"ui-priority": 0,
|
||||
"misp-attribute": "text",
|
||||
"sane_default": [
|
||||
"stix 2.0"
|
||||
]
|
||||
}
|
||||
},
|
||||
"version": 2,
|
||||
"description": "An object describing a STIX pattern. The object can be linked via a relationship to other attributes or objects to describe how it can be represented as a STIX pattern.",
|
||||
"meta-category": "misc",
|
||||
"uuid": "0c5bd072-7c3e-4d45-86f7-a8104d9143b9",
|
||||
"name": "stix2-pattern"
|
||||
}
|
||||
|
|
@ -0,0 +1,33 @@
|
|||
{
|
||||
"requiredOneOf": [
|
||||
"suricata"
|
||||
],
|
||||
"attributes": {
|
||||
"comment": {
|
||||
"description": "A description of the Suricata rule(s).",
|
||||
"ui-priority": 0,
|
||||
"misp-attribute": "comment"
|
||||
},
|
||||
"suricata": {
|
||||
"description": "Suricata rule.",
|
||||
"ui-priority": 0,
|
||||
"misp-attribute": "snort",
|
||||
"multiple": true
|
||||
},
|
||||
"version": {
|
||||
"description": "Version of the Suricata rule depending where the suricata rule is known to work as expected.",
|
||||
"ui-priority": 0,
|
||||
"misp-attribute": "text"
|
||||
},
|
||||
"ref": {
|
||||
"description": "Reference to the Suricata rule such as origin of the rule or alike.",
|
||||
"misp-attribute": "link",
|
||||
"ui-priority": 0
|
||||
}
|
||||
},
|
||||
"version": 2,
|
||||
"description": "An object describing one or more Suricata rule(s) along with version and contextual information.",
|
||||
"meta-category": "network",
|
||||
"uuid": "3c177337-fb80-405a-a6c1-1b2ddea8684a",
|
||||
"name": "suricata"
|
||||
}
|
||||
|
|
@ -0,0 +1,39 @@
|
|||
{
|
||||
"name": "target-system",
|
||||
"uuid": "3110944f-eca0-4c94-9d61-a84d022228a4",
|
||||
"meta-category": "internal",
|
||||
"description": "Description about an targeted system, this could potentially be a compromissed internal system",
|
||||
"version": 1,
|
||||
"attributes": {
|
||||
"targeted_machine": {
|
||||
"description": "Targeted system",
|
||||
"ui-priority": 1,
|
||||
"misp-attribute": "target-machine",
|
||||
"disable_correlation": true,
|
||||
"categories": [
|
||||
"Targeting data"
|
||||
]
|
||||
},
|
||||
"targeted_ip_of_system": {
|
||||
"description": "Targeted system IP address",
|
||||
"ui-priority": 1,
|
||||
"misp-attribute": "ip-src",
|
||||
"disable_correlation": true,
|
||||
"categories": [
|
||||
"Network activity"
|
||||
]
|
||||
},
|
||||
"timestamp_seen": {
|
||||
"description": "Registered date and time",
|
||||
"ui-priority": 1,
|
||||
"misp-attribute": "datetime",
|
||||
"disable_correlation": true,
|
||||
"categories": [
|
||||
"Other"
|
||||
]
|
||||
}
|
||||
},
|
||||
"requiredOneOf": [
|
||||
"targeted_machine"
|
||||
]
|
||||
}
|
||||
|
|
@ -0,0 +1,79 @@
|
|||
{
|
||||
"required": [
|
||||
"threat_score"
|
||||
],
|
||||
"attributes": {
|
||||
"threat_score": {
|
||||
"description": "threat_score",
|
||||
"disable_correlation": true,
|
||||
"categories": [
|
||||
"External analysis"
|
||||
],
|
||||
"ui-priority": 0,
|
||||
"misp-attribute": "text"
|
||||
},
|
||||
"heuristic_raw_score": {
|
||||
"description": "heuristic_raw_score",
|
||||
"disable_correlation": true,
|
||||
"categories": [
|
||||
"External analysis"
|
||||
],
|
||||
"ui-priority": 1,
|
||||
"misp-attribute": "text"
|
||||
},
|
||||
"heuristic_score": {
|
||||
"description": "heuristic_score",
|
||||
"categories": [
|
||||
"Other"
|
||||
],
|
||||
"ui-priority": 0,
|
||||
"misp-attribute": "text"
|
||||
},
|
||||
"analysis_submitted_at": {
|
||||
"description": "Submission date",
|
||||
"categories": [
|
||||
"Other"
|
||||
],
|
||||
"ui-priority": 0,
|
||||
"misp-attribute": "text"
|
||||
},
|
||||
"original_filename": {
|
||||
"description": "Original filename",
|
||||
"categories": [
|
||||
"Other"
|
||||
],
|
||||
"ui-priority": 0,
|
||||
"misp-attribute": "text"
|
||||
},
|
||||
"permalink": {
|
||||
"description": "permalink",
|
||||
"categories": [
|
||||
"Other"
|
||||
],
|
||||
"ui-priority": 0,
|
||||
"misp-attribute": "text"
|
||||
},
|
||||
"id": {
|
||||
"description": "ThreatGrid ID",
|
||||
"categories": [
|
||||
"Other"
|
||||
],
|
||||
"ui-priority": 0,
|
||||
"misp-attribute": "text"
|
||||
},
|
||||
"iocs": {
|
||||
"description": "iocs",
|
||||
"categories": [
|
||||
"Other"
|
||||
],
|
||||
"ui-priority": 0,
|
||||
"multiple": true,
|
||||
"misp-attribute": "text"
|
||||
}
|
||||
},
|
||||
"version": 6,
|
||||
"description": "ThreatGrid report",
|
||||
"meta-category": "misc",
|
||||
"uuid": "23b3576b-2e68-4a86-a103-68820daef1d5",
|
||||
"name": "threatgrid-report"
|
||||
}
|
||||
|
|
@ -0,0 +1,52 @@
|
|||
{
|
||||
"requiredOneOf": [
|
||||
"description",
|
||||
"start-marker-timecode",
|
||||
"end-marker-timecode",
|
||||
"start-timecode",
|
||||
"end-timecode",
|
||||
"recording-date"
|
||||
],
|
||||
"attributes": {
|
||||
"description": {
|
||||
"description": "Description of the video sequence",
|
||||
"ui-priority": 1,
|
||||
"misp-attribute": "text"
|
||||
},
|
||||
"start-marker-timecode": {
|
||||
"description": "Start marker timecode in the format hh:mm:ss;ff",
|
||||
"ui-priority": 0,
|
||||
"misp-attribute": "text",
|
||||
"multiple": true
|
||||
},
|
||||
"end-marker-timecode": {
|
||||
"description": "End marker timecode in the format hh:mm:ss;ff",
|
||||
"ui-priority": 0,
|
||||
"misp-attribute": "text",
|
||||
"multiple": true
|
||||
},
|
||||
"start-timecode": {
|
||||
"description": "Start marker timecode in the format hh:mm:ss.mms",
|
||||
"ui-priority": 0,
|
||||
"misp-attribute": "text",
|
||||
"multiple": true
|
||||
},
|
||||
"end-timecode": {
|
||||
"description": "End marker timecode in the format hh:mm:ss.mms",
|
||||
"ui-priority": 0,
|
||||
"misp-attribute": "text",
|
||||
"multiple": true
|
||||
},
|
||||
"recording-date": {
|
||||
"description": "Date of recording of the video sequence",
|
||||
"ui-priority": 0,
|
||||
"misp-attribute": "datetime",
|
||||
"multiple": true
|
||||
}
|
||||
},
|
||||
"version": 1,
|
||||
"description": "Timecode object to describe a start of video sequence (e.g. CCTV evidence) and the end of the video sequence.",
|
||||
"meta-category": "misc",
|
||||
"uuid": "60141eac-71d2-4173-930d-91dba8106c40",
|
||||
"name": "timecode"
|
||||
}
|
||||
|
|
@ -0,0 +1,33 @@
|
|||
{
|
||||
"requiredOneOf": [
|
||||
"message",
|
||||
"datetime"
|
||||
],
|
||||
"attributes": {
|
||||
"message": {
|
||||
"description": "Informative message of the event",
|
||||
"ui-priority": 0,
|
||||
"misp-attribute": "text"
|
||||
},
|
||||
"timestamp": {
|
||||
"description": "When the log entry was seen in microseconds since Unix epoch",
|
||||
"ui-priority": 0,
|
||||
"misp-attribute": "timestamp-microsec"
|
||||
},
|
||||
"timestamp_desc": {
|
||||
"description": "Text explaining what type of timestamp is it",
|
||||
"ui-priority": 0,
|
||||
"misp-attribute": "text"
|
||||
},
|
||||
"datetime": {
|
||||
"description": "When the log entry was seen",
|
||||
"ui-priority": 0,
|
||||
"misp-attribute": "datetime"
|
||||
}
|
||||
},
|
||||
"version": 2,
|
||||
"description": "A timesketch timeline object based on mandatory field in timesketch to describe a log entry.",
|
||||
"meta-category": "misc",
|
||||
"uuid": "06db0221-cbc0-4ffc-ad98-7f34549310f1",
|
||||
"name": "timesketch-timeline"
|
||||
}
|
||||
|
|
@ -0,0 +1,45 @@
|
|||
{
|
||||
"requiredOneOf": [
|
||||
"first-seen",
|
||||
"last-seen"
|
||||
],
|
||||
"attributes": {
|
||||
"text": {
|
||||
"description": "Description of the time object.",
|
||||
"ui-priority": 0,
|
||||
"misp-attribute": "text",
|
||||
"disable_correlation": true
|
||||
},
|
||||
"precision": {
|
||||
"description": "Timestamp precision represents the precision given to first_seen and/or last_seen in this object.",
|
||||
"ui-priority": 0,
|
||||
"misp-attribute": "text",
|
||||
"sane_default": [
|
||||
"year",
|
||||
"month",
|
||||
"day",
|
||||
"hour",
|
||||
"minute",
|
||||
"full"
|
||||
],
|
||||
"disable_correlation": true
|
||||
},
|
||||
"first-seen": {
|
||||
"description": "First time that the linked object or attribute has been seen.",
|
||||
"ui-priority": 0,
|
||||
"misp-attribute": "datetime",
|
||||
"disable_correlation": true
|
||||
},
|
||||
"last-seen": {
|
||||
"description": "First time that the linked object or attribute has been seen.",
|
||||
"ui-priority": 0,
|
||||
"misp-attribute": "datetime",
|
||||
"disable_correlation": true
|
||||
}
|
||||
},
|
||||
"version": 1,
|
||||
"description": "A generic timestamp object to represent time including first time and last time seen. Relationship will then define the kind of time relationship.",
|
||||
"meta-category": "misc",
|
||||
"uuid": "c8c91e23-4221-4533-8bf7-64e12b05f265",
|
||||
"name": "timestamp"
|
||||
}
|
||||
|
|
@ -0,0 +1,116 @@
|
|||
{
|
||||
"requiredOneOf": [
|
||||
"transaction-number",
|
||||
"date",
|
||||
"amount",
|
||||
"transmode-code"
|
||||
],
|
||||
"attributes": {
|
||||
"text": {
|
||||
"description": "A description of the transaction.",
|
||||
"disable_correlation": true,
|
||||
"ui-priority": 1,
|
||||
"misp-attribute": "text"
|
||||
},
|
||||
"transaction-number": {
|
||||
"description": "A unique number identifying a transaction.",
|
||||
"ui-priority": 0,
|
||||
"misp-attribute": "text"
|
||||
},
|
||||
"location": {
|
||||
"description": "Location where the transaction took place.",
|
||||
"ui-priority": 0,
|
||||
"misp-attribute": "text"
|
||||
},
|
||||
"transmode-code": {
|
||||
"description": "How the transaction was conducted.",
|
||||
"ui-priority": 0,
|
||||
"misp-attribute": "text"
|
||||
},
|
||||
"transmode-comment": {
|
||||
"description": "Comment describing transmode-code, if needed.",
|
||||
"ui-priority": 0,
|
||||
"misp-attribute": "text"
|
||||
},
|
||||
"teller": {
|
||||
"description": "Person who conducted the transaction.",
|
||||
"ui-priority": 0,
|
||||
"misp-attribute": "text"
|
||||
},
|
||||
"authorized": {
|
||||
"description": "Person who autorized the transaction.",
|
||||
"ui-priority": 0,
|
||||
"misp-attribute": "text"
|
||||
},
|
||||
"date": {
|
||||
"description": "Date and time of the transaction.",
|
||||
"ui-priority": 0,
|
||||
"misp-attribute": "datetime"
|
||||
},
|
||||
"amount": {
|
||||
"description": "The value of the transaction in local currency.",
|
||||
"ui-priority": 0,
|
||||
"misp-attribute": "text"
|
||||
},
|
||||
"date-posting": {
|
||||
"description": "Date of posting, if different from date of transaction.",
|
||||
"ui-priority": 0,
|
||||
"misp-attribute": "datetime"
|
||||
},
|
||||
"from-funds-code": {
|
||||
"description": "Type of funds used to initiate a transaction.",
|
||||
"ui-priority": 0,
|
||||
"misp-attribute": "text",
|
||||
"disable_correlation": true,
|
||||
"sane_default": [
|
||||
"A Deposit",
|
||||
"C Currency exchange",
|
||||
"D Casino chips",
|
||||
"E Bank draft",
|
||||
"F Money order",
|
||||
"G Traveler’s cheques",
|
||||
"H Life insurance policy",
|
||||
"I Real estate",
|
||||
"J Securities",
|
||||
"K Cash",
|
||||
"O Other",
|
||||
"P Cheque"
|
||||
]
|
||||
},
|
||||
"to-funds-code": {
|
||||
"description": "Type of funds used to finalize a transaction.",
|
||||
"ui-priority": 0,
|
||||
"misp-attribute": "text",
|
||||
"disable_correlation": true,
|
||||
"sane_default": [
|
||||
"A Deposit",
|
||||
"C Currency exchange",
|
||||
"D Casino chips",
|
||||
"E Bank draft",
|
||||
"F Money order",
|
||||
"G Traveler’s cheques",
|
||||
"H Life insurance policy",
|
||||
"I Real estate",
|
||||
"J Securities",
|
||||
"K Cash",
|
||||
"O Other",
|
||||
"P Cheque"
|
||||
]
|
||||
},
|
||||
"from-country": {
|
||||
"description": "Origin country of a transaction.",
|
||||
"ui-priority": 0,
|
||||
"misp-attribute": "text"
|
||||
},
|
||||
"to-country": {
|
||||
"description": "Target country of a transaction.",
|
||||
"ui-priority": 0,
|
||||
"misp-attribute": "text"
|
||||
}
|
||||
},
|
||||
"version": 1,
|
||||
"description": "An object to describe a financial transaction.",
|
||||
"meta-category": "financial",
|
||||
"uuid": "a47fa26a-01b6-4747-a394-5144e34456dc",
|
||||
"name": "transaction"
|
||||
}
|
||||
|
|
@ -6,7 +6,8 @@
|
|||
"fragment": {
|
||||
"description": "Fragment identifier is a short string of characters that refers to a resource that is subordinate to another, primary resource.",
|
||||
"ui-priority": 0,
|
||||
"misp-attribute": "text"
|
||||
"misp-attribute": "text",
|
||||
"multiple": true
|
||||
},
|
||||
"tld": {
|
||||
"description": "Top-Level Domain",
|
||||
|
|
@ -35,18 +36,21 @@
|
|||
},
|
||||
"first-seen": {
|
||||
"description": "First time this URL has been seen",
|
||||
"disable_correlation": true,
|
||||
"ui-priority": 0,
|
||||
"misp-attribute": "datetime"
|
||||
},
|
||||
"resource_path": {
|
||||
"description": "Path (between hostname:port and query)",
|
||||
"ui-priority": 0,
|
||||
"misp-attribute": "text"
|
||||
"misp-attribute": "text",
|
||||
"multiple": true
|
||||
},
|
||||
"query_string": {
|
||||
"description": "Query (after path, preceded by '?')",
|
||||
"ui-priority": 0,
|
||||
"misp-attribute": "text"
|
||||
"misp-attribute": "text",
|
||||
"multiple": true
|
||||
},
|
||||
"url": {
|
||||
"description": "Full URL",
|
||||
|
|
@ -81,6 +85,7 @@
|
|||
},
|
||||
"last-seen": {
|
||||
"description": "Last time this URL has been seen",
|
||||
"disable_correlation": true,
|
||||
"ui-priority": 0,
|
||||
"misp-attribute": "datetime"
|
||||
},
|
||||
|
|
@ -90,7 +95,7 @@
|
|||
"misp-attribute": "hostname"
|
||||
}
|
||||
},
|
||||
"version": 4,
|
||||
"version": 6,
|
||||
"description": "url object describes an url along with its normalized field (like extracted using faup parsing library) and its metadata.",
|
||||
"meta-category": "network",
|
||||
"uuid": "60efb77b-40b5-4c46-871b-ed1ed999fce5",
|
||||
|
|
|
|||
|
|
@ -9,13 +9,21 @@
|
|||
"misp-attribute": "text"
|
||||
},
|
||||
"name": {
|
||||
"description": "The name of the victim targeted. The name can be an organisation or a group of organisations.",
|
||||
"description": "The name of the department(s) or organisation(s) targeted.",
|
||||
"ui-priority": 1,
|
||||
"misp-attribute": "text"
|
||||
"misp-attribute": "target-org",
|
||||
"multiple": true
|
||||
},
|
||||
"external": {
|
||||
"description": "External target organisations affected by this attack.",
|
||||
"ui-priority": 1,
|
||||
"misp-attribute": "target-external",
|
||||
"multiple": true
|
||||
},
|
||||
"classification": {
|
||||
"description": "The type of entity being targeted.",
|
||||
"misp-attribute": "text",
|
||||
"disable_correlation": true,
|
||||
"ui-priority": 1,
|
||||
"sane_default": [
|
||||
"individual",
|
||||
|
|
@ -47,18 +55,18 @@
|
|||
"energy",
|
||||
"engineering",
|
||||
"entertainment",
|
||||
"financialservices",
|
||||
"governmentnational",
|
||||
"governmentregional",
|
||||
"governmentlocal",
|
||||
"governmentpublicservices",
|
||||
"financial services",
|
||||
"government national",
|
||||
"government regional",
|
||||
"government local",
|
||||
"government public services",
|
||||
"healthcare",
|
||||
"hospitalityleisure",
|
||||
"hospitality leisure",
|
||||
"infrastructure",
|
||||
"insurance",
|
||||
"manufacturing",
|
||||
"mining",
|
||||
"nonprofit",
|
||||
"non profit",
|
||||
"pharmaceuticals",
|
||||
"retail",
|
||||
"technology",
|
||||
|
|
@ -70,11 +78,35 @@
|
|||
"regions": {
|
||||
"description": "The list of regions or locations from the victim targeted. ISO 3166 should be used.",
|
||||
"multiple": true,
|
||||
"misp-attribute": "text",
|
||||
"misp-attribute": "target-location",
|
||||
"ui-priority": 1
|
||||
},
|
||||
"user": {
|
||||
"description": "The username(s) of the user targeted.",
|
||||
"misp-attribute": "target-user",
|
||||
"ui-priority": 1,
|
||||
"multiple": true
|
||||
},
|
||||
"email": {
|
||||
"description": "The email address(es) of the user targeted.",
|
||||
"misp-attribute": "target-email",
|
||||
"ui-priority": 1,
|
||||
"multiple": true
|
||||
},
|
||||
"node": {
|
||||
"description": "Name(s) of node that was targeted.",
|
||||
"misp-attribute": "target-machine",
|
||||
"ui-priority": 1,
|
||||
"multiple": true
|
||||
},
|
||||
"ip-address": {
|
||||
"description": "IP address(es) of the node targeted.",
|
||||
"misp-attribute": "ip-dst",
|
||||
"ui-priority": 1,
|
||||
"multiple": true
|
||||
}
|
||||
},
|
||||
"version": 1,
|
||||
"version": 4,
|
||||
"description": "Victim object describes the target of an attack or abuse.",
|
||||
"meta-category": "misc",
|
||||
"uuid": "a8806e40-39ad-435f-be02-ac2a13d6fc7d",
|
||||
|
|
|
|||
|
|
@ -44,9 +44,18 @@
|
|||
],
|
||||
"ui-priority": 2,
|
||||
"misp-attribute": "link"
|
||||
},
|
||||
"comment": {
|
||||
"description": "Comment related to this hash",
|
||||
"categories": [
|
||||
"Exernal analysis"
|
||||
],
|
||||
"misp-attribute": "text",
|
||||
"ui-priority": 2,
|
||||
"multiple": true
|
||||
}
|
||||
},
|
||||
"version": 1,
|
||||
"version": 2,
|
||||
"description": "VirusTotal report",
|
||||
"meta-category": "misc",
|
||||
"uuid": "d7dd0154-e04f-4c34-a2fb-79f3a3a52aa4",
|
||||
|
|
|
|||
|
|
@ -5,51 +5,94 @@
|
|||
"references",
|
||||
"vulnerable_configuration",
|
||||
"summary",
|
||||
"text",
|
||||
"description",
|
||||
"id"
|
||||
],
|
||||
"attributes": {
|
||||
"id": {
|
||||
"description": "Vulnerability ID (generally CVE, but not necessarely)",
|
||||
"ui-priority": 1,
|
||||
"misp-attribute": "vulnerability"
|
||||
"description": "Vulnerability ID (generally CVE, but not necessarely). The id is not required as the object itself has an UUID and the CVE id can be update or assigned later.",
|
||||
"ui-priority": 0,
|
||||
"misp-attribute": "text",
|
||||
"multiple": true
|
||||
},
|
||||
"text": {
|
||||
"description": {
|
||||
"description": "Description of the vulnerability",
|
||||
"ui-priority": 1,
|
||||
"ui-priority": 0,
|
||||
"misp-attribute": "text"
|
||||
},
|
||||
"summary": {
|
||||
"description": "Summary of the vulnerability",
|
||||
"ui-priority": 1,
|
||||
"ui-priority": 0,
|
||||
"misp-attribute": "text"
|
||||
},
|
||||
"vulnerable_configuration": {
|
||||
"description": "The vulnerable configuration is described in CPE format",
|
||||
"multiple": true,
|
||||
"ui-priority": 1,
|
||||
"ui-priority": 0,
|
||||
"misp-attribute": "text"
|
||||
},
|
||||
"modified": {
|
||||
"description": "Last modification date",
|
||||
"ui-priority": 0,
|
||||
"misp-attribute": "datetime"
|
||||
"misp-attribute": "datetime",
|
||||
"disable_correlation": true
|
||||
},
|
||||
"published": {
|
||||
"description": "Initial publication date",
|
||||
"ui-priority": 0,
|
||||
"misp-attribute": "datetime"
|
||||
"misp-attribute": "datetime",
|
||||
"disable_correlation": true
|
||||
},
|
||||
"created": {
|
||||
"description": "First time when the vulnerability was discovered",
|
||||
"ui-priority": 0,
|
||||
"misp-attribute": "datetime",
|
||||
"disable_correlation": true
|
||||
},
|
||||
"references": {
|
||||
"description": "External references",
|
||||
"multiple": true,
|
||||
"ui-priority": 1,
|
||||
"ui-priority": 0,
|
||||
"misp-attribute": "link"
|
||||
},
|
||||
"state": {
|
||||
"description": "State of the vulnerability. A vulnerability can have multiple states depending of the current actions performed.",
|
||||
"multiple": true,
|
||||
"ui-priority": 0,
|
||||
"sane_default": [
|
||||
"Published",
|
||||
"Embargo",
|
||||
"Reviewed",
|
||||
"Vulnerability ID Assigned",
|
||||
"Reported",
|
||||
"Fixed"
|
||||
],
|
||||
"disable_correlation": true,
|
||||
"misp-attribute": "text"
|
||||
},
|
||||
"cvss-score": {
|
||||
"description": "Score of the Common Vulnerability Scoring System (version 3).",
|
||||
"ui-priority": 1,
|
||||
"disable_correlation": true,
|
||||
"misp-attribute": "float"
|
||||
},
|
||||
"cvss-string": {
|
||||
"description": "String of the Common Vulnerability Scoring System (version 3).",
|
||||
"ui-priority": 1,
|
||||
"disable_correlation": true,
|
||||
"misp-attribute": "text"
|
||||
},
|
||||
"credit": {
|
||||
"description": "Who reported/found the vulnerability such as an organisation, person or nickname.",
|
||||
"ui-priority": 0,
|
||||
"disable_correlation": true,
|
||||
"misp-attribute": "text",
|
||||
"multiple": true
|
||||
}
|
||||
},
|
||||
"version": 2,
|
||||
"description": "Vulnerability object describing common vulnerability enumeration",
|
||||
"meta-category": "network",
|
||||
"version": 5,
|
||||
"description": "Vulnerability object describing a common vulnerability enumeration which can describe published, unpublished, under review or embargo vulnerability for software, equipments or hardware.",
|
||||
"meta-category": "vulnerability",
|
||||
"uuid": "81650945-f186-437b-8945-9f31715d32da",
|
||||
"name": "vulnerability"
|
||||
}
|
||||
|
|
|
|||
|
|
@ -4,18 +4,19 @@
|
|||
"registrant-phone",
|
||||
"creation-date",
|
||||
"registrant-name",
|
||||
"registrar"
|
||||
],
|
||||
"required": [
|
||||
"domain"
|
||||
"registrar",
|
||||
"text",
|
||||
"domain",
|
||||
"ip-address"
|
||||
],
|
||||
"attributes": {
|
||||
"text": {
|
||||
"description": "Full whois entry",
|
||||
"disable_correlation": true,
|
||||
"ui-priority": 1,
|
||||
"misp-attribute": "text"
|
||||
},
|
||||
"registar": {
|
||||
"registrar": {
|
||||
"description": "Registrar of the whois entry",
|
||||
"ui-priority": 0,
|
||||
"misp-attribute": "whois-registrar"
|
||||
|
|
@ -35,33 +36,61 @@
|
|||
"ui-priority": 1,
|
||||
"misp-attribute": "whois-registrant-email"
|
||||
},
|
||||
"registrant-org": {
|
||||
"description": "Registrant organisation",
|
||||
"ui-priority": 1,
|
||||
"misp-attribute": "whois-registrant-org"
|
||||
},
|
||||
"creation-date": {
|
||||
"description": "Initial creation of the whois entry",
|
||||
"disable_correlation": true,
|
||||
"ui-priority": 0,
|
||||
"misp-attribute": "datetime"
|
||||
},
|
||||
"modification-date": {
|
||||
"description": "Last update of the whois entry",
|
||||
"disable_correlation": true,
|
||||
"ui-priority": 0,
|
||||
"misp-attribute": "datetime"
|
||||
},
|
||||
"expiration-date": {
|
||||
"description": "Expiration of the whois entry",
|
||||
"disable_correlation": true,
|
||||
"ui-priority": 0,
|
||||
"misp-attribute": "datetime"
|
||||
},
|
||||
"nameserver": {
|
||||
"description": "Nameserver",
|
||||
"ui-priority": 0,
|
||||
"misp-attribute": "hostname",
|
||||
"disable_correlation": true,
|
||||
"multiple": true,
|
||||
"to_ids": false
|
||||
},
|
||||
"domain": {
|
||||
"description": "Domain of the whois entry",
|
||||
"categories": [
|
||||
"Network activity",
|
||||
"External analysis"
|
||||
],
|
||||
"ui-priority": 1,
|
||||
"ui-priority": 0,
|
||||
"multiple": true,
|
||||
"misp-attribute": "domain"
|
||||
},
|
||||
"comment": {
|
||||
"description": "Comment of the whois entry",
|
||||
"ui-priority": 0,
|
||||
"misp-attribute": "text"
|
||||
},
|
||||
"ip-address": {
|
||||
"description": "IP address of the whois entry",
|
||||
"ui-priority": 0,
|
||||
"multiple": true,
|
||||
"misp-attribute": "ip-src"
|
||||
}
|
||||
},
|
||||
"version": 4,
|
||||
"description": "Whois records information for a domain name.",
|
||||
"version": 10,
|
||||
"description": "Whois records information for a domain name or an IP address.",
|
||||
"meta-category": "network",
|
||||
"uuid": "429faea1-34ff-47af-8a00-7c62d3be5a6a",
|
||||
"name": "whois"
|
||||
|
|
|
|||
|
|
@ -2,7 +2,8 @@
|
|||
"requiredOneOf": [
|
||||
"x509-fingerprint-md5",
|
||||
"x509-fingerprint-sha1",
|
||||
"x509-fingerprint-sha256"
|
||||
"x509-fingerprint-sha256",
|
||||
"serial-number"
|
||||
],
|
||||
"attributes": {
|
||||
"subject": {
|
||||
|
|
@ -33,22 +34,27 @@
|
|||
"x509-fingerprint-md5": {
|
||||
"description": "[Insecure] MD5 hash (128 bits)",
|
||||
"ui-priority": 1,
|
||||
"misp-attribute": "md5",
|
||||
"misp-attribute": "x509-fingerprint-md5",
|
||||
"recommended": false
|
||||
},
|
||||
"x509-fingerprint-sha1": {
|
||||
"description": "[Insecure] Secure Hash Algorithm 1 (160 bits)",
|
||||
"ui-priority": 1,
|
||||
"misp-attribute": "sha1",
|
||||
"misp-attribute": "x509-fingerprint-sha1",
|
||||
"recommended": false
|
||||
},
|
||||
"x509-fingerprint-sha256": {
|
||||
"description": "Secure Hash Algorithm 2 (256 bits)",
|
||||
"ui-priority": 1,
|
||||
"misp-attribute": "sha256"
|
||||
"misp-attribute": "x509-fingerprint-sha256"
|
||||
},
|
||||
"raw-base64": {
|
||||
"description": "Raw certificate base64 encoded",
|
||||
"description": "Raw certificate base64 encoded (DER format)",
|
||||
"ui-priority": 0,
|
||||
"misp-attribute": "text"
|
||||
},
|
||||
"pem": {
|
||||
"description": "Raw certificate in PEM formati (Unix-like newlines)",
|
||||
"ui-priority": 0,
|
||||
"misp-attribute": "text"
|
||||
},
|
||||
|
|
@ -81,9 +87,25 @@
|
|||
"description": "Version of the certificate",
|
||||
"ui-priority": 0,
|
||||
"misp-attribute": "text"
|
||||
},
|
||||
"self_signed": {
|
||||
"description": "Self-signed certificate",
|
||||
"ui-priority": 0,
|
||||
"misp-attribute": "boolean"
|
||||
},
|
||||
"is_ca": {
|
||||
"description": "CA certificate",
|
||||
"ui-priority": 0,
|
||||
"misp-attribute": "boolean"
|
||||
},
|
||||
"dns_names": {
|
||||
"description": "DNS names",
|
||||
"multiple": true,
|
||||
"misp-attribute": "text",
|
||||
"ui-priority": 0
|
||||
}
|
||||
},
|
||||
"version": 4,
|
||||
"version": 7,
|
||||
"description": "x509 object describing a X.509 certificate",
|
||||
"meta-category": "network",
|
||||
"uuid": "d1ab756a-26b5-4349-9f43-765630f0911c",
|
||||
|
|
|
|||
|
|
@ -0,0 +1,41 @@
|
|||
{
|
||||
"requiredOneOf": [
|
||||
"yara"
|
||||
],
|
||||
"attributes": {
|
||||
"comment": {
|
||||
"description": "A description of the YARA rule.",
|
||||
"ui-priority": 0,
|
||||
"misp-attribute": "comment"
|
||||
},
|
||||
"yara": {
|
||||
"description": "YARA rule.",
|
||||
"ui-priority": 0,
|
||||
"misp-attribute": "yara"
|
||||
},
|
||||
"version": {
|
||||
"sane_default": [
|
||||
"3.7.1"
|
||||
],
|
||||
"description": "Version of the YARA rule depending where the yara rule is known to work as expected.",
|
||||
"ui-priority": 0,
|
||||
"misp-attribute": "text"
|
||||
},
|
||||
"context": {
|
||||
"description": "Context where the YARA rule can be applied",
|
||||
"sane_default": [
|
||||
"all",
|
||||
"disk",
|
||||
"memory",
|
||||
"network"
|
||||
],
|
||||
"misp-attribute": "text",
|
||||
"ui-priority": 0
|
||||
}
|
||||
},
|
||||
"version": 3,
|
||||
"description": "An object describing a YARA rule along with its version.",
|
||||
"meta-category": "misc",
|
||||
"uuid": "b5acf82e-ecca-4868-82fe-9dbdf4d808c3",
|
||||
"name": "yara"
|
||||
}
|
||||
|
|
@ -1,5 +1,5 @@
|
|||
{
|
||||
"version": 10,
|
||||
"version": 12,
|
||||
"values": [
|
||||
{
|
||||
"name": "derived-from",
|
||||
|
|
@ -25,6 +25,142 @@
|
|||
"stix-2.0"
|
||||
]
|
||||
},
|
||||
{
|
||||
"name": "connected-to",
|
||||
"description": "The referenced source is connected to the target object.",
|
||||
"format": [
|
||||
"misp",
|
||||
"stix-1.1"
|
||||
]
|
||||
},
|
||||
{
|
||||
"name": "connected-from",
|
||||
"description": "The referenced source is connected from the target object.",
|
||||
"format": [
|
||||
"misp",
|
||||
"stix-1.1"
|
||||
]
|
||||
},
|
||||
{
|
||||
"name": "contains",
|
||||
"description": "The referenced source is containing the target object.",
|
||||
"format": [
|
||||
"misp",
|
||||
"stix-1.1"
|
||||
]
|
||||
},
|
||||
{
|
||||
"name": "contained-by",
|
||||
"description": "The referenced source is contained by the target object.",
|
||||
"format": [
|
||||
"misp",
|
||||
"stix-1.1"
|
||||
]
|
||||
},
|
||||
{
|
||||
"name": "contained-within",
|
||||
"description": "The referenced source is contained within the target object.",
|
||||
"format": [
|
||||
"misp",
|
||||
"stix-1.1"
|
||||
]
|
||||
},
|
||||
{
|
||||
"name": "characterized-by",
|
||||
"description": "The referenced source is characterized by the target object.",
|
||||
"format": [
|
||||
"misp",
|
||||
"stix-1.1"
|
||||
]
|
||||
},
|
||||
{
|
||||
"name": "characterizes",
|
||||
"description": "The referenced source is characterizing the target object.",
|
||||
"format": [
|
||||
"misp",
|
||||
"stix-1.1"
|
||||
]
|
||||
},
|
||||
{
|
||||
"name": "properties-queried",
|
||||
"description": "The referenced source has queried the target object.",
|
||||
"format": [
|
||||
"misp",
|
||||
"stix-1.1"
|
||||
]
|
||||
},
|
||||
{
|
||||
"name": "properties-queried-by",
|
||||
"description": "The referenced source is queried by the target object.",
|
||||
"format": [
|
||||
"misp",
|
||||
"stix-1.1"
|
||||
]
|
||||
},
|
||||
{
|
||||
"name": "extracted-from",
|
||||
"description": "The referenced source is extracted from the target object.",
|
||||
"format": [
|
||||
"misp",
|
||||
"stix-1.1"
|
||||
]
|
||||
},
|
||||
{
|
||||
"name": "supra-domain-of",
|
||||
"description": "The referenced source is a supra domain of the target object.",
|
||||
"format": [
|
||||
"misp",
|
||||
"stix-1.1"
|
||||
]
|
||||
},
|
||||
{
|
||||
"name": "sub-domain-of",
|
||||
"description": "The referenced source is a sub domain of the target object.",
|
||||
"format": [
|
||||
"misp",
|
||||
"stix-1.1"
|
||||
]
|
||||
},
|
||||
{
|
||||
"name": "dropped",
|
||||
"description": "The referenced source has dropped the target object.",
|
||||
"format": [
|
||||
"misp",
|
||||
"stix-1.1"
|
||||
]
|
||||
},
|
||||
{
|
||||
"name": "dropped-by",
|
||||
"description": "The referenced source is dropped by the target object.",
|
||||
"format": [
|
||||
"misp",
|
||||
"stix-1.1"
|
||||
]
|
||||
},
|
||||
{
|
||||
"name": "downloaded",
|
||||
"description": "The referenced source has downloaded the target object.",
|
||||
"format": [
|
||||
"misp",
|
||||
"stix-1.1"
|
||||
]
|
||||
},
|
||||
{
|
||||
"name": "downloaded-from",
|
||||
"description": "The referenced source has been downloaded from the target object.",
|
||||
"format": [
|
||||
"misp",
|
||||
"stix-1.1"
|
||||
]
|
||||
},
|
||||
{
|
||||
"name": "resolved-to",
|
||||
"description": "The referenced source is resolved to the target object.",
|
||||
"format": [
|
||||
"misp",
|
||||
"stix-1.1"
|
||||
]
|
||||
},
|
||||
{
|
||||
"name": "attributed-to",
|
||||
"description": "This referenced source is attributed to the target object.",
|
||||
|
|
@ -75,7 +211,7 @@
|
|||
},
|
||||
{
|
||||
"name": "impersonates",
|
||||
"description": "This relationship describe a source object which impersonates the target object",
|
||||
"description": "This relationship describes a source object which impersonates the target object",
|
||||
"format": [
|
||||
"misp",
|
||||
"stix-2.0"
|
||||
|
|
@ -130,6 +266,13 @@
|
|||
"misp"
|
||||
]
|
||||
},
|
||||
{
|
||||
"name": "drops",
|
||||
"description": "This relationship describes an object which drops another object",
|
||||
"format": [
|
||||
"misp"
|
||||
]
|
||||
},
|
||||
{
|
||||
"name": "executed-by",
|
||||
"description": "This relationship describes an object executed by another object.",
|
||||
|
|
@ -193,6 +336,20 @@
|
|||
"misp"
|
||||
]
|
||||
},
|
||||
{
|
||||
"name": "followed-by",
|
||||
"description": "This relationship describes an object which is followed by another object. This can be used when a time reference is missing but a sequence is known.",
|
||||
"format": [
|
||||
"misp"
|
||||
]
|
||||
},
|
||||
{
|
||||
"name": "preceding-by",
|
||||
"description": "This relationship describes an object which is preceded by another object. This can be used when a time reference is missing but a sequence is known.",
|
||||
"format": [
|
||||
"misp"
|
||||
]
|
||||
},
|
||||
{
|
||||
"name": "triggers",
|
||||
"description": "This relationship describes an object which triggers another object.",
|
||||
|
|
@ -451,6 +608,13 @@
|
|||
"format": [
|
||||
"cert-eu"
|
||||
]
|
||||
},
|
||||
{
|
||||
"name": "exploits",
|
||||
"description": "This relationships describes an object (like a PoC/exploit) which exploits another object (such as a vulnerability object).",
|
||||
"format": [
|
||||
"misp"
|
||||
]
|
||||
}
|
||||
],
|
||||
"description": "Default type of relationships in MISP objects.",
|
||||
|
|
|
|||
|
|
@ -67,7 +67,8 @@
|
|||
"network",
|
||||
"financial",
|
||||
"misc",
|
||||
"internal"
|
||||
"internal",
|
||||
"vulnerability"
|
||||
]
|
||||
},
|
||||
"name": {
|
||||
|
|
|
|||
Loading…
Reference in New Issue