mirror of https://github.com/MISP/misp-objects
wip: [event] New object template to describe events that can happen during an incident
Christian Studer
parent
1a05a9f253
commit
c5c8f35fb4
|
|
@ -0,0 +1,172 @@
|
|||
{
|
||||
"attributes": {
|
||||
"description": {
|
||||
"description": "Description of the event.",
|
||||
"misp-attribute": "text",
|
||||
"ui-priority": 0
|
||||
},
|
||||
"end_time": {
|
||||
"description": "The date and time the event was last recorded.",
|
||||
"misp-attribute": "datetime",
|
||||
"ui-priority": 0
|
||||
},
|
||||
"end_time_fidelity": {
|
||||
"description": "Level of fidelity that the `end_time` is recorded in.",
|
||||
"disable_correlation": true,
|
||||
"misp-attribute": "text",
|
||||
"sane_default": [
|
||||
"day",
|
||||
"hour",
|
||||
"minute",
|
||||
"month",
|
||||
"second",
|
||||
"year"
|
||||
],
|
||||
"ui-priority": 0
|
||||
},
|
||||
"event_type": {
|
||||
"description": "Type of event.",
|
||||
"disable_correlation": true,
|
||||
"misp-attribute": "text",
|
||||
"multiple": true,
|
||||
"sane_default": [
|
||||
"aggregation-information-phishing-schemes",
|
||||
"benign",
|
||||
"blocked",
|
||||
"brute-force-attempt",
|
||||
"c&c-server-hosting",
|
||||
"compromised-system",
|
||||
"confirmed",
|
||||
"connection-malware-port",
|
||||
"connection-malware-system",
|
||||
"content-forbidden-by-law",
|
||||
"control-system-bypass",
|
||||
"copyrighted-content",
|
||||
"data-exfiltration",
|
||||
"deferred",
|
||||
"deletion-information",
|
||||
"denial-of-service",
|
||||
"destruction",
|
||||
"dictionary-attack-attempt",
|
||||
"discarded",
|
||||
"disruption-data-transmission",
|
||||
"dissemination-malware-email",
|
||||
"dissemination-phishing-emails",
|
||||
"dns-cache-poisoning",
|
||||
"dns-local-resolver-hijacking",
|
||||
"dns-spoofing-registered",
|
||||
"dns-rebinding",
|
||||
"dns-server-compromise",
|
||||
"dns-spoofing-unregistered",
|
||||
"dns-stub-resolver-hijacking",
|
||||
"dns-zone-transfer",
|
||||
"domain-name-compromise",
|
||||
"duplicate",
|
||||
"email-flooding",
|
||||
"equipment-loss",
|
||||
"equipment-theft",
|
||||
"exploit",
|
||||
"exploit-attempt",
|
||||
"exploit-framework-exhausting-resources",
|
||||
"exploit-tool-exhausting-resources",
|
||||
"failed",
|
||||
"file-inclusion",
|
||||
"file-inclusion-attempt",
|
||||
"hosting-malware-webpage",
|
||||
"hosting-phishing-sites",
|
||||
"illegitimate-use-name",
|
||||
"illegitimate-use-resources",
|
||||
"infected-by-known-malware",
|
||||
"insufficient-data",
|
||||
"known-malware",
|
||||
"lame-delegations",
|
||||
"major",
|
||||
"modification-information",
|
||||
"misconfiguration",
|
||||
"natural",
|
||||
"network-scanning",
|
||||
"no-apt",
|
||||
"packet-flood",
|
||||
"password-cracking-attempt",
|
||||
"ransomware",
|
||||
"refuted",
|
||||
"scan-probe",
|
||||
"silently-discarded",
|
||||
"supply-chain-customer",
|
||||
"supply-chain-vendor",
|
||||
"spam",
|
||||
"sql-injection",
|
||||
"sql-injection-attempt",
|
||||
"successful",
|
||||
"system-probe",
|
||||
"theft-access-credentials",
|
||||
"unattributed",
|
||||
"unauthorized-access-information",
|
||||
"unauthorized-access-system",
|
||||
"unauthorized-equipment",
|
||||
"unauthorized-release",
|
||||
"unauthorized-use",
|
||||
"undetermined",
|
||||
"unintentional",
|
||||
"unknown-apt",
|
||||
"unspecified",
|
||||
"vandalism",
|
||||
"wiretapping",
|
||||
"worm-spreading",
|
||||
"xss",
|
||||
"xss-attempt"
|
||||
],
|
||||
"ui-priority": 0
|
||||
},
|
||||
"goal": {
|
||||
"description": "The assumed objective of the event.",
|
||||
"misp-attribute": "text",
|
||||
"ui-priority": 0
|
||||
},
|
||||
"name": {
|
||||
"description": "Name of the event.",
|
||||
"misp-attribute": "text",
|
||||
"ui-priority": 0
|
||||
},
|
||||
"start_time": {
|
||||
"description": "The date and time the event was first recorded.",
|
||||
"misp-attribute": "datetime",
|
||||
"ui-priority": 0
|
||||
},
|
||||
"start_time_fidelity": {
|
||||
"description": "Level of fidelity that the `start_time` is recorded in.",
|
||||
"disable_correlation": true,
|
||||
"misp-attribute": "text",
|
||||
"sane_default": [
|
||||
"day",
|
||||
"hour",
|
||||
"minute",
|
||||
"month",
|
||||
"second",
|
||||
"year"
|
||||
],
|
||||
"ui-priority": 0
|
||||
},
|
||||
"status": {
|
||||
"description": "Current status of the event.",
|
||||
"disable_correlation": true,
|
||||
"misp-attribute": "text",
|
||||
"sane_default": [
|
||||
"not-occurred",
|
||||
"ongoing",
|
||||
"occurred",
|
||||
"pending",
|
||||
"undetermined"
|
||||
],
|
||||
"ui-priority": 1
|
||||
}
|
||||
},
|
||||
"description": "Event object as described in STIX 2.1 Incident object extension.",
|
||||
"meta-category": "misc",
|
||||
"name": "event",
|
||||
"required": [
|
||||
"status"
|
||||
],
|
||||
"uuid": "3853b726-6a9c-43b3-8ffb-23839b07d5a9",
|
||||
"version": 1
|
||||
}
|
||||
Loading…
Reference in New Issue