From c8ecf75fdcc880a358155286365e09b4e8e56707 Mon Sep 17 00:00:00 2001
From: Alexandre Dulaunoy <a@foo.be>
Date: Sun, 9 Sep 2018 12:29:58 +0200
Subject: [PATCH] new: [tracking-id] Analytics and tracking ID such as used in
 Google Analytics or other analytic platform.

---
 objects/tracking-id/definition.json | 46 +++++++++++++++++++++++++++++
 1 file changed, 46 insertions(+)
 create mode 100644 objects/tracking-id/definition.json

diff --git a/objects/tracking-id/definition.json b/objects/tracking-id/definition.json
new file mode 100644
index 0000000..509dbe7
--- /dev/null
+++ b/objects/tracking-id/definition.json
@@ -0,0 +1,46 @@
+{
+  "requiredOneOf": [
+    "id"
+  ],
+  "attributes": {
+    "id": {
+      "description": "Tracking code",
+      "ui-priority": 1,
+      "misp-attribute": "text"
+    },
+    "description": {
+      "description": "Description of the tracking id",
+      "ui-priority": 1,
+      "misp-attribute": "text"
+    },
+    "url": {
+      "description": "URL where the tracking id was found",
+      "ui-priority": 1,
+      "multiple": true,
+      "misp-attribute": "url"
+    },
+    "hostname": {
+      "description": "hostname where the tracking id was found",
+      "ui-priority": 0,
+      "misp-attribute": "hostname",
+      "multiple": true
+    },
+    "first-seen": {
+      "description": "First time the tracking code was seen",
+      "disable_correlation": true,
+      "ui-priority": 0,
+      "misp-attribute": "datetime"
+    },
+    "last-seen": {
+      "description": "Last time the tracking code was seen",
+      "disable_correlation": true,
+      "ui-priority": 0,
+      "misp-attribute": "datetime"
+    }
+  },
+  "version": 1,
+  "description": "Analytics and tracking ID such as used in Google Analytics or other analytic platform.",
+  "meta-category": "network",
+  "uuid": "3681c62a-2c75-48d8-99f2-6a3444ce2393",
+  "name": "tracking-id"
+}