mirror of https://github.com/MISP/misp-objects
update: Forensic-evidence object
parent
4e66e692d4
commit
d2550dffb6
|
@ -27,30 +27,42 @@
|
||||||
"Cloud",
|
"Cloud",
|
||||||
"IoT",
|
"IoT",
|
||||||
"Other"
|
"Other"
|
||||||
],
|
]
|
||||||
"disable_correlation": true
|
|
||||||
},
|
},
|
||||||
"name": {
|
"name": {
|
||||||
"description": "Name",
|
"description": "Name",
|
||||||
"ui-priority": 0,
|
"ui-priority": 0,
|
||||||
"misp-attribute": "text"
|
"misp-attribute": "text"
|
||||||
},
|
},
|
||||||
"acquisition-hash-type": {
|
"acquisition-method": {
|
||||||
"description": "Hashing algorithm used on the evidence",
|
"description": "Method used for acquisition of the evidence.",
|
||||||
"multiple": true,
|
|
||||||
"ui-priority": 0,
|
"ui-priority": 0,
|
||||||
"misp-attribute": "text",
|
"misp-attribute": "text",
|
||||||
"sane_default": [
|
"sane_default": [
|
||||||
"MD5",
|
"Live acquisition",
|
||||||
"SHA-1",
|
"Dead/Offline acquisition",
|
||||||
|
"Physical collection",
|
||||||
|
"Logical collection",
|
||||||
|
"File system extraction",
|
||||||
|
"Chip-off",
|
||||||
"Other"
|
"Other"
|
||||||
],
|
]
|
||||||
"disable_correlation": true
|
|
||||||
},
|
},
|
||||||
"acquisition-hash": {
|
"acquisition-tools": {
|
||||||
"description": "Acquisition hash of the evidence",
|
"description": "Tools used for acquisition of the evidence.",
|
||||||
"ui-priority": 0,
|
"ui-priority": 0,
|
||||||
"misp-attribute": "text"
|
"misp-attribute": "text",
|
||||||
|
"multiple" : true,
|
||||||
|
"sane_default": [
|
||||||
|
"DCFldd",
|
||||||
|
"EnCase",
|
||||||
|
"FTK Imager",
|
||||||
|
"FDAS",
|
||||||
|
"TrueBack",
|
||||||
|
"Guymager",
|
||||||
|
"IXimager",
|
||||||
|
"Other"
|
||||||
|
]
|
||||||
},
|
},
|
||||||
"references": {
|
"references": {
|
||||||
"description": "External references",
|
"description": "External references",
|
||||||
|
@ -62,12 +74,6 @@
|
||||||
"description": "Comments.",
|
"description": "Comments.",
|
||||||
"ui-priority": 0,
|
"ui-priority": 0,
|
||||||
"misp-attribute": "text"
|
"misp-attribute": "text"
|
||||||
},
|
|
||||||
"file-upload": {
|
|
||||||
"description": "Upload any file pertaining to the evidence.",
|
|
||||||
"ui-priority": 0,
|
|
||||||
"misp-attribute": "attachment",
|
|
||||||
"multiple": true
|
|
||||||
}
|
}
|
||||||
},
|
},
|
||||||
"version": 1,
|
"version": 1,
|
||||||
|
|
Loading…
Reference in New Issue