From d9f1db590aa1258950b1b45b57881b33d35a5e93 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Rapha=C3=ABl=20Vinot?= Date: Sun, 26 Apr 2020 02:10:02 +0200 Subject: [PATCH] chg: Sort all the entries in the templates by default --- objects/ail-leak/definition.json | 126 ++--- objects/ais-info/definition.json | 34 +- objects/android-permission/definition.json | 26 +- objects/annotation/definition.json | 100 ++-- objects/anonymisation/definition.json | 130 ++--- objects/asn/definition.json | 88 +-- objects/attack-pattern/definition.json | 90 +-- .../authenticode-signerinfo/definition.json | 76 +-- objects/av-signature/definition.json | 84 +-- objects/bank-account/definition.json | 226 ++++---- objects/bgp-hijack/definition.json | 90 +-- objects/blog/definition.json | 136 ++--- objects/btc-transaction/definition.json | 88 +-- objects/btc-wallet/definition.json | 46 +- objects/cap-alert/definition.json | 138 ++--- objects/cap-info/definition.json | 206 +++---- objects/cap-resource/definition.json | 66 +-- objects/coin-address/definition.json | 124 ++-- objects/command-line/definition.json | 22 +- objects/command/definition.json | 28 +- objects/cookie/definition.json | 58 +- objects/cortex-taxonomy/definition.json | 84 +-- objects/cortex/definition.json | 52 +- objects/course-of-action/definition.json | 148 ++--- .../covid19-csse-daily-report/definition.json | 106 ++-- objects/covid19-dxy-live-city/definition.json | 40 +- .../covid19-dxy-live-province/definition.json | 50 +- objects/cowrie/definition.json | 208 +++---- objects/credential/definition.json | 108 ++-- objects/credit-card/definition.json | 84 +-- objects/crypto-material/definition.json | 226 ++++---- objects/cytomic-orion-file/definition.json | 74 +-- objects/cytomic-orion-machine/definition.json | 192 +++---- objects/dark-pattern-item/definition.json | 78 +-- objects/ddos/definition.json | 122 ++-- objects/device/definition.json | 110 ++-- objects/diameter-attack/definition.json | 94 ++-- objects/dns-record/definition.json | 104 ++-- objects/domain-crawled/definition.json | 40 +- objects/domain-ip/definition.json | 104 ++-- objects/elf-section/definition.json | 216 +++---- objects/elf/definition.json | 82 +-- objects/email/definition.json | 342 +++++------ objects/employee/definition.json | 86 +-- objects/exploit-poc/definition.json | 76 +-- objects/facial-composite/definition.json | 40 +- objects/fail2ban/definition.json | 108 ++-- objects/file/definition.json | 348 ++++++------ objects/forensic-case/definition.json | 66 +-- objects/forensic-evidence/definition.json | 100 ++-- objects/forged-document/definition.json | 132 ++--- objects/geolocation/definition.json | 134 ++--- objects/gtp-attack/definition.json | 78 +-- objects/http-request/definition.json | 108 ++-- objects/ilr-impact/definition.json | 54 +- .../ilr-notification-incident/definition.json | 186 +++--- objects/impersonation/definition.json | 116 ++-- objects/imsi-catcher/definition.json | 136 ++--- objects/instant-message-group/definition.json | 98 ++-- objects/instant-message/definition.json | 154 ++--- objects/intelmq_event/definition.json | 2 +- objects/intelmq_report/definition.json | 2 +- objects/internal-reference/definition.json | 78 +-- objects/interpol-notice/definition.json | 216 +++---- objects/iot-device/definition.json | 168 +++--- objects/iot-firmware/definition.json | 104 ++-- objects/ip-api-address/definition.json | 142 ++--- objects/ip-port/definition.json | 190 +++---- objects/irc/definition.json | 136 ++--- objects/ja3/definition.json | 46 +- objects/leaked-document/definition.json | 170 +++--- objects/legal-entity/definition.json | 84 +-- objects/lnk/definition.json | 530 +++++++++--------- objects/macho-section/definition.json | 166 +++--- objects/macho/definition.json | 62 +- .../mactime-timeline-analysis/definition.json | 68 +-- objects/malware-config/definition.json | 58 +- objects/meme-image/definition.json | 138 ++--- objects/microblog/definition.json | 258 ++++----- objects/mutex/definition.json | 30 +- objects/narrative/definition.json | 80 +-- objects/netflow/definition.json | 212 +++---- objects/network-connection/definition.json | 122 ++-- objects/network-socket/definition.json | 160 +++--- objects/news-agency/definition.json | 136 ++--- objects/news-media/definition.json | 208 +++---- objects/organization/definition.json | 110 ++-- .../original-imported-file/definition.json | 34 +- objects/passive-dns/definition.json | 126 ++--- objects/paste/definition.json | 80 +-- objects/pcap-metadata/definition.json | 64 +-- objects/pe-section/definition.json | 236 ++++---- objects/pe/definition.json | 236 ++++---- objects/person/definition.json | 258 ++++----- objects/pgp-meta/definition.json | 24 +- objects/phishing-kit/definition.json | 146 ++--- objects/phishing/definition.json | 174 +++--- objects/phone/definition.json | 106 ++-- objects/process/definition.json | 208 +++---- objects/python-etvx-event-log/definition.json | 230 ++++---- objects/r2graphity/definition.json | 212 +++---- objects/regexp/definition.json | 36 +- objects/registry-key/definition.json | 102 ++-- objects/regripper-NTUser/definition.json | 180 +++--- .../definition.json | 116 ++-- .../definition.json | 92 +-- .../definition.json | 106 ++-- .../definition.json | 92 +-- .../definition.json | 84 +-- .../definition.json | 102 ++-- .../definition.json | 52 +- .../definition.json | 70 +-- .../definition.json | 308 +++++----- .../definition.json | 194 +++---- .../definition.json | 66 +-- .../definition.json | 146 ++--- .../definition.json | 164 +++--- .../definition.json | 112 ++-- objects/report/definition.json | 48 +- objects/research-scanner/definition.json | 106 ++-- objects/rogue-dns/definition.json | 54 +- objects/rtir/definition.json | 54 +- objects/sandbox-report/definition.json | 164 +++--- objects/sb-signature/definition.json | 86 +-- objects/scheduled-event/definition.json | 178 +++--- objects/scrippsco2-c13-daily/definition.json | 86 +-- .../scrippsco2-c13-monthly/definition.json | 98 ++-- objects/scrippsco2-co2-daily/definition.json | 86 +-- .../scrippsco2-co2-monthly/definition.json | 98 ++-- objects/scrippsco2-o18-daily/definition.json | 86 +-- .../scrippsco2-o18-monthly/definition.json | 98 ++-- objects/script/definition.json | 64 +-- objects/shell-commands/definition.json | 42 +- objects/shodan-report/definition.json | 118 ++-- objects/short-message-service/definition.json | 102 ++-- objects/shortened-link/definition.json | 76 +-- objects/social-media-group/definition.json | 188 +++---- objects/splunk/definition.json | 106 ++-- objects/ss7-attack/definition.json | 258 ++++----- objects/ssh-authorized-keys/definition.json | 128 ++--- objects/stix2-pattern/definition.json | 24 +- objects/suricata/definition.json | 38 +- objects/target-system/definition.json | 52 +- objects/threatgrid-report/definition.json | 148 ++--- objects/timecode/definition.json | 84 +-- objects/timesketch-timeline/definition.json | 54 +- objects/timesketch_message/definition.json | 22 +- objects/timestamp/definition.json | 50 +- objects/tor-hiddenservice/definition.json | 66 +-- objects/tor-node/definition.json | 156 +++--- objects/tracking-id/definition.json | 70 +-- objects/transaction/definition.json | 216 +++---- objects/translation/definition.json | 232 ++++---- objects/trustar_report/definition.json | 2 +- objects/tsk-chats/definition.json | 128 ++--- objects/tsk-web-bookmark/definition.json | 76 +-- objects/tsk-web-cookie/definition.json | 80 +-- objects/tsk-web-downloads/definition.json | 98 ++-- objects/tsk-web-history/definition.json | 86 +-- objects/tsk-web-search-query/definition.json | 84 +-- objects/url/definition.json | 148 ++--- objects/user-account/definition.json | 202 +++---- objects/vehicle/definition.json | 172 +++--- objects/victim/definition.json | 138 ++--- objects/virustotal-graph/definition.json | 50 +- objects/virustotal-report/definition.json | 116 ++-- objects/vulnerability/definition.json | 174 +++--- objects/weakness/definition.json | 46 +- objects/whois/definition.json | 170 +++--- objects/x509/definition.json | 294 +++++----- objects/yabin/definition.json | 48 +- objects/yara/definition.json | 54 +- 172 files changed, 10100 insertions(+), 10100 deletions(-) diff --git a/objects/ail-leak/definition.json b/objects/ail-leak/definition.json index feae522..8bc341c 100644 --- a/objects/ail-leak/definition.json +++ b/objects/ail-leak/definition.json @@ -1,4 +1,65 @@ { + "attributes": { + "duplicate": { + "description": "Duplicate of the existing leaks.", + "misp-attribute": "text", + "multiple": true, + "ui-priority": 0 + }, + "duplicate_number": { + "description": "Number of known duplicates.", + "disable_correlation": true, + "misp-attribute": "counter", + "ui-priority": 0 + }, + "first-seen": { + "description": "When the leak has been accessible or seen for the first time.", + "disable_correlation": true, + "misp-attribute": "datetime", + "ui-priority": 0 + }, + "last-seen": { + "description": "When the leak has been accessible or seen for the last time.", + "disable_correlation": true, + "misp-attribute": "datetime", + "ui-priority": 0 + }, + "origin": { + "description": "The link where the leak is (or was) accessible at first-seen.", + "misp-attribute": "text", + "ui-priority": 1 + }, + "original-date": { + "description": "When the information available in the leak was created. It's usually before the first-seen.", + "disable_correlation": true, + "misp-attribute": "datetime", + "ui-priority": 0 + }, + "raw-data": { + "description": "Raw data as received by the AIL sensor compressed and encoded in Base64.", + "disable_correlation": true, + "misp-attribute": "attachment", + "ui-priority": 0 + }, + "sensor": { + "description": "The AIL sensor uuid where the leak was processed and analysed.", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 0 + }, + "text": { + "description": "A description of the leak which could include the potential victim(s) or description of the leak.", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 1 + } + }, + "description": "An information leak as defined by the AIL Analysis Information Leak framework.", + "meta-category": "misc", + "name": "ail-leak", + "required": [ + "sensor" + ], "requiredOneOf": [ "text", "first-seen", @@ -6,67 +67,6 @@ "origin", "raw-data" ], - "required": [ - "sensor" - ], - "attributes": { - "sensor": { - "description": "The AIL sensor uuid where the leak was processed and analysed.", - "disable_correlation": true, - "ui-priority": 0, - "misp-attribute": "text" - }, - "duplicate": { - "description": "Duplicate of the existing leaks.", - "ui-priority": 0, - "misp-attribute": "text", - "multiple": true - }, - "duplicate_number": { - "description": "Number of known duplicates.", - "disable_correlation": true, - "ui-priority": 0, - "misp-attribute": "counter" - }, - "origin": { - "description": "The link where the leak is (or was) accessible at first-seen.", - "ui-priority": 1, - "misp-attribute": "text" - }, - "text": { - "description": "A description of the leak which could include the potential victim(s) or description of the leak.", - "disable_correlation": true, - "ui-priority": 1, - "misp-attribute": "text" - }, - "original-date": { - "description": "When the information available in the leak was created. It's usually before the first-seen.", - "disable_correlation": true, - "ui-priority": 0, - "misp-attribute": "datetime" - }, - "last-seen": { - "description": "When the leak has been accessible or seen for the last time.", - "disable_correlation": true, - "ui-priority": 0, - "misp-attribute": "datetime" - }, - "first-seen": { - "description": "When the leak has been accessible or seen for the first time.", - "disable_correlation": true, - "ui-priority": 0, - "misp-attribute": "datetime" - }, - "raw-data": { - "description": "Raw data as received by the AIL sensor compressed and encoded in Base64.", - "disable_correlation": true, - "ui-priority": 0, - "misp-attribute": "attachment" - } - }, - "version": 9, - "description": "An information leak as defined by the AIL Analysis Information Leak framework.", - "meta-category": "misc", "uuid": "dc6a8fa2-0a43-4a0c-a5aa-b1a5336ca80e", - "name": "ail-leak" -} + "version": 9 +} \ No newline at end of file diff --git a/objects/ais-info/definition.json b/objects/ais-info/definition.json index 05e9629..9365798 100644 --- a/objects/ais-info/definition.json +++ b/objects/ais-info/definition.json @@ -1,25 +1,18 @@ { - "requiredOneOf": [ - "organisation", - "administrative-area", - "industry", - "country" - ], "attributes": { - "organisation": { - "description": "AIS Organisation Name.", + "administrative-area": { + "description": "AIS Administrative Area represented using ISO-3166-2.", "misp-attribute": "text", "ui-priority": 1 }, - "administrative-area": { - "description": "AIS Administrative Area represented using ISO-3166-2.", + "country": { + "description": "AIS Country represented using ISO-3166-1_alpha-2.", "misp-attribute": "text", "ui-priority": 1 }, "industry": { "description": "AIS IndustryType.", "misp-attribute": "text", - "ui-priority": 1, "multiple": true, "sane_default": [ "Chemical Sector", @@ -39,17 +32,24 @@ "Transportation Systems Sector", "Water and Wastewater Systems Sector", "Other" - ] + ], + "ui-priority": 1 }, - "country": { - "description": "AIS Country represented using ISO-3166-1_alpha-2.", + "organisation": { + "description": "AIS Organisation Name.", "misp-attribute": "text", "ui-priority": 1 } }, - "version": 1, "description": "Automated Indicator Sharing (AIS) Information Source Markings.", "meta-category": "misc", + "name": "ais-info", + "requiredOneOf": [ + "organisation", + "administrative-area", + "industry", + "country" + ], "uuid": "1f3f466d-465f-4c3a-8cce-933642c9ea83", - "name": "ais-info" -} + "version": 1 +} \ No newline at end of file diff --git a/objects/android-permission/definition.json b/objects/android-permission/definition.json index 0ecf198..993ea0c 100644 --- a/objects/android-permission/definition.json +++ b/objects/android-permission/definition.json @@ -1,11 +1,12 @@ { - "requiredOneOf": [ - "permission" - ], "attributes": { + "comment": { + "description": "Comment about the set of android permission(s)", + "misp-attribute": "comment", + "ui-priority": 0 + }, "permission": { "description": "Android permission", - "ui-priority": 0, "misp-attribute": "text", "multiple": true, "sane_default": [ @@ -155,17 +156,16 @@ "WRITE_SETTINGS", "WRITE_SYNC_SETTINGS", "WRITE_VOICEMAIL" - ] - }, - "comment": { - "description": "Comment about the set of android permission(s)", - "ui-priority": 0, - "misp-attribute": "comment" + ], + "ui-priority": 0 } }, - "version": 2, "description": "A set of android permissions - one or more permission(s) which can be linked to other objects (e.g. malware, app).", "meta-category": "misc", + "name": "android-permission", + "requiredOneOf": [ + "permission" + ], "uuid": "d81003b2-5c03-4d96-ae30-e6695de1aea2", - "name": "android-permission" -} + "version": 2 +} \ No newline at end of file diff --git a/objects/annotation/definition.json b/objects/annotation/definition.json index b64ee94..4d0f2fb 100644 --- a/objects/annotation/definition.json +++ b/objects/annotation/definition.json @@ -1,24 +1,55 @@ { - "requiredOneOf": [ - "text" - ], "attributes": { - "text": { - "description": "Raw text of the annotation", - "ui-priority": 0, - "misp-attribute": "text" + "attachment": { + "description": "An attachment to support the annotation", + "misp-attribute": "attachment", + "multiple": true, + "ui-priority": 0 + }, + "creation-date": { + "description": "Initial creation of the annotation", + "misp-attribute": "datetime", + "ui-priority": 0 + }, + "format": { + "description": "Format of the annotation", + "disable_correlation": true, + "misp-attribute": "text", + "sane_default": [ + "text", + "markdown", + "asciidoctor", + "MultiMarkdown", + "GFM", + "pandoc", + "Fountain", + "CommonWork", + "kramdown-rfc2629", + "rfc7328", + "Extra" + ], + "ui-priority": 0 + }, + "modification-date": { + "description": "Last update of the annotation", + "misp-attribute": "datetime", + "ui-priority": 0 }, "ref": { "description": "Reference(s) to the annotation", - "ui-priority": 0, "misp-attribute": "link", - "multiple": true + "multiple": true, + "ui-priority": 0 + }, + "text": { + "description": "Raw text of the annotation", + "misp-attribute": "text", + "ui-priority": 0 }, "type": { "description": "Type of the annotation", - "ui-priority": 0, - "misp-attribute": "text", "disable_correlation": true, + "misp-attribute": "text", "sane_default": [ "Annotation", "Executive Summary", @@ -32,47 +63,16 @@ "Authors", "Logo", "Full Report" - ] - }, - "format": { - "description": "Format of the annotation", - "ui-priority": 0, - "misp-attribute": "text", - "disable_correlation": true, - "sane_default": [ - "text", - "markdown", - "asciidoctor", - "MultiMarkdown", - "GFM", - "pandoc", - "Fountain", - "CommonWork", - "kramdown-rfc2629", - "rfc7328", - "Extra" - ] - }, - "creation-date": { - "description": "Initial creation of the annotation", - "ui-priority": 0, - "misp-attribute": "datetime" - }, - "modification-date": { - "description": "Last update of the annotation", - "ui-priority": 0, - "misp-attribute": "datetime" - }, - "attachment": { - "description": "An attachment to support the annotation", - "ui-priority": 0, - "misp-attribute": "attachment", - "multiple": true + ], + "ui-priority": 0 } }, - "version": 3, "description": "An annotation object allowing analysts to add annotations, comments, executive summary to a MISP event, objects or attributes.", "meta-category": "misc", + "name": "annotation", + "requiredOneOf": [ + "text" + ], "uuid": "5d8dc046-15a1-4ca3-a09f-ed4ede7c4487", - "name": "annotation" -} + "version": 3 +} \ No newline at end of file diff --git a/objects/anonymisation/definition.json b/objects/anonymisation/definition.json index d9da978..aa97427 100644 --- a/objects/anonymisation/definition.json +++ b/objects/anonymisation/definition.json @@ -1,62 +1,15 @@ { - "requiredOneOf": [ - "description", - "method", - "key", - "keyed-hash-function", - "encryption-function", - "regexp", - "iv" - ], "attributes": { - "method": { - "description": "Anonymisation (or pseudo-anonymisation) method(s) used", - "ui-priority": 1, + "description": { + "description": "Description of the anonymisation technique or tool used", "disable_correlation": true, - "sane_default": [ - "hiding - Attribute is replaced with a constant value (typically 0) of the same size. Sometimes called 'black marker'.", - "hash - A hash function maps each attribute to a new (not necessarily unique) attribute.", - "permutation - Maps each original value to a unique new value.", - "prefix-preserving - Any two values that had the same n-bit prefix before anonymisation will still have the same n-bit prefix as each other after anonymization. (Would be more accurately called 'prefix-relationship-preserving', because the actual prefix values are not preserved.) ", - "shift - Adds a fixed offset to each value/attribute.", - "enumeration - Map each original value to a new value such that their ordering is preserved.", - "partitioning - Possible values are partitioned into meaningful sets; actual values are replaced with a fixed value from the same set. E.g., TCP port numbers 0 to 1023 are replaced with 0, and 1024 to 65535 replaced with 65535.", - "updated - Checksums are recalculated to reflect changes made to other fields.", - "truncation - Field is shortened, losing data at the end.", - "encryption - Attribute is encrypted." - ], "misp-attribute": "text", - "multiple": true - }, - "key": { - "description": "Key (such as a PSK in a keyed-hash-function) used to anonymise the attribute", - "ui-priority": 1, - "disable_correlation": true, - "misp-attribute": "text" - }, - "iv": { - "description": "Initialisation vector for the encryption function used to anonymise the attribute", - "ui-priority": 1, - "disable_correlation": true, - "misp-attribute": "text" - }, - "keyed-hash-function": { - "description": "Keyed-hash function used to anonymise the attribute", - "ui-priority": 1, - "disable_correlation": true, - "sane_default": [ - "hmac-sha1", - "hmac-md5", - "hmac-sha256", - "hmac-sha384", - "hmac-sha512" - ], - "misp-attribute": "text" + "ui-priority": 1 }, "encryption-function": { "description": "Encryption function or algorithm used to anonymise the attribute", - "ui-priority": 1, "disable_correlation": true, + "misp-attribute": "text", "sane_default": [ "aes128", "aes-128-cbc", @@ -165,34 +118,81 @@ "sm4-ecb", "sm4-ofb" ], - "misp-attribute": "text" + "ui-priority": 1 }, - "regexp": { - "description": "Regular expression to perfom the anonymisation (reversible or not)", - "ui-priority": 10, + "iv": { + "description": "Initialisation vector for the encryption function used to anonymise the attribute", "disable_correlation": true, - "misp-attribute": "text" + "misp-attribute": "text", + "ui-priority": 1 }, - "description": { - "description": "Description of the anonymisation technique or tool used", - "ui-priority": 1, + "key": { + "description": "Key (such as a PSK in a keyed-hash-function) used to anonymise the attribute", "disable_correlation": true, - "misp-attribute": "text" + "misp-attribute": "text", + "ui-priority": 1 + }, + "keyed-hash-function": { + "description": "Keyed-hash function used to anonymise the attribute", + "disable_correlation": true, + "misp-attribute": "text", + "sane_default": [ + "hmac-sha1", + "hmac-md5", + "hmac-sha256", + "hmac-sha384", + "hmac-sha512" + ], + "ui-priority": 1 }, "level-of-knowledge": { "description": "Level of knowledge of the organisation who created this object", + "disable_correlation": true, + "misp-attribute": "text", "ui-priority": 10, "values_list": [ "Only the anonymised data is known", "Deanonymised data is known" - ], + ] + }, + "method": { + "description": "Anonymisation (or pseudo-anonymisation) method(s) used", "disable_correlation": true, - "misp-attribute": "text" + "misp-attribute": "text", + "multiple": true, + "sane_default": [ + "hiding - Attribute is replaced with a constant value (typically 0) of the same size. Sometimes called 'black marker'.", + "hash - A hash function maps each attribute to a new (not necessarily unique) attribute.", + "permutation - Maps each original value to a unique new value.", + "prefix-preserving - Any two values that had the same n-bit prefix before anonymisation will still have the same n-bit prefix as each other after anonymization. (Would be more accurately called 'prefix-relationship-preserving', because the actual prefix values are not preserved.) ", + "shift - Adds a fixed offset to each value/attribute.", + "enumeration - Map each original value to a new value such that their ordering is preserved.", + "partitioning - Possible values are partitioned into meaningful sets; actual values are replaced with a fixed value from the same set. E.g., TCP port numbers 0 to 1023 are replaced with 0, and 1024 to 65535 replaced with 65535.", + "updated - Checksums are recalculated to reflect changes made to other fields.", + "truncation - Field is shortened, losing data at the end.", + "encryption - Attribute is encrypted." + ], + "ui-priority": 1 + }, + "regexp": { + "description": "Regular expression to perfom the anonymisation (reversible or not)", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 10 } }, - "version": 2, "description": "Anonymisation object describing an anonymisation technique used to encode MISP attribute values. Reference: https://www.caida.org/tools/taxonomy/anonymization.xml", "meta-category": "misc", + "name": "anonymisation", + "requiredOneOf": [ + "description", + "method", + "key", + "keyed-hash-function", + "encryption-function", + "regexp", + "iv" + ], "uuid": "5867cffe-60ff-44f6-b097-e5f36b5de0ac", - "name": "anonymisation" -} + "version": 2 +} \ No newline at end of file diff --git a/objects/asn/definition.json b/objects/asn/definition.json index 9f8b1d6..9ca9c6a 100644 --- a/objects/asn/definition.json +++ b/objects/asn/definition.json @@ -1,69 +1,69 @@ { - "requiredOneOf": [ - "asn" - ], "attributes": { "asn": { "description": "Autonomous System Number", - "ui-priority": 1, - "misp-attribute": "AS" - }, - "description": { - "description": "Description of the autonomous system", - "ui-priority": 1, - "misp-attribute": "text" + "misp-attribute": "AS", + "ui-priority": 1 }, "country": { "description": "Country code of the main location of the autonomous system", - "ui-priority": 1, - "misp-attribute": "text" + "misp-attribute": "text", + "ui-priority": 1 }, - "subnet-announced": { - "description": "Subnet announced", - "ui-priority": 0, - "misp-attribute": "ip-src", - "multiple": true + "description": { + "description": "Description of the autonomous system", + "misp-attribute": "text", + "ui-priority": 1 + }, + "export": { + "description": "The outbound routing policy of the AS in RFC 2622 – Routing Policy Specification Language (RPSL) format", + "misp-attribute": "text", + "multiple": true, + "ui-priority": 0 }, "first-seen": { "description": "First time the ASN was seen", "disable_correlation": true, - "ui-priority": 0, - "misp-attribute": "datetime" + "misp-attribute": "datetime", + "ui-priority": 0 + }, + "import": { + "description": "The inbound IPv4 routing policy of the AS in RFC 2622 – Routing Policy Specification Language (RPSL) format", + "misp-attribute": "text", + "multiple": true, + "ui-priority": 0 }, "last-seen": { "description": "Last time the ASN was seen", "disable_correlation": true, - "ui-priority": 0, - "misp-attribute": "datetime" - }, - "import": { - "description": "The inbound IPv4 routing policy of the AS in RFC 2622 – Routing Policy Specification Language (RPSL) format", - "ui-priority": 0, - "misp-attribute": "text", - "multiple": true - }, - "export": { - "description": "The outbound routing policy of the AS in RFC 2622 – Routing Policy Specification Language (RPSL) format", - "ui-priority": 0, - "misp-attribute": "text", - "multiple": true - }, - "mp-import": { - "description": "The inbound IPv4 or IPv6 routing policy of the AS in RFC 4012 – Routing Policy Specification Language next generation (RPSLng), section 4.5. format", - "ui-priority": 0, - "misp-attribute": "text", - "multiple": true + "misp-attribute": "datetime", + "ui-priority": 0 }, "mp-export": { "description": "This attribute performs the same function as the export attribute above. The difference is that mp-export allows both IPv4 and IPv6 address families to be specified. The export is described in RFC 4012 – Routing Policy Specification Language next generation (RPSLng), section 4.5. format", - "ui-priority": 0, "misp-attribute": "text", - "multiple": true + "multiple": true, + "ui-priority": 0 + }, + "mp-import": { + "description": "The inbound IPv4 or IPv6 routing policy of the AS in RFC 4012 – Routing Policy Specification Language next generation (RPSLng), section 4.5. format", + "misp-attribute": "text", + "multiple": true, + "ui-priority": 0 + }, + "subnet-announced": { + "description": "Subnet announced", + "misp-attribute": "ip-src", + "multiple": true, + "ui-priority": 0 } }, - "version": 4, "description": "Autonomous system object describing an autonomous system which can include one or more network operators management an entity (e.g. ISP) along with their routing policy, routing prefixes or alike.", "meta-category": "network", + "name": "asn", + "requiredOneOf": [ + "asn" + ], "uuid": "4ec55cc6-9e49-4c64-b794-03c25c1a6587", - "name": "asn" -} + "version": 4 +} \ No newline at end of file diff --git a/objects/attack-pattern/definition.json b/objects/attack-pattern/definition.json index e3aa6a4..29255b5 100644 --- a/objects/attack-pattern/definition.json +++ b/objects/attack-pattern/definition.json @@ -1,51 +1,51 @@ { + "attributes": { + "id": { + "description": "CAPEC ID.", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 0 + }, + "name": { + "description": "Name of the attack pattern.", + "misp-attribute": "text", + "ui-priority": 0 + }, + "prerequisites": { + "description": "Prerequisites for the attack pattern to succeed.", + "misp-attribute": "text", + "ui-priority": 0 + }, + "references": { + "description": "External references", + "misp-attribute": "link", + "multiple": true, + "ui-priority": 0 + }, + "related-weakness": { + "description": "Weakness related to the attack pattern.", + "misp-attribute": "weakness", + "multiple": true, + "ui-priority": 0 + }, + "solutions": { + "description": "Solutions for the attack pattern to be countered.", + "misp-attribute": "text", + "ui-priority": 0 + }, + "summary": { + "description": "Summary description of the attack pattern.", + "misp-attribute": "text", + "ui-priority": 0 + } + }, + "description": "Attack pattern describing a common attack pattern enumeration and classification.", + "meta-category": "vulnerability", + "name": "attack-pattern", "requiredOneOf": [ "name", "id" ], - "attributes": { - "id": { - "description": "CAPEC ID.", - "ui-priority": 0, - "disable_correlation": true, - "misp-attribute": "text" - }, - "name": { - "description": "Name of the attack pattern.", - "ui-priority": 0, - "misp-attribute": "text" - }, - "summary": { - "description": "Summary description of the attack pattern.", - "ui-priority": 0, - "misp-attribute": "text" - }, - "prerequisites": { - "description": "Prerequisites for the attack pattern to succeed.", - "ui-priority": 0, - "misp-attribute": "text" - }, - "solutions": { - "description": "Solutions for the attack pattern to be countered.", - "ui-priority": 0, - "misp-attribute": "text" - }, - "related-weakness": { - "description": "Weakness related to the attack pattern.", - "ui-priority": 0, - "multiple": true, - "misp-attribute": "weakness" - }, - "references": { - "description": "External references", - "ui-priority": 0, - "multiple": true, - "misp-attribute": "link" - } - }, - "version": 1, - "description": "Attack pattern describing a common attack pattern enumeration and classification.", - "meta-category": "vulnerability", "uuid": "35928348-56be-4d7f-9752-a80927936351", - "name": "attack-pattern" -} + "version": 1 +} \ No newline at end of file diff --git a/objects/authenticode-signerinfo/definition.json b/objects/authenticode-signerinfo/definition.json index 7010ce9..64d6070 100644 --- a/objects/authenticode-signerinfo/definition.json +++ b/objects/authenticode-signerinfo/definition.json @@ -1,34 +1,19 @@ { - "requiredOneOf": [ - "url", - "program-name" - ], "attributes": { - "text": { - "description": "Free text description of the signer info", - "ui-priority": 1, - "misp-attribute": "text" + "content-type": { + "description": "Content type", + "misp-attribute": "text", + "ui-priority": 0 + }, + "digest_algorithm": { + "description": "Digest algorithm", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 0 }, "issuer": { "description": "Issuer of the certificate", - "ui-priority": 0, - "misp-attribute": "text", - "disable_correlation": true - }, - "version": { - "description": "Version of the certificate", - "ui-priority": 0, - "misp-attribute": "text", - "disable_correlation": true - }, - "url": { - "description": "Url", - "multiple": true, - "misp-attribute": "url", - "ui-priority": 0 - }, - "content-type": { - "description": "Content type", + "disable_correlation": true, "misp-attribute": "text", "ui-priority": 0 }, @@ -37,26 +22,41 @@ "misp-attribute": "text", "ui-priority": 0 }, - "digest_algorithm": { - "description": "Digest algorithm", - "misp-attribute": "text", - "ui-priority": 0, - "disable_correlation": true - }, "signature_algorithm": { "description": "Signature algorithm", - "misp-attribute": "text", - "ui-priority": 0, "disable_correlation": true, + "misp-attribute": "text", "sane_default": [ "SHA1_WITH_RSA_ENCRYPTION", "SHA256_WITH_RSA_ENCRYPTION" - ] + ], + "ui-priority": 0 + }, + "text": { + "description": "Free text description of the signer info", + "misp-attribute": "text", + "ui-priority": 1 + }, + "url": { + "description": "Url", + "misp-attribute": "url", + "multiple": true, + "ui-priority": 0 + }, + "version": { + "description": "Version of the certificate", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 0 } }, - "version": 1, "description": "Authenticode Signer Info", "meta-category": "file", + "name": "authenticode-signerinfo", + "requiredOneOf": [ + "url", + "program-name" + ], "uuid": "965cb0aa-baf1-4cc6-9070-68f5c1698c1e", - "name": "authenticode-signerinfo" -} + "version": 1 +} \ No newline at end of file diff --git a/objects/av-signature/definition.json b/objects/av-signature/definition.json index 345f887..b8609bb 100644 --- a/objects/av-signature/definition.json +++ b/objects/av-signature/definition.json @@ -1,48 +1,48 @@ { + "attributes": { + "datetime": { + "categories": [ + "Other" + ], + "description": "Datetime", + "disable_correlation": true, + "misp-attribute": "datetime", + "ui-priority": 0 + }, + "signature": { + "categories": [ + "Antivirus detection" + ], + "description": "Name of detection signature", + "misp-attribute": "text", + "ui-priority": 2 + }, + "software": { + "categories": [ + "Antivirus detection" + ], + "description": "Name of antivirus software", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 1 + }, + "text": { + "categories": [ + "Other" + ], + "description": "Free text value to attach to the file", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 0 + } + }, + "description": "Antivirus detection signature", + "meta-category": "misc", + "name": "av-signature", "required": [ "software", "signature" ], - "attributes": { - "software": { - "description": "Name of antivirus software", - "disable_correlation": true, - "categories": [ - "Antivirus detection" - ], - "ui-priority": 1, - "misp-attribute": "text" - }, - "signature": { - "description": "Name of detection signature", - "categories": [ - "Antivirus detection" - ], - "ui-priority": 2, - "misp-attribute": "text" - }, - "text": { - "description": "Free text value to attach to the file", - "disable_correlation": true, - "categories": [ - "Other" - ], - "ui-priority": 0, - "misp-attribute": "text" - }, - "datetime": { - "description": "Datetime", - "disable_correlation": true, - "categories": [ - "Other" - ], - "ui-priority": 0, - "misp-attribute": "datetime" - } - }, - "version": 1, - "description": "Antivirus detection signature", - "meta-category": "misc", "uuid": "4dbb56ef-4763-4c97-8696-a2bfc305cf8e", - "name": "av-signature" -} + "version": 1 +} \ No newline at end of file diff --git a/objects/bank-account/definition.json b/objects/bank-account/definition.json index 37d0527..fd19d8b 100644 --- a/objects/bank-account/definition.json +++ b/objects/bank-account/definition.json @@ -1,83 +1,110 @@ { - "requiredOneOf": [ - "account", - "iban" - ], "attributes": { - "text": { - "description": "A description of the bank account.", - "disable_correlation": true, - "ui-priority": 0, - "misp-attribute": "text" + "aba-rtn": { + "description": " ABA routing transit number", + "misp-attribute": "aba-rtn", + "ui-priority": 0 }, - "institution-name": { - "description": "Name of the bank or financial organisation.", - "disable_correlation": true, - "ui-priority": 0, - "misp-attribute": "text" + "account": { + "description": "Account number", + "misp-attribute": "bank-account-nr", + "ui-priority": 0 }, - "institution-code": { - "description": "Institution code of the bank.", - "disable_correlation": true, - "ui-priority": 0, - "misp-attribute": "text" + "account-name": { + "description": "A field to freely describe the bank account details.", + "misp-attribute": "text", + "ui-priority": 0 }, - "swift": { - "description": "SWIFT or BIC as defined in ISO 9362.", + "balance": { + "description": "The balance of the account after the suspicious transaction was processed.", "disable_correlation": true, - "ui-priority": 0, - "misp-attribute": "bic" + "misp-attribute": "text", + "ui-priority": 0 + }, + "beneficiary": { + "description": "Final beneficiary of the bank account.", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 0 + }, + "beneficiary-comment": { + "description": "Comment about the final beneficiary.", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 0 }, "branch": { "description": "Branch code or name", "disable_correlation": true, - "ui-priority": 0, - "misp-attribute": "text" + "misp-attribute": "text", + "ui-priority": 0 }, - "non-banking-institution": { - "description": "A flag to define if this account belong to a non-banking organisation. If set to true, it's a non-banking organisation.", + "client-number": { + "description": "Client number as seen by the bank.", + "misp-attribute": "text", + "ui-priority": 0 + }, + "closed": { + "description": "When the account was closed.", "disable_correlation": true, - "ui-priority": 0, - "misp-attribute": "boolean" + "misp-attribute": "datetime", + "ui-priority": 0 }, - "account": { - "description": "Account number", - "ui-priority": 0, - "misp-attribute": "bank-account-nr" + "comments": { + "description": "Comments about the bank account.", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 0 }, "currency-code": { "description": "Currency of the account.", - "ui-priority": 0, + "disable_correlation": true, + "misp-attribute": "text", "sane_default": [ "USD", "EUR" ], + "ui-priority": 0 + }, + "date-balance": { + "description": "When the balance was reported.", "disable_correlation": true, - "misp-attribute": "text" - }, - "aba-rtn": { - "description": " ABA routing transit number", - "ui-priority": 0, - "misp-attribute": "aba-rtn" - }, - "account-name": { - "description": "A field to freely describe the bank account details.", - "ui-priority": 0, - "misp-attribute": "text" + "misp-attribute": "datetime", + "ui-priority": 0 }, "iban": { "description": "IBAN of the bank account.", - "ui-priority": 0, - "misp-attribute": "iban" + "misp-attribute": "iban", + "ui-priority": 0 }, - "client-number": { - "description": "Client number as seen by the bank.", - "ui-priority": 0, - "misp-attribute": "text" + "institution-code": { + "description": "Institution code of the bank.", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 0 + }, + "institution-name": { + "description": "Name of the bank or financial organisation.", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 0 + }, + "non-banking-institution": { + "description": "A flag to define if this account belong to a non-banking organisation. If set to true, it's a non-banking organisation.", + "disable_correlation": true, + "misp-attribute": "boolean", + "ui-priority": 0 + }, + "opened": { + "description": "When the account was opened.", + "disable_correlation": true, + "misp-attribute": "datetime", + "ui-priority": 0 }, "personal-account-type": { "description": "Account type.", - "ui-priority": 0, + "disable_correlation": true, + "misp-attribute": "text", "sane_default": [ "A - Business", "B - Personal Current", @@ -86,67 +113,12 @@ "E - Trading Account", "O - Other" ], - "disable_correlation": true, - "misp-attribute": "text" - }, - "opened": { - "description": "When the account was opened.", - "ui-priority": 0, - "misp-attribute": "datetime", - "disable_correlation": true - }, - "closed": { - "description": "When the account was closed.", - "ui-priority": 0, - "misp-attribute": "datetime", - "disable_correlation": true - }, - "balance": { - "description": "The balance of the account after the suspicious transaction was processed.", - "ui-priority": 0, - "misp-attribute": "text", - "disable_correlation": true - }, - "date-balance": { - "description": "When the balance was reported.", - "ui-priority": 0, - "misp-attribute": "datetime", - "disable_correlation": true - }, - "status-code": { - "description": "Account status at the time of the transaction processed.", - "ui-priority": 0, - "misp-attribute": "text", - "disable_correlation": true, - "sane_default": [ - "A - Active", - "B - Inactive", - "C - Dormant" - ] - }, - "beneficiary": { - "description": "Final beneficiary of the bank account.", - "ui-priority": 0, - "misp-attribute": "text", - "disable_correlation": true - }, - "beneficiary-comment": { - "description": "Comment about the final beneficiary.", - "ui-priority": 0, - "misp-attribute": "text", - "disable_correlation": true - }, - "comments": { - "description": "Comments about the bank account.", - "ui-priority": 0, - "misp-attribute": "text", - "disable_correlation": true + "ui-priority": 0 }, "report-code": { "description": "Report code of the bank account.", - "ui-priority": 0, - "misp-attribute": "text", "disable_correlation": true, + "misp-attribute": "text", "sane_default": [ "CTR Cash Transaction Report", "STR Suspicious Transaction Report", @@ -160,12 +132,40 @@ "ORI Outgoing Request for Information – International", "IRD Incoming Request for Information – Domestic", "ORD Outgoing Request for Information – Domestic" - ] + ], + "ui-priority": 0 + }, + "status-code": { + "description": "Account status at the time of the transaction processed.", + "disable_correlation": true, + "misp-attribute": "text", + "sane_default": [ + "A - Active", + "B - Inactive", + "C - Dormant" + ], + "ui-priority": 0 + }, + "swift": { + "description": "SWIFT or BIC as defined in ISO 9362.", + "disable_correlation": true, + "misp-attribute": "bic", + "ui-priority": 0 + }, + "text": { + "description": "A description of the bank account.", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 0 } }, - "version": 2, "description": "An object describing bank account information based on account description from goAML 4.0.", "meta-category": "financial", + "name": "bank-account", + "requiredOneOf": [ + "account", + "iban" + ], "uuid": "b4712203-95a8-4883-80e9-b566f5df11c9", - "name": "bank-account" -} + "version": 2 +} \ No newline at end of file diff --git a/objects/bgp-hijack/definition.json b/objects/bgp-hijack/definition.json index 1955f9a..4253d08 100644 --- a/objects/bgp-hijack/definition.json +++ b/objects/bgp-hijack/definition.json @@ -1,53 +1,53 @@ { + "attributes": { + "country": { + "description": "Country code of the main location of the attacking autonomous system", + "misp-attribute": "text", + "ui-priority": 1 + }, + "description": { + "description": "BGP Hijack details", + "misp-attribute": "text", + "ui-priority": 1 + }, + "detected-asn": { + "description": "Detected Autonomous System Number", + "misp-attribute": "AS", + "ui-priority": 1 + }, + "end": { + "description": "Last time the Prefix hijack was seen", + "disable_correlation": true, + "misp-attribute": "datetime", + "ui-priority": 0 + }, + "expected-asn": { + "description": "Expected Autonomous System Number", + "misp-attribute": "AS", + "ui-priority": 1 + }, + "start": { + "description": "First time the Prefix hijack was seen", + "disable_correlation": true, + "misp-attribute": "datetime", + "ui-priority": 0 + }, + "subnet-announced": { + "description": "Subnet announced", + "misp-attribute": "ip-src", + "multiple": true, + "ui-priority": 0 + } + }, + "description": "Object encapsulating BGP Hijack description as specified, for example, by bgpstream.com", + "meta-category": "network", + "name": "bgp-hijack", "required": [ "expected-asn", "detected-asn", "start", "subnet-announced" ], - "attributes": { - "expected-asn": { - "description": "Expected Autonomous System Number", - "ui-priority": 1, - "misp-attribute": "AS" - }, - "detected-asn": { - "description": "Detected Autonomous System Number", - "ui-priority": 1, - "misp-attribute": "AS" - }, - "description": { - "description": "BGP Hijack details", - "ui-priority": 1, - "misp-attribute": "text" - }, - "country": { - "description": "Country code of the main location of the attacking autonomous system", - "ui-priority": 1, - "misp-attribute": "text" - }, - "subnet-announced": { - "description": "Subnet announced", - "ui-priority": 0, - "misp-attribute": "ip-src", - "multiple": true - }, - "start": { - "description": "First time the Prefix hijack was seen", - "disable_correlation": true, - "ui-priority": 0, - "misp-attribute": "datetime" - }, - "end": { - "description": "Last time the Prefix hijack was seen", - "disable_correlation": true, - "ui-priority": 0, - "misp-attribute": "datetime" - } - }, - "version": 1, - "description": "Object encapsulating BGP Hijack description as specified, for example, by bgpstream.com", - "meta-category": "network", "uuid": "42355673-1fab-4908-8045-00bebd91c389", - "name": "bgp-hijack" -} + "version": 1 +} \ No newline at end of file diff --git a/objects/blog/definition.json b/objects/blog/definition.json index 7528174..9a1873c 100644 --- a/objects/blog/definition.json +++ b/objects/blog/definition.json @@ -1,42 +1,57 @@ { - "requiredOneOf": [ - "post", - "archive", - "url", - "link" - ], "attributes": { - "post": { - "description": "Raw post.", - "ui-priority": 1, - "misp-attribute": "text" + "archive": { + "description": "Archive of the original document (Internet Archive, Archive.is, etc).", + "misp-attribute": "link", + "multiple": true, + "ui-priority": 1 }, - "title": { - "description": "Title of blog post.", - "ui-priority": 1, - "misp-attribute": "text" + "creation-date": { + "description": "Initial creation of the blog post.", + "misp-attribute": "datetime", + "ui-priority": 0 }, - "url": { - "description": "Original URL location of the blog post (potentially malicious).", - "ui-priority": 1, - "misp-attribute": "url" + "embedded-link": { + "description": "Site linked by the blog post.", + "misp-attribute": "url", + "multiple": true, + "ui-priority": 0 + }, + "embedded-safe-link": { + "description": "Safe site linked by the blog post.", + "misp-attribute": "link", + "multiple": true, + "ui-priority": 0 }, "link": { "description": "Original link into the blog post (Supposed harmless).", - "ui-priority": 1, - "misp-attribute": "link" + "misp-attribute": "link", + "ui-priority": 1 }, - "archive": { - "description": "Archive of the original document (Internet Archive, Archive.is, etc).", - "ui-priority": 1, - "multiple": true, - "misp-attribute": "link" + "modification-date": { + "description": "Last update of the blog post.", + "misp-attribute": "datetime", + "ui-priority": 0 + }, + "post": { + "description": "Raw post.", + "misp-attribute": "text", + "ui-priority": 1 + }, + "removal-date": { + "description": "When the blog post was removed.", + "misp-attribute": "datetime", + "ui-priority": 0 + }, + "title": { + "description": "Title of blog post.", + "misp-attribute": "text", + "ui-priority": 1 }, "type": { "description": "Type of blog post.", - "ui-priority": 1, - "misp-attribute": "text", "disable_correlation": true, + "misp-attribute": "text", "sane_default": [ "Medium", "WordPress", @@ -45,61 +60,46 @@ "LiveJournal", "Forum", "Other" - ] + ], + "ui-priority": 1 + }, + "url": { + "description": "Original URL location of the blog post (potentially malicious).", + "misp-attribute": "url", + "ui-priority": 1 }, "username": { "description": "Username who posted the blog post.", - "ui-priority": 0, - "misp-attribute": "text" + "misp-attribute": "text", + "ui-priority": 0 + }, + "username-quoted": { + "description": "Username who are quoted into the blog post.", + "misp-attribute": "text", + "multiple": true, + "ui-priority": 0 }, "verified-username": { "description": "Is the username account verified by the operator of the blog platform.", - "ui-priority": 0, - "misp-attribute": "text", "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 0, "values_list": [ "Verified", "Unverified", "Unknown" ] - }, - "creation-date": { - "description": "Initial creation of the blog post.", - "ui-priority": 0, - "misp-attribute": "datetime" - }, - "modification-date": { - "description": "Last update of the blog post.", - "ui-priority": 0, - "misp-attribute": "datetime" - }, - "embedded-link": { - "description": "Site linked by the blog post.", - "ui-priority": 0, - "misp-attribute": "url", - "multiple": true - }, - "embedded-safe-link": { - "description": "Safe site linked by the blog post.", - "ui-priority": 0, - "misp-attribute": "link", - "multiple": true - }, - "removal-date": { - "description": "When the blog post was removed.", - "ui-priority": 0, - "misp-attribute": "datetime" - }, - "username-quoted": { - "description": "Username who are quoted into the blog post.", - "ui-priority": 0, - "multiple": true, - "misp-attribute": "text" } }, - "version": 14, "description": "Blog post like Medium or WordPress.", "meta-category": "misc", + "name": "blog", + "requiredOneOf": [ + "post", + "archive", + "url", + "link" + ], "uuid": "1f165fc0-b158-498f-8bc8-6dc3d2822bb1", - "name": "blog" -} + "version": 14 +} \ No newline at end of file diff --git a/objects/btc-transaction/definition.json b/objects/btc-transaction/definition.json index 109b70b..0b5dcd5 100644 --- a/objects/btc-transaction/definition.json +++ b/objects/btc-transaction/definition.json @@ -1,51 +1,51 @@ { + "attributes": { + "btc-address": { + "description": "A Bitcoin transactional address", + "disable_correlation": true, + "misp-attribute": "btc", + "ui-priority": 0 + }, + "time": { + "description": "Date and time of transaction", + "disable_correlation": true, + "misp-attribute": "datetime", + "ui-priority": 0 + }, + "transaction-number": { + "description": "A Bitcoin transaction number in a sequence of transactions", + "disable_correlation": true, + "misp-attribute": "text", + "multiple": true, + "ui-priority": 0 + }, + "value_BTC": { + "description": "Value in BTC at date/time displayed in field 'time'", + "disable_correlation": true, + "misp-attribute": "float", + "ui-priority": 0 + }, + "value_EUR": { + "description": "Value in EUR with conversion rate as of date/time displayed in field 'time'", + "disable_correlation": true, + "misp-attribute": "float", + "ui-priority": 0 + }, + "value_USD": { + "description": "Value in USD with conversion rate as of date/time displayed in field 'time'", + "disable_correlation": true, + "misp-attribute": "float", + "ui-priority": 0 + } + }, + "description": "An object to describe a Bitcoin transaction. Best to be used with bitcoin-wallet.", + "meta-category": "financial", + "name": "btc-transaction", "requiredOneOf": [ "transaction-number", "time", "value_BTC" ], - "attributes": { - "transaction-number": { - "description": "A Bitcoin transaction number in a sequence of transactions", - "ui-priority": 0, - "disable_correlation": true, - "multiple": true, - "misp-attribute": "text" - }, - "time": { - "description": "Date and time of transaction", - "ui-priority": 0, - "disable_correlation": true, - "misp-attribute": "datetime" - }, - "value_BTC": { - "description": "Value in BTC at date/time displayed in field 'time'", - "ui-priority": 0, - "disable_correlation": true, - "misp-attribute": "float" - }, - "value_EUR": { - "description": "Value in EUR with conversion rate as of date/time displayed in field 'time'", - "ui-priority": 0, - "disable_correlation": true, - "misp-attribute": "float" - }, - "value_USD": { - "description": "Value in USD with conversion rate as of date/time displayed in field 'time'", - "ui-priority": 0, - "disable_correlation": true, - "misp-attribute": "float" - }, - "btc-address": { - "description": "A Bitcoin transactional address", - "ui-priority": 0, - "disable_correlation": true, - "misp-attribute": "btc" - } - }, - "version": 4, - "description": "An object to describe a Bitcoin transaction. Best to be used with bitcoin-wallet.", - "meta-category": "financial", "uuid": "B7341729-5A8A-439F-A775-6D814DA3C7B5", - "name": "btc-transaction" -} + "version": 4 +} \ No newline at end of file diff --git a/objects/btc-wallet/definition.json b/objects/btc-wallet/definition.json index e73bdef..a1db69b 100644 --- a/objects/btc-wallet/definition.json +++ b/objects/btc-wallet/definition.json @@ -1,41 +1,41 @@ { - "requiredOneOf": [ - "wallet-address" - ], "attributes": { - "wallet-address": { - "description": "A Bitcoin wallet address", - "ui-priority": 0, - "misp-attribute": "btc" - }, - "balance_BTC": { - "description": "Value in BTC at date/time displayed in field 'time'", - "ui-priority": 0, - "disable_correlation": true, - "misp-attribute": "float" - }, "BTC_received": { "description": "Value of received BTC", - "ui-priority": 0, "disable_correlation": true, - "misp-attribute": "float" + "misp-attribute": "float", + "ui-priority": 0 }, "BTC_sent": { "description": "Value of sent BTC", - "ui-priority": 0, "disable_correlation": true, - "misp-attribute": "float" + "misp-attribute": "float", + "ui-priority": 0 + }, + "balance_BTC": { + "description": "Value in BTC at date/time displayed in field 'time'", + "disable_correlation": true, + "misp-attribute": "float", + "ui-priority": 0 }, "time": { "description": "Date and time of lookup/conversion", - "ui-priority": 0, "disable_correlation": true, - "misp-attribute": "datetime" + "misp-attribute": "datetime", + "ui-priority": 0 + }, + "wallet-address": { + "description": "A Bitcoin wallet address", + "misp-attribute": "btc", + "ui-priority": 0 } }, - "version": 2, "description": "An object to describe a Bitcoin wallet. Best to be used with bitcoin-transactions.", "meta-category": "financial", + "name": "btc-wallet", + "requiredOneOf": [ + "wallet-address" + ], "uuid": "22910C83-DD0E-4ED2-9823-45F8CAD562A4", - "name": "btc-wallet" -} + "version": 2 +} \ No newline at end of file diff --git a/objects/cap-alert/definition.json b/objects/cap-alert/definition.json index c9fe3ac..b60328c 100644 --- a/objects/cap-alert/definition.json +++ b/objects/cap-alert/definition.json @@ -1,41 +1,31 @@ { - "requiredOneOf": [ - "msgType" - ], "attributes": { + "addresses": { + "description": "The group listing of intended recipients of the alert message. (1) Required when is “Private”, optional when is “Public” or “Restricted”. (2) Each recipient SHALL be identified by an identifier or an address. (3) Multiple space-delimited addresses MAY be included. Addresses including whitespace MUST be enclosed in double-quotes. ", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 0 + }, + "code": { + "description": "The code denoting the special handling of the alert message.", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 0 + }, "identifier": { "description": "The identifier of the alert message in a number or string uniquely identifying this message, assigned by the sender.", "disable_correlation": true, - "ui-priority": 1, - "misp-attribute": "text" - }, - "sender": { - "description": "The identifier of the sender of the alert message which identifies the originator of this alert. Guaranteed by assigner to be unique globally; e.g., may be based on an Internet domain name.", - "disable_correlation": true, - "ui-priority": 0, - "misp-attribute": "text" - }, - "sent": { - "description": "The time and date of the origination of the alert message.", - "disable_correlation": true, - "ui-priority": 0, - "misp-attribute": "datetime" - }, - "status": { - "description": "The code denoting the appropriate handling of the alert message.", - "ui-priority": 0, "misp-attribute": "text", - "sane_default": [ - "Actual", - "Exercise", - "System", - "Test", - "Draft" - ] + "ui-priority": 1 + }, + "incident": { + "description": "The group listing naming the referent incident(s) of the alert message. (1) Used to collate multiple messages referring to different aspects of the same incident. (2) If multiple incident identifiers are referenced, they SHALL be separated by whitespace. Incident names including whitespace SHALL be surrounded by double-quotes.", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 0 }, "msgType": { "description": "The code denoting the nature of the alert message.", - "ui-priority": 0, "disable_correlation": true, "misp-attribute": "text", "sane_default": [ @@ -44,65 +34,75 @@ "Cancel", "Ack", "Error" - ] + ], + "ui-priority": 0 }, - "source": { - "description": "The text identifying the source of the alert message. The particular source of this alert; e.g., an operator or a specific device.", - "ui-priority": 0, + "note": { + "description": "The text describing the purpose or significance of the alert message.", "disable_correlation": true, - "misp-attribute": "text" + "misp-attribute": "text", + "ui-priority": 0 + }, + "references": { + "description": "The group listing identifying earlier message(s) referenced by the alert message. (1) The extended message identifier(s) (in the form sender,identifier,sent) of an earlier CAP message or messages referenced by this one. (2) If multiple messages are referenced, they SHALL be separated by whitespace.", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 0 + }, + "restriction": { + "description": "The text describing the rule for limiting distribution of the restricted alert message.", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 0 }, "scope": { "description": "The code denoting the intended distribution of the alert message. ", - "ui-priority": 0, - "misp-attribute": "text", "disable_correlation": true, + "misp-attribute": "text", "sane_default": [ "Public", "Restricted", "Private" - ] + ], + "ui-priority": 0 }, - "restriction": { - "description": "The text describing the rule for limiting distribution of the restricted alert message.", - "ui-priority": 0, + "sender": { + "description": "The identifier of the sender of the alert message which identifies the originator of this alert. Guaranteed by assigner to be unique globally; e.g., may be based on an Internet domain name.", + "disable_correlation": true, "misp-attribute": "text", - "disable_correlation": true + "ui-priority": 0 }, - "addresses": { - "description": "The group listing of intended recipients of the alert message. (1) Required when is “Private”, optional when is “Public” or “Restricted”. (2) Each recipient SHALL be identified by an identifier or an address. (3) Multiple space-delimited addresses MAY be included. Addresses including whitespace MUST be enclosed in double-quotes. ", - "ui-priority": 0, - "misp-attribute": "text", - "disable_correlation": true + "sent": { + "description": "The time and date of the origination of the alert message.", + "disable_correlation": true, + "misp-attribute": "datetime", + "ui-priority": 0 }, - "code": { - "description": "The code denoting the special handling of the alert message.", - "ui-priority": 0, + "source": { + "description": "The text identifying the source of the alert message. The particular source of this alert; e.g., an operator or a specific device.", + "disable_correlation": true, "misp-attribute": "text", - "disable_correlation": true + "ui-priority": 0 }, - "note": { - "description": "The text describing the purpose or significance of the alert message.", - "ui-priority": 0, + "status": { + "description": "The code denoting the appropriate handling of the alert message.", "misp-attribute": "text", - "disable_correlation": true - }, - "references": { - "description": "The group listing identifying earlier message(s) referenced by the alert message. (1) The extended message identifier(s) (in the form sender,identifier,sent) of an earlier CAP message or messages referenced by this one. (2) If multiple messages are referenced, they SHALL be separated by whitespace.", - "ui-priority": 0, - "misp-attribute": "text", - "disable_correlation": true - }, - "incident": { - "description": "The group listing naming the referent incident(s) of the alert message. (1) Used to collate multiple messages referring to different aspects of the same incident. (2) If multiple incident identifiers are referenced, they SHALL be separated by whitespace. Incident names including whitespace SHALL be surrounded by double-quotes.", - "ui-priority": 0, - "misp-attribute": "text", - "disable_correlation": true + "sane_default": [ + "Actual", + "Exercise", + "System", + "Test", + "Draft" + ], + "ui-priority": 0 } }, - "version": 1, "description": "Common Alerting Protocol Version (CAP) alert object", "meta-category": "misc", + "name": "cap-alert", + "requiredOneOf": [ + "msgType" + ], "uuid": "03b107bb-133d-4180-87ff-e3dbe731f828", - "name": "cap-alert" -} + "version": 1 +} \ No newline at end of file diff --git a/objects/cap-info/definition.json b/objects/cap-info/definition.json index 9645f13..6161884 100644 --- a/objects/cap-info/definition.json +++ b/objects/cap-info/definition.json @@ -1,17 +1,14 @@ { - "requiredOneOf": [ - "category" - ], "attributes": { - "language": { - "description": "The code denoting the language of the info sub-element of the alert message. ", - "ui-priority": 0, + "audience": { + "description": "The text describing the intended audience of the alert message.", "disable_correlation": true, - "misp-attribute": "text" + "misp-attribute": "text", + "ui-priority": 0 }, "category": { "description": "The code denoting the category of the subject event of the alert message.", - "ui-priority": 0, + "disable_correlation": true, "misp-attribute": "text", "sane_default": [ "Geo", @@ -27,17 +24,88 @@ "CBRNE", "Other" ], - "disable_correlation": true + "ui-priority": 0 + }, + "certainty": { + "description": "The code denoting the certainty of the subject event of the alert message. For backward compatibility with CAP 1.0, the deprecated value of “Very Likely” SHOULD be treated as equivalent to “Likely”.", + "disable_correlation": true, + "misp-attribute": "text", + "sane_default": [ + "Likely", + "Possible", + "Unlikely", + "Unknown" + ], + "ui-priority": 0 + }, + "contact": { + "description": "The text describing the contact for follow-up and confirmation of the alert message.", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 0 + }, + "description": { + "description": "The text describing the subject event of the alert message.", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 0 + }, + "effective": { + "description": "The effective time of the information of the alert message.", + "disable_correlation": true, + "misp-attribute": "datetime", + "ui-priority": 0 }, "event": { "description": "The text denoting the type of the subject event of the alert message.", - "ui-priority": 0, "disable_correlation": true, - "misp-attribute": "text" + "misp-attribute": "text", + "ui-priority": 0 + }, + "eventCode": { + "description": "A system-specific code identifying the event type of the alert message.", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 0 + }, + "expires": { + "description": "The expiry time of the information of the alert message.", + "disable_correlation": true, + "misp-attribute": "datetime", + "ui-priority": 0 + }, + "headline": { + "description": "The text headline of the alert message.", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 0 + }, + "instruction": { + "description": "The text describing the recommended action to be taken by recipients of the alert message.", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 0 + }, + "language": { + "description": "The code denoting the language of the info sub-element of the alert message. ", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 0 + }, + "onset": { + "description": "The expected time of the beginning of the subject event of the alert message.", + "disable_correlation": true, + "misp-attribute": "datetime", + "ui-priority": 0 + }, + "parameter": { + "description": "A system-specific additional parameter associated with the alert message.", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 0 }, "responseType": { "description": "The code denoting the type of action recommended for the target audience.", - "ui-priority": 0, "disable_correlation": true, "misp-attribute": "text", "sane_default": [ @@ -50,24 +118,17 @@ "Assess", "AllClear", "None" - ] + ], + "ui-priority": 0 }, - "urgency": { - "description": "The code denoting the urgency of the subject event of the alert message.", - "ui-priority": 0, + "senderName": { + "description": "The text naming the originator of the alert message.", "disable_correlation": true, "misp-attribute": "text", - "sane_default": [ - "Immediate", - "Expected", - "Future", - "Past", - "Unknown" - ] + "ui-priority": 0 }, "severity": { "description": "The code denoting the severity of the subject event of the alert message.", - "ui-priority": 0, "disable_correlation": true, "misp-attribute": "text", "sane_default": [ @@ -76,96 +137,35 @@ "Moderate", "Minor", "Unknown" - ] + ], + "ui-priority": 0 }, - "certainty": { - "description": "The code denoting the certainty of the subject event of the alert message. For backward compatibility with CAP 1.0, the deprecated value of “Very Likely” SHOULD be treated as equivalent to “Likely”.", - "ui-priority": 0, + "urgency": { + "description": "The code denoting the urgency of the subject event of the alert message.", "disable_correlation": true, "misp-attribute": "text", "sane_default": [ - "Likely", - "Possible", - "Unlikely", + "Immediate", + "Expected", + "Future", + "Past", "Unknown" - ] - }, - "audience": { - "description": "The text describing the intended audience of the alert message.", - "ui-priority": 0, - "disable_correlation": true, - "misp-attribute": "text" - }, - "eventCode": { - "description": "A system-specific code identifying the event type of the alert message.", - "ui-priority": 0, - "disable_correlation": true, - "misp-attribute": "text" - }, - "effective": { - "description": "The effective time of the information of the alert message.", - "ui-priority": 0, - "disable_correlation": true, - "misp-attribute": "datetime" - }, - "onset": { - "description": "The expected time of the beginning of the subject event of the alert message.", - "ui-priority": 0, - "disable_correlation": true, - "misp-attribute": "datetime" - }, - "expires": { - "description": "The expiry time of the information of the alert message.", - "ui-priority": 0, - "disable_correlation": true, - "misp-attribute": "datetime" - }, - "senderName": { - "description": "The text naming the originator of the alert message.", - "ui-priority": 0, - "disable_correlation": true, - "misp-attribute": "text" - }, - "headline": { - "description": "The text headline of the alert message.", - "ui-priority": 0, - "disable_correlation": true, - "misp-attribute": "text" - }, - "description": { - "description": "The text describing the subject event of the alert message.", - "ui-priority": 0, - "disable_correlation": true, - "misp-attribute": "text" - }, - "instruction": { - "description": "The text describing the recommended action to be taken by recipients of the alert message.", - "ui-priority": 0, - "disable_correlation": true, - "misp-attribute": "text" + ], + "ui-priority": 0 }, "web": { "description": "The identifier of the hyperlink associating additional information with the alert message.", - "ui-priority": 0, "disable_correlation": true, - "misp-attribute": "link" - }, - "contact": { - "description": "The text describing the contact for follow-up and confirmation of the alert message.", - "ui-priority": 0, - "disable_correlation": true, - "misp-attribute": "text" - }, - "parameter": { - "description": "A system-specific additional parameter associated with the alert message.", - "ui-priority": 0, - "disable_correlation": true, - "misp-attribute": "text" + "misp-attribute": "link", + "ui-priority": 0 } }, - "version": 1, "description": "Common Alerting Protocol Version (CAP) info object", "meta-category": "misc", + "name": "cap-info", + "requiredOneOf": [ + "category" + ], "uuid": "826c25e6-fdd5-4e4a-b081-be5ba3ac2c3d", - "name": "cap-info" -} + "version": 1 +} \ No newline at end of file diff --git a/objects/cap-resource/definition.json b/objects/cap-resource/definition.json index 92502a2..753ef30 100644 --- a/objects/cap-resource/definition.json +++ b/objects/cap-resource/definition.json @@ -1,46 +1,46 @@ { - "requiredOneOf": [ - "resourceDesc" - ], "attributes": { - "resourceDesc": { - "description": "The text describing the type and content of the resource file.", - "ui-priority": 0, - "disable_correlation": true, - "misp-attribute": "text" - }, - "mimeType": { - "description": "The identifier of the MIME content type and sub-type describing the resource file.", - "ui-priority": 0, - "disable_correlation": true, - "misp-attribute": "mime-type" - }, - "size": { - "description": "The integer indicating the size of the resource file.", - "ui-priority": 0, - "disable_correlation": true, - "misp-attribute": "text" - }, - "uri": { - "description": "The identifier of the hyperlink for the resource file.", - "ui-priority": 0, - "misp-attribute": "link" - }, "derefUri": { "description": "The base-64 encoded data content of the resource file.", - "ui-priority": 0, + "disable_correlation": true, "misp-attribute": "attachment", - "disable_correlation": true + "ui-priority": 0 }, "digest": { "description": "The code representing the digital digest (“hash”) computed from the resource file (OPTIONAL).", - "ui-priority": 0, - "misp-attribute": "sha1" + "misp-attribute": "sha1", + "ui-priority": 0 + }, + "mimeType": { + "description": "The identifier of the MIME content type and sub-type describing the resource file.", + "disable_correlation": true, + "misp-attribute": "mime-type", + "ui-priority": 0 + }, + "resourceDesc": { + "description": "The text describing the type and content of the resource file.", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 0 + }, + "size": { + "description": "The integer indicating the size of the resource file.", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 0 + }, + "uri": { + "description": "The identifier of the hyperlink for the resource file.", + "misp-attribute": "link", + "ui-priority": 0 } }, - "version": 1, "description": "Common Alerting Protocol Version (CAP) resource object", "meta-category": "misc", + "name": "cap-resource", + "requiredOneOf": [ + "resourceDesc" + ], "uuid": "6fddc76b-59fc-49f6-a673-52f8d15149c4", - "name": "cap-resource" -} + "version": 1 +} \ No newline at end of file diff --git a/objects/coin-address/definition.json b/objects/coin-address/definition.json index 659b59d..d40dcdf 100644 --- a/objects/coin-address/definition.json +++ b/objects/coin-address/definition.json @@ -1,24 +1,44 @@ { - "requiredOneOf": [ - "address", - "address-xmr" - ], "attributes": { "address": { "description": "Bitcoin address used as a payment destination in a cryptocurrency", - "ui-priority": 1, - "misp-attribute": "btc" + "misp-attribute": "btc", + "ui-priority": 1 }, "address-xmr": { "description": "Monero address used as a payment destination in a cryptocurrency", - "ui-priority": 1, - "misp-attribute": "xmr" + "misp-attribute": "xmr", + "ui-priority": 1 + }, + "current-balance": { + "description": "Current balance of address", + "disable_correlation": true, + "misp-attribute": "float", + "recommended": false, + "ui-priority": 1 + }, + "first-seen": { + "description": "First time this payment destination address has been seen", + "disable_correlation": true, + "misp-attribute": "datetime", + "ui-priority": 0 + }, + "last-seen": { + "description": "Last time this payment destination address has been seen", + "disable_correlation": true, + "misp-attribute": "datetime", + "ui-priority": 0 + }, + "last-updated": { + "description": "Last time the balances and totals have been updated", + "disable_correlation": true, + "misp-attribute": "datetime", + "ui-priority": 0 }, "symbol": { "description": "The (uppercase) symbol of the cryptocurrency used. Symbol should be from https://coinmarketcap.com/all/views/all/", - "misp-attribute": "text", "disable_correlation": true, - "ui-priority": 1, + "misp-attribute": "text", "sane_default": [ "BTC", "ETH", @@ -46,65 +66,45 @@ "WAVES", "PPT", "ETN" - ] - }, - "last-seen": { - "description": "Last time this payment destination address has been seen", - "disable_correlation": true, - "ui-priority": 0, - "misp-attribute": "datetime" - }, - "first-seen": { - "description": "First time this payment destination address has been seen", - "disable_correlation": true, - "ui-priority": 0, - "misp-attribute": "datetime" - }, - "last-updated": { - "description": "Last time the balances and totals have been updated", - "disable_correlation": true, - "ui-priority": 0, - "misp-attribute": "datetime" - }, - "current-balance": { - "description": "Current balance of address", - "disable_correlation": true, - "ui-priority": 1, - "misp-attribute": "float", - "recommended": false - }, - "total-transactions": { - "description": "Total transactions performed", - "disable_correlation": true, - "ui-priority": 1, - "misp-attribute": "text", - "recommended": false - }, - "total-received": { - "description": "Total balance received", - "disable_correlation": true, - "ui-priority": 1, - "misp-attribute": "float", - "recommended": false - }, - "total-sent": { - "description": "Total balance sent", - "disable_correlation": true, - "ui-priority": 1, - "misp-attribute": "float", - "recommended": false + ], + "ui-priority": 1 }, "text": { "description": "Free text value", "disable_correlation": true, - "ui-priority": 1, "misp-attribute": "text", - "recommended": false + "recommended": false, + "ui-priority": 1 + }, + "total-received": { + "description": "Total balance received", + "disable_correlation": true, + "misp-attribute": "float", + "recommended": false, + "ui-priority": 1 + }, + "total-sent": { + "description": "Total balance sent", + "disable_correlation": true, + "misp-attribute": "float", + "recommended": false, + "ui-priority": 1 + }, + "total-transactions": { + "description": "Total transactions performed", + "disable_correlation": true, + "misp-attribute": "text", + "recommended": false, + "ui-priority": 1 } }, - "version": 5, "description": "An address used in a cryptocurrency", "meta-category": "financial", + "name": "coin-address", + "requiredOneOf": [ + "address", + "address-xmr" + ], "uuid": "d0e6997e-78da-4815-a6a1-cfc1c1cb8a46", - "name": "coin-address" -} + "version": 5 +} \ No newline at end of file diff --git a/objects/command-line/definition.json b/objects/command-line/definition.json index f48dcbd..f80dd52 100644 --- a/objects/command-line/definition.json +++ b/objects/command-line/definition.json @@ -1,20 +1,20 @@ { "attributes": { - "value": { - "description": "command code", - "ui-priority": 1, - "misp-attribute": "text", - "multiple": true - }, "description": { "description": "description of the command", - "ui-priority": 1, - "misp-attribute": "text" + "misp-attribute": "text", + "ui-priority": 1 + }, + "value": { + "description": "command code", + "misp-attribute": "text", + "multiple": true, + "ui-priority": 1 } }, - "version": 1, "description": "Command line and options related to a specific command executed by a program, whether it is malicious or not.", "meta-category": "misc", + "name": "command-line", "uuid": "88ebe222-d3cc-11e9-875d-7f13f460adaf", - "name": "command-line" -} + "version": 1 +} \ No newline at end of file diff --git a/objects/command/definition.json b/objects/command/definition.json index 651d7d8..4cd2f72 100644 --- a/objects/command/definition.json +++ b/objects/command/definition.json @@ -1,37 +1,37 @@ { "attributes": { + "description": { + "description": "Description of the command functionalities", + "misp-attribute": "text", + "ui-priority": 1 + }, "location": { "description": "Location of the command functionality", - "ui-priority": 1, - "misp-attribute": "text", "disable_correlation": true, + "misp-attribute": "text", "sane_default": [ "Bundled", "Module", "Libraries", "Unknown" - ] + ], + "ui-priority": 1 }, "trigger": { "description": "How the commands are triggered", - "ui-priority": 1, - "misp-attribute": "text", "disable_correlation": true, + "misp-attribute": "text", "sane_default": [ "Local", "Network", "Unknown" - ] - }, - "description": { - "description": "Description of the command functionalities", - "ui-priority": 1, - "misp-attribute": "text" + ], + "ui-priority": 1 } }, - "version": 1, "description": "Command functionalities related to specific commands executed by a program, whether it is malicious or not. Command-line are attached to this object for the related commands.", "meta-category": "misc", + "name": "command", "uuid": "21ad70d8-d397-11e9-9ea7-43b2d5f6a6e3", - "name": "command" -} + "version": 1 +} \ No newline at end of file diff --git a/objects/cookie/definition.json b/objects/cookie/definition.json index 450e605..4250054 100644 --- a/objects/cookie/definition.json +++ b/objects/cookie/definition.json @@ -1,54 +1,53 @@ { - "required": [ - "cookie" - ], "attributes": { "cookie": { "description": "Full cookie", - "ui-priority": 1, - "misp-attribute": "cookie" + "misp-attribute": "cookie", + "ui-priority": 1 }, "cookie-name": { "description": "Name of the cookie (if splitted)", - "ui-priority": 0, - "misp-attribute": "text" + "misp-attribute": "text", + "ui-priority": 0 }, "cookie-value": { "description": "Value of the cookie (if splitted)", - "ui-priority": 0, - "misp-attribute": "text" - }, - "path": { - "description": "Path defined in the cookie", - "ui-priority": 0, - "disable_correlation": true, - "misp-attribute": "text" + "misp-attribute": "text", + "ui-priority": 0 }, "expires": { "description": "Expiration date/time of the cookie", - "ui-priority": 0, "disable_correlation": true, - "misp-attribute": "datetime" + "misp-attribute": "datetime", + "ui-priority": 0 }, "http-only": { "description": "True if send only through HTTP", - "ui-priority": 0, "disable_correlation": true, - "misp-attribute": "boolean" + "misp-attribute": "boolean", + "ui-priority": 0 + }, + "path": { + "description": "Path defined in the cookie", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 0 }, "secure": { "description": "True if cookie is sent over TLS", - "ui-priority": 0, "disable_correlation": true, - "misp-attribute": "boolean" + "misp-attribute": "boolean", + "ui-priority": 0 }, "text": { "description": "A description of the cookie.", "disable_correlation": true, - "ui-priority": 0, - "misp-attribute": "text" + "misp-attribute": "text", + "ui-priority": 0 }, "type": { + "description": "Type of cookie and how it's used in this specific object.", + "misp-attribute": "text", "sane_default": [ "Session management", "Personalization", @@ -57,14 +56,15 @@ "Malicious Payload", "Beaconing" ], - "description": "Type of cookie and how it's used in this specific object.", - "ui-priority": 0, - "misp-attribute": "text" + "ui-priority": 0 } }, - "version": 3, "description": "An HTTP cookie (web cookie, browser cookie) is a small piece of data that a server sends to the user's web browser. The browser may store it and send it back with the next request to the same server. Typically, it's used to tell if two requests came from the same browser — keeping a user logged-in, for example. It remembers stateful information for the stateless HTTP protocol. (as defined by the Mozilla foundation.", "meta-category": "network", + "name": "cookie", + "required": [ + "cookie" + ], "uuid": "7755ad19-55c7-4da4-805e-197cf81bbcb8", - "name": "cookie" -} + "version": 3 +} \ No newline at end of file diff --git a/objects/cortex-taxonomy/definition.json b/objects/cortex-taxonomy/definition.json index edb3580..5b33a70 100644 --- a/objects/cortex-taxonomy/definition.json +++ b/objects/cortex-taxonomy/definition.json @@ -1,40 +1,10 @@ { - "required": [ - "level", - "predicate", - "value", - "namespace" - ], "attributes": { - "namespace": { - "categories": [ - "External analysis" - ], - "description": "Cortex Taxonomy Namespace", + "cortex_url": { + "description": "URL to the Cortex job", "disable_correlation": true, - "multiple": false, - "ui-priority": 0, - "misp-attribute": "text" - }, - "predicate": { - "categories": [ - "External analysis" - ], - "description": "Cortex Taxonomy Predicate", - "disable_correlation": true, - "multiple": false, - "ui-priority": 0, - "misp-attribute": "text" - }, - "value": { - "categories": [ - "External analysis" - ], - "description": "Cortex Taxonomy Value", - "disable_correlation": true, - "multiple": false, - "ui-priority": 0, - "misp-attribute": "text" + "misp-attribute": "link", + "ui-priority": 0 }, "level": { "categories": [ @@ -42,8 +12,8 @@ ], "description": "Cortex Taxonomy Level", "disable_correlation": true, - "multiple": false, "misp-attribute": "text", + "multiple": false, "ui-priority": 0, "values_list": [ "info", @@ -52,16 +22,46 @@ "malicious" ] }, - "cortex_url": { - "description": "URL to the Cortex job", + "namespace": { + "categories": [ + "External analysis" + ], + "description": "Cortex Taxonomy Namespace", "disable_correlation": true, - "ui-priority": 0, - "misp-attribute": "link" + "misp-attribute": "text", + "multiple": false, + "ui-priority": 0 + }, + "predicate": { + "categories": [ + "External analysis" + ], + "description": "Cortex Taxonomy Predicate", + "disable_correlation": true, + "misp-attribute": "text", + "multiple": false, + "ui-priority": 0 + }, + "value": { + "categories": [ + "External analysis" + ], + "description": "Cortex Taxonomy Value", + "disable_correlation": true, + "misp-attribute": "text", + "multiple": false, + "ui-priority": 0 } }, - "version": 4, "description": "Cortex object describing an Cortex Taxonomy (or mini report)", "meta-category": "misc", + "name": "cortex-taxonomy", + "required": [ + "level", + "predicate", + "value", + "namespace" + ], "uuid": "bef7d23b-e796-4d46-803a-32e317896894", - "name": "cortex-taxonomy" -} + "version": 4 +} \ No newline at end of file diff --git a/objects/cortex/definition.json b/objects/cortex/definition.json index a45a0a3..bb5ddb7 100644 --- a/objects/cortex/definition.json +++ b/objects/cortex/definition.json @@ -1,48 +1,48 @@ { - "requiredOneOf": [ - "full" - ], "attributes": { - "summary": { - "description": "Cortex summary object (summary) in JSON", - "disable_correlation": false, - "ui-priority": 0, - "misp-attribute": "text" - }, "full": { "description": "Cortex report object (full report) in JSON", "disable_correlation": true, - "ui-priority": 0, - "misp-attribute": "text" - }, - "start-date": { - "description": "When the Cortex analyser was started", - "disable_correlation": true, - "ui-priority": 0, - "misp-attribute": "datetime" + "misp-attribute": "text", + "ui-priority": 0 }, "name": { "description": "Cortex analyser/worker name", "disable_correlation": true, - "ui-priority": 0, - "misp-attribute": "text" + "misp-attribute": "text", + "ui-priority": 0 }, "server-name": { "description": "Name of the cortex server", "disable_correlation": true, - "ui-priority": 0, - "misp-attribute": "text" + "misp-attribute": "text", + "ui-priority": 0 + }, + "start-date": { + "description": "When the Cortex analyser was started", + "disable_correlation": true, + "misp-attribute": "datetime", + "ui-priority": 0 }, "success": { "description": "Result of the cortex job", "disable_correlation": true, - "ui-priority": 0, - "misp-attribute": "boolean" + "misp-attribute": "boolean", + "ui-priority": 0 + }, + "summary": { + "description": "Cortex summary object (summary) in JSON", + "disable_correlation": false, + "misp-attribute": "text", + "ui-priority": 0 } }, - "version": 1, "description": "Cortex object describing a complete cortex analysis. Observables would be attribute with a relationship from this object.", "meta-category": "misc", + "name": "cortex", + "requiredOneOf": [ + "full" + ], "uuid": "144988f3-fa00-4374-8015-c1a32092f451", - "name": "cortex" -} + "version": 1 +} \ No newline at end of file diff --git a/objects/course-of-action/definition.json b/objects/course-of-action/definition.json index b2099e0..ace7e70 100644 --- a/objects/course-of-action/definition.json +++ b/objects/course-of-action/definition.json @@ -1,20 +1,77 @@ { - "requiredOneOf": [ - "name", - "type" - ], "attributes": { + "cost": { + "description": "The estimated cost of applying the course of action.", + "disable_correlation": true, + "misp-attribute": "text", + "sane_default": [ + "High", + "Medium", + "Low", + "None", + "Unknown" + ], + "ui-priority": 0 + }, + "description": { + "description": "A description of the course of action.", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 0 + }, + "efficacy": { + "description": "The estimated efficacy of applying the course of action.", + "disable_correlation": true, + "misp-attribute": "text", + "sane_default": [ + "High", + "Medium", + "Low", + "None", + "Unknown" + ], + "ui-priority": 0 + }, + "impact": { + "description": "The estimated impact of applying the course of action.", + "disable_correlation": true, + "misp-attribute": "text", + "sane_default": [ + "High", + "Medium", + "Low", + "None", + "Unknown" + ], + "ui-priority": 0 + }, "name": { "description": "The name used to identify the course of action.", + "disable_correlation": true, "misp-attribute": "text", - "ui-priority": 0, - "disable_correlation": true + "ui-priority": 0 + }, + "objective": { + "description": "The objective of the course of action.", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 0 + }, + "stage": { + "description": "The stage of the threat management lifecycle that the course of action is applicable to.", + "disable_correlation": true, + "misp-attribute": "text", + "sane_default": [ + "Remedy", + "Response", + "Further Analysis Required" + ], + "ui-priority": 0 }, "type": { "description": "The type of the course of action.", - "misp-attribute": "text", - "ui-priority": 0, "disable_correlation": true, + "misp-attribute": "text", "sane_default": [ "Perimeter Blocking", "Internal Blocking", @@ -32,74 +89,17 @@ "Diplomatic Actions", "Policy Actions", "Other" - ] - }, - "description": { - "description": "A description of the course of action.", - "misp-attribute": "text", - "ui-priority": 0, - "disable_correlation": true - }, - "objective": { - "description": "The objective of the course of action.", - "misp-attribute": "text", - "ui-priority": 0, - "disable_correlation": true - }, - "stage": { - "description": "The stage of the threat management lifecycle that the course of action is applicable to.", - "misp-attribute": "text", - "ui-priority": 0, - "disable_correlation": true, - "sane_default": [ - "Remedy", - "Response", - "Further Analysis Required" - ] - }, - "cost": { - "description": "The estimated cost of applying the course of action.", - "misp-attribute": "text", - "ui-priority": 0, - "disable_correlation": true, - "sane_default": [ - "High", - "Medium", - "Low", - "None", - "Unknown" - ] - }, - "impact": { - "description": "The estimated impact of applying the course of action.", - "misp-attribute": "text", - "ui-priority": 0, - "disable_correlation": true, - "sane_default": [ - "High", - "Medium", - "Low", - "None", - "Unknown" - ] - }, - "efficacy": { - "description": "The estimated efficacy of applying the course of action.", - "misp-attribute": "text", - "ui-priority": 0, - "disable_correlation": true, - "sane_default": [ - "High", - "Medium", - "Low", - "None", - "Unknown" - ] + ], + "ui-priority": 0 } }, - "version": 1, "description": "An object describing a specific measure taken to prevent or respond to an attack.", "meta-category": "misc", + "name": "course-of-action", + "requiredOneOf": [ + "name", + "type" + ], "uuid": "3d1c2c06-68a9-4394-8c8d-258d115f796f", - "name": "course-of-action" -} + "version": 1 +} \ No newline at end of file diff --git a/objects/covid19-csse-daily-report/definition.json b/objects/covid19-csse-daily-report/definition.json index dc261d0..59171cf 100644 --- a/objects/covid19-csse-daily-report/definition.json +++ b/objects/covid19-csse-daily-report/definition.json @@ -1,79 +1,79 @@ { - "required": [ - "country-region", - "update" - ], "attributes": { - "fips": { - "description": "Federal Information Processing Standard county code (US Only)", - "ui-priority": 0, + "active": { + "description": "the number of active cases.", + "disable_correlation": true, "misp-attribute": "counter", - "disable_correlation": true - }, - "county": { - "description": "US County (US Only)", - "ui-priority": 0, - "misp-attribute": "counter", - "disable_correlation": true - }, - "province-state": { - "description": "province name; US/Canada/Australia/ - city name, state/province name; Others - name of the event (e.g., \"Diamond Princess\" cruise ship); other countries - blank.", - "ui-priority": 1, - "misp-attribute": "text", - "disable_correlation": true - }, - "country-region": { - "description": "country/region name conforming to WHO (will be updated).", - "ui-priority": 1, - "misp-attribute": "text", - "disable_correlation": true - }, - "update": { - "description": "Time of the last update that day (UTC)", - "ui-priority": 1, - "misp-attribute": "datetime", - "disable_correlation": true - }, - "latitude": { - "description": "Approximate latitude of the entry", - "ui-priority": 0, - "misp-attribute": "float", - "disable_correlation": true - }, - "longitude": { - "description": "Approximate longitude of the entry", - "ui-priority": 0, - "misp-attribute": "float", - "disable_correlation": true + "ui-priority": 1 }, "confirmed": { "description": "the number of confirmed cases. For Hubei Province: from Feb 13 (GMT +8), we report both clinically diagnosed and lab-confirmed cases. For lab-confirmed cases only (Before Feb 17), please refer to https://github.com/CSSEGISandData/COVID-19/tree/master/who_covid_19_situation_reports.", - "misp-attribute": "counter", "disable_correlation": true, + "misp-attribute": "counter", "ui-priority": 1 }, + "country-region": { + "description": "country/region name conforming to WHO (will be updated).", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 1 + }, + "county": { + "description": "US County (US Only)", + "disable_correlation": true, + "misp-attribute": "counter", + "ui-priority": 0 + }, "death": { "description": "the number of deaths.", - "misp-attribute": "counter", "disable_correlation": true, + "misp-attribute": "counter", + "ui-priority": 1 + }, + "fips": { + "description": "Federal Information Processing Standard county code (US Only)", + "disable_correlation": true, + "misp-attribute": "counter", + "ui-priority": 0 + }, + "latitude": { + "description": "Approximate latitude of the entry", + "disable_correlation": true, + "misp-attribute": "float", + "ui-priority": 0 + }, + "longitude": { + "description": "Approximate longitude of the entry", + "disable_correlation": true, + "misp-attribute": "float", + "ui-priority": 0 + }, + "province-state": { + "description": "province name; US/Canada/Australia/ - city name, state/province name; Others - name of the event (e.g., \"Diamond Princess\" cruise ship); other countries - blank.", + "disable_correlation": true, + "misp-attribute": "text", "ui-priority": 1 }, "recovered": { "description": "the number of recovered cases.", - "misp-attribute": "counter", "disable_correlation": true, + "misp-attribute": "counter", "ui-priority": 1 }, - "active": { - "description": "the number of active cases.", - "misp-attribute": "counter", + "update": { + "description": "Time of the last update that day (UTC)", "disable_correlation": true, + "misp-attribute": "datetime", "ui-priority": 1 } }, - "version": 2, "description": "CSSE COVID-19 Daily report", "meta-category": "health", + "name": "covid19-csse-daily-report", + "required": [ + "country-region", + "update" + ], "uuid": "9458bf83-2e29-4ff3-9996-0564f2d954c8", - "name": "covid19-csse-daily-report" -} + "version": 2 +} \ No newline at end of file diff --git a/objects/covid19-dxy-live-city/definition.json b/objects/covid19-dxy-live-city/definition.json index 1a665b1..d079c32 100644 --- a/objects/covid19-dxy-live-city/definition.json +++ b/objects/covid19-dxy-live-city/definition.json @@ -1,49 +1,49 @@ { - "required": [ - "city", - "update" - ], "attributes": { "city": { "description": "Name of the Chinese city, in Chinese.", - "ui-priority": 1, + "disable_correlation": true, "misp-attribute": "text", - "disable_correlation": true - }, - "update": { - "description": "Approximate time of the update (~hour)", - "ui-priority": 1, - "misp-attribute": "datetime", - "disable_correlation": true + "ui-priority": 1 }, "current-confirmed": { "description": "Current number of confirmed cases", - "ui-priority": 1, + "disable_correlation": true, "misp-attribute": "counter", - "disable_correlation": true + "ui-priority": 1 }, "total-confirmed": { "description": "Total number of confirmed cases.", - "misp-attribute": "counter", "disable_correlation": true, + "misp-attribute": "counter", "ui-priority": 1 }, "total-cured": { "description": "Total number of cured cases.", - "misp-attribute": "counter", "disable_correlation": true, + "misp-attribute": "counter", "ui-priority": 1 }, "total-death": { "description": "Total number of deaths.", - "misp-attribute": "counter", "disable_correlation": true, + "misp-attribute": "counter", + "ui-priority": 1 + }, + "update": { + "description": "Approximate time of the update (~hour)", + "disable_correlation": true, + "misp-attribute": "datetime", "ui-priority": 1 } }, - "version": 1, "description": "COVID 19 from dxy.cn - Aggregation by city", "meta-category": "health", + "name": "covid19-dxy-live-city", + "required": [ + "city", + "update" + ], "uuid": "9132452b-f60a-41ac-a3b9-62701b85621b", - "name": "covid19-dxy-live-city" -} + "version": 1 +} \ No newline at end of file diff --git a/objects/covid19-dxy-live-province/definition.json b/objects/covid19-dxy-live-province/definition.json index 3bb3cf8..d9cb08d 100644 --- a/objects/covid19-dxy-live-province/definition.json +++ b/objects/covid19-dxy-live-province/definition.json @@ -1,55 +1,55 @@ { - "required": [ - "province", - "update" - ], "attributes": { - "province": { - "description": "Name of the Chinese province, in Chinese.", - "ui-priority": 1, + "comment": { + "description": "Comment, in chinese", + "disable_correlation": true, "misp-attribute": "text", - "disable_correlation": true - }, - "update": { - "description": "Approximate time of the update (~hour)", - "ui-priority": 1, - "misp-attribute": "datetime", - "disable_correlation": true + "ui-priority": 1 }, "current-confirmed": { "description": "Current number of confirmed cases", - "ui-priority": 1, + "disable_correlation": true, "misp-attribute": "counter", - "disable_correlation": true + "ui-priority": 1 + }, + "province": { + "description": "Name of the Chinese province, in Chinese.", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 1 }, "total-confirmed": { "description": "Total number of confirmed cases.", - "misp-attribute": "counter", "disable_correlation": true, + "misp-attribute": "counter", "ui-priority": 1 }, "total-cured": { "description": "Total number of cured cases.", - "misp-attribute": "counter", "disable_correlation": true, + "misp-attribute": "counter", "ui-priority": 1 }, "total-death": { "description": "Total number of deaths.", - "misp-attribute": "counter", "disable_correlation": true, + "misp-attribute": "counter", "ui-priority": 1 }, - "comment": { - "description": "Comment, in chinese", - "misp-attribute": "text", + "update": { + "description": "Approximate time of the update (~hour)", "disable_correlation": true, + "misp-attribute": "datetime", "ui-priority": 1 } }, - "version": 1, "description": "COVID 19 from dxy.cn - Aggregation by province", "meta-category": "health", + "name": "covid19-dxy-live-province", + "required": [ + "province", + "update" + ], "uuid": "40b49502-088b-44a5-80a7-0e55653f3ed4", - "name": "covid19-dxy-live-province" -} + "version": 1 +} \ No newline at end of file diff --git a/objects/cowrie/definition.json b/objects/cowrie/definition.json index a29410f..2d8206a 100644 --- a/objects/cowrie/definition.json +++ b/objects/cowrie/definition.json @@ -1,131 +1,131 @@ { - "requiredOneOf": [ - "session" - ], "attributes": { - "eventid": { - "description": "Eventid of the session in the cowrie honeypot", + "compCS": { + "description": "SSH compression algorithm supported in the session", "disable_correlation": true, - "ui-priority": 1, - "misp-attribute": "text" - }, - "system": { - "description": "System origin in cowrie honeypot", - "disable_correlation": true, - "ui-priority": 1, - "misp-attribute": "text" - }, - "username": { - "description": "Username related to the password(s)", - "ui-priority": 1, - "misp-attribute": "text" - }, - "password": { - "description": "Password", + "misp-attribute": "text", "multiple": true, - "ui-priority": 1, - "misp-attribute": "text" - }, - "session": { - "description": "Session id", - "ui-priority": 1, - "misp-attribute": "text" - }, - "timestamp": { - "description": "When the event happened", - "ui-priority": 1, - "misp-attribute": "datetime", - "disable_correlation": true - }, - "message": { - "description": "Message of the cowrie honeypot", - "ui-priority": 1, - "misp-attribute": "text", - "disable_correlation": true - }, - "protocol": { - "description": "Protocol used in the cowrie honeypot", - "ui-priority": 1, - "misp-attribute": "text", - "disable_correlation": true - }, - "sensor": { - "description": "Cowrie sensor name", - "ui-priority": 1, - "misp-attribute": "text", - "disable_correlation": true - }, - "src_ip": { - "description": "Source IP address of the session", - "ui-priority": 1, - "misp-attribute": "ip-src" + "ui-priority": 1 }, "dst_ip": { "description": "Destination IP address of the session", - "ui-priority": 1, + "disable_correlation": true, "misp-attribute": "ip-dst", - "disable_correlation": true - }, - "src_port": { - "description": "Source port of the session", - "ui-priority": 1, - "misp-attribute": "port", - "disable_correlation": true + "ui-priority": 1 }, "dst_port": { "description": "Destination port of the session", - "ui-priority": 1, + "disable_correlation": true, "misp-attribute": "port", - "disable_correlation": true - }, - "isError": { - "description": "isError", - "ui-priority": 1, - "misp-attribute": "text", - "disable_correlation": true - }, - "input": { - "description": "Input of the session", - "ui-priority": 1, - "misp-attribute": "text" - }, - "macCS": { - "description": "SSH MAC supported in the sesssion", - "multiple": true, - "disable_correlation": true, - "ui-priority": 1, - "misp-attribute": "text" - }, - "keyAlgs": { - "description": "SSH public-key algorithm supported in the session", - "multiple": true, - "disable_correlation": true, - "ui-priority": 1, - "misp-attribute": "text" + "ui-priority": 1 }, "encCS": { "description": "SSH symmetric encryption algorithm supported in the session", - "multiple": true, "disable_correlation": true, - "ui-priority": 1, - "misp-attribute": "text" - }, - "compCS": { - "description": "SSH compression algorithm supported in the session", - "multiple": true, - "ui-priority": 1, "misp-attribute": "text", - "disable_correlation": true + "multiple": true, + "ui-priority": 1 + }, + "eventid": { + "description": "Eventid of the session in the cowrie honeypot", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 1 }, "hassh": { "description": "HASSH of the client SSH session following Salesforce algorithm", "misp-attribute": "hassh-md5", "ui-priority": 1 + }, + "input": { + "description": "Input of the session", + "misp-attribute": "text", + "ui-priority": 1 + }, + "isError": { + "description": "isError", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 1 + }, + "keyAlgs": { + "description": "SSH public-key algorithm supported in the session", + "disable_correlation": true, + "misp-attribute": "text", + "multiple": true, + "ui-priority": 1 + }, + "macCS": { + "description": "SSH MAC supported in the sesssion", + "disable_correlation": true, + "misp-attribute": "text", + "multiple": true, + "ui-priority": 1 + }, + "message": { + "description": "Message of the cowrie honeypot", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 1 + }, + "password": { + "description": "Password", + "misp-attribute": "text", + "multiple": true, + "ui-priority": 1 + }, + "protocol": { + "description": "Protocol used in the cowrie honeypot", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 1 + }, + "sensor": { + "description": "Cowrie sensor name", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 1 + }, + "session": { + "description": "Session id", + "misp-attribute": "text", + "ui-priority": 1 + }, + "src_ip": { + "description": "Source IP address of the session", + "misp-attribute": "ip-src", + "ui-priority": 1 + }, + "src_port": { + "description": "Source port of the session", + "disable_correlation": true, + "misp-attribute": "port", + "ui-priority": 1 + }, + "system": { + "description": "System origin in cowrie honeypot", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 1 + }, + "timestamp": { + "description": "When the event happened", + "disable_correlation": true, + "misp-attribute": "datetime", + "ui-priority": 1 + }, + "username": { + "description": "Username related to the password(s)", + "misp-attribute": "text", + "ui-priority": 1 } }, - "version": 3, "description": "Cowrie honeypot object template", "meta-category": "network", + "name": "cowrie", + "requiredOneOf": [ + "session" + ], "uuid": "ae085d32-6534-4d52-b3eb-063fccb753e7", - "name": "cowrie" -} + "version": 3 +} \ No newline at end of file diff --git a/objects/credential/definition.json b/objects/credential/definition.json index b1b90fd..fe6685c 100644 --- a/objects/credential/definition.json +++ b/objects/credential/definition.json @@ -1,57 +1,10 @@ { - "requiredOneOf": [ - "password", - "username" - ], "attributes": { - "text": { - "description": "A description of the credential(s)", - "disable_correlation": true, - "ui-priority": 1, - "misp-attribute": "text" - }, - "username": { - "description": "Username related to the password(s)", - "ui-priority": 1, - "misp-attribute": "text" - }, - "password": { - "description": "Password", - "multiple": true, - "ui-priority": 1, - "misp-attribute": "text" - }, - "type": { - "description": "Type of password(s)", - "ui-priority": 1, - "misp-attribute": "text", - "disable_correlation": true, - "values_list": [ - "password", - "api-key", - "encryption-key", - "unknown" - ] - }, - "origin": { - "description": "Origin of the credential(s)", - "ui-priority": 1, - "misp-attribute": "text", - "disable_correlation": true, - "sane_default": [ - "bruteforce-scanning", - "malware-analysis", - "memory-analysis", - "network-analysis", - "leak", - "unknown" - ] - }, "format": { "description": "Format of the password(s)", - "ui-priority": 1, - "misp-attribute": "text", "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 1, "values_list": [ "clear-text", "hashed", @@ -61,20 +14,67 @@ }, "notification": { "description": "Mention of any notification(s) towards the potential owner(s) of the credential(s)", - "ui-priority": 1, - "misp-attribute": "text", "disable_correlation": true, + "misp-attribute": "text", "multiple": true, + "ui-priority": 1, "values_list": [ "victim-notified", "service-notified", "none" ] + }, + "origin": { + "description": "Origin of the credential(s)", + "disable_correlation": true, + "misp-attribute": "text", + "sane_default": [ + "bruteforce-scanning", + "malware-analysis", + "memory-analysis", + "network-analysis", + "leak", + "unknown" + ], + "ui-priority": 1 + }, + "password": { + "description": "Password", + "misp-attribute": "text", + "multiple": true, + "ui-priority": 1 + }, + "text": { + "description": "A description of the credential(s)", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 1 + }, + "type": { + "description": "Type of password(s)", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 1, + "values_list": [ + "password", + "api-key", + "encryption-key", + "unknown" + ] + }, + "username": { + "description": "Username related to the password(s)", + "misp-attribute": "text", + "ui-priority": 1 } }, - "version": 4, "description": "Credential describes one or more credential(s) including password(s), api key(s) or decryption key(s).", "meta-category": "misc", + "name": "credential", + "requiredOneOf": [ + "password", + "username" + ], "uuid": "a27e98c9-9b0e-414c-8076-d201e039ca09", - "name": "credential" -} + "version": 4 +} \ No newline at end of file diff --git a/objects/credit-card/definition.json b/objects/credit-card/definition.json index 2a2e36b..8c97571 100644 --- a/objects/credit-card/definition.json +++ b/objects/credit-card/definition.json @@ -1,57 +1,57 @@ { - "requiredOneOf": [ - "cc-number" - ], "attributes": { - "iin": { - "description": "International Issuer Number (First eight digits of the credit card number", - "ui-priority": 0, - "misp-attribute": "text" - }, "bank_name": { "description": "Name of the bank which have issued the card", - "ui-priority": 0, - "misp-attribute": "text" - }, - "version": { - "description": "Version of the card.", - "ui-priority": 0, - "misp-attribute": "text" - }, - "comment": { - "description": "A description of the card.", - "ui-priority": 0, - "misp-attribute": "comment" + "misp-attribute": "text", + "ui-priority": 0 }, "card-security-code": { "description": "Card security code (CSC, CVD, CVV, CVC and SPC) as embossed or printed on the card.", - "ui-priority": 0, - "misp-attribute": "text" - }, - "name": { - "description": "Name of the card owner.", - "ui-priority": 0, - "misp-attribute": "text" - }, - "issued": { - "description": "Initial date of validity or issued date.", - "ui-priority": 0, - "misp-attribute": "datetime" - }, - "expiration": { - "description": "Maximum date of validity", - "ui-priority": 0, - "misp-attribute": "datetime" + "misp-attribute": "text", + "ui-priority": 0 }, "cc-number": { "description": "credit-card number as encoded on the card.", - "ui-priority": 0, - "misp-attribute": "cc-number" + "misp-attribute": "cc-number", + "ui-priority": 0 + }, + "comment": { + "description": "A description of the card.", + "misp-attribute": "comment", + "ui-priority": 0 + }, + "expiration": { + "description": "Maximum date of validity", + "misp-attribute": "datetime", + "ui-priority": 0 + }, + "iin": { + "description": "International Issuer Number (First eight digits of the credit card number", + "misp-attribute": "text", + "ui-priority": 0 + }, + "issued": { + "description": "Initial date of validity or issued date.", + "misp-attribute": "datetime", + "ui-priority": 0 + }, + "name": { + "description": "Name of the card owner.", + "misp-attribute": "text", + "ui-priority": 0 + }, + "version": { + "description": "Version of the card.", + "misp-attribute": "text", + "ui-priority": 0 } }, - "version": 3, "description": "A payment card like credit card, debit card or any similar cards which can be used for financial transactions.", "meta-category": "financial", + "name": "credit-card", + "requiredOneOf": [ + "cc-number" + ], "uuid": "2b9c57aa-daba-4330-a738-56f18743b0c7", - "name": "credit-card" -} + "version": 3 +} \ No newline at end of file diff --git a/objects/crypto-material/definition.json b/objects/crypto-material/definition.json index 3283a62..ac93cd5 100644 --- a/objects/crypto-material/definition.json +++ b/objects/crypto-material/definition.json @@ -1,126 +1,40 @@ { - "requiredOneOf": [ - "generic-symmetric-key", - "text", - "private", - "p", - "q", - "modulus" - ], "attributes": { - "text": { - "description": "A description of the cryptographic materials.", - "disable_correlation": true, - "ui-priority": 1, - "misp-attribute": "text" - }, - "rsa-modulus-size": { - "description": "RSA modulus size in bits", - "disable_correlation": true, - "ui-priority": 1, - "misp-attribute": "text" - }, - "modulus": { - "description": "Modulus Parameter - in hexadecimal - no 0x, no :", - "disable_correlation": false, - "ui-priority": 1, - "misp-attribute": "text" - }, - "e": { - "description": "RSA public exponent", - "disable_correlation": false, - "ui-priority": 1, - "misp-attribute": "text" - }, - "p": { - "description": "Prime Parameter - P in decimal", - "disable_correlation": false, - "ui-priority": 1, - "misp-attribute": "text" - }, - "q": { - "description": "Prime Parameter - Q in decimal", - "disable_correlation": false, - "ui-priority": 1, - "misp-attribute": "text" - }, - "g": { - "description": "Curve Parameter - G in decimal", - "disable_correlation": true, - "ui-priority": 1, - "misp-attribute": "text" - }, - "y": { - "description": "Curve Parameter - Y in decimal", - "disable_correlation": true, - "ui-priority": 1, - "misp-attribute": "text" - }, - "x": { - "description": "Curve Parameter - X in decimal", - "disable_correlation": true, - "ui-priority": 1, - "misp-attribute": "text" - }, - "n": { - "description": "Curve Parameter - N in decimal", - "disable_correlation": true, - "ui-priority": 1, - "misp-attribute": "text" - }, - "b": { - "description": "Curve Parameter - B in decimal", - "disable_correlation": true, - "ui-priority": 1, - "misp-attribute": "text" - }, - "curve-length": { - "description": "Length of the Curve in bits", - "disable_correlation": true, - "ui-priority": 1, - "misp-attribute": "text" - }, "Gx": { "description": "Curve Parameter - Gx in decimal", "disable_correlation": true, - "ui-priority": 1, - "misp-attribute": "text" + "misp-attribute": "text", + "ui-priority": 1 }, "Gy": { "description": "Curve Parameter - Gy in decimal", "disable_correlation": true, - "ui-priority": 1, - "misp-attribute": "text" - }, - "private": { - "description": "Private part of the cryptographic materials in PEM format", - "ui-priority": 1, - "misp-attribute": "text" - }, - "generic-symmetric-key": { - "description": "Generic symmetric key (please precise the type)", - "ui-priority": 1, - "misp-attribute": "text" - }, - "type": { - "description": "Type of crytographic materials", - "ui-priority": 1, "misp-attribute": "text", + "ui-priority": 1 + }, + "b": { + "description": "Curve Parameter - B in decimal", "disable_correlation": true, - "values_list": [ - "RSA", - "DSA", - "ECDSA", - "RC4", - "XOR", - "unknown" - ] + "misp-attribute": "text", + "ui-priority": 1 + }, + "curve-length": { + "description": "Length of the Curve in bits", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 1 + }, + "e": { + "description": "RSA public exponent", + "disable_correlation": false, + "misp-attribute": "text", + "ui-priority": 1 }, "ecdsa-type": { "description": "Curve type of the ECDSA cryptographic materials", - "ui-priority": 1, - "misp-attribute": "text", "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 1, "values_list": [ "Anomalous", "M-221", @@ -144,11 +58,33 @@ "E-521" ] }, + "g": { + "description": "Curve Parameter - G in decimal", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 1 + }, + "generic-symmetric-key": { + "description": "Generic symmetric key (please precise the type)", + "misp-attribute": "text", + "ui-priority": 1 + }, + "modulus": { + "description": "Modulus Parameter - in hexadecimal - no 0x, no :", + "disable_correlation": false, + "misp-attribute": "text", + "ui-priority": 1 + }, + "n": { + "description": "Curve Parameter - N in decimal", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 1 + }, "origin": { "description": "Origin of the cryptographic materials", - "ui-priority": 1, - "misp-attribute": "text", "disable_correlation": true, + "misp-attribute": "text", "sane_default": [ "mathematical-attack", "exhaustive-search", @@ -158,12 +94,76 @@ "network-interception", "leak", "unknown" + ], + "ui-priority": 1 + }, + "p": { + "description": "Prime Parameter - P in decimal", + "disable_correlation": false, + "misp-attribute": "text", + "ui-priority": 1 + }, + "private": { + "description": "Private part of the cryptographic materials in PEM format", + "misp-attribute": "text", + "ui-priority": 1 + }, + "q": { + "description": "Prime Parameter - Q in decimal", + "disable_correlation": false, + "misp-attribute": "text", + "ui-priority": 1 + }, + "rsa-modulus-size": { + "description": "RSA modulus size in bits", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 1 + }, + "text": { + "description": "A description of the cryptographic materials.", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 1 + }, + "type": { + "description": "Type of crytographic materials", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 1, + "values_list": [ + "RSA", + "DSA", + "ECDSA", + "RC4", + "XOR", + "unknown" ] + }, + "x": { + "description": "Curve Parameter - X in decimal", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 1 + }, + "y": { + "description": "Curve Parameter - Y in decimal", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 1 } }, - "version": 3, "description": "Cryptographic materials such as public or/and private keys.", "meta-category": "misc", + "name": "crypto-material", + "requiredOneOf": [ + "generic-symmetric-key", + "text", + "private", + "p", + "q", + "modulus" + ], "uuid": "50677f82-ec9c-4484-bb29-2519cfe56823", - "name": "crypto-material" -} + "version": 3 +} \ No newline at end of file diff --git a/objects/cytomic-orion-file/definition.json b/objects/cytomic-orion-file/definition.json index 050506c..d7ec063 100644 --- a/objects/cytomic-orion-file/definition.json +++ b/objects/cytomic-orion-file/definition.json @@ -1,63 +1,63 @@ { - "required": [], "attributes": { - "fileName": { - "description": "Original filename", - "ui-priority": 9, - "categories": [ - "Other" - ], - "misp-attribute": "filename" - }, - "fileSize": { - "description": "Size of the file", - "to_ids": false, - "ui-priority": 0, - "categories": [ - "Other" - ], - "misp-attribute": "size-in-bytes" - }, "classification": { - "description": "File classification - number", - "to_ids": false, - "ui-priority": 2, "categories": [ "Other" ], - "misp-attribute": "text" + "description": "File classification - number", + "misp-attribute": "text", + "to_ids": false, + "ui-priority": 2 }, "classificationName": { - "description": "File classification", - "to_ids": false, - "ui-priority": 1, "categories": [ "Other" ], - "misp-attribute": "text" + "description": "File classification", + "misp-attribute": "text", + "to_ids": false, + "ui-priority": 1 + }, + "fileName": { + "categories": [ + "Other" + ], + "description": "Original filename", + "misp-attribute": "filename", + "ui-priority": 9 + }, + "fileSize": { + "categories": [ + "Other" + ], + "description": "Size of the file", + "misp-attribute": "size-in-bytes", + "to_ids": false, + "ui-priority": 0 }, "first-seen": { - "description": "First seen timestamp of the file", - "to_ids": false, - "ui-priority": 3, "categories": [ "Other" ], - "misp-attribute": "datetime" + "description": "First seen timestamp of the file", + "misp-attribute": "datetime", + "to_ids": false, + "ui-priority": 3 }, "last-seen": { - "description": "Last seen timestamp of the file", - "to_ids": false, - "ui-priority": 4, "categories": [ "Other" ], - "misp-attribute": "datetime" + "description": "Last seen timestamp of the file", + "misp-attribute": "datetime", + "to_ids": false, + "ui-priority": 4 } }, - "version": 7, "description": "Cytomic Orion File Detection", "meta-category": "misc", + "name": "cytomic-orion-file", + "required": [], "uuid": "0ad86572-ba38-4baf-9fed-1926e9ecc916", - "name": "cytomic-orion-file" -} + "version": 7 +} \ No newline at end of file diff --git a/objects/cytomic-orion-machine/definition.json b/objects/cytomic-orion-machine/definition.json index 5a25dd7..ce00962 100644 --- a/objects/cytomic-orion-machine/definition.json +++ b/objects/cytomic-orion-machine/definition.json @@ -1,101 +1,101 @@ { + "attributes": { + "clientCreationDateUTC": { + "categories": [ + "Other" + ], + "description": "Client creation date UTC", + "misp-attribute": "datetime", + "to_ids": false, + "ui-priority": 0 + }, + "clientId": { + "categories": [ + "Other" + ], + "description": "Client id", + "misp-attribute": "text", + "to_ids": false, + "ui-priority": 0 + }, + "clientName": { + "categories": [ + "Other" + ], + "description": "Client name", + "misp-attribute": "target-org", + "to_ids": false, + "ui-priority": 0 + }, + "creationDate": { + "categories": [ + "Other" + ], + "description": "Client creation date", + "misp-attribute": "datetime", + "to_ids": false, + "ui-priority": 0 + }, + "first-seen": { + "categories": [ + "Other" + ], + "description": "First seen on machine", + "misp-attribute": "datetime", + "to_ids": false, + "ui-priority": 3 + }, + "last-seen": { + "categories": [ + "Other" + ], + "description": "Last seen on machine", + "misp-attribute": "datetime", + "to_ids": false, + "ui-priority": 4 + }, + "lastSeenUtc": { + "categories": [ + "Other" + ], + "description": "Client last seen UTC", + "misp-attribute": "datetime", + "to_ids": false, + "ui-priority": 0 + }, + "machineMuid": { + "categories": [ + "Other" + ], + "description": "Machine UID", + "misp-attribute": "text", + "to_ids": false, + "ui-priority": 0 + }, + "machineName": { + "categories": [ + "Other" + ], + "description": "Machine name", + "misp-attribute": "target-machine", + "ui-priority": 9 + }, + "machinePath": { + "categories": [ + "Other" + ], + "description": "Path of observable", + "misp-attribute": "text", + "to_ids": false, + "ui-priority": 2 + } + }, + "description": "Cytomic Orion File at Machine Detection", + "meta-category": "misc", + "name": "cytomic-orion-machine", "required": [ "machineName" ], - "attributes": { - "machineName": { - "description": "Machine name", - "ui-priority": 9, - "categories": [ - "Other" - ], - "misp-attribute": "target-machine" - }, - "machineMuid": { - "description": "Machine UID", - "to_ids": false, - "ui-priority": 0, - "categories": [ - "Other" - ], - "misp-attribute": "text" - }, - "clientName": { - "description": "Client name", - "to_ids": false, - "ui-priority": 0, - "categories": [ - "Other" - ], - "misp-attribute": "target-org" - }, - "clientId": { - "description": "Client id", - "to_ids": false, - "ui-priority": 0, - "categories": [ - "Other" - ], - "misp-attribute": "text" - }, - "machinePath": { - "description": "Path of observable", - "to_ids": false, - "ui-priority": 2, - "categories": [ - "Other" - ], - "misp-attribute": "text" - }, - "first-seen": { - "description": "First seen on machine", - "to_ids": false, - "ui-priority": 3, - "categories": [ - "Other" - ], - "misp-attribute": "datetime" - }, - "last-seen": { - "description": "Last seen on machine", - "to_ids": false, - "ui-priority": 4, - "categories": [ - "Other" - ], - "misp-attribute": "datetime" - }, - "clientCreationDateUTC": { - "description": "Client creation date UTC", - "to_ids": false, - "ui-priority": 0, - "categories": [ - "Other" - ], - "misp-attribute": "datetime" - }, - "creationDate": { - "description": "Client creation date", - "to_ids": false, - "ui-priority": 0, - "categories": [ - "Other" - ], - "misp-attribute": "datetime" - }, - "lastSeenUtc": { - "description": "Client last seen UTC", - "to_ids": false, - "ui-priority": 0, - "categories": [ - "Other" - ], - "misp-attribute": "datetime" - } - }, - "version": 4, - "description": "Cytomic Orion File at Machine Detection", - "meta-category": "misc", "uuid": "e0e46343-43fd-4ce7-b447-51381402c774", - "name": "cytomic-orion-machine" -} + "version": 4 +} \ No newline at end of file diff --git a/objects/dark-pattern-item/definition.json b/objects/dark-pattern-item/definition.json index fb0c75c..362fa58 100644 --- a/objects/dark-pattern-item/definition.json +++ b/objects/dark-pattern-item/definition.json @@ -1,63 +1,63 @@ { - "requiredOneOf": [ - "location", - "screenshot" - ], "attributes": { - "location": { - "description": "Location where to find the item", - "ui-priority": 0, - "disable_correlation": true, - "multiple": true, - "misp-attribute": "text" - }, - "time": { - "description": "Date and time when first-seen", - "ui-priority": 0, - "disable_correlation": true, - "misp-attribute": "datetime" - }, - "implementer": { - "description": "Who is the vendor / holder of the item", - "ui-priority": 0, - "disable_correlation": true, - "misp-attribute": "text" - }, - "user": { - "description": "who are the user of the item", - "ui-priority": 0, - "disable_correlation": true, - "misp-attribute": "text" - }, "comment": { "description": "textual comment about the item", - "ui-priority": 0, "disable_correlation": true, - "misp-attribute": "text" + "misp-attribute": "text", + "ui-priority": 0 }, "gain": { "description": "What is the implementer is gaining by deceiving the user", - "ui-priority": 0, + "disable_correlation": true, "misp-attribute": "text", + "ui-priority": 0, "values_list": [ "registration", "personal data", "money", "contacts", "audience" - ], - "disable_correlation": true + ] + }, + "implementer": { + "description": "Who is the vendor / holder of the item", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 0 + }, + "location": { + "description": "Location where to find the item", + "disable_correlation": true, + "misp-attribute": "text", + "multiple": true, + "ui-priority": 0 }, "screenshot": { "description": "A screencapture or a screengrab of the item at work", - "ui-priority": 1, "disable_correlation": true, - "misp-attribute": "attachment" + "misp-attribute": "attachment", + "ui-priority": 1 + }, + "time": { + "description": "Date and time when first-seen", + "disable_correlation": true, + "misp-attribute": "datetime", + "ui-priority": 0 + }, + "user": { + "description": "who are the user of the item", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 0 } }, - "version": 2, "description": "An Item whose User Interface implements a dark pattern.", "meta-category": "misc", + "name": "dark-pattern-item", + "requiredOneOf": [ + "location", + "screenshot" + ], "uuid": "05755e29-8f5f-464d-bcff-2b4686472769", - "name": "dark-pattern-item" -} + "version": 2 +} \ No newline at end of file diff --git a/objects/ddos/definition.json b/objects/ddos/definition.json index 715150c..55bebf3 100644 --- a/objects/ddos/definition.json +++ b/objects/ddos/definition.json @@ -1,65 +1,22 @@ { - "name": "ddos", - "uuid": "e2f124d6-f57c-4f93-99e6-8450545fa05d", - "meta-category": "network", - "description": "DDoS object describes a current DDoS activity from a specific or/and to a specific target. Type of DDoS can be attached to the object as a taxonomy", - "version": 6, "attributes": { - "total-bps": { - "description": "Bits per second", - "misp-attribute": "counter", - "ui-priority": 0 - }, - "text": { - "description": "Description of the DDoS", - "disable_correlation": true, - "misp-attribute": "text", - "ui-priority": 0 - }, "domain-dst": { + "categories": [ + "Network activity", + "External analysis" + ], "description": "Destination domain (victim)", "misp-attribute": "domain", - "ui-priority": 1, - "categories": [ - "Network activity", - "External analysis" - ] - }, - "ip-dst": { - "description": "Destination IP (victim)", - "misp-attribute": "ip-dst", - "ui-priority": 1, - "categories": [ - "Network activity", - "External analysis" - ] - }, - "ip-src": { - "description": "IP address originating the attack", - "misp-attribute": "ip-src", - "ui-priority": 1, - "categories": [ - "Network activity", - "External analysis" - ] + "ui-priority": 1 }, "dst-port": { + "categories": [ + "Network activity", + "External analysis" + ], "description": "Destination port of the attack", "misp-attribute": "port", - "ui-priority": 0, - "categories": [ - "Network activity", - "External analysis" - ] - }, - "src-port": { - "description": "Port originating the attack", - "misp-attribute": "port", - "ui-priority": 0, - "categories": [ - "Network activity", - "External analysis" - ] + "ui-priority": 0 }, "first-seen": { "description": "Beginning of the attack", @@ -67,6 +24,30 @@ "misp-attribute": "datetime", "ui-priority": 0 }, + "ip-dst": { + "categories": [ + "Network activity", + "External analysis" + ], + "description": "Destination IP (victim)", + "misp-attribute": "ip-dst", + "ui-priority": 1 + }, + "ip-src": { + "categories": [ + "Network activity", + "External analysis" + ], + "description": "IP address originating the attack", + "misp-attribute": "ip-src", + "ui-priority": 1 + }, + "last-seen": { + "description": "End of the attack", + "disable_correlation": true, + "misp-attribute": "datetime", + "ui-priority": 0 + }, "protocol": { "description": "Protocol used for the attack", "misp-attribute": "text", @@ -78,21 +59,40 @@ "IP" ] }, + "src-port": { + "categories": [ + "Network activity", + "External analysis" + ], + "description": "Port originating the attack", + "misp-attribute": "port", + "ui-priority": 0 + }, + "text": { + "description": "Description of the DDoS", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 0 + }, + "total-bps": { + "description": "Bits per second", + "misp-attribute": "counter", + "ui-priority": 0 + }, "total-pps": { "description": "Packets per second", "misp-attribute": "counter", "ui-priority": 0 - }, - "last-seen": { - "description": "End of the attack", - "disable_correlation": true, - "misp-attribute": "datetime", - "ui-priority": 0 } }, + "description": "DDoS object describes a current DDoS activity from a specific or/and to a specific target. Type of DDoS can be attached to the object as a taxonomy", + "meta-category": "network", + "name": "ddos", "requiredOneOf": [ "ip-dst", "ip-src", "domain-dst" - ] -} + ], + "uuid": "e2f124d6-f57c-4f93-99e6-8450545fa05d", + "version": 6 +} \ No newline at end of file diff --git a/objects/device/definition.json b/objects/device/definition.json index d9f05d5..2a81682 100644 --- a/objects/device/definition.json +++ b/objects/device/definition.json @@ -1,31 +1,44 @@ { - "requiredOneOf": [ - "name", - "alias" - ], "attributes": { - "description": { - "description": "Description of the Device", - "ui-priority": 0, - "misp-attribute": "text", - "disable_correlation": true + "MAC-address": { + "description": "Device MAC address", + "misp-attribute": "mac-address", + "ui-priority": 0 }, - "name": { - "description": "Name of the Device", - "ui-priority": 101, - "misp-attribute": "text" + "OS": { + "description": "OS of the device", + "disable_correlation": true, + "misp-attribute": "text", + "multiple": true, + "ui-priority": 98 }, "alias": { "description": "Alias of the Device", - "ui-priority": 100, "misp-attribute": "text", - "multiple": true + "multiple": true, + "ui-priority": 100 + }, + "analysis-date": { + "description": "Date of device analysis", + "misp-attribute": "datetime", + "ui-priority": 0 + }, + "attachment": { + "description": "An attachment", + "misp-attribute": "attachment", + "multiple": true, + "ui-priority": 0 + }, + "description": { + "description": "Description of the Device", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 0 }, "device-type": { "description": "Type of the device", - "ui-priority": 99, - "misp-attribute": "text", "disable_correlation": true, + "misp-attribute": "text", "sane_default": [ "PC", "Mobile", @@ -35,53 +48,40 @@ "IoT", "Hardware", "Other" - ] - }, - "OS": { - "description": "OS of the device", - "ui-priority": 98, - "misp-attribute": "text", - "disable_correlation": true, - "multiple": true - }, - "version": { - "description": "Version of the device/ OS", - "ui-priority": 97, - "misp-attribute": "text", - "disable_correlation": true - }, - "ip-address": { - "description": "Device IP address", - "ui-priority": 0, - "misp-attribute": "ip-src", - "multiple": true + ], + "ui-priority": 99 }, "dns-name": { "description": "Device DNS Name", - "ui-priority": 0, "misp-attribute": "text", - "multiple": true + "multiple": true, + "ui-priority": 0 }, - "MAC-address": { - "description": "Device MAC address", - "ui-priority": 0, - "misp-attribute": "mac-address" + "ip-address": { + "description": "Device IP address", + "misp-attribute": "ip-src", + "multiple": true, + "ui-priority": 0 }, - "analysis-date": { - "description": "Date of device analysis", - "ui-priority": 0, - "misp-attribute": "datetime" + "name": { + "description": "Name of the Device", + "misp-attribute": "text", + "ui-priority": 101 }, - "attachment": { - "description": "An attachment", - "ui-priority": 0, - "misp-attribute": "attachment", - "multiple": true + "version": { + "description": "Version of the device/ OS", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 97 } }, - "version": 7, "description": "An object to define a device", "meta-category": "misc", + "name": "device", + "requiredOneOf": [ + "name", + "alias" + ], "uuid": "0c64b41a-e583-4f4d-ac92-d484163b9e52", - "name": "device" -} + "version": 7 +} \ No newline at end of file diff --git a/objects/diameter-attack/definition.json b/objects/diameter-attack/definition.json index 71c2766..11ee5b5 100644 --- a/objects/diameter-attack/definition.json +++ b/objects/diameter-attack/definition.json @@ -1,89 +1,89 @@ { - "requiredOneOf": [ - "text" - ], "attributes": { - "category": { - "description": "Category.", - "sane_default": [ - "Cat0", - "Cat1", - "Cat2", - "Cat3", - "CatSMS" - ], - "misp-attribute": "text", - "disable_correlation": true, - "ui-priority": 0 - }, "ApplicationId": { "description": "Application-ID is used to identify for which Diameter application the message is applicable. Application-ID is a decimal representation.", "misp-attribute": "text", "ui-priority": 0 }, - "SessionId": { - "description": "Session-ID.", - "misp-attribute": "text", - "ui-priority": 0 - }, "CmdCode": { "description": "A decimal representation of the diameter Command Code.", "disable_correlation": true, "misp-attribute": "text", "ui-priority": 0 }, - "Origin-Host": { - "description": "Origin-Host.", - "misp-attribute": "text", - "multiple": true, - "ui-priority": 0 - }, "Destination-Host": { "description": "Destination-Host.", "misp-attribute": "text", "multiple": true, "ui-priority": 0 }, - "Origin-Realm": { - "description": "Origin-Realm.", - "misp-attribute": "text", - "multiple": true, - "ui-priority": 0 - }, "Destination-Realm": { "description": "Destination-Realm.", "misp-attribute": "text", "multiple": true, "ui-priority": 0 }, + "IdrFlags": { + "description": "IDR-Flags.", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 0 + }, + "Origin-Host": { + "description": "Origin-Host.", + "misp-attribute": "text", + "multiple": true, + "ui-priority": 0 + }, + "Origin-Realm": { + "description": "Origin-Realm.", + "misp-attribute": "text", + "multiple": true, + "ui-priority": 0 + }, + "SessionId": { + "description": "Session-ID.", + "misp-attribute": "text", + "ui-priority": 0 + }, "Username": { "description": "Username (in this case, usually the IMSI).", "misp-attribute": "text", "multiple": true, "ui-priority": 0 }, - "IdrFlags": { - "description": "IDR-Flags.", - "misp-attribute": "text", + "category": { + "description": "Category.", "disable_correlation": true, + "misp-attribute": "text", + "sane_default": [ + "Cat0", + "Cat1", + "Cat2", + "Cat3", + "CatSMS" + ], + "ui-priority": 0 + }, + "first-seen": { + "description": "When the attack has been seen for the first time.", + "disable_correlation": true, + "misp-attribute": "datetime", "ui-priority": 0 }, "text": { "description": "A description of the attack seen.", "disable_correlation": true, - "ui-priority": 0, - "misp-attribute": "text" - }, - "first-seen": { - "description": "When the attack has been seen for the first time.", - "disable_correlation": true, - "ui-priority": 0, - "misp-attribute": "datetime" + "misp-attribute": "text", + "ui-priority": 0 } }, - "version": 1, "description": "Attack as seen on diameter authentication against a GSM, UMTS or LTE network", "meta-category": "network", + "name": "diameter-attack", + "requiredOneOf": [ + "text" + ], "uuid": "a3fdce4c-8e21-4acc-ab8e-9976e9165a12", - "name": "diameter-attack" -} + "version": 1 +} \ No newline at end of file diff --git a/objects/dns-record/definition.json b/objects/dns-record/definition.json index 8c4d5c1..12ef92a 100644 --- a/objects/dns-record/definition.json +++ b/objects/dns-record/definition.json @@ -1,4 +1,54 @@ { + "attributes": { + "a-record": { + "categories": [ + "Network activity", + "External analysis" + ], + "description": "IP Address sassociated with A Records", + "misp-attribute": "ip-dst", + "multiple": true, + "ui-priority": 1 + }, + "mx-record": { + "categories": [ + "Network activity", + "External analysis" + ], + "description": "Domain associated with MX Record", + "misp-attribute": "domain", + "multiple": true, + "ui-priority": 1 + }, + "ns-record": { + "categories": [ + "Network activity", + "External analysis" + ], + "description": "Domain associated with NS Records", + "misp-attribute": "domain", + "multiple": true, + "ui-priority": 1 + }, + "queried-domain": { + "categories": [ + "Network activity", + "External analysis" + ], + "description": "Domain name", + "misp-attribute": "domain", + "ui-priority": 1 + }, + "text": { + "description": "A description of the records", + "misp-attribute": "text", + "recommended": false, + "ui-priority": 1 + } + }, + "description": "A set of dns records observed for a specific domain.", + "meta-category": "network", + "name": "dns-record", "required": [ "queried-domain" ], @@ -7,56 +57,6 @@ "mx-record", "ns-record" ], - "attributes": { - "text": { - "description": "A description of the records", - "ui-priority": 1, - "misp-attribute": "text", - "recommended": false - }, - "queried-domain": { - "description": "Domain name", - "categories": [ - "Network activity", - "External analysis" - ], - "ui-priority": 1, - "misp-attribute": "domain" - }, - "a-record": { - "description": "IP Address sassociated with A Records", - "categories": [ - "Network activity", - "External analysis" - ], - "ui-priority": 1, - "misp-attribute": "ip-dst", - "multiple": true - }, - "mx-record": { - "description": "Domain associated with MX Record", - "categories": [ - "Network activity", - "External analysis" - ], - "ui-priority": 1, - "misp-attribute": "domain", - "multiple": true - }, - "ns-record": { - "description": "Domain associated with NS Records", - "categories": [ - "Network activity", - "External analysis" - ], - "ui-priority": 1, - "misp-attribute": "domain", - "multiple": true - } - }, - "version": 1, - "description": "A set of dns records observed for a specific domain.", - "meta-category": "network", "uuid": "f023c8f0-81ab-41f3-9f5d-fa597a34a9b9", - "name": "dns-record" -} + "version": 1 +} \ No newline at end of file diff --git a/objects/domain-crawled/definition.json b/objects/domain-crawled/definition.json index 4c89e6e..8e0de46 100644 --- a/objects/domain-crawled/definition.json +++ b/objects/domain-crawled/definition.json @@ -1,38 +1,38 @@ { - "required": [ - "domain" - ], "attributes": { + "domain": { + "categories": [ + "Network activity", + "External analysis" + ], + "description": "Domain name", + "misp-attribute": "domain", + "ui-priority": 1 + }, "text": { "description": "A description of the tuple", "disable_correlation": true, - "ui-priority": 1, "misp-attribute": "text", - "recommended": false - }, - "domain": { - "description": "Domain name", - "categories": [ - "Network activity", - "External analysis" - ], - "ui-priority": 1, - "misp-attribute": "domain" + "recommended": false, + "ui-priority": 1 }, "url": { - "description": "domain url", "categories": [ "Network activity", "External analysis" ], - "ui-priority": 1, + "description": "domain url", "misp-attribute": "url", - "multiple": true + "multiple": true, + "ui-priority": 1 } }, - "version": 2, "description": "A domain crawled over time", "meta-category": "network", + "name": "domain-crawled", + "required": [ + "domain" + ], "uuid": "bad4888d-c44e-4612-b08f-3d97c1e0014a", - "name": "domain-crawled" -} + "version": 2 +} \ No newline at end of file diff --git a/objects/domain-ip/definition.json b/objects/domain-ip/definition.json index f5fc64a..f780dbe 100644 --- a/objects/domain-ip/definition.json +++ b/objects/domain-ip/definition.json @@ -1,68 +1,68 @@ { - "required": [ - "ip", - "domain" - ], "attributes": { - "text": { - "description": "A description of the tuple", - "disable_correlation": true, - "ui-priority": 1, - "misp-attribute": "text", - "recommended": false - }, - "last-seen": { - "description": "Last time the tuple has been seen", - "disable_correlation": true, - "ui-priority": 0, - "misp-attribute": "datetime" + "domain": { + "categories": [ + "Network activity", + "External analysis" + ], + "description": "Domain name", + "misp-attribute": "domain", + "multiple": true, + "ui-priority": 1 }, "first-seen": { "description": "First time the tuple has been seen", "disable_correlation": true, - "ui-priority": 0, - "misp-attribute": "datetime" + "misp-attribute": "datetime", + "ui-priority": 0 + }, + "ip": { + "categories": [ + "Network activity", + "External analysis" + ], + "description": "IP Address", + "misp-attribute": "ip-dst", + "multiple": true, + "ui-priority": 1 + }, + "last-seen": { + "description": "Last time the tuple has been seen", + "disable_correlation": true, + "misp-attribute": "datetime", + "ui-priority": 0 + }, + "port": { + "categories": [ + "Network activity", + "External analysis" + ], + "description": "Associated TCP port with the domain", + "misp-attribute": "port", + "multiple": true, + "ui-priority": 1 }, "registration-date": { "description": "Registration date of domain", "disable_correlation": false, - "ui-priority": 0, - "misp-attribute": "datetime" + "misp-attribute": "datetime", + "ui-priority": 0 }, - "domain": { - "description": "Domain name", - "categories": [ - "Network activity", - "External analysis" - ], - "ui-priority": 1, - "misp-attribute": "domain", - "multiple": true - }, - "ip": { - "description": "IP Address", - "categories": [ - "Network activity", - "External analysis" - ], - "ui-priority": 1, - "misp-attribute": "ip-dst", - "multiple": true - }, - "port": { - "description": "Associated TCP port with the domain", - "categories": [ - "Network activity", - "External analysis" - ], - "ui-priority": 1, - "misp-attribute": "port", - "multiple": true + "text": { + "description": "A description of the tuple", + "disable_correlation": true, + "misp-attribute": "text", + "recommended": false, + "ui-priority": 1 } }, - "version": 8, "description": "A domain and IP address seen as a tuple in a specific time frame.", "meta-category": "network", + "name": "domain-ip", + "required": [ + "ip", + "domain" + ], "uuid": "43b3b146-77eb-4931-b4cc-b66c60f28734", - "name": "domain-ip" -} + "version": 8 +} \ No newline at end of file diff --git a/objects/elf-section/definition.json b/objects/elf-section/definition.json index 97e049b..f891881 100644 --- a/objects/elf-section/definition.json +++ b/objects/elf-section/definition.json @@ -1,95 +1,116 @@ { - "requiredOneOf": [ - "text", - "name", - "md5", - "sha1", - "sha224", - "sha256", - "sha384", - "sha512", - "sha512/224", - "sha512/256" - ], "attributes": { - "md5": { - "description": "[Insecure] MD5 hash (128 bits)", - "ui-priority": 1, - "misp-attribute": "md5", - "recommended": false - }, - "sha1": { - "description": "[Insecure] Secure Hash Algorithm 1 (160 bits)", - "ui-priority": 1, - "misp-attribute": "sha1", - "recommended": false - }, - "sha224": { - "description": "Secure Hash Algorithm 2 (224 bits)", - "ui-priority": 0, - "misp-attribute": "sha224", - "recommended": false - }, - "sha256": { - "description": "Secure Hash Algorithm 2 (256 bits)", - "ui-priority": 1, - "misp-attribute": "sha256" - }, - "sha384": { - "description": "Secure Hash Algorithm 2 (384 bits)", - "ui-priority": 0, - "misp-attribute": "sha384", - "recommended": false - }, - "sha512": { - "description": "Secure Hash Algorithm 2 (512 bits)", - "ui-priority": 1, - "misp-attribute": "sha512" - }, - "sha512/224": { - "description": "Secure Hash Algorithm 2 (224 bits)", - "ui-priority": 0, - "misp-attribute": "sha512/224", - "recommended": false - }, - "sha512/256": { - "description": "Secure Hash Algorithm 2 (256 bits)", - "ui-priority": 0, - "misp-attribute": "sha512/256", - "recommended": false - }, - "ssdeep": { - "description": "Fuzzy hash using context triggered piecewise hashes (CTPH)", - "ui-priority": 0, - "misp-attribute": "ssdeep" - }, "entropy": { "description": "Entropy of the whole section", "disable_correlation": true, - "ui-priority": 0, - "misp-attribute": "float" + "misp-attribute": "float", + "ui-priority": 0 + }, + "flag": { + "description": "Flag of the section", + "disable_correlation": true, + "misp-attribute": "text", + "multiple": true, + "sane_default": [ + "ALLOC", + "EXCLUDE", + "EXECINSTR", + "GROUP", + "HEX_GPREL", + "INFO_LINK", + "LINK_ORDER", + "MASKOS", + "MASKPROC", + "MERGE", + "MIPS_ADDR", + "MIPS_LOCAL", + "MIPS_MERGE", + "MIPS_NAMES", + "MIPS_NODUPES", + "MIPS_NOSTRIP", + "NONE", + "OS_NONCONFORMING", + "STRINGS", + "TLS", + "WRITE", + "XCORE_SHF_CP_SECTION" + ], + "ui-priority": 0 + }, + "md5": { + "description": "[Insecure] MD5 hash (128 bits)", + "misp-attribute": "md5", + "recommended": false, + "ui-priority": 1 }, "name": { "description": "Name of the section", "disable_correlation": true, - "ui-priority": 1, - "misp-attribute": "text" + "misp-attribute": "text", + "ui-priority": 1 + }, + "sha1": { + "description": "[Insecure] Secure Hash Algorithm 1 (160 bits)", + "misp-attribute": "sha1", + "recommended": false, + "ui-priority": 1 + }, + "sha224": { + "description": "Secure Hash Algorithm 2 (224 bits)", + "misp-attribute": "sha224", + "recommended": false, + "ui-priority": 0 + }, + "sha256": { + "description": "Secure Hash Algorithm 2 (256 bits)", + "misp-attribute": "sha256", + "ui-priority": 1 + }, + "sha384": { + "description": "Secure Hash Algorithm 2 (384 bits)", + "misp-attribute": "sha384", + "recommended": false, + "ui-priority": 0 + }, + "sha512": { + "description": "Secure Hash Algorithm 2 (512 bits)", + "misp-attribute": "sha512", + "ui-priority": 1 + }, + "sha512/224": { + "description": "Secure Hash Algorithm 2 (224 bits)", + "misp-attribute": "sha512/224", + "recommended": false, + "ui-priority": 0 + }, + "sha512/256": { + "description": "Secure Hash Algorithm 2 (256 bits)", + "misp-attribute": "sha512/256", + "recommended": false, + "ui-priority": 0 }, "size-in-bytes": { "description": "Size of the section, in bytes", "disable_correlation": true, - "ui-priority": 1, - "misp-attribute": "size-in-bytes" + "misp-attribute": "size-in-bytes", + "ui-priority": 1 + }, + "ssdeep": { + "description": "Fuzzy hash using context triggered piecewise hashes (CTPH)", + "misp-attribute": "ssdeep", + "ui-priority": 0 }, "text": { "description": "Free text value to attach to the section", "disable_correlation": true, - "ui-priority": 1, "misp-attribute": "text", - "recommended": false + "recommended": false, + "ui-priority": 1 }, "type": { "description": "Type of the section", + "disable_correlation": true, + "misp-attribute": "text", "sane_default": [ "NULL", "PROGBITS", @@ -127,45 +148,24 @@ "LOUSER", "HIUSER" ], - "disable_correlation": true, - "ui-priority": 0, - "misp-attribute": "text" - }, - "flag": { - "description": "Flag of the section", - "sane_default": [ - "ALLOC", - "EXCLUDE", - "EXECINSTR", - "GROUP", - "HEX_GPREL", - "INFO_LINK", - "LINK_ORDER", - "MASKOS", - "MASKPROC", - "MERGE", - "MIPS_ADDR", - "MIPS_LOCAL", - "MIPS_MERGE", - "MIPS_NAMES", - "MIPS_NODUPES", - "MIPS_NOSTRIP", - "NONE", - "OS_NONCONFORMING", - "STRINGS", - "TLS", - "WRITE", - "XCORE_SHF_CP_SECTION" - ], - "disable_correlation": true, - "ui-priority": 0, - "misp-attribute": "text", - "multiple": true + "ui-priority": 0 } }, - "version": 4, "description": "Object describing a section of an Executable and Linkable Format", "meta-category": "file", + "name": "elf-section", + "requiredOneOf": [ + "text", + "name", + "md5", + "sha1", + "sha224", + "sha256", + "sha384", + "sha512", + "sha512/224", + "sha512/256" + ], "uuid": "ca271f32-1234-4e87-b240-6b6e882de5de", - "name": "elf-section" -} + "version": 4 +} \ No newline at end of file diff --git a/objects/elf/definition.json b/objects/elf/definition.json index 34ee8c7..b6ba345 100644 --- a/objects/elf/definition.json +++ b/objects/elf/definition.json @@ -1,38 +1,9 @@ { - "requiredOneOf": [ - "text", - "entrypoint-address" - ], "attributes": { - "entrypoint-address": { - "description": "Address of the entry point", - "disable_correlation": true, - "ui-priority": 0, - "misp-attribute": "text" - }, - "type": { - "description": "Type of ELF", - "sane_default": [ - "CORE", - "DYNAMIC", - "EXECUTABLE", - "HIPROC", - "LOPROC", - "NONE", - "RELOCATABLE" - ], - "ui-priority": 0, - "misp-attribute": "text", - "disable_correlation": true - }, - "number-sections": { - "description": "Number of sections", - "disable_correlation": true, - "ui-priority": 0, - "misp-attribute": "counter" - }, "arch": { "description": "Architecture of the ELF file", + "disable_correlation": true, + "misp-attribute": "text", "sane_default": [ "None", "M32", @@ -210,12 +181,24 @@ "CSR_KALIMBA", "AMDGPU" ], - "ui-priority": 0, + "ui-priority": 0 + }, + "entrypoint-address": { + "description": "Address of the entry point", + "disable_correlation": true, "misp-attribute": "text", - "disable_correlation": true + "ui-priority": 0 + }, + "number-sections": { + "description": "Number of sections", + "disable_correlation": true, + "misp-attribute": "counter", + "ui-priority": 0 }, "os_abi": { "description": "Header operating system application binary interface (ABI)", + "disable_correlation": true, + "misp-attribute": "text", "sane_default": [ "AIX", "ARM", @@ -239,21 +222,38 @@ "SYSTEMV", "TRU64" ], - "ui-priority": 0, - "misp-attribute": "text", - "disable_correlation": true + "ui-priority": 0 }, "text": { "description": "Free text value to attach to the ELF", "disable_correlation": true, - "ui-priority": 1, "misp-attribute": "text", - "recommended": false + "recommended": false, + "ui-priority": 1 + }, + "type": { + "description": "Type of ELF", + "disable_correlation": true, + "misp-attribute": "text", + "sane_default": [ + "CORE", + "DYNAMIC", + "EXECUTABLE", + "HIPROC", + "LOPROC", + "NONE", + "RELOCATABLE" + ], + "ui-priority": 0 } }, - "version": 5, "description": "Object describing a Executable and Linkable Format", "meta-category": "file", + "name": "elf", + "requiredOneOf": [ + "text", + "entrypoint-address" + ], "uuid": "fa6534ae-ad74-4ce0-8f23-15a66c82c7fa", - "name": "elf" -} + "version": 5 +} \ No newline at end of file diff --git a/objects/email/definition.json b/objects/email/definition.json index f984e0a..30191bd 100644 --- a/objects/email/definition.json +++ b/objects/email/definition.json @@ -1,195 +1,193 @@ { - "name": "email", - "uuid": "a0c666e0-fc65-4be8-b48f-3423d788b552", - "meta-category": "network", - "description": "Email object describing an email with meta-information", - "version": 15, "attributes": { - "reply-to": { - "description": "Email address the reply will be sent to", - "misp-attribute": "email-reply-to", - "ui-priority": 1, - "categories": [ - "Payload delivery" - ] - }, - "message-id": { - "description": "Message ID", - "misp-attribute": "email-message-id", - "disable_correlation": true, - "ui-priority": 0, - "categories": [ - "Payload delivery" - ] - }, - "to": { - "description": "Destination email address", - "misp-attribute": "email-dst", - "disable_correlation": true, - "ui-priority": 1, - "categories": [ - "Payload delivery" - ], - "multiple": true - }, - "cc": { - "description": "Carbon copy", - "misp-attribute": "email-dst", - "disable_correlation": true, - "ui-priority": 1, - "categories": [ - "Payload delivery" - ], - "multiple": true - }, - "to-display-name": { - "description": "Display name of the receiver", - "misp-attribute": "email-dst-display-name", - "ui-priority": 1, - "categories": [ - "Payload delivery" - ], - "multiple": true - }, - "subject": { - "description": "Subject", - "misp-attribute": "email-subject", - "ui-priority": 1, - "categories": [ - "Payload delivery" - ], - "multiple": true - }, - "screenshot": { - "description": "Screenshot of email", - "misp-attribute": "attachment", - "disable_correlation": true, - "ui-priority": 1, - "categories": [ - "External analysis" - ] - }, "attachment": { + "categories": [ + "Payload delivery" + ], "description": "Attachment", "misp-attribute": "email-attachment", - "ui-priority": 0, + "multiple": true, + "ui-priority": 0 + }, + "cc": { "categories": [ "Payload delivery" ], - "multiple": true - }, - "received-header-ip": { - "description": "Extracted IP address from parsed headers", - "misp-attribute": "ip-src", - "ui-priority": 0, - "multiple": true - }, - "received-header-hostname": { - "description": "Extracted hostname from parsed headers", - "misp-attribute": "hostname", - "ui-priority": 0, - "multiple": true - }, - "x-mailer": { - "description": "X-Mailer generally tells the program that was used to draft and send the original email", - "misp-attribute": "email-x-mailer", + "description": "Carbon copy", "disable_correlation": true, - "ui-priority": 0, - "categories": [ - "Payload delivery" - ] - }, - "header": { - "description": "Full headers", - "misp-attribute": "email-header", - "disable_correlation": true, - "ui-priority": 0, - "categories": [ - "Payload delivery" - ], - "multiple": true - }, - "send-date": { - "description": "Date the email has been sent", - "misp-attribute": "datetime", - "ui-priority": 0, - "disable_correlation": true, - "categories": [ - "Other" - ] - }, - "mime-boundary": { - "description": "MIME Boundary", - "misp-attribute": "email-mime-boundary", - "disable_correlation": true, - "ui-priority": 0, - "categories": [ - "Payload delivery" - ] - }, - "thread-index": { - "description": "Identifies a particular conversation thread", - "misp-attribute": "email-thread-index", - "disable_correlation": true, - "ui-priority": 0, - "categories": [ - "Payload delivery" - ] - }, - "from": { - "description": "Sender email address", - "misp-attribute": "email-src", - "ui-priority": 1, - "categories": [ - "Payload delivery" - ], - "multiple": true - }, - "return-path": { - "description": "Message return path", - "misp-attribute": "email-src", - "ui-priority": 1, - "categories": [ - "Payload delivery" - ] - }, - "from-display-name": { - "description": "Display name of the sender", - "misp-attribute": "email-src-display-name", - "ui-priority": 1, - "categories": [ - "Payload delivery" - ], - "multiple": true + "misp-attribute": "email-dst", + "multiple": true, + "ui-priority": 1 }, "email-body": { - "description": "Body of the email", - "misp-attribute": "email-body", - "disable_correlation": true, - "ui-priority": 1, "categories": [ "Payload delivery" - ] + ], + "description": "Body of the email", + "disable_correlation": true, + "misp-attribute": "email-body", + "ui-priority": 1 }, - "user-agent": { - "description": "User Agent of the sender", - "misp-attribute": "text", - "ui-priority": 0, - "disable_correlation": true + "eml": { + "description": "Full EML", + "disable_correlation": true, + "misp-attribute": "attachment", + "ui-priority": 1 + }, + "from": { + "categories": [ + "Payload delivery" + ], + "description": "Sender email address", + "misp-attribute": "email-src", + "multiple": true, + "ui-priority": 1 + }, + "from-display-name": { + "categories": [ + "Payload delivery" + ], + "description": "Display name of the sender", + "misp-attribute": "email-src-display-name", + "multiple": true, + "ui-priority": 1 + }, + "header": { + "categories": [ + "Payload delivery" + ], + "description": "Full headers", + "disable_correlation": true, + "misp-attribute": "email-header", + "multiple": true, + "ui-priority": 0 }, "ip-src": { "description": "Source IP address of the email sender", "misp-attribute": "ip-src", - "ui-priority": 0, - "multiple": true + "multiple": true, + "ui-priority": 0 }, - "eml": { - "description": "Full EML", - "misp-attribute": "attachment", + "message-id": { + "categories": [ + "Payload delivery" + ], + "description": "Message ID", "disable_correlation": true, + "misp-attribute": "email-message-id", + "ui-priority": 0 + }, + "mime-boundary": { + "categories": [ + "Payload delivery" + ], + "description": "MIME Boundary", + "disable_correlation": true, + "misp-attribute": "email-mime-boundary", + "ui-priority": 0 + }, + "received-header-hostname": { + "description": "Extracted hostname from parsed headers", + "misp-attribute": "hostname", + "multiple": true, + "ui-priority": 0 + }, + "received-header-ip": { + "description": "Extracted IP address from parsed headers", + "misp-attribute": "ip-src", + "multiple": true, + "ui-priority": 0 + }, + "reply-to": { + "categories": [ + "Payload delivery" + ], + "description": "Email address the reply will be sent to", + "misp-attribute": "email-reply-to", "ui-priority": 1 + }, + "return-path": { + "categories": [ + "Payload delivery" + ], + "description": "Message return path", + "misp-attribute": "email-src", + "ui-priority": 1 + }, + "screenshot": { + "categories": [ + "External analysis" + ], + "description": "Screenshot of email", + "disable_correlation": true, + "misp-attribute": "attachment", + "ui-priority": 1 + }, + "send-date": { + "categories": [ + "Other" + ], + "description": "Date the email has been sent", + "disable_correlation": true, + "misp-attribute": "datetime", + "ui-priority": 0 + }, + "subject": { + "categories": [ + "Payload delivery" + ], + "description": "Subject", + "misp-attribute": "email-subject", + "multiple": true, + "ui-priority": 1 + }, + "thread-index": { + "categories": [ + "Payload delivery" + ], + "description": "Identifies a particular conversation thread", + "disable_correlation": true, + "misp-attribute": "email-thread-index", + "ui-priority": 0 + }, + "to": { + "categories": [ + "Payload delivery" + ], + "description": "Destination email address", + "disable_correlation": true, + "misp-attribute": "email-dst", + "multiple": true, + "ui-priority": 1 + }, + "to-display-name": { + "categories": [ + "Payload delivery" + ], + "description": "Display name of the receiver", + "misp-attribute": "email-dst-display-name", + "multiple": true, + "ui-priority": 1 + }, + "user-agent": { + "description": "User Agent of the sender", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 0 + }, + "x-mailer": { + "categories": [ + "Payload delivery" + ], + "description": "X-Mailer generally tells the program that was used to draft and send the original email", + "disable_correlation": true, + "misp-attribute": "email-x-mailer", + "ui-priority": 0 } }, + "description": "Email object describing an email with meta-information", + "meta-category": "network", + "name": "email", "requiredOneOf": [ "from", "from-display-name", @@ -207,5 +205,7 @@ "return-path", "email-body", "eml" - ] -} + ], + "uuid": "a0c666e0-fc65-4be8-b48f-3423d788b552", + "version": 15 +} \ No newline at end of file diff --git a/objects/employee/definition.json b/objects/employee/definition.json index 8db5a4e..5f68ad3 100644 --- a/objects/employee/definition.json +++ b/objects/employee/definition.json @@ -1,53 +1,21 @@ { - "required": [ - "email-address" - ], "attributes": { - "text": { - "description": "A description of the person or identity.", - "disable_correlation": true, - "ui-priority": 1, - "misp-attribute": "text" - }, - "last-name": { - "description": "Last name Employee", - "disable_correlation": true, - "ui-priority": 0, - "misp-attribute": "last-name" - }, - "first-name": { - "description": "First name of Employee", - "disable_correlation": true, - "ui-priority": 0, - "misp-attribute": "first-name" - }, - "email-address": { - "description": "Employee Email Address", - "ui-priority": 0, - "misp-attribute": "target-email" - }, - "userid": { - "description": "EMployee user identification", - "disable_correlation": true, - "ui-priority": 0, - "misp-attribute": "target-user" - }, - "primary-asset": { - "description": "Asset tag of the primary asset assigned to employee", - "ui-priority": 0, - "misp-attribute": "target-machine" - }, "business-unit": { "description": "the organizational business unit associated with the employee", "disable_correlation": true, - "ui-priority": 0, - "misp-attribute": "target-org" + "misp-attribute": "target-org", + "ui-priority": 0 + }, + "email-address": { + "description": "Employee Email Address", + "misp-attribute": "target-email", + "ui-priority": 0 }, "employee-type": { "description": "type of employee", "disable_correlation": true, - "ui-priority": 0, "misp-attribute": "text", + "ui-priority": 0, "values_list": [ "Mid-Level Manager", "Senior Manager", @@ -56,11 +24,43 @@ "First-Line Manager", "Director" ] + }, + "first-name": { + "description": "First name of Employee", + "disable_correlation": true, + "misp-attribute": "first-name", + "ui-priority": 0 + }, + "last-name": { + "description": "Last name Employee", + "disable_correlation": true, + "misp-attribute": "last-name", + "ui-priority": 0 + }, + "primary-asset": { + "description": "Asset tag of the primary asset assigned to employee", + "misp-attribute": "target-machine", + "ui-priority": 0 + }, + "text": { + "description": "A description of the person or identity.", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 1 + }, + "userid": { + "description": "EMployee user identification", + "disable_correlation": true, + "misp-attribute": "target-user", + "ui-priority": 0 } }, - "version": 1, "description": "An employee and related data points", "meta-category": "misc", + "name": "employee", + "required": [ + "email-address" + ], "uuid": "443b2f15-d7c9-4d3d-bfd2-38f099753e83", - "name": "employee" -} + "version": 1 +} \ No newline at end of file diff --git a/objects/exploit-poc/definition.json b/objects/exploit-poc/definition.json index 55d9bc7..b3d9818 100644 --- a/objects/exploit-poc/definition.json +++ b/objects/exploit-poc/definition.json @@ -1,45 +1,45 @@ { + "attributes": { + "author": { + "description": "Author of the exploit - proof of concept", + "disable_correlation": true, + "misp-attribute": "text", + "multiple": true, + "ui-priority": 0 + }, + "description": { + "description": "Description of the exploit - proof of concept", + "misp-attribute": "text", + "ui-priority": 0 + }, + "poc": { + "description": "Proof of Concept or exploit (as a script, binary or described process)", + "disable_correlation": true, + "misp-attribute": "attachment", + "multiple": true, + "ui-priority": 0 + }, + "references": { + "description": "External references", + "misp-attribute": "link", + "multiple": true, + "ui-priority": 0 + }, + "vulnerable_configuration": { + "description": "The vulnerable configuration described in CPE format where the exploit/proof of concept is valid", + "misp-attribute": "text", + "multiple": true, + "ui-priority": 0 + } + }, + "description": "Exploit-poc object describing a proof of concept or exploit of a vulnerability. This object has often a relationship with a vulnerability object.", + "meta-category": "vulnerability", + "name": "exploit-poc", "requiredOneOf": [ "vulnerable_configuration", "description", "poc" ], - "attributes": { - "description": { - "description": "Description of the exploit - proof of concept", - "ui-priority": 0, - "misp-attribute": "text" - }, - "vulnerable_configuration": { - "description": "The vulnerable configuration described in CPE format where the exploit/proof of concept is valid", - "multiple": true, - "ui-priority": 0, - "misp-attribute": "text" - }, - "author": { - "description": "Author of the exploit - proof of concept", - "ui-priority": 0, - "disable_correlation": true, - "misp-attribute": "text", - "multiple": true - }, - "references": { - "description": "External references", - "multiple": true, - "ui-priority": 0, - "misp-attribute": "link" - }, - "poc": { - "description": "Proof of Concept or exploit (as a script, binary or described process)", - "ui-priority": 0, - "misp-attribute": "attachment", - "disable_correlation": true, - "multiple": true - } - }, - "version": 2, - "description": "Exploit-poc object describing a proof of concept or exploit of a vulnerability. This object has often a relationship with a vulnerability object.", - "meta-category": "vulnerability", "uuid": "e3bdeef8-78c3-48d8-9c2f-1be5e5bde93b", - "name": "exploit-poc" -} + "version": 2 +} \ No newline at end of file diff --git a/objects/facial-composite/definition.json b/objects/facial-composite/definition.json index 585f4ee..997c339 100644 --- a/objects/facial-composite/definition.json +++ b/objects/facial-composite/definition.json @@ -1,19 +1,16 @@ { - "requiredOneOf": [ - "facial-composite", - "text" - ], "attributes": { - "text": { - "description": "A description of the facial composite.", - "disable_correlation": true, - "ui-priority": 1, - "misp-attribute": "text" + "facial-composite": { + "description": "Facial composite image.", + "misp-attribute": "attachment", + "multiple": true, + "ui-priority": 10 }, "technique": { "description": "Construction technique of the facial composite.", - "ui-priority": 0, + "disable_correlation": true, "misp-attribute": "text", + "ui-priority": 0, "values_list": [ "E-FIT", "PROfit", @@ -21,19 +18,22 @@ "Photofit", "EvoFIT", "PortraitPad" - ], - "disable_correlation": true + ] }, - "facial-composite": { - "description": "Facial composite image.", - "ui-priority": 10, - "misp-attribute": "attachment", - "multiple": true + "text": { + "description": "A description of the facial composite.", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 1 } }, - "version": 1, "description": "An object which describes a facial composite.", "meta-category": "misc", + "name": "facial-composite", + "requiredOneOf": [ + "facial-composite", + "text" + ], "uuid": "d727bc27-d1b9-4754-972c-dea305bd5976", - "name": "facial-composite" -} + "version": 1 +} \ No newline at end of file diff --git a/objects/fail2ban/definition.json b/objects/fail2ban/definition.json index 90b0151..3519740 100644 --- a/objects/fail2ban/definition.json +++ b/objects/fail2ban/definition.json @@ -1,61 +1,61 @@ { + "attributes": { + "attack-type": { + "description": "Type of the attack", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 1 + }, + "banned-ip": { + "description": "IP Address banned by fail2ban", + "misp-attribute": "ip-src", + "ui-priority": 1 + }, + "failures": { + "description": "Amount of failures that lead to the ban.", + "disable_correlation": true, + "misp-attribute": "counter", + "ui-priority": 1 + }, + "logfile": { + "description": "Full logfile related to the attack.", + "disable_correlation": true, + "misp-attribute": "attachment", + "ui-priority": 1 + }, + "logline": { + "description": "Example log line that caused the ban.", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 1 + }, + "processing-timestamp": { + "description": "Timestamp of the report", + "disable_correlation": true, + "misp-attribute": "datetime", + "ui-priority": 1 + }, + "sensor": { + "description": "Identifier of the sensor", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 1 + }, + "victim": { + "description": "Identifier of the victim", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 1 + } + }, + "description": "Fail2ban event", + "meta-category": "network", + "name": "fail2ban", "required": [ "banned-ip", "processing-timestamp", "attack-type" ], - "attributes": { - "banned-ip": { - "description": "IP Address banned by fail2ban", - "ui-priority": 1, - "misp-attribute": "ip-src" - }, - "processing-timestamp": { - "description": "Timestamp of the report", - "ui-priority": 1, - "misp-attribute": "datetime", - "disable_correlation": true - }, - "attack-type": { - "description": "Type of the attack", - "ui-priority": 1, - "misp-attribute": "text", - "disable_correlation": true - }, - "failures": { - "description": "Amount of failures that lead to the ban.", - "ui-priority": 1, - "misp-attribute": "counter", - "disable_correlation": true - }, - "sensor": { - "description": "Identifier of the sensor", - "ui-priority": 1, - "misp-attribute": "text", - "disable_correlation": true - }, - "victim": { - "description": "Identifier of the victim", - "ui-priority": 1, - "misp-attribute": "text", - "disable_correlation": true - }, - "logline": { - "description": "Example log line that caused the ban.", - "ui-priority": 1, - "misp-attribute": "text", - "disable_correlation": true - }, - "logfile": { - "description": "Full logfile related to the attack.", - "ui-priority": 1, - "misp-attribute": "attachment", - "disable_correlation": true - } - }, - "version": 5, - "description": "Fail2ban event", - "meta-category": "network", "uuid": "8be2271-7326-41a5-a0dd-9b4bec88e1ba", - "name": "fail2ban" -} + "version": 5 +} \ No newline at end of file diff --git a/objects/file/definition.json b/objects/file/definition.json index 07897ae..eed1408 100644 --- a/objects/file/definition.json +++ b/objects/file/definition.json @@ -1,185 +1,36 @@ { - "requiredOneOf": [ - "filename", - "size-in-bytes", - "authentihash", - "ssdeep", - "md5", - "sha1", - "sha224", - "sha256", - "sha384", - "sha512", - "sha512/224", - "sha512/256", - "tlsh", - "pattern-in-file", - "certificate", - "malware-sample", - "attachment", - "path", - "fullpath" - ], "attributes": { - "md5": { - "description": "[Insecure] MD5 hash (128 bits)", - "ui-priority": 1, - "misp-attribute": "md5", - "recommended": false - }, - "sha1": { - "description": "[Insecure] Secure Hash Algorithm 1 (160 bits)", - "ui-priority": 1, - "misp-attribute": "sha1", - "recommended": false - }, - "sha224": { - "description": "Secure Hash Algorithm 2 (224 bits)", - "ui-priority": 0, - "misp-attribute": "sha224", - "recommended": false - }, - "sha256": { - "description": "Secure Hash Algorithm 2 (256 bits)", - "ui-priority": 1, - "misp-attribute": "sha256" - }, - "sha384": { - "description": "Secure Hash Algorithm 2 (384 bits)", - "ui-priority": 0, - "misp-attribute": "sha384", - "recommended": false - }, - "sha512": { - "description": "Secure Hash Algorithm 2 (512 bits)", - "ui-priority": 1, - "misp-attribute": "sha512" - }, - "sha512/224": { - "description": "Secure Hash Algorithm 2 (224 bits)", - "ui-priority": 0, - "misp-attribute": "sha512/224", - "recommended": false - }, - "sha512/256": { - "description": "Secure Hash Algorithm 2 (256 bits)", - "ui-priority": 0, - "misp-attribute": "sha512/256", - "recommended": false - }, - "ssdeep": { - "description": "Fuzzy hash using context triggered piecewise hashes (CTPH)", - "ui-priority": 0, - "misp-attribute": "ssdeep" + "attachment": { + "description": "A non-malicious file.", + "misp-attribute": "attachment", + "ui-priority": 1 }, "authentihash": { "description": "Authenticode executable signature hash", - "ui-priority": 0, "misp-attribute": "authentihash", - "recommended": false + "recommended": false, + "ui-priority": 0 }, - "size-in-bytes": { - "description": "Size of the file, in bytes", - "disable_correlation": true, - "ui-priority": 0, - "misp-attribute": "size-in-bytes" + "certificate": { + "description": "Certificate value if the binary is signed with another authentication scheme than authenticode", + "misp-attribute": "x509-fingerprint-sha1", + "ui-priority": 0 + }, + "compilation-timestamp": { + "description": "Compilation timestamp", + "misp-attribute": "datetime", + "ui-priority": 0 }, "entropy": { "description": "Entropy of the whole file", "disable_correlation": true, - "ui-priority": 1, - "misp-attribute": "float" - }, - "pattern-in-file": { - "description": "Pattern that can be found in the file", - "categories": [ - "Artifacts dropped", - "Payload installation", - "External analysis" - ], - "ui-priority": 1, - "misp-attribute": "pattern-in-file", - "multiple": true - }, - "text": { - "description": "Free text value to attach to the file", - "disable_correlation": true, - "ui-priority": 1, - "misp-attribute": "text", - "recommended": false - }, - "malware-sample": { - "description": "The file itself (binary)", - "ui-priority": 1, - "misp-attribute": "malware-sample" - }, - "attachment": { - "description": "A non-malicious file.", - "ui-priority": 1, - "misp-attribute": "attachment" - }, - "filename": { - "description": "Filename on disk", - "disable_correlation": true, - "multiple": true, - "categories": [ - "Payload delivery", - "Artifacts dropped", - "Payload installation", - "External analysis" - ], - "ui-priority": 1, - "misp-attribute": "filename" - }, - "path": { - "description": "Path of the filename complete or partial", - "disable_correlation": true, - "multiple": true, - "ui-priority": 0, - "misp-attribute": "text" - }, - "fullpath": { - "description": "Complete path of the filename including the filename", - "multiple": true, - "ui-priority": 0, - "misp-attribute": "text" - }, - "tlsh": { - "description": "Fuzzy hash by Trend Micro: Locality Sensitive Hash", - "ui-priority": 0, - "misp-attribute": "tlsh" - }, - "certificate": { - "description": "Certificate value if the binary is signed with another authentication scheme than authenticode", - "ui-priority": 0, - "misp-attribute": "x509-fingerprint-sha1" - }, - "mimetype": { - "description": "Mime type", - "disable_correlation": true, - "ui-priority": 0, - "misp-attribute": "mime-type" - }, - "state": { - "misp-attribute": "text", - "ui-priority": 0, - "description": "State of the file", - "multiple": true, - "disable_correlation": true, - "values_list": [ - "Malicious", - "Harmless", - "Signed", - "Revoked", - "Expired", - "Trusted" - ] + "misp-attribute": "float", + "ui-priority": 1 }, "file-encoding": { - "misp-attribute": "text", - "ui-priority": 0, "description": "Encoding format of the file", "disable_correlation": true, + "misp-attribute": "text", "sane_default": [ "Adobe-Standard-Encoding", "Adobe-Symbol-Encoding", @@ -439,17 +290,166 @@ "windows-1258", "Windows-31J", "windows-874" + ], + "ui-priority": 0 + }, + "filename": { + "categories": [ + "Payload delivery", + "Artifacts dropped", + "Payload installation", + "External analysis" + ], + "description": "Filename on disk", + "disable_correlation": true, + "misp-attribute": "filename", + "multiple": true, + "ui-priority": 1 + }, + "fullpath": { + "description": "Complete path of the filename including the filename", + "misp-attribute": "text", + "multiple": true, + "ui-priority": 0 + }, + "malware-sample": { + "description": "The file itself (binary)", + "misp-attribute": "malware-sample", + "ui-priority": 1 + }, + "md5": { + "description": "[Insecure] MD5 hash (128 bits)", + "misp-attribute": "md5", + "recommended": false, + "ui-priority": 1 + }, + "mimetype": { + "description": "Mime type", + "disable_correlation": true, + "misp-attribute": "mime-type", + "ui-priority": 0 + }, + "path": { + "description": "Path of the filename complete or partial", + "disable_correlation": true, + "misp-attribute": "text", + "multiple": true, + "ui-priority": 0 + }, + "pattern-in-file": { + "categories": [ + "Artifacts dropped", + "Payload installation", + "External analysis" + ], + "description": "Pattern that can be found in the file", + "misp-attribute": "pattern-in-file", + "multiple": true, + "ui-priority": 1 + }, + "sha1": { + "description": "[Insecure] Secure Hash Algorithm 1 (160 bits)", + "misp-attribute": "sha1", + "recommended": false, + "ui-priority": 1 + }, + "sha224": { + "description": "Secure Hash Algorithm 2 (224 bits)", + "misp-attribute": "sha224", + "recommended": false, + "ui-priority": 0 + }, + "sha256": { + "description": "Secure Hash Algorithm 2 (256 bits)", + "misp-attribute": "sha256", + "ui-priority": 1 + }, + "sha384": { + "description": "Secure Hash Algorithm 2 (384 bits)", + "misp-attribute": "sha384", + "recommended": false, + "ui-priority": 0 + }, + "sha512": { + "description": "Secure Hash Algorithm 2 (512 bits)", + "misp-attribute": "sha512", + "ui-priority": 1 + }, + "sha512/224": { + "description": "Secure Hash Algorithm 2 (224 bits)", + "misp-attribute": "sha512/224", + "recommended": false, + "ui-priority": 0 + }, + "sha512/256": { + "description": "Secure Hash Algorithm 2 (256 bits)", + "misp-attribute": "sha512/256", + "recommended": false, + "ui-priority": 0 + }, + "size-in-bytes": { + "description": "Size of the file, in bytes", + "disable_correlation": true, + "misp-attribute": "size-in-bytes", + "ui-priority": 0 + }, + "ssdeep": { + "description": "Fuzzy hash using context triggered piecewise hashes (CTPH)", + "misp-attribute": "ssdeep", + "ui-priority": 0 + }, + "state": { + "description": "State of the file", + "disable_correlation": true, + "misp-attribute": "text", + "multiple": true, + "ui-priority": 0, + "values_list": [ + "Malicious", + "Harmless", + "Signed", + "Revoked", + "Expired", + "Trusted" ] }, - "compilation-timestamp": { - "description": "Compilation timestamp", - "ui-priority": 0, - "misp-attribute": "datetime" + "text": { + "description": "Free text value to attach to the file", + "disable_correlation": true, + "misp-attribute": "text", + "recommended": false, + "ui-priority": 1 + }, + "tlsh": { + "description": "Fuzzy hash by Trend Micro: Locality Sensitive Hash", + "misp-attribute": "tlsh", + "ui-priority": 0 } }, - "version": 20, "description": "File object describing a file with meta-information", "meta-category": "file", + "name": "file", + "requiredOneOf": [ + "filename", + "size-in-bytes", + "authentihash", + "ssdeep", + "md5", + "sha1", + "sha224", + "sha256", + "sha384", + "sha512", + "sha512/224", + "sha512/256", + "tlsh", + "pattern-in-file", + "certificate", + "malware-sample", + "attachment", + "path", + "fullpath" + ], "uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", - "name": "file" -} + "version": 20 +} \ No newline at end of file diff --git a/objects/forensic-case/definition.json b/objects/forensic-case/definition.json index a15b7c2..da0b805 100644 --- a/objects/forensic-case/definition.json +++ b/objects/forensic-case/definition.json @@ -1,47 +1,47 @@ { - "requiredOneOf": [ - "case-number" - ], "attributes": { - "case-number": { - "description": "Any unique number assigned to the case for unique identification.", - "ui-priority": 0, - "misp-attribute": "text" - }, - "case-name": { - "description": "Name to address the case.", - "ui-priority": 0, - "misp-attribute": "text" - }, - "name-of-the-analyst": { - "description": "Name(s) of the analyst assigned to the case.", - "multiple": true, - "ui-priority": 0, + "additional-comments": { + "description": "Comments.", + "disable_correlation": true, "misp-attribute": "text", - "disable_correlation": true - }, - "references": { - "description": "External references", - "multiple": true, - "ui-priority": 0, - "misp-attribute": "link" + "ui-priority": 0 }, "analysis-start-date": { "description": "Date when the analysis began.", - "ui-priority": 0, + "disable_correlation": true, "misp-attribute": "datetime", - "disable_correlation": true + "ui-priority": 0 }, - "additional-comments": { - "description": "Comments.", - "ui-priority": 0, + "case-name": { + "description": "Name to address the case.", "misp-attribute": "text", - "disable_correlation": true + "ui-priority": 0 + }, + "case-number": { + "description": "Any unique number assigned to the case for unique identification.", + "misp-attribute": "text", + "ui-priority": 0 + }, + "name-of-the-analyst": { + "description": "Name(s) of the analyst assigned to the case.", + "disable_correlation": true, + "misp-attribute": "text", + "multiple": true, + "ui-priority": 0 + }, + "references": { + "description": "External references", + "misp-attribute": "link", + "multiple": true, + "ui-priority": 0 } }, - "version": 1, "description": "An object template to describe a digital forensic case.", "meta-category": "misc", + "name": "forensic-case", + "requiredOneOf": [ + "case-number" + ], "uuid": "3ea36022-ae93-455e-88b1-d43aca789cac", - "name": "forensic-case" -} + "version": 1 +} \ No newline at end of file diff --git a/objects/forensic-evidence/definition.json b/objects/forensic-evidence/definition.json index 95e5398..5188280 100644 --- a/objects/forensic-evidence/definition.json +++ b/objects/forensic-evidence/definition.json @@ -1,43 +1,8 @@ { - "required": [ - "case-number", - "evidence-number" - ], "attributes": { - "case-number": { - "description": "A unique number assigned to the case for unique identification.", - "ui-priority": 0, - "misp-attribute": "text" - }, - "evidence-number": { - "description": "A unique number assigned to the evidence for unique identification.", - "ui-priority": 0, - "misp-attribute": "text" - }, - "type": { - "description": "Evidence type.", - "multiple": true, - "ui-priority": 0, - "misp-attribute": "text", - "sane_default": [ - "Computer", - "Network", - "Mobile Device", - "Multimedia", - "Cloud", - "IoT", - "Other" - ], - "disable_correlation": true - }, - "name": { - "description": "Name of the evidence acquired.", - "ui-priority": 0, - "misp-attribute": "text" - }, "acquisition-method": { "description": "Method used for acquisition of the evidence.", - "ui-priority": 0, + "disable_correlation": true, "misp-attribute": "text", "sane_default": [ "Live acquisition", @@ -48,11 +13,11 @@ "Chip-off", "Other" ], - "disable_correlation": true + "ui-priority": 0 }, "acquisition-tools": { "description": "Tools used for acquisition of the evidence.", - "ui-priority": 0, + "disable_correlation": true, "misp-attribute": "text", "multiple": true, "sane_default": [ @@ -67,24 +32,59 @@ "IXimager", "Other" ], - "disable_correlation": true - }, - "references": { - "description": "External references", - "multiple": true, - "ui-priority": 0, - "misp-attribute": "link" + "ui-priority": 0 }, "additional-comments": { "description": "Comments.", - "ui-priority": 0, + "disable_correlation": true, "misp-attribute": "text", - "disable_correlation": true + "ui-priority": 0 + }, + "case-number": { + "description": "A unique number assigned to the case for unique identification.", + "misp-attribute": "text", + "ui-priority": 0 + }, + "evidence-number": { + "description": "A unique number assigned to the evidence for unique identification.", + "misp-attribute": "text", + "ui-priority": 0 + }, + "name": { + "description": "Name of the evidence acquired.", + "misp-attribute": "text", + "ui-priority": 0 + }, + "references": { + "description": "External references", + "misp-attribute": "link", + "multiple": true, + "ui-priority": 0 + }, + "type": { + "description": "Evidence type.", + "disable_correlation": true, + "misp-attribute": "text", + "multiple": true, + "sane_default": [ + "Computer", + "Network", + "Mobile Device", + "Multimedia", + "Cloud", + "IoT", + "Other" + ], + "ui-priority": 0 } }, - "version": 2, "description": "An object template to describe a digital forensic evidence.", "meta-category": "misc", + "name": "forensic-evidence", + "required": [ + "case-number", + "evidence-number" + ], "uuid": "fe44c648-63ef-43fc-b3de-af71a2e023e4", - "name": "forensic-evidence" -} + "version": 2 +} \ No newline at end of file diff --git a/objects/forged-document/definition.json b/objects/forged-document/definition.json index f8a8f7a..2acefd1 100644 --- a/objects/forged-document/definition.json +++ b/objects/forged-document/definition.json @@ -1,34 +1,30 @@ { - "requiredOneOf": [ - "document-name", - "attachment", - "document-text" - ], "attributes": { - "purpose-of-document": { - "description": "What the document is used for.", - "ui-priority": 1, - "misp-attribute": "text", - "disable_correlation": true, + "archive": { + "description": "Archive of the original document (Internet Archive, Archive.is, etc).", + "misp-attribute": "link", "multiple": true, - "sane_default": [ - "Identification", - "Travel", - "Health", - "Legal", - "Financial", - "Government", - "Military", - "Media", - "Communication", - "Other" - ] + "ui-priority": 1 + }, + "attachment": { + "description": "The forged document file.", + "misp-attribute": "attachment", + "ui-priority": 1 + }, + "document-name": { + "description": "Title of the document.", + "misp-attribute": "text", + "ui-priority": 0 + }, + "document-text": { + "description": "Raw text of document", + "misp-attribute": "text", + "ui-priority": 1 }, "document-type": { "description": "The type of document (not the file type).", - "ui-priority": 1, - "misp-attribute": "text", "disable_correlation": true, + "misp-attribute": "text", "multiple": true, "sane_default": [ "email", @@ -42,68 +38,72 @@ "invoice", "receipt", "other" - ] + ], + "ui-priority": 1 }, - "attachment": { - "description": "The forged document file.", - "ui-priority": 1, - "misp-attribute": "attachment" + "first-seen": { + "description": "When the document has been accessible or seen for the first time.", + "disable_correlation": true, + "misp-attribute": "datetime", + "ui-priority": 0 }, - "document-name": { - "misp-attribute": "text", - "ui-priority": 0, - "description": "Title of the document." - }, - "document-text": { - "description": "Raw text of document", - "ui-priority": 1, - "misp-attribute": "text" - }, - "url": { - "description": "Original URL location of the document (potentially malicious)", - "ui-priority": 1, - "misp-attribute": "url" + "last-seen": { + "description": "When the document has been accessible or seen for the last time.", + "disable_correlation": true, + "misp-attribute": "datetime", + "ui-priority": 0 }, "link": { "description": "Original link into the document (Supposed harmless)", - "ui-priority": 1, - "misp-attribute": "link" - }, - "archive": { - "description": "Archive of the original document (Internet Archive, Archive.is, etc).", - "ui-priority": 1, - "multiple": true, - "misp-attribute": "link" + "misp-attribute": "link", + "ui-priority": 1 }, "objective": { "description": "Objective of the forged document.", - "ui-priority": 1, - "misp-attribute": "text", "disable_correlation": true, + "misp-attribute": "text", "multiple": true, "sane_default": [ "Disinformation", "Advertising", "Parody", "Other" - ] + ], + "ui-priority": 1 }, - "last-seen": { - "description": "When the document has been accessible or seen for the last time.", + "purpose-of-document": { + "description": "What the document is used for.", "disable_correlation": true, - "ui-priority": 0, - "misp-attribute": "datetime" + "misp-attribute": "text", + "multiple": true, + "sane_default": [ + "Identification", + "Travel", + "Health", + "Legal", + "Financial", + "Government", + "Military", + "Media", + "Communication", + "Other" + ], + "ui-priority": 1 }, - "first-seen": { - "description": "When the document has been accessible or seen for the first time.", - "disable_correlation": true, - "ui-priority": 0, - "misp-attribute": "datetime" + "url": { + "description": "Original URL location of the document (potentially malicious)", + "misp-attribute": "url", + "ui-priority": 1 } }, - "version": 7, "description": "Object describing a forged document.", "meta-category": "file", + "name": "forged-document", + "requiredOneOf": [ + "document-name", + "attachment", + "document-text" + ], "uuid": "7e927620-b97c-4b00-98c0-8c0184d83d21", - "name": "forged-document" -} + "version": 7 +} \ No newline at end of file diff --git a/objects/geolocation/definition.json b/objects/geolocation/definition.json index f0d2a33..8de5984 100644 --- a/objects/geolocation/definition.json +++ b/objects/geolocation/definition.json @@ -1,80 +1,27 @@ { - "requiredOneOf": [ - "latitude", - "longitude", - "city", - "region", - "country", - "epsg" - ], "attributes": { - "first-seen": { - "description": "When the location was seen for the first time.", + "accuracy-radius": { + "description": "The approximate accuracy radius, in kilometers, around the latitude and longitude for the geographical entity (country, subdivision, city or postal code) associated with the related object. (based on geoip2 accuracy of maxmind)", "disable_correlation": true, - "ui-priority": 0, - "misp-attribute": "datetime" - }, - "last-seen": { - "description": "When the location was seen for the last time.", - "disable_correlation": true, - "ui-priority": 0, - "misp-attribute": "datetime" - }, - "text": { - "description": "A generic description of the location.", - "disable_correlation": true, - "ui-priority": 1, - "misp-attribute": "text" - }, - "latitude": { - "description": "The latitude is the decimal value of the latitude in the World Geodetic System 84 (WGS84) reference.", - "disable_correlation": true, - "ui-priority": 90, - "misp-attribute": "float" - }, - "longitude": { - "description": "The longitude is the decimal value of the longitude in the World Geodetic System 84 (WGS84) reference", - "disable_correlation": true, - "ui-priority": 89, - "misp-attribute": "float" - }, - "altitude": { - "description": "The altitude is the decimal value of the altitude in the World Geodetic System 84 (WGS84) reference.", - "ui-priority": 0, "misp-attribute": "float", - "disable_correlation": true + "ui-priority": 1 }, "address": { "description": "Address.", "misp-attribute": "text", "ui-priority": 1 }, - "neighborhood": { - "description": "Neighborhood.", - "misp-attribute": "text", - "ui-priority": 1 - }, - "zipcode": { - "description": "Zip Code.", - "misp-attribute": "text", - "ui-priority": 1 + "altitude": { + "description": "The altitude is the decimal value of the altitude in the World Geodetic System 84 (WGS84) reference.", + "disable_correlation": true, + "misp-attribute": "float", + "ui-priority": 0 }, "city": { "description": "City.", "misp-attribute": "text", "ui-priority": 1 }, - "region": { - "description": "Region.", - "misp-attribute": "text", - "ui-priority": 1 - }, - "accuracy-radius": { - "description": "The approximate accuracy radius, in kilometers, around the latitude and longitude for the geographical entity (country, subdivision, city or postal code) associated with the related object. (based on geoip2 accuracy of maxmind)", - "misp-attribute": "float", - "ui-priority": 1, - "disable_correlation": true - }, "country": { "description": "Country.", "misp-attribute": "text", @@ -82,24 +29,77 @@ }, "epsg": { "description": "EPSG Geodetic Parameter value. This is an integer value of the EPSG.", + "disable_correlation": true, "misp-attribute": "text", - "ui-priority": 70, - "disable_correlation": true + "ui-priority": 70 + }, + "first-seen": { + "description": "When the location was seen for the first time.", + "disable_correlation": true, + "misp-attribute": "datetime", + "ui-priority": 0 + }, + "last-seen": { + "description": "When the location was seen for the last time.", + "disable_correlation": true, + "misp-attribute": "datetime", + "ui-priority": 0 + }, + "latitude": { + "description": "The latitude is the decimal value of the latitude in the World Geodetic System 84 (WGS84) reference.", + "disable_correlation": true, + "misp-attribute": "float", + "ui-priority": 90 + }, + "longitude": { + "description": "The longitude is the decimal value of the longitude in the World Geodetic System 84 (WGS84) reference", + "disable_correlation": true, + "misp-attribute": "float", + "ui-priority": 89 + }, + "neighborhood": { + "description": "Neighborhood.", + "misp-attribute": "text", + "ui-priority": 1 + }, + "region": { + "description": "Region.", + "misp-attribute": "text", + "ui-priority": 1 }, "spacial-reference": { "description": "Default spacial or projection refence for this object.", + "disable_correlation": true, "misp-attribute": "text", "ui-priority": 1, - "disable_correlation": true, "values_list": [ "WGS84 EPSG:4326", "Mercator EPSG:3857" ] + }, + "text": { + "description": "A generic description of the location.", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 1 + }, + "zipcode": { + "description": "Zip Code.", + "misp-attribute": "text", + "ui-priority": 1 } }, - "version": 5, "description": "An object to describe a geographic location.", "meta-category": "misc", + "name": "geolocation", + "requiredOneOf": [ + "latitude", + "longitude", + "city", + "region", + "country", + "epsg" + ], "uuid": "fdd30d5f-6752-45ed-bef2-25e8ce4d8a3", - "name": "geolocation" -} + "version": 5 +} \ No newline at end of file diff --git a/objects/gtp-attack/definition.json b/objects/gtp-attack/definition.json index 6f6cc78..36af16e 100644 --- a/objects/gtp-attack/definition.json +++ b/objects/gtp-attack/definition.json @@ -1,24 +1,10 @@ { - "requiredOneOf": [ - "text" - ], "attributes": { - "GtpServingNetwork": { - "description": "GTP Serving Network.", - "misp-attribute": "text", - "disable_correlation": true, - "ui-priority": 1 - }, "GtpImei": { "description": "GTP IMEI (International Mobile Equipment Identity).", "misp-attribute": "text", "ui-priority": 1 }, - "GtpMsisdn": { - "description": "GTP MSISDN.", - "misp-attribute": "text", - "ui-priority": 1 - }, "GtpImsi": { "description": "GTP IMSI (International mobile subscriber identity).", "misp-attribute": "text", @@ -26,6 +12,9 @@ }, "GtpInterface": { "description": "GTP interface.", + "disable_correlation": true, + "misp-attribute": "text", + "multiple": true, "sane_default": [ "S5", "S11", @@ -34,9 +23,6 @@ "Gn", "Gp" ], - "misp-attribute": "text", - "disable_correlation": true, - "multiple": true, "ui-priority": 1 }, "GtpMessageType": { @@ -45,6 +31,28 @@ "misp-attribute": "text", "ui-priority": 1 }, + "GtpMsisdn": { + "description": "GTP MSISDN.", + "misp-attribute": "text", + "ui-priority": 1 + }, + "GtpServingNetwork": { + "description": "GTP Serving Network.", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 1 + }, + "GtpVersion": { + "description": "GTP version", + "disable_correlation": true, + "misp-attribute": "text", + "sane_default": [ + "0", + "1", + "2" + ], + "ui-priority": 0 + }, "PortDest": { "description": "Destination port.", "disable_correlation": true, @@ -57,6 +65,12 @@ "misp-attribute": "port", "ui-priority": 0 }, + "first-seen": { + "description": "When the attack has been seen for the first time.", + "disable_correlation": true, + "misp-attribute": "datetime", + "ui-priority": 0 + }, "ipDest": { "description": "IP destination address.", "misp-attribute": "ip-dst", @@ -67,33 +81,19 @@ "misp-attribute": "ip-src", "ui-priority": 0 }, - "GtpVersion": { - "description": "GTP version", - "sane_default": [ - "0", - "1", - "2" - ], - "misp-attribute": "text", - "disable_correlation": true, - "ui-priority": 0 - }, "text": { "description": "A description of the GTP attack.", "disable_correlation": true, - "ui-priority": 0, - "misp-attribute": "text" - }, - "first-seen": { - "description": "When the attack has been seen for the first time.", - "disable_correlation": true, - "ui-priority": 0, - "misp-attribute": "datetime" + "misp-attribute": "text", + "ui-priority": 0 } }, - "version": 3, "description": "GTP attack object as seen on a GSM, UMTS or LTE network", "meta-category": "network", + "name": "gtp-attack", + "requiredOneOf": [ + "text" + ], "uuid": "6b3c48d2-0ca6-4608-9c36-455105439145", - "name": "gtp-attack" -} + "version": 3 +} \ No newline at end of file diff --git a/objects/http-request/definition.json b/objects/http-request/definition.json index c538392..0206d0c 100644 --- a/objects/http-request/definition.json +++ b/objects/http-request/definition.json @@ -1,56 +1,46 @@ { - "requiredOneOf": [ - "url", - "uri" - ], "attributes": { - "text": { - "description": "HTTP Request comment", - "disable_correlation": true, - "ui-priority": 1, - "misp-attribute": "text" - }, "basicauth-password": { "categories": [ "Network activity" ], "description": "HTTP Basic Authentication Password", - "ui-priority": 1, - "misp-attribute": "text" + "misp-attribute": "text", + "ui-priority": 1 }, "basicauth-user": { "categories": [ "Network activity" ], "description": "HTTP Basic Authentication Username", - "ui-priority": 1, - "misp-attribute": "text" + "misp-attribute": "text", + "ui-priority": 1 }, "content-type": { "categories": [ "Network activity" ], "description": "The MIME type of the body of the request", - "ui-priority": 1, - "misp-attribute": "other" + "misp-attribute": "other", + "ui-priority": 1 }, "cookie": { "categories": [ "Network activity" ], "description": "An HTTP cookie previously sent by the server with Set-Cookie", - "ui-priority": 1, "misp-attribute": "text", - "multiple": true + "multiple": true, + "ui-priority": 1 }, "header": { "categories": [ "Network activity" ], "description": "An HTTP header sent during HTTP request", - "ui-priority": 1, "misp-attribute": "text", - "multiple": true + "multiple": true, + "ui-priority": 1 }, "host": { "categories": [ @@ -58,8 +48,8 @@ "Payload delivery" ], "description": "The domain name of the server", - "ui-priority": 1, - "misp-attribute": "hostname" + "misp-attribute": "hostname", + "ui-priority": 1 }, "ip-dst": { "categories": [ @@ -67,8 +57,8 @@ "Payload delivery" ], "description": "The IP address of the server", - "ui-priority": 1, - "misp-attribute": "ip-dst" + "misp-attribute": "ip-dst", + "ui-priority": 1 }, "ip-src": { "categories": [ @@ -76,8 +66,8 @@ "Payload delivery" ], "description": "The IP address of the client", - "ui-priority": 1, - "misp-attribute": "ip-src" + "misp-attribute": "ip-src", + "ui-priority": 1 }, "method": { "categories": [ @@ -85,8 +75,24 @@ ], "description": "HTTP Method invoked (one of GET, POST, PUT, HEAD, DELETE, OPTIONS, CONNECT)", "disable_correlation": true, - "ui-priority": 1, - "misp-attribute": "http-method" + "misp-attribute": "http-method", + "ui-priority": 1 + }, + "proxy-password": { + "categories": [ + "Network activity" + ], + "description": "HTTP Proxy Password", + "misp-attribute": "text", + "ui-priority": 1 + }, + "proxy-user": { + "categories": [ + "Network activity" + ], + "description": "HTTP Proxy Username", + "misp-attribute": "text", + "ui-priority": 1 }, "referer": { "categories": [ @@ -94,32 +100,22 @@ "Payload delivery" ], "description": "This is the address of the previous web page from which a link to the currently requested page was followed", - "ui-priority": 1, - "misp-attribute": "other" + "misp-attribute": "other", + "ui-priority": 1 }, - "proxy-password": { - "categories": [ - "Network activity" - ], - "description": "HTTP Proxy Password", - "ui-priority": 1, - "misp-attribute": "text" - }, - "proxy-user": { - "categories": [ - "Network activity" - ], - "description": "HTTP Proxy Username", - "ui-priority": 1, - "misp-attribute": "text" + "text": { + "description": "HTTP Request comment", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 1 }, "uri": { "categories": [ "Network activity" ], "description": "Request URI", - "ui-priority": 1, - "misp-attribute": "uri" + "misp-attribute": "uri", + "ui-priority": 1 }, "url": { "categories": [ @@ -127,21 +123,25 @@ "Payload delivery" ], "description": "Full HTTP Request URL", - "ui-priority": 1, - "misp-attribute": "url" + "misp-attribute": "url", + "ui-priority": 1 }, "user-agent": { "categories": [ "Network activity" ], "description": "The user agent string of the user agent", - "ui-priority": 1, - "misp-attribute": "user-agent" + "misp-attribute": "user-agent", + "ui-priority": 1 } }, - "version": 4, "description": "A single HTTP request header", "meta-category": "network", + "name": "http-request", + "requiredOneOf": [ + "url", + "uri" + ], "uuid": "b4a8d163-8110-4239-bfcf-e08f3a9fdf7b", - "name": "http-request" -} + "version": 4 +} \ No newline at end of file diff --git a/objects/ilr-impact/definition.json b/objects/ilr-impact/definition.json index 4529a06..87562de 100644 --- a/objects/ilr-impact/definition.json +++ b/objects/ilr-impact/definition.json @@ -1,43 +1,43 @@ { - "required": [ - "service" - ], "attributes": { - "service": { + "duree": { + "description": "Duree de l'incident en hh : mm", + "disable_correlation": true, "misp-attribute": "text", - "ui-priority": 0, + "ui-priority": 0 + }, + "nombre-utilisateurs-touches": { + "description": "Nombre d’utilisateurs touches par l'incident", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 0 + }, + "pourcentage-utilisateurs-touches": { + "description": "Pourcentage d'utilisateurs du service touches par l'incident", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 0 + }, + "service": { "description": "Service impacte par l'incident", "disable_correlation": true, + "misp-attribute": "text", "multiple": true, "sane_default": [ "Telephonie fixe", "Acces Internet fixe", "Telephonie mobile", "Acces Internet mobile" - ] - }, - "nombre-utilisateurs-touches": { - "description": "Nombre d’utilisateurs touches par l'incident", - "ui-priority": 0, - "disable_correlation": true, - "misp-attribute": "text" - }, - "pourcentage-utilisateurs-touches": { - "description": "Pourcentage d'utilisateurs du service touches par l'incident", - "ui-priority": 0, - "disable_correlation": true, - "misp-attribute": "text" - }, - "duree": { - "description": "Duree de l'incident en hh : mm", - "ui-priority": 0, - "disable_correlation": true, - "misp-attribute": "text" + ], + "ui-priority": 0 } }, - "version": 1, "description": "Institut Luxembourgeois de Regulation - Impact", "meta-category": "misc", + "name": "ilr-impact", + "required": [ + "service" + ], "uuid": "b995af48-39b2-11e9-b2ab-b77adfee75d1", - "name": "ilr-impact" -} + "version": 1 +} \ No newline at end of file diff --git a/objects/ilr-notification-incident/definition.json b/objects/ilr-notification-incident/definition.json index 1dde3d2..11311e4 100644 --- a/objects/ilr-notification-incident/definition.json +++ b/objects/ilr-notification-incident/definition.json @@ -3,65 +3,32 @@ "Nom entreprise": { "description": "Nom de l’entreprise notifiee", "disable_correlation": true, - "ui-priority": 0, - "misp-attribute": "text" - }, - "date-incident": { - "description": "Date/heure de la detection de l’incident:", - "disable_correlation": true, - "ui-priority": 0, - "misp-attribute": "datetime" - }, - "date-pre-notification": { - "description": "Date de la pre-notification", - "disable_correlation": true, - "ui-priority": 0, - "misp-attribute": "text" - }, - "impact-servicesw-urgence": { - "description": "Services d’urgences impactes ?", - "disable_correlation": true, - "ui-priority": 0, "misp-attribute": "text", - "values_list": [ - "Oui", - "Non" - ] + "ui-priority": 0 }, - "description-probleme-services-urgence": { - "description": "Description du probleme sur les services d’urgences impactes", + "actions-corrective": { + "description": "Actions correctives a long terme", "disable_correlation": true, - "ui-priority": 0, - "misp-attribute": "text" - }, - "delimitation-geographique": { - "description": "Delimitation geographique", - "disable_correlation": true, - "ui-priority": 0, "misp-attribute": "text", - "values_list": [ - "Nationale", - "Regionale" - ] + "ui-priority": 0 }, - "zone-impactee": { - "description": "zones/communes/villes impactees ", + "actions-posterieur": { + "description": "Actions posterieures de l’incident pour minimiser le risque ", "disable_correlation": true, - "ui-priority": 0, - "multiple": true, - "misp-attribute": "text" + "misp-attribute": "text", + "ui-priority": 0 }, - "details-service": { - "description": "Details relatifs au service concerne et a l’impact de l’incident", + "autres-informations": { + "description": "Autres informations concernant la nature de l’incident notamment la liste des actifs affectes et les causes subsequentes eventuelles, declenches par la cause initiale ", "disable_correlation": true, - "ui-priority": 0, - "misp-attribute": "text" + "misp-attribute": "text", + "ui-priority": 0 }, "cause-initiale-incident": { "description": "Cause initiale de l'incident", "disable_correlation": true, - "ui-priority": 0, "misp-attribute": "text", + "ui-priority": 0, "values_list": [ "rreur humaine", "Defaut systeme 'hardware', 'software', 'procedures'", @@ -70,70 +37,103 @@ "Catastrophe naturelle" ] }, - "autres-informations": { - "description": "Autres informations concernant la nature de l’incident notamment la liste des actifs affectes et les causes subsequentes eventuelles, declenches par la cause initiale ", + "date-incident": { + "description": "Date/heure de la detection de l’incident:", "disable_correlation": true, + "misp-attribute": "datetime", + "ui-priority": 0 + }, + "date-pre-notification": { + "description": "Date de la pre-notification", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 0 + }, + "delimitation-geographique": { + "description": "Delimitation geographique", + "disable_correlation": true, + "misp-attribute": "text", "ui-priority": 0, - "misp-attribute": "text" + "values_list": [ + "Nationale", + "Regionale" + ] }, "description-incident": { "description": "Description generale de l’incident", "disable_correlation": true, - "ui-priority": 0, - "misp-attribute": "text" + "misp-attribute": "text", + "ui-priority": 0 }, - "traitement-incident": { - "description": "Traitement de l’incident et actions effectuees en ordre chronologique", + "description-probleme-services-urgence": { + "description": "Description du probleme sur les services d’urgences impactes", "disable_correlation": true, - "ui-priority": 0, - "misp-attribute": "text" + "misp-attribute": "text", + "ui-priority": 0 }, - "actions-posterieur": { - "description": "Actions posterieures de l’incident pour minimiser le risque ", + "details-service": { + "description": "Details relatifs au service concerne et a l’impact de l’incident", "disable_correlation": true, - "ui-priority": 0, - "misp-attribute": "text" - }, - "interconnections-affectees": { - "description": "Interconnections nationales et/ou internationales affectees", - "disable_correlation": true, - "ui-priority": 0, - "misp-attribute": "text" - }, - "actions-corrective": { - "description": "Actions correctives a long terme", - "disable_correlation": true, - "ui-priority": 0, - "misp-attribute": "text" - }, - "remarques": { - "description": "Remarque(s), notamment les experiences gagnees et les leçons tirees de l’incident", - "disable_correlation": true, - "ui-priority": 0, - "misp-attribute": "text" - }, - "nom-contact-incident": { - "description": "Nom de la personne de contact en rapport avec l’incident", - "disable_correlation": true, - "ui-priority": 0, - "misp-attribute": "text" - }, - "telephone-contact-incident": { - "description": "Telephone de la personne de contact en rapport avec l’incident", - "disable_correlation": true, - "ui-priority": 0, - "misp-attribute": "text" + "misp-attribute": "text", + "ui-priority": 0 }, "email-contact-incident": { "description": "Email de la personne de contact en rapport avec l’incident", "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 0 + }, + "impact-servicesw-urgence": { + "description": "Services d’urgences impactes ?", + "disable_correlation": true, + "misp-attribute": "text", "ui-priority": 0, - "misp-attribute": "text" + "values_list": [ + "Oui", + "Non" + ] + }, + "interconnections-affectees": { + "description": "Interconnections nationales et/ou internationales affectees", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 0 + }, + "nom-contact-incident": { + "description": "Nom de la personne de contact en rapport avec l’incident", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 0 + }, + "remarques": { + "description": "Remarque(s), notamment les experiences gagnees et les leçons tirees de l’incident", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 0 + }, + "telephone-contact-incident": { + "description": "Telephone de la personne de contact en rapport avec l’incident", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 0 + }, + "traitement-incident": { + "description": "Traitement de l’incident et actions effectuees en ordre chronologique", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 0 + }, + "zone-impactee": { + "description": "zones/communes/villes impactees ", + "disable_correlation": true, + "misp-attribute": "text", + "multiple": true, + "ui-priority": 0 } }, - "version": 1, "description": "Institut Luxembourgeois de Regulation - Notification d'incident", "meta-category": "misc", + "name": "ilr-notification-incident", "uuid": "b8ade604-39b2-11e9-b753-1fd28d3b612c", - "name": "ilr-notification-incident" -} + "version": 1 +} \ No newline at end of file diff --git a/objects/impersonation/definition.json b/objects/impersonation/definition.json index 78a35b5..6b80914 100644 --- a/objects/impersonation/definition.json +++ b/objects/impersonation/definition.json @@ -1,10 +1,61 @@ { "attributes": { + "account-name": { + "description": "Name of the impersonating account", + "misp-attribute": "text", + "ui-priority": 1 + }, + "account-url": { + "description": "url of the impersonating account", + "misp-attribute": "url", + "ui-priority": 1 + }, + "impersonated-account-name": { + "description": "Name of the impersonated account", + "misp-attribute": "text", + "ui-priority": 1 + }, + "impersonated-account-url": { + "description": "url of the impersonated account", + "misp-attribute": "link", + "ui-priority": 1 + }, + "objective": { + "description": "Objective of the impersonation", + "disable_correlation": true, + "misp-attribute": "text", + "multiple": true, + "sane_default": [ + "Information stealing", + "Disinformation", + "Distrusting", + "Advertising", + "Parody", + "Other" + ], + "ui-priority": 1 + }, + "real-name": { + "description": "Real name of the impersonated person or entity", + "misp-attribute": "text", + "ui-priority": 1 + }, + "type": { + "description": "Type of the account", + "disable_correlation": true, + "misp-attribute": "text", + "sane_default": [ + "Person", + "Association", + "Enterprise", + "Other" + ], + "ui-priority": 1 + }, "type-of-account": { "description": "Type of the impersonated account", - "ui-priority": 1, - "misp-attribute": "text", "disable_correlation": true, + "misp-attribute": "text", "sane_default": [ "Twitter", "Facebook", @@ -14,64 +65,13 @@ "Instagram", "Forum", "Other" - ] - }, - "account-url": { - "description": "url of the impersonating account", - "ui-priority": 1, - "misp-attribute": "url" - }, - "account-name": { - "description": "Name of the impersonating account", - "ui-priority": 1, - "misp-attribute": "text" - }, - "impersonated-account-url": { - "description": "url of the impersonated account", - "ui-priority": 1, - "misp-attribute": "link" - }, - "impersonated-account-name": { - "description": "Name of the impersonated account", - "ui-priority": 1, - "misp-attribute": "text" - }, - "real-name": { - "description": "Real name of the impersonated person or entity", - "ui-priority": 1, - "misp-attribute": "text" - }, - "type": { - "description": "Type of the account", - "ui-priority": 1, - "misp-attribute": "text", - "disable_correlation": true, - "sane_default": [ - "Person", - "Association", - "Enterprise", - "Other" - ] - }, - "objective": { - "description": "Objective of the impersonation", - "ui-priority": 1, - "misp-attribute": "text", - "disable_correlation": true, - "multiple": true, - "sane_default": [ - "Information stealing", - "Disinformation", - "Distrusting", - "Advertising", - "Parody", - "Other" - ] + ], + "ui-priority": 1 } }, - "version": 1, "description": "Represent an impersonating account", "meta-category": "misc", + "name": "impersonation", "uuid": "01833a92-d2ff-11e9-8016-d3b988153702", - "name": "impersonation" -} + "version": 1 +} \ No newline at end of file diff --git a/objects/imsi-catcher/definition.json b/objects/imsi-catcher/definition.json index 061ebc5..7c13595 100644 --- a/objects/imsi-catcher/definition.json +++ b/objects/imsi-catcher/definition.json @@ -1,15 +1,70 @@ { - "requiredOneOf": [ - "text", - "first-seen", - "imsi" - ], "attributes": { + "brand": { + "description": "Brand associated with the IMSI registration.", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 0 + }, + "cellid": { + "description": "CellID", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 0 + }, + "country": { + "description": "Country where the IMSI is registered.", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 0 + }, + "first-seen": { + "description": "When the IMSI has been accessible or seen for the first time.", + "disable_correlation": true, + "misp-attribute": "datetime", + "ui-priority": 0 + }, "imsi": { "description": "A usually unique International Mobile Subscriber Identity (IMSI) is allocated to each mobile subscriber in the GSM/UMTS/EPS system. IMSI can also refer to International Mobile Station Identity in the ITU nomenclature.", "misp-attribute": "text", "ui-priority": 1 }, + "lac": { + "description": "LAC - Location Area Code", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 0 + }, + "mcc": { + "description": "MCC - Mobile Country Code", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 0 + }, + "mnc": { + "description": "MNC - Mobile Network Code", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 0 + }, + "operator": { + "description": "Operator associated with the IMSI registration.", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 0 + }, + "seq": { + "description": "A sequence number for the collection", + "disable_correlation": true, + "misp-attribute": "counter", + "ui-priority": 0 + }, + "text": { + "description": "A description of the IMSI record.", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 1 + }, "tmsi-1": { "description": "Temporary Mobile Subscriber Identities (TMSI) to visiting mobile subscribers can be allocated.", "misp-attribute": "text", @@ -19,71 +74,16 @@ "description": "Temporary Mobile Subscriber Identities (TMSI) to visiting mobile subscribers can be allocated.", "misp-attribute": "text", "ui-priority": 0 - }, - "country": { - "description": "Country where the IMSI is registered.", - "misp-attribute": "text", - "ui-priority": 0, - "disable_correlation": true - }, - "brand": { - "description": "Brand associated with the IMSI registration.", - "misp-attribute": "text", - "ui-priority": 0, - "disable_correlation": true - }, - "operator": { - "description": "Operator associated with the IMSI registration.", - "misp-attribute": "text", - "ui-priority": 0, - "disable_correlation": true - }, - "mcc": { - "description": "MCC - Mobile Country Code", - "misp-attribute": "text", - "ui-priority": 0, - "disable_correlation": true - }, - "mnc": { - "description": "MNC - Mobile Network Code", - "misp-attribute": "text", - "ui-priority": 0, - "disable_correlation": true - }, - "lac": { - "description": "LAC - Location Area Code", - "misp-attribute": "text", - "ui-priority": 0, - "disable_correlation": true - }, - "cellid": { - "description": "CellID", - "misp-attribute": "text", - "ui-priority": 0, - "disable_correlation": true - }, - "text": { - "description": "A description of the IMSI record.", - "disable_correlation": true, - "ui-priority": 1, - "misp-attribute": "text" - }, - "first-seen": { - "description": "When the IMSI has been accessible or seen for the first time.", - "disable_correlation": true, - "ui-priority": 0, - "misp-attribute": "datetime" - }, - "seq": { - "description": "A sequence number for the collection", - "disable_correlation": true, - "ui-priority": 0, - "misp-attribute": "counter" } }, - "version": 1, "description": "IMSI Catcher entry object based on the open source IMSI cather", "meta-category": "misc", + "name": "imsi-catcher", + "requiredOneOf": [ + "text", + "first-seen", + "imsi" + ], "uuid": "a64f21b1-2f1b-4298-8243-c45db2c4aa7c", - "name": "imsi-catcher" -} + "version": 1 +} \ No newline at end of file diff --git a/objects/instant-message-group/definition.json b/objects/instant-message-group/definition.json index 6232afb..b5174dc 100644 --- a/objects/instant-message-group/definition.json +++ b/objects/instant-message-group/definition.json @@ -1,27 +1,9 @@ { - "requiredOneOf": [ - "group-name", - "group-alias", - "archive", - "attachment" - ], "attributes": { - "group-name": { - "description": "The name of the group, channel or community.", - "ui-priority": 1, - "misp-attribute": "text" - }, - "group-alias": { - "description": "Aliases of group, channel or community.", - "ui-priority": 1, - "multiple": true, - "misp-attribute": "text" - }, "app-used": { "description": "The IM application used to send the message.", - "ui-priority": 1, - "misp-attribute": "text", "disable_correlation": true, + "misp-attribute": "text", "multiple": true, "sane_default": [ "WhatsApp", @@ -35,46 +17,64 @@ "TorChat", "RetroShare", "Slack" - ] - }, - "username": { - "description": "A user account who is a member of the group.", - "ui-priority": 1, - "misp-attribute": "text", - "multiple": true - }, - "person-name": { - "description": "A person who is a member of the group.", - "ui-priority": 1, - "misp-attribute": "text", - "multiple": true - }, - "url": { - "description": "Original URL location of the group (potentially malicious).", - "ui-priority": 1, - "misp-attribute": "url" - }, - "link": { - "description": "Original link into the group (Supposed harmless).", - "ui-priority": 1, - "misp-attribute": "link" + ], + "ui-priority": 1 }, "archive": { "description": "Archive of the original group (Internet Archive, Archive.is, etc).", - "ui-priority": 1, + "misp-attribute": "link", "multiple": true, - "misp-attribute": "link" + "ui-priority": 1 }, "attachment": { "description": "A screen capture or exported list of contacts, group members, etc.", - "ui-priority": 1, + "misp-attribute": "attachment", "multiple": true, - "misp-attribute": "attachment" + "ui-priority": 1 + }, + "group-alias": { + "description": "Aliases of group, channel or community.", + "misp-attribute": "text", + "multiple": true, + "ui-priority": 1 + }, + "group-name": { + "description": "The name of the group, channel or community.", + "misp-attribute": "text", + "ui-priority": 1 + }, + "link": { + "description": "Original link into the group (Supposed harmless).", + "misp-attribute": "link", + "ui-priority": 1 + }, + "person-name": { + "description": "A person who is a member of the group.", + "misp-attribute": "text", + "multiple": true, + "ui-priority": 1 + }, + "url": { + "description": "Original URL location of the group (potentially malicious).", + "misp-attribute": "url", + "ui-priority": 1 + }, + "username": { + "description": "A user account who is a member of the group.", + "misp-attribute": "text", + "multiple": true, + "ui-priority": 1 } }, - "version": 1, "description": "Instant Message (IM) group object template describing a public or private IM group, channel or conversation.", "meta-category": "misc", + "name": "instant-message-group", + "requiredOneOf": [ + "group-name", + "group-alias", + "archive", + "attachment" + ], "uuid": "e26becca-2149-4bc0-b3fb-7090d43af28f", - "name": "instant-message-group" -} + "version": 1 +} \ No newline at end of file diff --git a/objects/instant-message/definition.json b/objects/instant-message/definition.json index 802b0a8..5936290 100644 --- a/objects/instant-message/definition.json +++ b/objects/instant-message/definition.json @@ -1,60 +1,9 @@ { - "requiredOneOf": [ - "body", - "from-user" - ], "attributes": { - "body": { - "description": "Message body of the IM.", - "ui-priority": 1, - "misp-attribute": "text" - }, - "from-number": { - "description": "Phone number used to send the message.", - "ui-priority": 1, - "misp-attribute": "phone-number", - "multiple": true - }, - "to-number": { - "description": "Phone number receiving the message.", - "ui-priority": 1, - "misp-attribute": "phone-number", - "multiple": true - }, - "from-user": { - "description": "User account that sent the message.", - "ui-priority": 1, - "misp-attribute": "text", - "multiple": true - }, - "to-user": { - "description": "User account that received the message.", - "ui-priority": 1, - "misp-attribute": "text", - "multiple": true - }, - "from-name": { - "description": "Name of the person that sent the message.", - "ui-priority": 1, - "misp-attribute": "text", - "multiple": true - }, - "to-name": { - "description": "Name of the person that received the message.", - "ui-priority": 1, - "misp-attribute": "text", - "multiple": true - }, - "subject": { - "description": "Subject of the message if any.", - "ui-priority": 0, - "misp-attribute": "text" - }, "app-used": { "description": "The IM application used to send the message.", - "ui-priority": 1, - "misp-attribute": "text", "disable_correlation": true, + "misp-attribute": "text", "sane_default": [ "WhatsApp", "Google Hangouts", @@ -67,46 +16,97 @@ "TorChat", "RetroShare", "Slack" - ] - }, - "url": { - "description": "Original URL location of the message (potentially malicious).", - "ui-priority": 1, - "misp-attribute": "url" - }, - "link": { - "description": "Original link into the message (Supposed harmless).", - "ui-priority": 1, - "misp-attribute": "link" + ], + "ui-priority": 1 }, "archive": { "description": "Archive of the original message (Internet Archive, Archive.is, etc).", - "ui-priority": 1, + "misp-attribute": "link", "multiple": true, - "misp-attribute": "link" + "ui-priority": 1 }, "attachment": { "description": "The message file or screen capture.", - "ui-priority": 1, + "misp-attribute": "attachment", "multiple": true, - "misp-attribute": "attachment" + "ui-priority": 1 }, - "sent-date": { - "description": "Initial sent date of the message.", - "ui-priority": 0, - "misp-attribute": "datetime", - "disable_correlation": true + "body": { + "description": "Message body of the IM.", + "misp-attribute": "text", + "ui-priority": 1 + }, + "from-name": { + "description": "Name of the person that sent the message.", + "misp-attribute": "text", + "multiple": true, + "ui-priority": 1 + }, + "from-number": { + "description": "Phone number used to send the message.", + "misp-attribute": "phone-number", + "multiple": true, + "ui-priority": 1 + }, + "from-user": { + "description": "User account that sent the message.", + "misp-attribute": "text", + "multiple": true, + "ui-priority": 1 + }, + "link": { + "description": "Original link into the message (Supposed harmless).", + "misp-attribute": "link", + "ui-priority": 1 }, "received-date": { "description": "Received date of the message.", - "ui-priority": 0, + "disable_correlation": true, "misp-attribute": "datetime", - "disable_correlation": true + "ui-priority": 0 + }, + "sent-date": { + "description": "Initial sent date of the message.", + "disable_correlation": true, + "misp-attribute": "datetime", + "ui-priority": 0 + }, + "subject": { + "description": "Subject of the message if any.", + "misp-attribute": "text", + "ui-priority": 0 + }, + "to-name": { + "description": "Name of the person that received the message.", + "misp-attribute": "text", + "multiple": true, + "ui-priority": 1 + }, + "to-number": { + "description": "Phone number receiving the message.", + "misp-attribute": "phone-number", + "multiple": true, + "ui-priority": 1 + }, + "to-user": { + "description": "User account that received the message.", + "misp-attribute": "text", + "multiple": true, + "ui-priority": 1 + }, + "url": { + "description": "Original URL location of the message (potentially malicious).", + "misp-attribute": "url", + "ui-priority": 1 } }, - "version": 1, "description": "Instant Message (IM) object template describing one or more IM message.", "meta-category": "misc", + "name": "instant-message", + "requiredOneOf": [ + "body", + "from-user" + ], "uuid": "5fa51a24-f40f-4696-a77e-d31e26bab5fc", - "name": "instant-message" -} + "version": 1 +} \ No newline at end of file diff --git a/objects/intelmq_event/definition.json b/objects/intelmq_event/definition.json index 6bd7969..5540e00 100644 --- a/objects/intelmq_event/definition.json +++ b/objects/intelmq_event/definition.json @@ -416,4 +416,4 @@ "name": "intelmq_event", "uuid": "491ac7d2-25a1-4078-8246-b04a132d003d", "version": 4 -} +} \ No newline at end of file diff --git a/objects/intelmq_report/definition.json b/objects/intelmq_report/definition.json index 2b07893..bb428ad 100644 --- a/objects/intelmq_report/definition.json +++ b/objects/intelmq_report/definition.json @@ -56,4 +56,4 @@ "name": "intelmq_report", "uuid": "c3d34be1-904b-455b-bceb-509418392110", "version": 3 -} +} \ No newline at end of file diff --git a/objects/internal-reference/definition.json b/objects/internal-reference/definition.json index f5ff0e3..da32f9e 100644 --- a/objects/internal-reference/definition.json +++ b/objects/internal-reference/definition.json @@ -1,44 +1,44 @@ { + "attributes": { + "comment": { + "categories": [ + "Internal reference" + ], + "description": "Comment associated to the identifier.", + "misp-attribute": "comment", + "ui-priority": 0 + }, + "identifier": { + "categories": [ + "Internal reference" + ], + "description": "Identifier of the reference. Should be unique in your system.", + "misp-attribute": "text", + "ui-priority": 1 + }, + "link": { + "categories": [ + "Internal reference" + ], + "description": "Link associated to the identifier.", + "misp-attribute": "link", + "ui-priority": 1 + }, + "type": { + "categories": [ + "Internal reference" + ], + "description": "Type of internal reference.", + "misp-attribute": "text", + "ui-priority": 1 + } + }, + "description": "Internal reference.", + "meta-category": "misc", + "name": "internal-reference", "required": [ "identifier" ], - "attributes": { - "identifier": { - "description": "Identifier of the reference. Should be unique in your system.", - "ui-priority": 1, - "misp-attribute": "text", - "categories": [ - "Internal reference" - ] - }, - "comment": { - "description": "Comment associated to the identifier.", - "ui-priority": 0, - "misp-attribute": "comment", - "categories": [ - "Internal reference" - ] - }, - "type": { - "description": "Type of internal reference.", - "ui-priority": 1, - "misp-attribute": "text", - "categories": [ - "Internal reference" - ] - }, - "link": { - "description": "Link associated to the identifier.", - "ui-priority": 1, - "misp-attribute": "link", - "categories": [ - "Internal reference" - ] - } - }, - "version": 2, - "description": "Internal reference.", - "meta-category": "misc", "uuid": "a3984dc5-5f70-4776-9262-c19641c0ff6a", - "name": "internal-reference" -} + "version": 2 +} \ No newline at end of file diff --git a/objects/interpol-notice/definition.json b/objects/interpol-notice/definition.json index 95aacaa..409cd24 100644 --- a/objects/interpol-notice/definition.json +++ b/objects/interpol-notice/definition.json @@ -1,12 +1,85 @@ { - "required": [ - "notice-color" - ], "attributes": { + "alias": { + "description": "Alias name or known as.", + "misp-attribute": "text", + "multiple": true, + "ui-priority": 0 + }, + "charges": { + "description": "Charges published as provided by requesting entity", + "disable_correlation": true, + "misp-attribute": "text", + "multiple": true, + "ui-priority": 0 + }, + "colour-of-eyes": { + "description": "Description of a person's colour of eyes.", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 0 + }, + "colour-of-hair": { + "description": "Description of a person's colour of hair.", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 0 + }, + "date-of-birth": { + "description": "Date of birth of a natural person (in YYYY-MM-DD format).", + "misp-attribute": "date-of-birth", + "ui-priority": 0 + }, + "date-of-disappearance": { + "description": "Date of disappearance of a missing person.", + "misp-attribute": "text", + "ui-priority": 0 + }, + "distinguishing-marks-and-characteristics": { + "description": "Distinguishing marks and characteristics of a person.", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 0 + }, + "father-s-family-name-&-forename": { + "description": "Father's family name & forename.", + "misp-attribute": "text", + "ui-priority": 0 + }, + "forename": { + "description": "First name of a natural person.", + "disable_correlation": true, + "misp-attribute": "first-name", + "ui-priority": 0 + }, + "height": { + "description": "Height of a person.", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 0 + }, + "language-spoken": { + "description": "Languages spoken by a person.", + "disable_correlation": true, + "misp-attribute": "text", + "multiple": true, + "ui-priority": 0 + }, + "mother-s-family-name-&-forename": { + "description": "Mother's family name & forename.", + "misp-attribute": "text", + "ui-priority": 0 + }, + "nationality": { + "description": "The nationality of a natural person.", + "disable_correlation": true, + "misp-attribute": "nationality", + "multiple": true, + "ui-priority": 0 + }, "notice-color": { "description": "The color/type of the notice", "misp-attribute": "text", - "ui-priority": 1, "sane_default": [ "Red", "Yellow", @@ -15,129 +88,56 @@ "Green", "Orange", "Purple" - ] - }, - "present-family-name": { - "description": "Last name of a natural person.", - "ui-priority": 0, - "misp-attribute": "last-name" - }, - "forename": { - "description": "First name of a natural person.", - "ui-priority": 0, - "misp-attribute": "first-name", - "disable_correlation": true - }, - "alias": { - "description": "Alias name or known as.", - "ui-priority": 0, - "misp-attribute": "text", - "multiple": true - }, - "father-s-family-name-&-forename": { - "description": "Father's family name & forename.", - "ui-priority": 0, - "misp-attribute": "text" - }, - "mother-s-family-name-&-forename": { - "description": "Mother's family name & forename.", - "ui-priority": 0, - "misp-attribute": "text" - }, - "date-of-birth": { - "description": "Date of birth of a natural person (in YYYY-MM-DD format).", - "ui-priority": 0, - "misp-attribute": "date-of-birth" + ], + "ui-priority": 1 }, "place-of-birth": { "description": "Place of birth of a natural person.", - "ui-priority": 0, + "disable_correlation": true, "misp-attribute": "place-of-birth", - "disable_correlation": true + "ui-priority": 0 + }, + "place-of-disappearance": { + "description": "Place of birth of a natural person.", + "misp-attribute": "text", + "ui-priority": 0 + }, + "portrait": { + "description": "Portrait of the person.", + "misp-attribute": "attachment", + "multiple": true, + "ui-priority": 10 + }, + "present-family-name": { + "description": "Last name of a natural person.", + "misp-attribute": "last-name", + "ui-priority": 0 }, "sex": { "description": "The gender of a natural person.", - "ui-priority": 0, + "disable_correlation": true, "misp-attribute": "gender", + "ui-priority": 0, "values_list": [ "Male", "Female", "Other", "Prefer not to say" - ], - "disable_correlation": true - }, - "nationality": { - "description": "The nationality of a natural person.", - "ui-priority": 0, - "misp-attribute": "nationality", - "multiple": true, - "disable_correlation": true - }, - "language-spoken": { - "description": "Languages spoken by a person.", - "ui-priority": 0, - "misp-attribute": "text", - "multiple": true, - "disable_correlation": true - }, - "charges": { - "description": "Charges published as provided by requesting entity", - "ui-priority": 0, - "misp-attribute": "text", - "multiple": true, - "disable_correlation": true - }, - "date-of-disappearance": { - "description": "Date of disappearance of a missing person.", - "ui-priority": 0, - "misp-attribute": "text" - }, - "place-of-disappearance": { - "description": "Place of birth of a natural person.", - "ui-priority": 0, - "misp-attribute": "text" - }, - "height": { - "description": "Height of a person.", - "ui-priority": 0, - "misp-attribute": "text", - "disable_correlation": true + ] }, "weight": { "description": "weight of a person.", - "ui-priority": 0, + "disable_correlation": true, "misp-attribute": "text", - "disable_correlation": true - }, - "colour-of-hair": { - "description": "Description of a person's colour of hair.", - "ui-priority": 0, - "misp-attribute": "text", - "disable_correlation": true - }, - "colour-of-eyes": { - "description": "Description of a person's colour of eyes.", - "ui-priority": 0, - "misp-attribute": "text", - "disable_correlation": true - }, - "distinguishing-marks-and-characteristics": { - "description": "Distinguishing marks and characteristics of a person.", - "ui-priority": 0, - "misp-attribute": "text", - "disable_correlation": true - }, - "portrait": { - "description": "Portrait of the person.", - "ui-priority": 10, - "misp-attribute": "attachment", - "multiple": true + "ui-priority": 0 } }, - "version": 1, "description": "An object which describes a Interpol notice.", "meta-category": "misc", + "name": "interpol-notice", + "required": [ + "notice-color" + ], "uuid": "24927972-1e4a-11e9-857e-3b2306b99911", - "name": "interpol-notice" -} + "version": 1 +} \ No newline at end of file diff --git a/objects/iot-device/definition.json b/objects/iot-device/definition.json index 0aac22f..7f1c6ab 100644 --- a/objects/iot-device/definition.json +++ b/objects/iot-device/definition.json @@ -1,40 +1,69 @@ { - "requiredOneOf": [ - "model", - "vendor", - "architecture", - "boot-log", - "picture-pcb", - "picture-device" - ], "attributes": { - "picture-pcb": { - "description": "Picture of the IoT device PCB", - "ui-priority": 10, - "misp-attribute": "attachment", - "multiple": true - }, - "picture-device": { - "description": "Picture of the IoT device", - "ui-priority": 10, - "misp-attribute": "attachment", - "multiple": true - }, - "fcc-id": { - "description": "FCC-ID of the IoT device", - "ui-priority": 10, + "architecture": { + "description": "architecture of the IoT device", "misp-attribute": "text", - "multiple": true + "sane_default": [ + "ARC", + "ARM", + "M68000", + "MicroBlaze", + "MIPS", + "NSD32", + "Nios II", + "PowerPC", + "RISC-V", + "Sandbox", + "SH", + "x86", + "Xtensa" + ], + "ui-priority": 1 }, "boot-log": { "description": "Boot log of the IoT device", - "ui-priority": 10, "misp-attribute": "attachment", - "multiple": true + "multiple": true, + "ui-priority": 10 + }, + "fcc-id": { + "description": "FCC-ID of the IoT device", + "misp-attribute": "text", + "multiple": true, + "ui-priority": 10 + }, + "jtag-interface": { + "description": "JTAG interface of the IoT device", + "disable_correlation": true, + "misp-attribute": "text", + "sane_default": [ + "Yes", + "No", + "Unknown", + "Disabled" + ], + "ui-priority": 1 + }, + "model": { + "description": "Model of the IoT device", + "misp-attribute": "text", + "multiple": true, + "ui-priority": 1 + }, + "picture-device": { + "description": "Picture of the IoT device", + "misp-attribute": "attachment", + "multiple": true, + "ui-priority": 10 + }, + "picture-pcb": { + "description": "Picture of the IoT device PCB", + "misp-attribute": "attachment", + "multiple": true, + "ui-priority": 10 }, "platform": { "description": "Platform of of the IoT device", - "ui-priority": 10, "misp-attribute": "text", "sane_default": [ "mach-aspeed", @@ -87,85 +116,56 @@ "mach-mscc", "mach-mtmips", "mach-pic32" - ] - }, - "architecture": { - "description": "architecture of the IoT device", - "ui-priority": 1, - "misp-attribute": "text", - "sane_default": [ - "ARC", - "ARM", - "M68000", - "MicroBlaze", - "MIPS", - "NSD32", - "Nios II", - "PowerPC", - "RISC-V", - "Sandbox", - "SH", - "x86", - "Xtensa" - ] - }, - "model": { - "description": "Model of the IoT device", - "ui-priority": 1, - "misp-attribute": "text", - "multiple": true - }, - "vendor": { - "description": "Vendor of the IoT device", - "ui-priority": 1, - "misp-attribute": "text" + ], + "ui-priority": 10 }, "reference": { "description": "Reference of the IoT device", - "ui-priority": 1, "misp-attribute": "link", - "multiple": true - }, - "spi-interface": { - "description": "SPI interface of the IoT device", - "ui-priority": 1, - "misp-attribute": "text", - "disable_correlation": true, - "sane_default": [ - "Yes", - "No", - "Unknown", - "Disabled" - ] + "multiple": true, + "ui-priority": 1 }, "serial-interface": { "description": "Serial interface of the IoT device", - "ui-priority": 1, - "misp-attribute": "text", "disable_correlation": true, + "misp-attribute": "text", "sane_default": [ "Yes", "No", "Unknown", "Disabled" - ] + ], + "ui-priority": 1 }, - "jtag-interface": { - "description": "JTAG interface of the IoT device", - "ui-priority": 1, - "misp-attribute": "text", + "spi-interface": { + "description": "SPI interface of the IoT device", "disable_correlation": true, + "misp-attribute": "text", "sane_default": [ "Yes", "No", "Unknown", "Disabled" - ] + ], + "ui-priority": 1 + }, + "vendor": { + "description": "Vendor of the IoT device", + "misp-attribute": "text", + "ui-priority": 1 } }, - "version": 3, "description": "An IoT device.", "meta-category": "iot", + "name": "iot-device", + "requiredOneOf": [ + "model", + "vendor", + "architecture", + "boot-log", + "picture-pcb", + "picture-device" + ], "uuid": "3de3b92a-859b-431b-9c4f-1a81de1d9637", - "name": "iot-device" -} + "version": 3 +} \ No newline at end of file diff --git a/objects/iot-firmware/definition.json b/objects/iot-firmware/definition.json index 4ba6e67..4e74789 100644 --- a/objects/iot-firmware/definition.json +++ b/objects/iot-firmware/definition.json @@ -1,99 +1,99 @@ { - "requiredOneOf": [ - "firmware", - "filename", - "binwalk-output" - ], "attributes": { - "firmware": { - "description": "Firmware of the IoT device", - "ui-priority": 10, + "binwalk-entropy-graph": { + "description": "Entropy graph of the firmware", + "disable_correlation": true, "misp-attribute": "attachment", - "multiple": true - }, - "version": { - "description": "Version of the firmware", - "ui-priority": 10, - "misp-attribute": "text", - "multiple": true - }, - "filename": { - "description": "Filename of the firmware", - "ui-priority": 10, - "misp-attribute": "text" - }, - "boot-log": { - "description": "Boot log of the IoT device for this firmware", - "ui-priority": 10, - "misp-attribute": "attachment", - "multiple": true + "ui-priority": 0 }, "binwalk-output": { "description": "Binwalk output of the firmware image", - "ui-priority": 10, - "misp-attribute": "attachment" + "misp-attribute": "attachment", + "ui-priority": 10 + }, + "boot-log": { + "description": "Boot log of the IoT device for this firmware", + "misp-attribute": "attachment", + "multiple": true, + "ui-priority": 10 + }, + "filename": { + "description": "Filename of the firmware", + "misp-attribute": "text", + "ui-priority": 10 + }, + "firmware": { + "description": "Firmware of the IoT device", + "misp-attribute": "attachment", + "multiple": true, + "ui-priority": 10 }, "format": { "description": "Format of the firmware", - "ui-priority": 10, "misp-attribute": "text", "sane_default": [ "raw", "Intel hex", "Motorola S-Record", "Unknown" - ] + ], + "ui-priority": 10 }, "md5": { "description": "[Insecure] MD5 hash (128 bits)", - "ui-priority": 1, "misp-attribute": "md5", - "recommended": false + "recommended": false, + "ui-priority": 1 }, "sha1": { "description": "[Insecure] Secure Hash Algorithm 1 (160 bits)", - "ui-priority": 1, "misp-attribute": "sha1", - "recommended": false + "recommended": false, + "ui-priority": 1 }, "sha224": { "description": "Secure Hash Algorithm 2 (224 bits)", - "ui-priority": 0, "misp-attribute": "sha224", - "recommended": false + "recommended": false, + "ui-priority": 0 }, "sha256": { "description": "Secure Hash Algorithm 2 (256 bits)", - "ui-priority": 1, - "misp-attribute": "sha256" + "misp-attribute": "sha256", + "ui-priority": 1 }, "sha384": { "description": "Secure Hash Algorithm 2 (384 bits)", - "ui-priority": 0, "misp-attribute": "sha384", - "recommended": false + "recommended": false, + "ui-priority": 0 }, "sha512": { "description": "Secure Hash Algorithm 2 (512 bits)", - "ui-priority": 1, - "misp-attribute": "sha512" + "misp-attribute": "sha512", + "ui-priority": 1 }, "size-in-bytes": { "description": "Size of the file, in bytes", "disable_correlation": true, - "ui-priority": 0, - "misp-attribute": "size-in-bytes" + "misp-attribute": "size-in-bytes", + "ui-priority": 0 }, - "binwalk-entropy-graph": { - "description": "Entropy graph of the firmware", - "disable_correlation": true, - "ui-priority": 0, - "misp-attribute": "attachment" + "version": { + "description": "Version of the firmware", + "misp-attribute": "text", + "multiple": true, + "ui-priority": 10 } }, - "version": 1, "description": "A firmware for an IoT device.", "meta-category": "iot", + "name": "iot-firmware", + "requiredOneOf": [ + "firmware", + "filename", + "binwalk-output" + ], "uuid": "8bafb8fc-d986-4a58-b22b-6b8c7c0e8b70", - "name": "iot-firmware" -} + "version": 1 +} \ No newline at end of file diff --git a/objects/ip-api-address/definition.json b/objects/ip-api-address/definition.json index 88030d3..9eac0a9 100644 --- a/objects/ip-api-address/definition.json +++ b/objects/ip-api-address/definition.json @@ -1,101 +1,101 @@ { - "name": "ip-api-address", - "meta-category": "network", - "description": "IP Address information. Useful if you are pulling your ip information from ip-api.com", - "version": 2, - "uuid": "4336f124-6264-4f72-943e-cc3797e4122b", "attributes": { - "ip-src": { - "description": "Source IP address of the network connection.", - "ui-priority": 1, - "misp-attribute": "ip-src" + "ISP": { + "description": "ISP.", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 1 }, "asn": { "description": "Autonomous System Number", - "ui-priority": 1, + "disable_correlation": true, "misp-attribute": "AS", - "disable_correlation": true - }, - "organization": { - "description": "organization", - "ui-priority": 1, - "misp-attribute": "text", - "disable_correlation": true - }, - "ISP": { - "description": "ISP.", - "ui-priority": 1, - "misp-attribute": "text", - "disable_correlation": true - }, - "zipcode": { - "description": "Zip Code.", - "misp-attribute": "text", - "ui-priority": 1, - "disable_correlation": true + "ui-priority": 1 }, "city": { "description": "City.", + "disable_correlation": true, "misp-attribute": "text", - "ui-priority": 1, - "disable_correlation": true - }, - "state": { - "description": "State.", - "misp-attribute": "text", - "ui-priority": 1, - "disable_correlation": true + "ui-priority": 1 }, "country": { "description": "Country name", - "ui-priority": 1, + "disable_correlation": true, "misp-attribute": "text", - "disable_correlation": true + "ui-priority": 1 }, "country code": { "description": "Country code ", - "ui-priority": 1, - "misp-attribute": "text", - "disable_correlation": true - }, - "region": { - "description": "Region. example: California.", - "misp-attribute": "text", - "ui-priority": 1, - "disable_correlation": true - }, - "region code": { - "description": "Region code. example: CA", - "misp-attribute": "text", - "ui-priority": 1, - "disable_correlation": true - }, - "latitude": { - "description": "The latitude is the decimal value of the latitude in the World Geodetic System 84 (WGS84) reference.", "disable_correlation": true, - "ui-priority": 90, - "misp-attribute": "float" - }, - "longitude": { - "description": "The longitude is the decimal value of the longitude in the World Geodetic System 84 (WGS84) reference", - "disable_correlation": true, - "ui-priority": 89, - "misp-attribute": "float" + "misp-attribute": "text", + "ui-priority": 1 }, "first-seen": { "description": "First time the ASN was seen", "disable_correlation": true, - "ui-priority": 0, - "misp-attribute": "datetime" + "misp-attribute": "datetime", + "ui-priority": 0 + }, + "ip-src": { + "description": "Source IP address of the network connection.", + "misp-attribute": "ip-src", + "ui-priority": 1 }, "last-seen": { "description": "Last time the ASN was seen", "disable_correlation": true, - "ui-priority": 0, - "misp-attribute": "datetime" + "misp-attribute": "datetime", + "ui-priority": 0 + }, + "latitude": { + "description": "The latitude is the decimal value of the latitude in the World Geodetic System 84 (WGS84) reference.", + "disable_correlation": true, + "misp-attribute": "float", + "ui-priority": 90 + }, + "longitude": { + "description": "The longitude is the decimal value of the longitude in the World Geodetic System 84 (WGS84) reference", + "disable_correlation": true, + "misp-attribute": "float", + "ui-priority": 89 + }, + "organization": { + "description": "organization", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 1 + }, + "region": { + "description": "Region. example: California.", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 1 + }, + "region code": { + "description": "Region code. example: CA", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 1 + }, + "state": { + "description": "State.", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 1 + }, + "zipcode": { + "description": "Zip Code.", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 1 } }, + "description": "IP Address information. Useful if you are pulling your ip information from ip-api.com", + "meta-category": "network", + "name": "ip-api-address", "requiredOneOf": [ "ip-src" - ] -} + ], + "uuid": "4336f124-6264-4f72-943e-cc3797e4122b", + "version": 2 +} \ No newline at end of file diff --git a/objects/ip-port/definition.json b/objects/ip-port/definition.json index bb9a1f6..9054eee 100644 --- a/objects/ip-port/definition.json +++ b/objects/ip-port/definition.json @@ -1,4 +1,97 @@ { + "attributes": { + "domain": { + "categories": [ + "Network activity", + "External analysis" + ], + "description": "Domain", + "misp-attribute": "domain", + "multiple": true, + "ui-priority": 1 + }, + "dst-port": { + "categories": [ + "Network activity", + "External analysis" + ], + "description": "Destination port", + "disable_correlation": true, + "misp-attribute": "port", + "multiple": true, + "ui-priority": 1 + }, + "first-seen": { + "description": "First time the tuple has been seen", + "disable_correlation": true, + "misp-attribute": "datetime", + "ui-priority": 0 + }, + "hostname": { + "categories": [ + "Network activity", + "External analysis" + ], + "description": "Hostname", + "misp-attribute": "hostname", + "multiple": true, + "ui-priority": 1 + }, + "ip": { + "categories": [ + "Network activity", + "External analysis" + ], + "description": "IP Address", + "misp-attribute": "ip-dst", + "multiple": true, + "ui-priority": 1 + }, + "ip-dst": { + "categories": [ + "Network activity", + "External analysis" + ], + "description": "destination IP address", + "misp-attribute": "ip-dst", + "multiple": true, + "ui-priority": 1 + }, + "ip-src": { + "categories": [ + "Network activity", + "External analysis" + ], + "description": "source IP address", + "misp-attribute": "ip-src", + "multiple": true, + "ui-priority": 1 + }, + "last-seen": { + "description": "Last time the tuple has been seen", + "disable_correlation": true, + "misp-attribute": "datetime", + "ui-priority": 0 + }, + "src-port": { + "categories": [ + "Network activity", + "External analysis" + ], + "description": "Source port", + "misp-attribute": "port", + "ui-priority": 0 + }, + "text": { + "description": "Description of the tuple", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 0 + } + }, + "description": "An IP address (or domain or hostname) and a port seen as a tuple (or as a triple) in a specific time frame.", + "meta-category": "network", + "name": "ip-port", "requiredOneOf": [ "dst-port", "src-port", @@ -8,99 +101,6 @@ "ip-src", "ip-dst" ], - "attributes": { - "text": { - "description": "Description of the tuple", - "disable_correlation": true, - "ui-priority": 0, - "misp-attribute": "text" - }, - "last-seen": { - "description": "Last time the tuple has been seen", - "disable_correlation": true, - "ui-priority": 0, - "misp-attribute": "datetime" - }, - "first-seen": { - "description": "First time the tuple has been seen", - "disable_correlation": true, - "ui-priority": 0, - "misp-attribute": "datetime" - }, - "src-port": { - "description": "Source port", - "categories": [ - "Network activity", - "External analysis" - ], - "ui-priority": 0, - "misp-attribute": "port" - }, - "dst-port": { - "description": "Destination port", - "categories": [ - "Network activity", - "External analysis" - ], - "ui-priority": 1, - "misp-attribute": "port", - "disable_correlation": true, - "multiple": true - }, - "domain": { - "description": "Domain", - "categories": [ - "Network activity", - "External analysis" - ], - "ui-priority": 1, - "misp-attribute": "domain", - "multiple": true - }, - "hostname": { - "description": "Hostname", - "categories": [ - "Network activity", - "External analysis" - ], - "ui-priority": 1, - "misp-attribute": "hostname", - "multiple": true - }, - "ip": { - "description": "IP Address", - "categories": [ - "Network activity", - "External analysis" - ], - "ui-priority": 1, - "misp-attribute": "ip-dst", - "multiple": true - }, - "ip-src": { - "description": "source IP address", - "categories": [ - "Network activity", - "External analysis" - ], - "ui-priority": 1, - "misp-attribute": "ip-src", - "multiple": true - }, - "ip-dst": { - "description": "destination IP address", - "categories": [ - "Network activity", - "External analysis" - ], - "ui-priority": 1, - "misp-attribute": "ip-dst", - "multiple": true - } - }, - "version": 8, - "description": "An IP address (or domain or hostname) and a port seen as a tuple (or as a triple) in a specific time frame.", - "meta-category": "network", "uuid": "9f8cea74-16fe-4968-a2b4-026676949ac6", - "name": "ip-port" -} + "version": 8 +} \ No newline at end of file diff --git a/objects/irc/definition.json b/objects/irc/definition.json index a371761..3ffa44e 100644 --- a/objects/irc/definition.json +++ b/objects/irc/definition.json @@ -1,76 +1,76 @@ { + "attributes": { + "channel": { + "description": "IRC channel associated to the IRC server", + "misp-attribute": "text", + "multiple": true, + "ui-priority": 1 + }, + "dst-port": { + "categories": [ + "Network activity", + "External analysis" + ], + "description": "Destination port to reach the IRC server", + "disable_correlation": true, + "misp-attribute": "port", + "multiple": true, + "ui-priority": 1 + }, + "first-seen": { + "description": "First time the IRC server with the associated channels has been seen", + "disable_correlation": true, + "misp-attribute": "datetime", + "ui-priority": 0 + }, + "hostname": { + "categories": [ + "Network activity", + "External analysis" + ], + "description": "Hostname of the IRC server", + "misp-attribute": "hostname", + "multiple": true, + "ui-priority": 1 + }, + "ip": { + "categories": [ + "Network activity", + "External analysis" + ], + "description": "IP address of the IRC server", + "misp-attribute": "ip-dst", + "multiple": true, + "ui-priority": 1 + }, + "last-seen": { + "description": "Last time the IRC server with the associated channels has been seen", + "disable_correlation": true, + "misp-attribute": "datetime", + "ui-priority": 0 + }, + "nickname": { + "description": "IRC nickname used to connect to the associated IRC server and channels", + "misp-attribute": "text", + "multiple": true, + "ui-priority": 1 + }, + "text": { + "description": "Description of the IRC server", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 0 + } + }, + "description": "An IRC object to describe an IRC server and the associated channels.", + "meta-category": "network", + "name": "irc", "requiredOneOf": [ "ip", "hostname", "channel", "nickname" ], - "attributes": { - "text": { - "description": "Description of the IRC server", - "disable_correlation": true, - "ui-priority": 0, - "misp-attribute": "text" - }, - "last-seen": { - "description": "Last time the IRC server with the associated channels has been seen", - "disable_correlation": true, - "ui-priority": 0, - "misp-attribute": "datetime" - }, - "first-seen": { - "description": "First time the IRC server with the associated channels has been seen", - "disable_correlation": true, - "ui-priority": 0, - "misp-attribute": "datetime" - }, - "dst-port": { - "description": "Destination port to reach the IRC server", - "categories": [ - "Network activity", - "External analysis" - ], - "ui-priority": 1, - "misp-attribute": "port", - "disable_correlation": true, - "multiple": true - }, - "channel": { - "description": "IRC channel associated to the IRC server", - "ui-priority": 1, - "misp-attribute": "text", - "multiple": true - }, - "nickname": { - "description": "IRC nickname used to connect to the associated IRC server and channels", - "ui-priority": 1, - "misp-attribute": "text", - "multiple": true - }, - "hostname": { - "description": "Hostname of the IRC server", - "categories": [ - "Network activity", - "External analysis" - ], - "ui-priority": 1, - "misp-attribute": "hostname", - "multiple": true - }, - "ip": { - "description": "IP address of the IRC server", - "categories": [ - "Network activity", - "External analysis" - ], - "ui-priority": 1, - "misp-attribute": "ip-dst", - "multiple": true - } - }, - "version": 2, - "description": "An IRC object to describe an IRC server and the associated channels.", - "meta-category": "network", "uuid": "4bbbc004-c344-4b20-8672-b41102177fc7", - "name": "irc" -} + "version": 2 +} \ No newline at end of file diff --git a/objects/ja3/definition.json b/objects/ja3/definition.json index 39b539d..9a4ee94 100644 --- a/objects/ja3/definition.json +++ b/objects/ja3/definition.json @@ -1,44 +1,44 @@ { - "name": "ja3", - "meta-category": "network", - "description": "JA3 is a new technique for creating SSL client fingerprints that are easy to produce and can be easily shared for threat intelligence. Fingerprints are composed of Client Hello packet; SSL Version, Accepted Ciphers, List of Extensions, Elliptic Curves, and Elliptic Curve Formats. https://github.com/salesforce/ja3", - "version": 4, - "uuid": "09b45449-5d6e-492c-a68a-cb2e188cbfac", "attributes": { - "ja3-fingerprint-md5": { - "description": "Hash identifying source", - "misp-attribute": "ja3-fingerprint-md5", - "ui-priority": 1 - }, "description": { "description": "Type of detected software ie software, malware", "misp-attribute": "text", "ui-priority": 1 }, + "first-seen": { + "description": "First seen of the SSL/TLS handshake", + "disable_correlation": true, + "misp-attribute": "datetime", + "ui-priority": 0 + }, + "ip-dst": { + "description": "Destination IP address", + "misp-attribute": "ip-dst", + "ui-priority": 1 + }, "ip-src": { "description": "Source IP Address", "misp-attribute": "ip-src", "ui-priority": 1 }, - "ip-dst": { - "description": "Destination IP address", - "misp-attribute": "ip-dst", + "ja3-fingerprint-md5": { + "description": "Hash identifying source", + "misp-attribute": "ja3-fingerprint-md5", "ui-priority": 1 }, - "first-seen": { - "misp-attribute": "datetime", - "disable_correlation": true, - "ui-priority": 0, - "description": "First seen of the SSL/TLS handshake" - }, "last-seen": { - "misp-attribute": "datetime", - "disable_correlation": true, "description": "Last seen of the SSL/TLS handshake", + "disable_correlation": true, + "misp-attribute": "datetime", "ui-priority": 0 } }, + "description": "JA3 is a new technique for creating SSL client fingerprints that are easy to produce and can be easily shared for threat intelligence. Fingerprints are composed of Client Hello packet; SSL Version, Accepted Ciphers, List of Extensions, Elliptic Curves, and Elliptic Curve Formats. https://github.com/salesforce/ja3", + "meta-category": "network", + "name": "ja3", "required": [ "ja3-fingerprint-md5" - ] -} + ], + "uuid": "09b45449-5d6e-492c-a68a-cb2e188cbfac", + "version": 4 +} \ No newline at end of file diff --git a/objects/leaked-document/definition.json b/objects/leaked-document/definition.json index 6adf927..766784e 100644 --- a/objects/leaked-document/definition.json +++ b/objects/leaked-document/definition.json @@ -1,20 +1,84 @@ { - "requiredOneOf": [ - "document-name", - "attachment", - "document-text" - ], "attributes": { + "archive": { + "description": "Archive of the original document (Internet Archive, Archive.is, etc).", + "misp-attribute": "link", + "multiple": true, + "ui-priority": 1 + }, + "attachment": { + "description": "The leaked document file.", + "misp-attribute": "attachment", + "ui-priority": 1 + }, + "document-name": { + "description": "Title of the document.", + "misp-attribute": "text", + "ui-priority": 0 + }, + "document-text": { + "description": "Raw text of document", + "misp-attribute": "text", + "ui-priority": 1 + }, + "document-type": { + "description": "The type of document (not the file type).", + "disable_correlation": true, + "misp-attribute": "text", + "multiple": true, + "sane_default": [ + "email", + "letterhead", + "speech", + "literature", + "photo", + "audio", + "invoice", + "receipt", + "other" + ], + "ui-priority": 1 + }, + "first-seen": { + "description": "When the document has been accessible or seen for the first time.", + "disable_correlation": true, + "misp-attribute": "datetime", + "ui-priority": 0 + }, + "last-seen": { + "description": "When the document has been accessible or seen for the last time.", + "disable_correlation": true, + "misp-attribute": "datetime", + "ui-priority": 0 + }, + "link": { + "description": "Original link into the document (Supposed harmless)", + "misp-attribute": "link", + "ui-priority": 1 + }, + "objective": { + "description": "Reason for leaking the document.", + "disable_correlation": true, + "misp-attribute": "text", + "multiple": true, + "sane_default": [ + "Disinformation", + "Influence", + "Whistleblowing", + "Extortion", + "Other" + ], + "ui-priority": 1 + }, "origin": { "description": "Original source of leaked document.", - "ui-priority": 1, - "misp-attribute": "text" + "misp-attribute": "text", + "ui-priority": 1 }, "purpose-of-document": { "description": "What the document is used for.", - "ui-priority": 1, - "misp-attribute": "text", "disable_correlation": true, + "misp-attribute": "text", "multiple": true, "sane_default": [ "Identification", @@ -27,87 +91,23 @@ "Media", "Communication", "Other" - ] - }, - "document-type": { - "description": "The type of document (not the file type).", - "ui-priority": 1, - "misp-attribute": "text", - "disable_correlation": true, - "multiple": true, - "sane_default": [ - "email", - "letterhead", - "speech", - "literature", - "photo", - "audio", - "invoice", - "receipt", - "other" - ] - }, - "attachment": { - "description": "The leaked document file.", - "ui-priority": 1, - "misp-attribute": "attachment" - }, - "document-name": { - "misp-attribute": "text", - "ui-priority": 0, - "description": "Title of the document." - }, - "document-text": { - "description": "Raw text of document", - "ui-priority": 1, - "misp-attribute": "text" + ], + "ui-priority": 1 }, "url": { "description": "Original URL location of the document (potentially malicious)", - "ui-priority": 1, - "misp-attribute": "url" - }, - "link": { - "description": "Original link into the document (Supposed harmless)", - "ui-priority": 1, - "misp-attribute": "link" - }, - "archive": { - "description": "Archive of the original document (Internet Archive, Archive.is, etc).", - "ui-priority": 1, - "multiple": true, - "misp-attribute": "link" - }, - "objective": { - "description": "Reason for leaking the document.", - "ui-priority": 1, - "misp-attribute": "text", - "disable_correlation": true, - "multiple": true, - "sane_default": [ - "Disinformation", - "Influence", - "Whistleblowing", - "Extortion", - "Other" - ] - }, - "last-seen": { - "description": "When the document has been accessible or seen for the last time.", - "disable_correlation": true, - "ui-priority": 0, - "misp-attribute": "datetime" - }, - "first-seen": { - "description": "When the document has been accessible or seen for the first time.", - "disable_correlation": true, - "ui-priority": 0, - "misp-attribute": "datetime" + "misp-attribute": "url", + "ui-priority": 1 } }, - "version": 6, "description": "Object describing a leaked document.", "meta-category": "file", + "name": "leaked-document", + "requiredOneOf": [ + "document-name", + "attachment", + "document-text" + ], "uuid": "ea145ecd-b3c2-4f57-ac11-c16e883c4247", - "name": "leaked-document" -} + "version": 6 +} \ No newline at end of file diff --git a/objects/legal-entity/definition.json b/objects/legal-entity/definition.json index 6812944..00a604f 100644 --- a/objects/legal-entity/definition.json +++ b/objects/legal-entity/definition.json @@ -1,58 +1,58 @@ { - "requiredOneOf": [ - "name" - ], "attributes": { - "text": { - "description": "A description of the entity.", - "disable_correlation": true, - "ui-priority": 1, - "misp-attribute": "text" - }, - "name": { - "description": "Name of the entity.", - "ui-priority": 0, - "misp-attribute": "text" + "business": { + "description": "Business area of the entity.", + "misp-attribute": "text", + "ui-priority": 0 }, "commercial-name": { "description": "Commercial name of the entity.", - "ui-priority": 0, - "misp-attribute": "text" + "misp-attribute": "text", + "ui-priority": 0 }, "legal-form": { "description": "Legal form of the entity.", - "ui-priority": 0, - "misp-attribute": "text" - }, - "registration-number": { - "description": "Registration number of the entity in the relevant authority.", - "ui-priority": 0, - "misp-attribute": "text" - }, - "business": { - "description": "Business area of the entity.", - "ui-priority": 0, - "misp-attribute": "text" - }, - "phone-number": { - "description": "Phone number of the entity.", - "ui-priority": 0, - "misp-attribute": "phone-number" - }, - "website": { - "description": "Website of the entity.", - "ui-priority": 0, - "misp-attribute": "link" + "misp-attribute": "text", + "ui-priority": 0 }, "logo": { "description": "Logo of the entity.", - "ui-priority": 0, - "misp-attribute": "attachment" + "misp-attribute": "attachment", + "ui-priority": 0 + }, + "name": { + "description": "Name of the entity.", + "misp-attribute": "text", + "ui-priority": 0 + }, + "phone-number": { + "description": "Phone number of the entity.", + "misp-attribute": "phone-number", + "ui-priority": 0 + }, + "registration-number": { + "description": "Registration number of the entity in the relevant authority.", + "misp-attribute": "text", + "ui-priority": 0 + }, + "text": { + "description": "A description of the entity.", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 1 + }, + "website": { + "description": "Website of the entity.", + "misp-attribute": "link", + "ui-priority": 0 } }, - "version": 2, "description": "An object to describe a legal entity.", "meta-category": "misc", + "name": "legal-entity", + "requiredOneOf": [ + "name" + ], "uuid": "14f5688f-d89c-469f-9878-c48bf6c41c65", - "name": "legal-entity" -} + "version": 2 +} \ No newline at end of file diff --git a/objects/lnk/definition.json b/objects/lnk/definition.json index 83eca79..704b4b6 100644 --- a/objects/lnk/definition.json +++ b/objects/lnk/definition.json @@ -1,4 +1,267 @@ { + "attributes": { + "birth-droid-file-identifier": { + "description": "Birth droid volume identifier (UUIDv1 where MAC can be extracted)", + "misp-attribute": "text", + "ui-priority": 0 + }, + "birth-droid-volume-identifier": { + "description": "Droid volume identifier", + "misp-attribute": "text", + "ui-priority": 0 + }, + "droid-file-identifier": { + "description": "Droid file identifier (UUIDv1 where MAC can be extracted)", + "misp-attribute": "text", + "ui-priority": 0 + }, + "droid-volume-identifier": { + "description": "Droid volume identifier", + "misp-attribute": "text", + "ui-priority": 0 + }, + "entropy": { + "description": "Entropy of the whole file", + "disable_correlation": true, + "misp-attribute": "float", + "ui-priority": 1 + }, + "filename": { + "categories": [ + "Payload delivery", + "Artifacts dropped", + "Payload installation", + "External analysis" + ], + "description": "Filename on disk", + "disable_correlation": true, + "misp-attribute": "filename", + "multiple": true, + "ui-priority": 1 + }, + "fullpath": { + "description": "Complete path of the LNK filename including the filename", + "misp-attribute": "text", + "multiple": true, + "ui-priority": 0 + }, + "lnk-access-time": { + "categories": [ + "Other" + ], + "description": "Access time of the LNK", + "disable_correlation": true, + "misp-attribute": "datetime", + "ui-priority": 0 + }, + "lnk-command-line-arguments": { + "description": "LNK command line arguments", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 0 + }, + "lnk-creation-time": { + "categories": [ + "Other" + ], + "description": "Creation time of the LNK", + "disable_correlation": true, + "misp-attribute": "datetime", + "ui-priority": 0 + }, + "lnk-description": { + "description": "LNK description", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 0 + }, + "lnk-drive-serial-number": { + "description": "Drive serial number", + "misp-attribute": "text", + "ui-priority": 0 + }, + "lnk-drive-type": { + "description": "Drive type", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 0 + }, + "lnk-file-attribute-flags": { + "description": "File attribute flags", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 0 + }, + "lnk-file-size": { + "description": "Size of the target file, in bytes", + "disable_correlation": true, + "misp-attribute": "size-in-bytes", + "ui-priority": 0 + }, + "lnk-hot-key-value": { + "description": "Hot Key value", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 0 + }, + "lnk-icon-index": { + "description": "Icon index", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 0 + }, + "lnk-local-path": { + "description": "Local path", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 0 + }, + "lnk-modification-time": { + "categories": [ + "Other" + ], + "description": "Modification time of the LNK", + "disable_correlation": true, + "misp-attribute": "datetime", + "ui-priority": 0 + }, + "lnk-relative-path": { + "description": "Relative path", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 0 + }, + "lnk-show-window-value": { + "description": "Show Window value", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 0 + }, + "lnk-volume-label": { + "description": "Volume label", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 0 + }, + "lnk-working-directory": { + "description": "LNK working path", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 0 + }, + "machine-identifier": { + "description": "Machine identifier", + "misp-attribute": "text", + "ui-priority": 0 + }, + "malware-sample": { + "description": "The LNK file itself (binary)", + "misp-attribute": "malware-sample", + "ui-priority": 1 + }, + "md5": { + "description": "[Insecure] MD5 hash (128 bits)", + "misp-attribute": "md5", + "recommended": false, + "ui-priority": 1 + }, + "path": { + "description": "Path of the LNK filename complete or partial", + "disable_correlation": true, + "misp-attribute": "text", + "multiple": true, + "ui-priority": 0 + }, + "pattern-in-file": { + "categories": [ + "Artifacts dropped", + "Payload installation", + "External analysis" + ], + "description": "Pattern that can be found in the file", + "misp-attribute": "pattern-in-file", + "multiple": true, + "ui-priority": 1 + }, + "sha1": { + "description": "[Insecure] Secure Hash Algorithm 1 (160 bits)", + "misp-attribute": "sha1", + "recommended": false, + "ui-priority": 1 + }, + "sha224": { + "description": "Secure Hash Algorithm 2 (224 bits)", + "misp-attribute": "sha224", + "recommended": false, + "ui-priority": 0 + }, + "sha256": { + "description": "Secure Hash Algorithm 2 (256 bits)", + "misp-attribute": "sha256", + "ui-priority": 1 + }, + "sha384": { + "description": "Secure Hash Algorithm 2 (384 bits)", + "misp-attribute": "sha384", + "recommended": false, + "ui-priority": 0 + }, + "sha512": { + "description": "Secure Hash Algorithm 2 (512 bits)", + "misp-attribute": "sha512", + "ui-priority": 1 + }, + "sha512/224": { + "description": "Secure Hash Algorithm 2 (224 bits)", + "misp-attribute": "sha512/224", + "recommended": false, + "ui-priority": 0 + }, + "sha512/256": { + "description": "Secure Hash Algorithm 2 (256 bits)", + "misp-attribute": "sha512/256", + "recommended": false, + "ui-priority": 0 + }, + "size-in-bytes": { + "description": "Size of the LNK file, in bytes", + "disable_correlation": true, + "misp-attribute": "size-in-bytes", + "ui-priority": 0 + }, + "ssdeep": { + "description": "Fuzzy hash using context triggered piecewise hashes (CTPH)", + "misp-attribute": "ssdeep", + "ui-priority": 0 + }, + "state": { + "description": "State of the LNK file", + "disable_correlation": true, + "misp-attribute": "text", + "multiple": true, + "ui-priority": 0, + "values_list": [ + "Malicious", + "Harmless", + "Trusted" + ] + }, + "text": { + "description": "Free text value to attach to the file", + "disable_correlation": true, + "misp-attribute": "text", + "recommended": false, + "ui-priority": 1 + }, + "tlsh": { + "description": "Fuzzy hash by Trend Micro: Locality Sensitive Hash", + "misp-attribute": "tlsh", + "ui-priority": 0 + } + }, + "description": "LNK object describing a Windows LNK binary file (aka Windows shortcut)", + "meta-category": "file", + "name": "lnk", "requiredOneOf": [ "filename", "ssdeep", @@ -11,269 +274,6 @@ "sha512/224", "sha512/256" ], - "attributes": { - "md5": { - "description": "[Insecure] MD5 hash (128 bits)", - "ui-priority": 1, - "misp-attribute": "md5", - "recommended": false - }, - "sha1": { - "description": "[Insecure] Secure Hash Algorithm 1 (160 bits)", - "ui-priority": 1, - "misp-attribute": "sha1", - "recommended": false - }, - "sha224": { - "description": "Secure Hash Algorithm 2 (224 bits)", - "ui-priority": 0, - "misp-attribute": "sha224", - "recommended": false - }, - "sha256": { - "description": "Secure Hash Algorithm 2 (256 bits)", - "ui-priority": 1, - "misp-attribute": "sha256" - }, - "sha384": { - "description": "Secure Hash Algorithm 2 (384 bits)", - "ui-priority": 0, - "misp-attribute": "sha384", - "recommended": false - }, - "sha512": { - "description": "Secure Hash Algorithm 2 (512 bits)", - "ui-priority": 1, - "misp-attribute": "sha512" - }, - "sha512/224": { - "description": "Secure Hash Algorithm 2 (224 bits)", - "ui-priority": 0, - "misp-attribute": "sha512/224", - "recommended": false - }, - "sha512/256": { - "description": "Secure Hash Algorithm 2 (256 bits)", - "ui-priority": 0, - "misp-attribute": "sha512/256", - "recommended": false - }, - "ssdeep": { - "description": "Fuzzy hash using context triggered piecewise hashes (CTPH)", - "ui-priority": 0, - "misp-attribute": "ssdeep" - }, - "size-in-bytes": { - "description": "Size of the LNK file, in bytes", - "disable_correlation": true, - "ui-priority": 0, - "misp-attribute": "size-in-bytes" - }, - "entropy": { - "description": "Entropy of the whole file", - "disable_correlation": true, - "ui-priority": 1, - "misp-attribute": "float" - }, - "pattern-in-file": { - "description": "Pattern that can be found in the file", - "categories": [ - "Artifacts dropped", - "Payload installation", - "External analysis" - ], - "ui-priority": 1, - "misp-attribute": "pattern-in-file", - "multiple": true - }, - "text": { - "description": "Free text value to attach to the file", - "disable_correlation": true, - "ui-priority": 1, - "misp-attribute": "text", - "recommended": false - }, - "malware-sample": { - "description": "The LNK file itself (binary)", - "ui-priority": 1, - "misp-attribute": "malware-sample" - }, - "filename": { - "description": "Filename on disk", - "disable_correlation": true, - "multiple": true, - "categories": [ - "Payload delivery", - "Artifacts dropped", - "Payload installation", - "External analysis" - ], - "ui-priority": 1, - "misp-attribute": "filename" - }, - "path": { - "description": "Path of the LNK filename complete or partial", - "disable_correlation": true, - "multiple": true, - "ui-priority": 0, - "misp-attribute": "text" - }, - "fullpath": { - "description": "Complete path of the LNK filename including the filename", - "multiple": true, - "ui-priority": 0, - "misp-attribute": "text" - }, - "tlsh": { - "description": "Fuzzy hash by Trend Micro: Locality Sensitive Hash", - "ui-priority": 0, - "misp-attribute": "tlsh" - }, - "state": { - "misp-attribute": "text", - "ui-priority": 0, - "description": "State of the LNK file", - "multiple": true, - "disable_correlation": true, - "values_list": [ - "Malicious", - "Harmless", - "Trusted" - ] - }, - "lnk-creation-time": { - "description": "Creation time of the LNK", - "categories": [ - "Other" - ], - "ui-priority": 0, - "misp-attribute": "datetime", - "disable_correlation": true - }, - "lnk-modification-time": { - "description": "Modification time of the LNK", - "categories": [ - "Other" - ], - "ui-priority": 0, - "misp-attribute": "datetime", - "disable_correlation": true - }, - "lnk-access-time": { - "description": "Access time of the LNK", - "categories": [ - "Other" - ], - "ui-priority": 0, - "misp-attribute": "datetime", - "disable_correlation": true - }, - "lnk-file-size": { - "description": "Size of the target file, in bytes", - "disable_correlation": true, - "ui-priority": 0, - "misp-attribute": "size-in-bytes" - }, - "lnk-icon-index": { - "description": "Icon index", - "disable_correlation": true, - "ui-priority": 0, - "misp-attribute": "text" - }, - "lnk-show-window-value": { - "description": "Show Window value", - "disable_correlation": true, - "ui-priority": 0, - "misp-attribute": "text" - }, - "lnk-hot-key-value": { - "description": "Hot Key value", - "disable_correlation": true, - "ui-priority": 0, - "misp-attribute": "text" - }, - "lnk-file-attribute-flags": { - "description": "File attribute flags", - "disable_correlation": true, - "ui-priority": 0, - "misp-attribute": "text" - }, - "lnk-drive-type": { - "description": "Drive type", - "disable_correlation": true, - "ui-priority": 0, - "misp-attribute": "text" - }, - "lnk-drive-serial-number": { - "description": "Drive serial number", - "ui-priority": 0, - "misp-attribute": "text" - }, - "lnk-volume-label": { - "description": "Volume label", - "disable_correlation": true, - "ui-priority": 0, - "misp-attribute": "text" - }, - "lnk-local-path": { - "description": "Local path", - "disable_correlation": true, - "ui-priority": 0, - "misp-attribute": "text" - }, - "lnk-description": { - "description": "LNK description", - "disable_correlation": true, - "ui-priority": 0, - "misp-attribute": "text" - }, - "lnk-relative-path": { - "description": "Relative path", - "disable_correlation": true, - "ui-priority": 0, - "misp-attribute": "text" - }, - "lnk-working-directory": { - "description": "LNK working path", - "disable_correlation": true, - "ui-priority": 0, - "misp-attribute": "text" - }, - "lnk-command-line-arguments": { - "description": "LNK command line arguments", - "disable_correlation": true, - "ui-priority": 0, - "misp-attribute": "text" - }, - "machine-identifier": { - "description": "Machine identifier", - "ui-priority": 0, - "misp-attribute": "text" - }, - "droid-volume-identifier": { - "description": "Droid volume identifier", - "ui-priority": 0, - "misp-attribute": "text" - }, - "droid-file-identifier": { - "description": "Droid file identifier (UUIDv1 where MAC can be extracted)", - "ui-priority": 0, - "misp-attribute": "text" - }, - "birth-droid-volume-identifier": { - "description": "Droid volume identifier", - "ui-priority": 0, - "misp-attribute": "text" - }, - "birth-droid-file-identifier": { - "description": "Birth droid volume identifier (UUIDv1 where MAC can be extracted)", - "ui-priority": 0, - "misp-attribute": "text" - } - }, - "version": 1, - "description": "LNK object describing a Windows LNK binary file (aka Windows shortcut)", - "meta-category": "file", "uuid": "ad13533e-1853-4da0-a111-33a7ce7e6c09", - "name": "lnk" -} + "version": 1 +} \ No newline at end of file diff --git a/objects/macho-section/definition.json b/objects/macho-section/definition.json index f2258f5..fced91f 100644 --- a/objects/macho-section/definition.json +++ b/objects/macho-section/definition.json @@ -1,4 +1,85 @@ { + "attributes": { + "entropy": { + "description": "Entropy of the whole section", + "disable_correlation": true, + "misp-attribute": "float", + "ui-priority": 0 + }, + "md5": { + "description": "[Insecure] MD5 hash (128 bits)", + "misp-attribute": "md5", + "recommended": false, + "ui-priority": 1 + }, + "name": { + "description": "Name of the section", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 1 + }, + "sha1": { + "description": "[Insecure] Secure Hash Algorithm 1 (160 bits)", + "misp-attribute": "sha1", + "recommended": false, + "ui-priority": 1 + }, + "sha224": { + "description": "Secure Hash Algorithm 2 (224 bits)", + "misp-attribute": "sha224", + "recommended": false, + "ui-priority": 0 + }, + "sha256": { + "description": "Secure Hash Algorithm 2 (256 bits)", + "misp-attribute": "sha256", + "ui-priority": 1 + }, + "sha384": { + "description": "Secure Hash Algorithm 2 (384 bits)", + "misp-attribute": "sha384", + "recommended": false, + "ui-priority": 0 + }, + "sha512": { + "description": "Secure Hash Algorithm 2 (512 bits)", + "misp-attribute": "sha512", + "ui-priority": 1 + }, + "sha512/224": { + "description": "Secure Hash Algorithm 2 (224 bits)", + "misp-attribute": "sha512/224", + "recommended": false, + "ui-priority": 0 + }, + "sha512/256": { + "description": "Secure Hash Algorithm 2 (256 bits)", + "misp-attribute": "sha512/256", + "recommended": false, + "ui-priority": 0 + }, + "size-in-bytes": { + "description": "Size of the section, in bytes", + "disable_correlation": true, + "misp-attribute": "size-in-bytes", + "ui-priority": 1 + }, + "ssdeep": { + "description": "Fuzzy hash using context triggered piecewise hashes (CTPH)", + "misp-attribute": "ssdeep", + "ui-priority": 0 + }, + "text": { + "description": "Free text value to attach to the section", + "disable_correlation": true, + "misp-attribute": "text", + "recommended": false, + "ui-priority": 1 + } + }, + "description": "Object describing a section of a file in Mach-O format.", + "meta-category": "file", + "name": "macho-section", "requiredOneOf": [ "text", "name", @@ -11,87 +92,6 @@ "sha512/224", "sha512/256" ], - "attributes": { - "md5": { - "description": "[Insecure] MD5 hash (128 bits)", - "ui-priority": 1, - "misp-attribute": "md5", - "recommended": false - }, - "sha1": { - "description": "[Insecure] Secure Hash Algorithm 1 (160 bits)", - "ui-priority": 1, - "misp-attribute": "sha1", - "recommended": false - }, - "sha224": { - "description": "Secure Hash Algorithm 2 (224 bits)", - "ui-priority": 0, - "misp-attribute": "sha224", - "recommended": false - }, - "sha256": { - "description": "Secure Hash Algorithm 2 (256 bits)", - "ui-priority": 1, - "misp-attribute": "sha256" - }, - "sha384": { - "description": "Secure Hash Algorithm 2 (384 bits)", - "ui-priority": 0, - "misp-attribute": "sha384", - "recommended": false - }, - "sha512": { - "description": "Secure Hash Algorithm 2 (512 bits)", - "ui-priority": 1, - "misp-attribute": "sha512" - }, - "sha512/224": { - "description": "Secure Hash Algorithm 2 (224 bits)", - "ui-priority": 0, - "misp-attribute": "sha512/224", - "recommended": false - }, - "sha512/256": { - "description": "Secure Hash Algorithm 2 (256 bits)", - "ui-priority": 0, - "misp-attribute": "sha512/256", - "recommended": false - }, - "ssdeep": { - "description": "Fuzzy hash using context triggered piecewise hashes (CTPH)", - "ui-priority": 0, - "misp-attribute": "ssdeep" - }, - "entropy": { - "description": "Entropy of the whole section", - "disable_correlation": true, - "ui-priority": 0, - "misp-attribute": "float" - }, - "name": { - "description": "Name of the section", - "disable_correlation": true, - "ui-priority": 1, - "misp-attribute": "text" - }, - "size-in-bytes": { - "description": "Size of the section, in bytes", - "disable_correlation": true, - "ui-priority": 1, - "misp-attribute": "size-in-bytes" - }, - "text": { - "description": "Free text value to attach to the section", - "disable_correlation": true, - "ui-priority": 1, - "misp-attribute": "text", - "recommended": false - } - }, - "version": 2, - "description": "Object describing a section of a file in Mach-O format.", - "meta-category": "file", "uuid": "fca3c534-d188-4964-9c6e-9922e1dfe66e", - "name": "macho-section" -} + "version": 2 +} \ No newline at end of file diff --git a/objects/macho/definition.json b/objects/macho/definition.json index 956fbb0..a100617 100644 --- a/objects/macho/definition.json +++ b/objects/macho/definition.json @@ -1,18 +1,33 @@ { - "requiredOneOf": [ - "text", - "name", - "entrypoint-address" - ], "attributes": { "entrypoint-address": { "description": "Address of the entry point", "disable_correlation": true, - "ui-priority": 0, - "misp-attribute": "text" + "misp-attribute": "text", + "ui-priority": 0 + }, + "name": { + "description": "Binary's name", + "disable_correlation": false, + "misp-attribute": "text", + "ui-priority": 1 + }, + "number-sections": { + "description": "Number of sections", + "disable_correlation": true, + "misp-attribute": "counter", + "ui-priority": 0 + }, + "text": { + "description": "Free text value to attach to the Mach-O file", + "disable_correlation": true, + "misp-attribute": "text", + "recommended": false, + "ui-priority": 1 }, "type": { "description": "Type of Mach-O", + "misp-attribute": "text", "sane_default": [ "BUNDLE", "CORE", @@ -26,32 +41,17 @@ "OBJECT", "PRELOAD" ], - "ui-priority": 0, - "misp-attribute": "text" - }, - "number-sections": { - "description": "Number of sections", - "disable_correlation": true, - "ui-priority": 0, - "misp-attribute": "counter" - }, - "name": { - "description": "Binary's name", - "disable_correlation": false, - "ui-priority": 1, - "misp-attribute": "text" - }, - "text": { - "description": "Free text value to attach to the Mach-O file", - "disable_correlation": true, - "ui-priority": 1, - "misp-attribute": "text", - "recommended": false + "ui-priority": 0 } }, - "version": 2, "description": "Object describing a file in Mach-O format.", "meta-category": "file", + "name": "macho", + "requiredOneOf": [ + "text", + "name", + "entrypoint-address" + ], "uuid": "23fb8371-c7e3-45fe-b897-fdf074f95267", - "name": "macho" -} + "version": 2 +} \ No newline at end of file diff --git a/objects/mactime-timeline-analysis/definition.json b/objects/mactime-timeline-analysis/definition.json index cb20d2b..f77dfea 100644 --- a/objects/mactime-timeline-analysis/definition.json +++ b/objects/mactime-timeline-analysis/definition.json @@ -1,30 +1,8 @@ { - "requiredOneOf": [ - "file-path", - "activityType", - "datetime" - ], "attributes": { - "file-path": { - "description": "Location of the file on the disc", - "ui-priority": 0, - "misp-attribute": "text" - }, - "datetime": { - "description": "Date and time when the operation was conducted on the file", - "ui-priority": 0, - "misp-attribute": "datetime", - "disable_correlation": true - }, - "file_size": { - "description": "Determines the file size in bytes", - "ui-priority": 0, - "misp-attribute": "text", - "disable_correlation": true - }, "activityType": { "description": "Determines the type of activity conducted on the file at a given time", - "ui-priority": 0, + "disable_correlation": true, "misp-attribute": "text", "sane_default": [ "Accessed", @@ -33,24 +11,46 @@ "Modified", "Other" ], - "disable_correlation": true + "ui-priority": 0 }, - "filePermissions": { - "description": "Describes permissions assigned the file", - "ui-priority": 0, - "misp-attribute": "text", - "disable_correlation": true + "datetime": { + "description": "Date and time when the operation was conducted on the file", + "disable_correlation": true, + "misp-attribute": "datetime", + "ui-priority": 0 }, "file": { "description": "Mactime output file", - "ui-priority": 0, + "disable_correlation": true, "misp-attribute": "attachment", - "disable_correlation": true + "ui-priority": 0 + }, + "file-path": { + "description": "Location of the file on the disc", + "misp-attribute": "text", + "ui-priority": 0 + }, + "filePermissions": { + "description": "Describes permissions assigned the file", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 0 + }, + "file_size": { + "description": "Determines the file size in bytes", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 0 } }, - "version": 3, "description": "Mactime template, used in forensic investigations to describe the timeline of a file activity", "meta-category": "file", + "name": "mactime-timeline-analysis", + "requiredOneOf": [ + "file-path", + "activityType", + "datetime" + ], "uuid": "9297982e-be62-4772-a665-c91f5a8d639", - "name": "mactime-timeline-analysis" -} + "version": 3 +} \ No newline at end of file diff --git a/objects/malware-config/definition.json b/objects/malware-config/definition.json index 435fc95..e8ec946 100644 --- a/objects/malware-config/definition.json +++ b/objects/malware-config/definition.json @@ -1,51 +1,51 @@ { - "requiredOneOf": [ - "config" - ], "attributes": { "config": { "description": "Raw (decrypted, decoded) text of the malware configuration.", - "ui-priority": 1, - "misp-attribute": "text" + "misp-attribute": "text", + "ui-priority": 1 + }, + "encrypted": { + "description": "Encrypted or encoded text of the malware configuration in base64.", + "misp-attribute": "text", + "ui-priority": 1 + }, + "first-seen": { + "description": "When the malware configuration has been seen for the first time.", + "disable_correlation": true, + "misp-attribute": "datetime", + "ui-priority": 0 }, "format": { + "description": "Original format of the malware configuration.", + "disable_correlation": true, + "misp-attribute": "text", "sane_default": [ "JSON", "yaml", "INI", "other" ], - "description": "Original format of the malware configuration.", - "ui-priority": 0, - "misp-attribute": "text", - "disable_correlation": true - }, - "encrypted": { - "description": "Encrypted or encoded text of the malware configuration in base64.", - "ui-priority": 1, - "misp-attribute": "text" - }, - "password": { - "description": "Password or encryption key used to encrypt the malware configuration.", - "ui-priority": 1, - "misp-attribute": "text" + "ui-priority": 0 }, "last-seen": { "description": "When the malware configuration has been seen for the last time.", "disable_correlation": true, - "ui-priority": 0, - "misp-attribute": "datetime" + "misp-attribute": "datetime", + "ui-priority": 0 }, - "first-seen": { - "description": "When the malware configuration has been seen for the first time.", - "disable_correlation": true, - "ui-priority": 0, - "misp-attribute": "datetime" + "password": { + "description": "Password or encryption key used to encrypt the malware configuration.", + "misp-attribute": "text", + "ui-priority": 1 } }, - "version": 1, "description": "Malware configuration recovered or extracted from a malicious binary.", "meta-category": "file", + "name": "malware-config", + "requiredOneOf": [ + "config" + ], "uuid": "8200b79b-1d8c-49a8-9a63-7710e613c059", - "name": "malware-config" -} + "version": 1 +} \ No newline at end of file diff --git a/objects/meme-image/definition.json b/objects/meme-image/definition.json index 06cb1a7..d6b2484 100644 --- a/objects/meme-image/definition.json +++ b/objects/meme-image/definition.json @@ -1,21 +1,11 @@ { - "requiredOneOf": [ - "attachment", - "archive", - "document-text" - ], "attributes": { - "username": { - "description": "Username who posted the meme.", - "ui-priority": 0, - "misp-attribute": "text" - }, "5Ds-of-propaganda": { "description": "5 D's of propaganda are tactics of rebuttal used to defend against criticism and adversarial narratives.", - "ui-priority": 1, - "misp-attribute": "text", "disable_correlation": true, + "misp-attribute": "text", "multiple": true, + "ui-priority": 1, "values_list": [ "dismiss", "distort", @@ -24,84 +14,94 @@ "divide" ] }, - "attachment": { - "description": "The image file.", - "ui-priority": 1, - "misp-attribute": "attachment" - }, - "document-text": { - "description": "Raw text of meme", - "ui-priority": 1, - "misp-attribute": "text" - }, - "meme-reference": { - "description": "A link to know-your-meme or similar reference material.", - "ui-priority": 1, - "misp-attribute": "link" - }, "a/b-test": { "description": "A flag to define if this meme is part of an a/b test. If set to true, it is part of an a/b test set.", "disable_correlation": true, - "ui-priority": 0, - "misp-attribute": "boolean" - }, - "crosspost": { - "description": "Safe site where the meme has been posted.", - "ui-priority": 0, - "misp-attribute": "link", - "multiple": true - }, - "crosspost-unsafe": { - "description": "Unsafe site where the meme has been posted.", - "ui-priority": 0, - "misp-attribute": "url", - "multiple": true - }, - "url": { - "description": "Original URL location of the meme (potentially malicious)", - "ui-priority": 1, - "misp-attribute": "url" - }, - "link": { - "description": "Original link into the meme (Supposed harmless)", - "ui-priority": 1, - "misp-attribute": "link" + "misp-attribute": "boolean", + "ui-priority": 0 }, "archive": { "description": "Archive of the original document (Internet Archive, Archive.is, etc).", - "ui-priority": 1, + "misp-attribute": "link", "multiple": true, - "misp-attribute": "link" + "ui-priority": 1 + }, + "attachment": { + "description": "The image file.", + "misp-attribute": "attachment", + "ui-priority": 1 + }, + "crosspost": { + "description": "Safe site where the meme has been posted.", + "misp-attribute": "link", + "multiple": true, + "ui-priority": 0 + }, + "crosspost-unsafe": { + "description": "Unsafe site where the meme has been posted.", + "misp-attribute": "url", + "multiple": true, + "ui-priority": 0 + }, + "document-text": { + "description": "Raw text of meme", + "misp-attribute": "text", + "ui-priority": 1 + }, + "first-seen": { + "description": "When the meme has been accessible or seen for the first time.", + "disable_correlation": true, + "misp-attribute": "datetime", + "ui-priority": 0 + }, + "last-seen": { + "description": "When the meme has been accessible or seen for the last time.", + "disable_correlation": true, + "misp-attribute": "datetime", + "ui-priority": 0 + }, + "link": { + "description": "Original link into the meme (Supposed harmless)", + "misp-attribute": "link", + "ui-priority": 1 + }, + "meme-reference": { + "description": "A link to know-your-meme or similar reference material.", + "misp-attribute": "link", + "ui-priority": 1 }, "objective": { "description": "Objective of the meme.", - "ui-priority": 1, - "misp-attribute": "text", "disable_correlation": true, + "misp-attribute": "text", "multiple": true, "sane_default": [ "Disinformation", "Advertising", "Parody", "Other" - ] + ], + "ui-priority": 1 }, - "last-seen": { - "description": "When the meme has been accessible or seen for the last time.", - "disable_correlation": true, - "ui-priority": 0, - "misp-attribute": "datetime" + "url": { + "description": "Original URL location of the meme (potentially malicious)", + "misp-attribute": "url", + "ui-priority": 1 }, - "first-seen": { - "description": "When the meme has been accessible or seen for the first time.", - "disable_correlation": true, - "ui-priority": 0, - "misp-attribute": "datetime" + "username": { + "description": "Username who posted the meme.", + "misp-attribute": "text", + "ui-priority": 0 } }, - "version": 7, "description": "Object describing a meme (image).", "meta-category": "file", + "name": "meme-image", + "requiredOneOf": [ + "attachment", + "archive", + "document-text" + ], "uuid": "6f6c3b61-f085-475e-93df-2e2d9c2fb0f6", - "name": "meme-image" -} + "version": 7 +} \ No newline at end of file diff --git a/objects/microblog/definition.json b/objects/microblog/definition.json index fd8dbb8..44216a8 100644 --- a/objects/microblog/definition.json +++ b/objects/microblog/definition.json @@ -1,52 +1,119 @@ { - "requiredOneOf": [ - "post", - "archive", - "url", - "link", - "attachment" - ], "attributes": { - "post": { - "description": "Raw text of the post.", - "ui-priority": 1, - "misp-attribute": "text" - }, - "title": { - "description": "Title of the post.", - "ui-priority": 1, - "misp-attribute": "text" - }, - "url": { - "description": "Original URL of the microblog post (potentially malicious).", - "ui-priority": 1, - "multiple": true, - "misp-attribute": "url" - }, - "link": { - "description": "Original link to the microblog post (supposed harmless).", - "ui-priority": 1, - "misp-attribute": "link", - "multiple": true, - "to_ids": false - }, "archive": { "description": "Archive of the original document (Internet Archive, Archive.is, etc).", - "ui-priority": 1, + "misp-attribute": "link", "multiple": true, - "misp-attribute": "link" + "ui-priority": 1 }, "attachment": { "description": "The microblog post file or screen capture.", - "ui-priority": 1, + "misp-attribute": "attachment", "multiple": true, - "misp-attribute": "attachment" + "ui-priority": 1 + }, + "creation-date": { + "description": "Initial creation of the microblog post", + "misp-attribute": "datetime", + "ui-priority": 0 + }, + "display-name": { + "description": "Display name of the account who posted the microblog.", + "misp-attribute": "text", + "ui-priority": 0 + }, + "embedded-link": { + "description": "Link into the microblog post", + "misp-attribute": "url", + "multiple": true, + "ui-priority": 0 + }, + "embedded-safe-link": { + "description": "Safe link into the microblog post", + "misp-attribute": "link", + "multiple": true, + "ui-priority": 0 + }, + "hashtag": { + "description": "Hashtag embedded in the microblog post", + "misp-attribute": "text", + "multiple": true, + "ui-priority": 0 + }, + "in-reply-to-display-name": { + "description": "The user display name of the microblog this post replies to.", + "misp-attribute": "text", + "multiple": true, + "ui-priority": 0 + }, + "in-reply-to-status-id": { + "description": "The microblog ID of the microblog this post replies to.", + "misp-attribute": "text", + "multiple": true, + "ui-priority": 0 + }, + "in-reply-to-user-id": { + "description": "The user ID of the microblog this post replies to.", + "misp-attribute": "text", + "multiple": true, + "ui-priority": 0 + }, + "language": { + "description": "The language of the post.", + "misp-attribute": "text", + "multiple": true, + "ui-priority": 0 + }, + "link": { + "description": "Original link to the microblog post (supposed harmless).", + "misp-attribute": "link", + "multiple": true, + "to_ids": false, + "ui-priority": 1 + }, + "modification-date": { + "description": "Last update of the microblog post", + "misp-attribute": "datetime", + "ui-priority": 0 + }, + "post": { + "description": "Raw text of the post.", + "misp-attribute": "text", + "ui-priority": 1 + }, + "removal-date": { + "description": "When the microblog post was removed.", + "misp-attribute": "datetime", + "ui-priority": 0 + }, + "state": { + "description": "State of the microblog post", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 0, + "values_list": [ + "Informative", + "Malicious", + "Misinformation", + "Disinformation", + "Unknown" + ] + }, + "title": { + "description": "Title of the post.", + "misp-attribute": "text", + "ui-priority": 1 + }, + "twitter-id": { + "description": "The microblog post id.", + "misp-attribute": "twitter-id", + "multiple": true, + "ui-priority": 0 }, "type": { "description": "Type of the microblog post", - "ui-priority": 1, - "misp-attribute": "text", "disable_correlation": true, + "misp-attribute": "text", "sane_default": [ "Twitter", "Facebook", @@ -56,115 +123,48 @@ "Instagram", "Forum", "Other" - ] + ], + "ui-priority": 1 }, - "state": { - "misp-attribute": "text", - "ui-priority": 0, - "description": "State of the microblog post", - "disable_correlation": true, - "values_list": [ - "Informative", - "Malicious", - "Misinformation", - "Disinformation", - "Unknown" - ] + "url": { + "description": "Original URL of the microblog post (potentially malicious).", + "misp-attribute": "url", + "multiple": true, + "ui-priority": 1 }, "username": { "description": "Username who posted the microblog post (without the @ prefix)", - "ui-priority": 0, - "misp-attribute": "text" + "misp-attribute": "text", + "ui-priority": 0 }, - "display-name": { - "description": "Display name of the account who posted the microblog.", - "ui-priority": 0, - "misp-attribute": "text" + "username-quoted": { + "description": "Username who are quoted in the microblog post.", + "misp-attribute": "text", + "multiple": true, + "ui-priority": 0 }, "verified-username": { "description": "Is the username account verified by the operator of the microblog platform", - "ui-priority": 0, - "misp-attribute": "text", "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 0, "values_list": [ "Verified", "Unverified", "Unknown" ] - }, - "creation-date": { - "description": "Initial creation of the microblog post", - "ui-priority": 0, - "misp-attribute": "datetime" - }, - "modification-date": { - "description": "Last update of the microblog post", - "ui-priority": 0, - "misp-attribute": "datetime" - }, - "in-reply-to-user-id": { - "description": "The user ID of the microblog this post replies to.", - "ui-priority": 0, - "misp-attribute": "text", - "multiple": true - }, - "in-reply-to-status-id": { - "description": "The microblog ID of the microblog this post replies to.", - "ui-priority": 0, - "misp-attribute": "text", - "multiple": true - }, - "in-reply-to-display-name": { - "description": "The user display name of the microblog this post replies to.", - "ui-priority": 0, - "misp-attribute": "text", - "multiple": true - }, - "language": { - "description": "The language of the post.", - "ui-priority": 0, - "misp-attribute": "text", - "multiple": true - }, - "embedded-link": { - "description": "Link into the microblog post", - "ui-priority": 0, - "misp-attribute": "url", - "multiple": true - }, - "embedded-safe-link": { - "description": "Safe link into the microblog post", - "ui-priority": 0, - "misp-attribute": "link", - "multiple": true - }, - "removal-date": { - "description": "When the microblog post was removed.", - "ui-priority": 0, - "misp-attribute": "datetime" - }, - "username-quoted": { - "description": "Username who are quoted in the microblog post.", - "ui-priority": 0, - "multiple": true, - "misp-attribute": "text" - }, - "twitter-id": { - "description": "The microblog post id.", - "ui-priority": 0, - "multiple": true, - "misp-attribute": "twitter-id" - }, - "hashtag": { - "description": "Hashtag embedded in the microblog post", - "ui-priority": 0, - "misp-attribute": "text", - "multiple": true } }, - "version": 20, "description": "Microblog post like a Twitter tweet or a post on a Facebook wall.", "meta-category": "misc", + "name": "microblog", + "requiredOneOf": [ + "post", + "archive", + "url", + "link", + "attachment" + ], "uuid": "8ec8c911-ddbe-4f5b-895b-fbff70c42a60", - "name": "microblog" -} + "version": 20 +} \ No newline at end of file diff --git a/objects/mutex/definition.json b/objects/mutex/definition.json index f9d23aa..df22638 100644 --- a/objects/mutex/definition.json +++ b/objects/mutex/definition.json @@ -1,31 +1,31 @@ { - "requiredOneOf": [ - "name" - ], "attributes": { "description": { "description": "Description", - "ui-priority": 0, - "misp-attribute": "text" + "misp-attribute": "text", + "ui-priority": 0 + }, + "name": { + "description": "name of the mutex", + "misp-attribute": "text", + "ui-priority": 0 }, "operating-system": { "description": "Operating system where the mutex has been seen", - "ui-priority": 0, "misp-attribute": "text", "sane_default": [ "Windows", "Unix" - ] - }, - "name": { - "description": "name of the mutex", - "ui-priority": 0, - "misp-attribute": "text" + ], + "ui-priority": 0 } }, - "version": 1, "description": "Object to describe mutual exclusion locks (mutex) as seen in memory or computer program", "meta-category": "misc", + "name": "mutex", + "requiredOneOf": [ + "name" + ], "uuid": "9f5c1a68-2021-4faa-b409-61c899c86466", - "name": "mutex" -} + "version": 1 +} \ No newline at end of file diff --git a/objects/narrative/definition.json b/objects/narrative/definition.json index f57edcf..9c551cc 100644 --- a/objects/narrative/definition.json +++ b/objects/narrative/definition.json @@ -1,16 +1,11 @@ { - "requiredOneOf": [ - "attachment", - "archive", - "narrative-summary" - ], "attributes": { "5Ds-of-propaganda": { "description": "5 D's of propaganda are tactics of rebuttal used to defend against criticism and adversarial narratives.", - "ui-priority": 1, - "misp-attribute": "text", "disable_correlation": true, + "misp-attribute": "text", "multiple": true, + "ui-priority": 1, "values_list": [ "dismiss", "distort", @@ -19,62 +14,67 @@ "divide" ] }, + "archive": { + "description": "Archive of the original narrative source (Internet Archive, Archive.is, etc).", + "disable_correlation": true, + "misp-attribute": "link", + "multiple": true, + "ui-priority": 1 + }, "attachment": { "description": "Documents related to the narrative.", - "ui-priority": 1, - "misp-attribute": "attachment" - }, - "narrative-disproof": { - "description": "Disproof or evidence against the narrative.", - "disable_correlation": true, - "ui-priority": 1, - "misp-attribute": "text" - }, - "narrative-summary": { - "description": "A summary of the narrative.", - "ui-priority": 1, - "misp-attribute": "text" + "misp-attribute": "attachment", + "ui-priority": 1 }, "external-references": { "description": "Link to external references.", "disable_correlation": true, - "ui-priority": 1, - "misp-attribute": "link" + "misp-attribute": "link", + "ui-priority": 1 }, "link": { "description": "Original link to the narrative source (Supposed harmless)", - "ui-priority": 1, - "misp-attribute": "link" + "misp-attribute": "link", + "ui-priority": 1 }, - "url": { - "description": "Original link to the narrative source (Supposed malicious)", - "ui-priority": 1, - "misp-attribute": "url" - }, - "archive": { - "description": "Archive of the original narrative source (Internet Archive, Archive.is, etc).", + "narrative-disproof": { + "description": "Disproof or evidence against the narrative.", "disable_correlation": true, - "ui-priority": 1, - "multiple": true, - "misp-attribute": "link" + "misp-attribute": "text", + "ui-priority": 1 + }, + "narrative-summary": { + "description": "A summary of the narrative.", + "misp-attribute": "text", + "ui-priority": 1 }, "objective": { "description": "Objective of the narrative.", - "ui-priority": 1, - "misp-attribute": "text", "disable_correlation": true, + "misp-attribute": "text", "multiple": true, "sane_default": [ "Disinformation", "Advertising", "Parody", "Other" - ] + ], + "ui-priority": 1 + }, + "url": { + "description": "Original link to the narrative source (Supposed malicious)", + "misp-attribute": "url", + "ui-priority": 1 } }, - "version": 4, "description": "Object describing a narrative.", "meta-category": "misc", + "name": "narrative", + "requiredOneOf": [ + "attachment", + "archive", + "narrative-summary" + ], "uuid": "83bea299-514a-4719-a84b-f6fd0997fac1", - "name": "narrative" -} + "version": 4 +} \ No newline at end of file diff --git a/objects/netflow/definition.json b/objects/netflow/definition.json index 35d412b..5e80527 100644 --- a/objects/netflow/definition.json +++ b/objects/netflow/definition.json @@ -1,159 +1,159 @@ { - "name": "netflow", - "uuid": "bf148c58-3e7e-414e-8de8-5d96379ca77e", - "meta-category": "network", - "description": "Netflow object describes an network object based on the Netflowv5/v9 minimal definition", - "version": 2, "attributes": { - "ip-dst": { - "misp-attribute": "ip-dst", - "ui-priority": 1, - "categories": [ - "Network activity", - "External analysis" - ], - "description": "IP address destination of the netflow" + "byte-count": { + "description": "Bytes counted in this flow", + "disable_correlation": true, + "misp-attribute": "counter", + "ui-priority": 0 }, - "ip-src": { - "misp-attribute": "ip-src", - "ui-priority": 1, + "community-id": { + "description": "Community id of the represented flow", + "misp-attribute": "community-id", + "ui-priority": 0 + }, + "direction": { + "description": "Direction of this flow", + "disable_correlation": true, + "misp-attribute": "text", + "sane_default": [ + "Ingress", + "Egress" + ], + "ui-priority": 0 + }, + "dst-as": { "categories": [ "Network activity", "External analysis" ], - "description": "IP address source of the netflow" + "description": "Destination AS number for this flow", + "misp-attribute": "AS", + "ui-priority": 0 }, "dst-port": { + "categories": [ + "Network activity", + "External analysis" + ], "description": "Destination port of the netflow", "misp-attribute": "port", - "ui-priority": 1, - "categories": [ - "Network activity", - "External analysis" - ] + "ui-priority": 1 }, - "src-port": { - "description": "Source port of the netflow", - "misp-attribute": "port", - "ui-priority": 1, - "categories": [ - "Network activity", - "External analysis" - ] - }, - "tcp-flags": { - "misp-attribute": "text", - "ui-priority": 0, + "first-packet-seen": { + "description": "First packet seen in this flow", "disable_correlation": true, - "categories": [ - "Network activity", - "External analysis" - ], - "description": "TCP flags of the flow" + "misp-attribute": "datetime", + "ui-priority": 1 + }, + "flow-count": { + "description": "Flows counted in this flow", + "disable_correlation": true, + "misp-attribute": "counter", + "ui-priority": 0 }, "icmp-type": { - "misp-attribute": "text", - "ui-priority": 0, - "disable_correlation": true, "categories": [ "Network activity", "External analysis" ], - "description": "ICMP type of the flow (if the traffic is ICMP)" + "description": "ICMP type of the flow (if the traffic is ICMP)", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 0 + }, + "ip-dst": { + "categories": [ + "Network activity", + "External analysis" + ], + "description": "IP address destination of the netflow", + "misp-attribute": "ip-dst", + "ui-priority": 1 }, "ip-protocol-number": { - "misp-attribute": "size-in-bytes", - "ui-priority": 0, + "description": "IP protocol number of this flow", "disable_correlation": true, - "description": "IP protocol number of this flow" + "misp-attribute": "size-in-bytes", + "ui-priority": 0 + }, + "ip-src": { + "categories": [ + "Network activity", + "External analysis" + ], + "description": "IP address source of the netflow", + "misp-attribute": "ip-src", + "ui-priority": 1 + }, + "ip_version": { + "description": "IP version of this flow", + "disable_correlation": true, + "misp-attribute": "counter", + "ui-priority": 0 + }, + "last-packet-seen": { + "description": "Last packet seen in this flow", + "disable_correlation": true, + "misp-attribute": "datetime", + "ui-priority": 0 + }, + "packet-count": { + "description": "Packets counted in this flow", + "disable_correlation": true, + "misp-attribute": "counter", + "ui-priority": 0 }, "protocol": { + "description": "Protocol used for this flow", + "disable_correlation": true, "misp-attribute": "text", "ui-priority": 0, - "disable_correlation": true, "values_list": [ "TCP", "UDP", "ICMP", "IP" - ], - "description": "Protocol used for this flow" + ] }, "src-as": { - "misp-attribute": "AS", - "ui-priority": 0, "categories": [ "Network activity", "External analysis" ], - "description": "Source AS number for this flow" - }, - "dst-as": { + "description": "Source AS number for this flow", "misp-attribute": "AS", - "ui-priority": 0, + "ui-priority": 0 + }, + "src-port": { "categories": [ "Network activity", "External analysis" ], - "description": "Destination AS number for this flow" + "description": "Source port of the netflow", + "misp-attribute": "port", + "ui-priority": 1 }, - "ip_version": { - "misp-attribute": "counter", - "ui-priority": 0, + "tcp-flags": { + "categories": [ + "Network activity", + "External analysis" + ], + "description": "TCP flags of the flow", "disable_correlation": true, - "description": "IP version of this flow" - }, - "direction": { "misp-attribute": "text", - "ui-priority": 0, - "disable_correlation": true, - "sane_default": [ - "Ingress", - "Egress" - ], - "description": "Direction of this flow" - }, - "flow-count": { - "misp-attribute": "counter", - "ui-priority": 0, - "disable_correlation": true, - "description": "Flows counted in this flow" - }, - "packet-count": { - "misp-attribute": "counter", - "ui-priority": 0, - "disable_correlation": true, - "description": "Packets counted in this flow" - }, - "byte-count": { - "misp-attribute": "counter", - "ui-priority": 0, - "disable_correlation": true, - "description": "Bytes counted in this flow" - }, - "first-packet-seen": { - "misp-attribute": "datetime", - "ui-priority": 1, - "description": "First packet seen in this flow", - "disable_correlation": true - }, - "last-packet-seen": { - "misp-attribute": "datetime", - "ui-priority": 0, - "description": "Last packet seen in this flow", - "disable_correlation": true - }, - "community-id": { - "misp-attribute": "community-id", - "ui-priority": 0, - "description": "Community id of the represented flow" + "ui-priority": 0 } }, + "description": "Netflow object describes an network object based on the Netflowv5/v9 minimal definition", + "meta-category": "network", + "name": "netflow", "requiredOneOf": [ "first-packet-seen", "ip-src", "ip-dst", "dst-port", "community-id" - ] -} + ], + "uuid": "bf148c58-3e7e-414e-8de8-5d96379ca77e", + "version": 2 +} \ No newline at end of file diff --git a/objects/network-connection/definition.json b/objects/network-connection/definition.json index e0ac368..16efe53 100644 --- a/objects/network-connection/definition.json +++ b/objects/network-connection/definition.json @@ -1,100 +1,98 @@ { - "name": "network-connection", - "uuid": "af16764b-f8e5-4603-9de1-de34d272f80b", - "meta-category": "network", - "description": "A local or remote network connection.", - "version": 3, "attributes": { - "ip-src": { - "description": "Source IP address of the nework connection.", - "ui-priority": 1, - "categories": [ - "Network activity", - "External analysis" - ], - "misp-attribute": "ip-src" - }, - "ip-dst": { - "description": "Destination IP address of the nework connection.", - "ui-priority": 1, - "categories": [ - "Network activity", - "External analysis" - ], - "misp-attribute": "ip-dst" - }, - "src-port": { - "description": "Source port of the nework connection.", - "ui-priority": 1, - "categories": [ - "Network activity", - "External analysis" - ], - "misp-attribute": "port" + "community-id": { + "description": "Flow description as a community ID hash value", + "misp-attribute": "community-id", + "ui-priority": 1 }, "dst-port": { - "description": "Destination port of the nework connection.", - "ui-priority": 1, "categories": [ "Network activity", "External analysis" ], - "misp-attribute": "port" + "description": "Destination port of the nework connection.", + "misp-attribute": "port", + "ui-priority": 1 }, - "hostname-src": { - "description": "Source hostname of the network connection.", - "ui-priority": 1, - "misp-attribute": "hostname" + "first-packet-seen": { + "description": "Datetime of the first packet seen.", + "disable_correlation": true, + "misp-attribute": "datetime", + "ui-priority": 1 }, "hostname-dst": { "description": "Destination hostname of the network connection.", - "ui-priority": 1, - "misp-attribute": "hostname" + "misp-attribute": "hostname", + "ui-priority": 1 + }, + "hostname-src": { + "description": "Source hostname of the network connection.", + "misp-attribute": "hostname", + "ui-priority": 1 + }, + "ip-dst": { + "categories": [ + "Network activity", + "External analysis" + ], + "description": "Destination IP address of the nework connection.", + "misp-attribute": "ip-dst", + "ui-priority": 1 + }, + "ip-src": { + "categories": [ + "Network activity", + "External analysis" + ], + "description": "Source IP address of the nework connection.", + "misp-attribute": "ip-src", + "ui-priority": 1 }, "layer3-protocol": { "description": "Layer 3 protocol of the network connection.", - "ui-priority": 0, + "disable_correlation": true, + "misp-attribute": "text", "sane_default": [ "IP", "ICMP", "ARP" ], - "misp-attribute": "text", - "disable_correlation": true + "ui-priority": 0 }, "layer4-protocol": { "description": "Layer 4 protocol of the network connection.", - "ui-priority": 0, + "disable_correlation": true, + "misp-attribute": "text", "sane_default": [ "TCP", "UDP" ], - "misp-attribute": "text", - "disable_correlation": true + "ui-priority": 0 }, "layer7-protocol": { "description": "Layer 7 protocol of the network connection.", - "ui-priority": 0, + "disable_correlation": true, + "misp-attribute": "text", "sane_default": [ "HTTP", "HTTPS", "FTP" ], - "misp-attribute": "text", - "disable_correlation": true + "ui-priority": 0 }, - "first-packet-seen": { - "misp-attribute": "datetime", - "ui-priority": 1, - "description": "Datetime of the first packet seen.", - "disable_correlation": true - }, - "community-id": { - "misp-attribute": "community-id", - "ui-priority": 1, - "description": "Flow description as a community ID hash value" + "src-port": { + "categories": [ + "Network activity", + "External analysis" + ], + "description": "Source port of the nework connection.", + "misp-attribute": "port", + "ui-priority": 1 } }, + "description": "A local or remote network connection.", + "meta-category": "network", + "name": "network-connection", "requiredOneOf": [ "first-packet-seen", "ip-src", @@ -102,5 +100,7 @@ "src-port", "dst-port", "community-id" - ] -} + ], + "uuid": "af16764b-f8e5-4603-9de1-de34d272f80b", + "version": 3 +} \ No newline at end of file diff --git a/objects/network-socket/definition.json b/objects/network-socket/definition.json index 94ecb53..0e1498a 100644 --- a/objects/network-socket/definition.json +++ b/objects/network-socket/definition.json @@ -1,75 +1,8 @@ { - "name": "network-socket", - "uuid": "48bbfd72-ef8e-4649-b14d-41b4b5a0eba2", - "meta-category": "network", - "description": "Network socket object describes a local or remote network connections based on the socket data structure.", - "version": 2, "attributes": { - "ip-src": { - "description": "Source (local) IP address of the network socket connection.", - "ui-priority": 1, - "categories": [ - "Network activity", - "External analysis" - ], - "misp-attribute": "ip-src" - }, - "filename": { - "description": "Socket using filename", - "ui-priority": 1, - "misp-attribute": "filename" - }, - "hostname-src": { - "description": "Source (local) hostname of the network socket connection.", - "ui-priority": 1, - "misp-attribute": "hostname" - }, - "ip-dst": { - "description": "Destination IP address of the network socket connection.", - "ui-priority": 1, - "categories": [ - "Network activity", - "External analysis" - ], - "misp-attribute": "ip-dst" - }, - "hostname-dst": { - "description": "Destination hostname of the network socket connection.", - "ui-priority": 1, - "misp-attribute": "hostname" - }, - "src-port": { - "description": "Source (local) port of the network socket connection.", - "ui-priority": 1, - "categories": [ - "Network activity", - "External analysis" - ], - "misp-attribute": "port" - }, - "dst-port": { - "description": "Destination port of the network socket connection.", - "ui-priority": 1, - "categories": [ - "Network activity", - "External analysis" - ], - "misp-attribute": "port" - }, - "protocol": { - "misp-attribute": "text", - "ui-priority": 0, - "values_list": [ - "TCP", - "UDP", - "ICMP", - "IP" - ], - "description": "Protocol used by the network socket." - }, "address-family": { "description": "Address family who specifies the address family type (AF_*) of the socket connection.", - "ui-priority": 1, + "misp-attribute": "text", "sane_default": [ "AF_UNSPEC", "AF_LOCAL", @@ -118,11 +51,11 @@ "AF_KCM", "AF_MAX" ], - "misp-attribute": "text" + "ui-priority": 1 }, "domain-family": { "description": "Domain family who specifies the communication domain (PF_*) of the socket connection.", - "ui-priority": 1, + "misp-attribute": "text", "sane_default": [ "PF_UNSPEC", "PF_LOCAL", @@ -171,29 +104,96 @@ "PF_KCM", "PF_MAX" ], - "misp-attribute": "text" + "ui-priority": 1 + }, + "dst-port": { + "categories": [ + "Network activity", + "External analysis" + ], + "description": "Destination port of the network socket connection.", + "misp-attribute": "port", + "ui-priority": 1 + }, + "filename": { + "description": "Socket using filename", + "misp-attribute": "filename", + "ui-priority": 1 + }, + "hostname-dst": { + "description": "Destination hostname of the network socket connection.", + "misp-attribute": "hostname", + "ui-priority": 1 + }, + "hostname-src": { + "description": "Source (local) hostname of the network socket connection.", + "misp-attribute": "hostname", + "ui-priority": 1 + }, + "ip-dst": { + "categories": [ + "Network activity", + "External analysis" + ], + "description": "Destination IP address of the network socket connection.", + "misp-attribute": "ip-dst", + "ui-priority": 1 + }, + "ip-src": { + "categories": [ + "Network activity", + "External analysis" + ], + "description": "Source (local) IP address of the network socket connection.", + "misp-attribute": "ip-src", + "ui-priority": 1 + }, + "option": { + "description": "Option on the socket connection.", + "misp-attribute": "text", + "multiple": true, + "ui-priority": 1 + }, + "protocol": { + "description": "Protocol used by the network socket.", + "misp-attribute": "text", + "ui-priority": 0, + "values_list": [ + "TCP", + "UDP", + "ICMP", + "IP" + ] + }, + "src-port": { + "categories": [ + "Network activity", + "External analysis" + ], + "description": "Source (local) port of the network socket connection.", + "misp-attribute": "port", + "ui-priority": 1 }, "state": { "description": "State of the socket connection.", + "misp-attribute": "text", "multiple": true, "sane_default": [ "blocking", "listening" ], - "misp-attribute": "text", - "ui-priority": 1 - }, - "option": { - "description": "Option on the socket connection.", - "multiple": true, - "misp-attribute": "text", "ui-priority": 1 } }, + "description": "Network socket object describes a local or remote network connections based on the socket data structure.", + "meta-category": "network", + "name": "network-socket", "requiredOneOf": [ "ip-src", "ip-dst", "src-port", "dst-port" - ] -} + ], + "uuid": "48bbfd72-ef8e-4649-b14d-41b4b5a0eba2", + "version": 2 +} \ No newline at end of file diff --git a/objects/news-agency/definition.json b/objects/news-agency/definition.json index 438da8b..6cfd6e1 100644 --- a/objects/news-agency/definition.json +++ b/objects/news-agency/definition.json @@ -1,4 +1,70 @@ { + "attributes": { + "address": { + "description": "Postal address of the news agency.", + "misp-attribute": "text", + "multiple": true, + "ui-priority": 10 + }, + "alias": { + "description": "Alias of the news agency.", + "disable_correlation": true, + "misp-attribute": "text", + "multiple": true, + "ui-priority": 99 + }, + "archive": { + "description": "Archive of the original document (Internet Archive, Archive.is, etc).", + "misp-attribute": "link", + "multiple": true, + "ui-priority": 1 + }, + "attachment": { + "description": "The news file, screen capture, audio, etc.", + "misp-attribute": "attachment", + "multiple": true, + "ui-priority": 1 + }, + "e-mail": { + "description": "Email address of the organization.", + "misp-attribute": "email-src", + "multiple": true, + "ui-priority": 10 + }, + "fax-number": { + "description": "Fax number of the news agency.", + "misp-attribute": "phone-number", + "multiple": true, + "ui-priority": 10 + }, + "link": { + "description": "Original link to the news agency (Supposed harmless).", + "misp-attribute": "link", + "multiple": true, + "ui-priority": 1 + }, + "name": { + "description": "Name of the news agency.", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 100 + }, + "phone-number": { + "description": "Phone number of the news agency.", + "misp-attribute": "phone-number", + "multiple": true, + "ui-priority": 10 + }, + "url": { + "description": "Original URL location of the news agency (potentially malicious).", + "misp-attribute": "url", + "multiple": true, + "ui-priority": 1 + } + }, + "description": "News agencies compile news and disseminate news in bulk.", + "meta-category": "misc", + "name": "news-agency", "requiredOneOf": [ "name", "alias", @@ -7,72 +73,6 @@ "link", "attachment" ], - "attributes": { - "name": { - "description": "Name of the news agency.", - "disable_correlation": true, - "ui-priority": 100, - "misp-attribute": "text" - }, - "alias": { - "description": "Alias of the news agency.", - "ui-priority": 99, - "disable_correlation": true, - "misp-attribute": "text", - "multiple": true - }, - "archive": { - "description": "Archive of the original document (Internet Archive, Archive.is, etc).", - "ui-priority": 1, - "multiple": true, - "misp-attribute": "link" - }, - "attachment": { - "description": "The news file, screen capture, audio, etc.", - "ui-priority": 1, - "multiple": true, - "misp-attribute": "attachment" - }, - "url": { - "description": "Original URL location of the news agency (potentially malicious).", - "ui-priority": 1, - "misp-attribute": "url", - "multiple": true - }, - "link": { - "description": "Original link to the news agency (Supposed harmless).", - "ui-priority": 1, - "misp-attribute": "link", - "multiple": true - }, - "phone-number": { - "description": "Phone number of the news agency.", - "ui-priority": 10, - "misp-attribute": "phone-number", - "multiple": true - }, - "fax-number": { - "description": "Fax number of the news agency.", - "ui-priority": 10, - "misp-attribute": "phone-number", - "multiple": true - }, - "address": { - "description": "Postal address of the news agency.", - "ui-priority": 10, - "misp-attribute": "text", - "multiple": true - }, - "e-mail": { - "description": "Email address of the organization.", - "ui-priority": 10, - "misp-attribute": "email-src", - "multiple": true - } - }, - "version": 2, - "description": "News agencies compile news and disseminate news in bulk.", - "meta-category": "misc", "uuid": "92b3f7fd-c4bc-42af-a73b-033ace439622", - "name": "news-agency" -} + "version": 2 +} \ No newline at end of file diff --git a/objects/news-media/definition.json b/objects/news-media/definition.json index 8a46926..a1d4e32 100644 --- a/objects/news-media/definition.json +++ b/objects/news-media/definition.json @@ -1,84 +1,82 @@ { - "requiredOneOf": [ - "source", - "alias", - "archive", - "content", - "url", - "link", - "attachment" - ], "attributes": { - "source": { - "description": "Name of the news source.", - "disable_correlation": true, - "ui-priority": 100, - "misp-attribute": "text" + "address": { + "description": "Postal address of the news source.", + "misp-attribute": "text", + "multiple": true, + "ui-priority": 10 }, "alias": { "description": "Alias of the news source.", - "ui-priority": 99, "disable_correlation": true, "misp-attribute": "text", - "multiple": true - }, - "username": { - "description": "Username who posted the blog post.", - "ui-priority": 0, - "misp-attribute": "text" - }, - "content": { - "description": "Raw content of the news.", - "ui-priority": 1, - "misp-attribute": "text" - }, - "transcription": { - "description": "Transcribed audio/visual content.", - "ui-priority": 1, - "misp-attribute": "text" - }, - "title": { - "description": "Title of the post.", - "ui-priority": 1, - "misp-attribute": "text" + "multiple": true, + "ui-priority": 99 }, "archive": { "description": "Archive of the news (Internet Archive, Archive.is, etc).", - "ui-priority": 1, + "misp-attribute": "link", "multiple": true, - "misp-attribute": "link" + "ui-priority": 1 }, "attachment": { "description": "The news file, screen capture, audio, etc.", - "ui-priority": 1, + "misp-attribute": "attachment", "multiple": true, - "misp-attribute": "attachment" + "ui-priority": 1 }, - "type": { - "description": "Type of news media (newspaper, TV, podcast, etc).", - "ui-priority": 1, + "content": { + "description": "Raw content of the news.", "misp-attribute": "text", - "disable_correlation": true, + "ui-priority": 1 + }, + "e-mail": { + "description": "Email address of the news source.", + "misp-attribute": "email-src", "multiple": true, - "sane_default": [ - "Newspaper", - "Newspaper (Online)", - "Magazine", - "Magazine (Online)", - "TV", - "Tube", - "Radio", - "Radio (Online)", - "Podcast", - "Alternative Media", - "Other" - ] + "ui-priority": 10 + }, + "embedded-link": { + "description": "Site linked by the blog post.", + "misp-attribute": "url", + "multiple": true, + "ui-priority": 0 + }, + "embedded-safe-link": { + "description": "Safe site linked by the blog post.", + "misp-attribute": "link", + "multiple": true, + "ui-priority": 0 + }, + "fax-number": { + "description": "Fax number of the news source.", + "misp-attribute": "phone-number", + "multiple": true, + "ui-priority": 10 + }, + "link": { + "description": "Original link to news (Supposed harmless).", + "misp-attribute": "link", + "multiple": true, + "ui-priority": 1 + }, + "phone-number": { + "description": "Phone number of the news source.", + "misp-attribute": "phone-number", + "multiple": true, + "ui-priority": 10 + }, + "source": { + "description": "Name of the news source.", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 100 }, "sub-type": { - "misp-attribute": "text", - "ui-priority": 0, "description": "Format of the news post (business daily, local news, metasite, etc).", "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 0, "values_list": [ "Business Daily", "Local News", @@ -93,58 +91,60 @@ "Other" ] }, + "title": { + "description": "Title of the post.", + "misp-attribute": "text", + "ui-priority": 1 + }, + "transcription": { + "description": "Transcribed audio/visual content.", + "misp-attribute": "text", + "ui-priority": 1 + }, + "type": { + "description": "Type of news media (newspaper, TV, podcast, etc).", + "disable_correlation": true, + "misp-attribute": "text", + "multiple": true, + "sane_default": [ + "Newspaper", + "Newspaper (Online)", + "Magazine", + "Magazine (Online)", + "TV", + "Tube", + "Radio", + "Radio (Online)", + "Podcast", + "Alternative Media", + "Other" + ], + "ui-priority": 1 + }, "url": { "description": "Original URL location of news (potentially malicious).", - "ui-priority": 1, "misp-attribute": "url", - "multiple": true + "multiple": true, + "ui-priority": 1 }, - "link": { - "description": "Original link to news (Supposed harmless).", - "ui-priority": 1, - "misp-attribute": "link", - "multiple": true - }, - "phone-number": { - "description": "Phone number of the news source.", - "ui-priority": 10, - "misp-attribute": "phone-number", - "multiple": true - }, - "fax-number": { - "description": "Fax number of the news source.", - "ui-priority": 10, - "misp-attribute": "phone-number", - "multiple": true - }, - "address": { - "description": "Postal address of the news source.", - "ui-priority": 10, + "username": { + "description": "Username who posted the blog post.", "misp-attribute": "text", - "multiple": true - }, - "embedded-link": { - "description": "Site linked by the blog post.", - "ui-priority": 0, - "misp-attribute": "url", - "multiple": true - }, - "embedded-safe-link": { - "description": "Safe site linked by the blog post.", - "ui-priority": 0, - "misp-attribute": "link", - "multiple": true - }, - "e-mail": { - "description": "Email address of the news source.", - "ui-priority": 10, - "misp-attribute": "email-src", - "multiple": true + "ui-priority": 0 } }, - "version": 2, "description": "News media are forms of mass media delivering news to the general public.", "meta-category": "misc", + "name": "news-media", + "requiredOneOf": [ + "source", + "alias", + "archive", + "content", + "url", + "link", + "attachment" + ], "uuid": "691463c5-5302-4847-9bec-4c56ccfec677", - "name": "news-media" -} + "version": 2 +} \ No newline at end of file diff --git a/objects/organization/definition.json b/objects/organization/definition.json index 4e39398..d1d622a 100644 --- a/objects/organization/definition.json +++ b/objects/organization/definition.json @@ -1,65 +1,63 @@ { - "requiredOneOf": [ - "name", - "alias" - ], "attributes": { - "name": { - "description": "Name of the organization", - "disable_correlation": false, - "ui-priority": 100, - "misp-attribute": "text" - }, - "alias": { - "description": "Alias of the organization", - "ui-priority": 99, + "VAT": { + "description": "VAT or TAX-ID of the organization", "misp-attribute": "text", - "multiple": true - }, - "type-of-organization": { - "description": "Type of the organization", - "ui-priority": 97, - "misp-attribute": "text" - }, - "description": { - "description": "Description of the organization", - "ui-priority": 96, - "misp-attribute": "text" - }, - "date-of-inception": { - "description": "Date of inception of the organization", - "ui-priority": 0, - "misp-attribute": "date-of-birth" - }, - "phone-number": { - "description": "Phone number of the organization.", - "ui-priority": 10, - "misp-attribute": "phone-number", - "multiple": true - }, - "fax-number": { - "description": "Fax number of the organization.", - "ui-priority": 10, - "misp-attribute": "phone-number", - "multiple": true + "multiple": true, + "ui-priority": 0 }, "address": { "description": "Postal address of the organization.", - "ui-priority": 10, "misp-attribute": "text", - "multiple": true + "multiple": true, + "ui-priority": 10 + }, + "alias": { + "description": "Alias of the organization", + "misp-attribute": "text", + "multiple": true, + "ui-priority": 99 + }, + "date-of-inception": { + "description": "Date of inception of the organization", + "misp-attribute": "date-of-birth", + "ui-priority": 0 + }, + "description": { + "description": "Description of the organization", + "misp-attribute": "text", + "ui-priority": 96 }, "e-mail": { "description": "Email address of the organization.", - "ui-priority": 10, "misp-attribute": "email-src", - "multiple": true + "multiple": true, + "ui-priority": 10 + }, + "fax-number": { + "description": "Fax number of the organization.", + "misp-attribute": "phone-number", + "multiple": true, + "ui-priority": 10 + }, + "name": { + "description": "Name of the organization", + "disable_correlation": false, + "misp-attribute": "text", + "ui-priority": 100 + }, + "phone-number": { + "description": "Phone number of the organization.", + "misp-attribute": "phone-number", + "multiple": true, + "ui-priority": 10 }, "role": { "description": "The role of the organization.", - "ui-priority": 0, + "disable_correlation": true, "misp-attribute": "text", "multiple": true, + "ui-priority": 0, "values_list": [ "Suspect", "Victim", @@ -68,19 +66,21 @@ "Culprit", "Accomplice", "Target" - ], - "disable_correlation": true + ] }, - "VAT": { - "description": "VAT or TAX-ID of the organization", - "ui-priority": 0, + "type-of-organization": { + "description": "Type of the organization", "misp-attribute": "text", - "multiple": true + "ui-priority": 97 } }, - "version": 4, "description": "An object which describes an organization.", "meta-category": "misc", + "name": "organization", + "requiredOneOf": [ + "name", + "alias" + ], "uuid": "f750e12b-127a-432c-b022-b3f9153c4e2a", - "name": "organization" -} + "version": 4 +} \ No newline at end of file diff --git a/objects/original-imported-file/definition.json b/objects/original-imported-file/definition.json index 6436924..72142cb 100644 --- a/objects/original-imported-file/definition.json +++ b/objects/original-imported-file/definition.json @@ -1,18 +1,7 @@ { - "requiredOneOf": [ - "imported-sample", - "format" - ], "attributes": { - "imported-sample": { - "description": "The original imported file itself (binary).", - "ui-priority": 1, - "disable_correlation": true, - "misp-attribute": "attachment" - }, "format": { "description": "Format of data imported.", - "ui-priority": 1, "disable_correlation": true, "misp-attribute": "text", "sane_default": [ @@ -21,17 +10,28 @@ "STIX 1.2", "STIX 2.0", "OpenIOC" - ] + ], + "ui-priority": 1 + }, + "imported-sample": { + "description": "The original imported file itself (binary).", + "disable_correlation": true, + "misp-attribute": "attachment", + "ui-priority": 1 }, "uri": { "description": "URI related to the imported file.", - "ui-priority": 0, - "misp-attribute": "uri" + "misp-attribute": "uri", + "ui-priority": 0 } }, - "version": 2, "description": "Object describing the original file used to import data in MISP.", "meta-category": "file", + "name": "original-imported-file", + "requiredOneOf": [ + "imported-sample", + "format" + ], "uuid": "4cd560e9-2cfe-40a1-9964-7b2e797ecac5", - "name": "original-imported-file" -} + "version": 2 +} \ No newline at end of file diff --git a/objects/passive-dns/definition.json b/objects/passive-dns/definition.json index 38994ee..147fafa 100644 --- a/objects/passive-dns/definition.json +++ b/objects/passive-dns/definition.json @@ -1,44 +1,44 @@ { - "required": [ - "rrtype", - "rrname", - "rdata" - ], "attributes": { - "zone_time_last": { - "description": "Last time that the unique tuple (rrname, rrtype, rdata) record has been seen via master file import.", - "ui-priority": 0, - "misp-attribute": "datetime", - "disable_correlation": true - }, - "text": { - "description": "Description of the passive DNS record.", - "ui-priority": 0, + "bailiwick": { + "description": "Best estimate of the apex of the zone where this data is authoritative", + "disable_correlation": true, "misp-attribute": "text", - "disable_correlation": true + "ui-priority": 0 }, "count": { "description": "How many authoritative DNS answers were received at the Passive DNS Server's collectors with exactly the given set of values as answers.", - "ui-priority": 0, + "disable_correlation": true, "misp-attribute": "counter", - "disable_correlation": true + "ui-priority": 0 + }, + "origin": { + "description": "Origin of the Passive DNS response", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 0 + }, + "rdata": { + "description": "Resource records of the queried resource", + "misp-attribute": "text", + "ui-priority": 1 }, "rrname": { - "description": "Resource Record name of the queried resource.", "categories": [ "Network activity", "External analysis" ], - "ui-priority": 1, - "misp-attribute": "text" + "description": "Resource Record name of the queried resource.", + "misp-attribute": "text", + "ui-priority": 1 }, "rrtype": { - "description": "Resource Record type as seen by the passive DNS.", "categories": [ "Network activity", "External analysis" ], - "ui-priority": 1, + "description": "Resource Record type as seen by the passive DNS.", + "disable_correlation": true, "misp-attribute": "text", "sane_default": [ "A", @@ -55,53 +55,53 @@ "HINFO", "A6" ], - "disable_correlation": true - }, - "rdata": { - "description": "Resource records of the queried resource", - "ui-priority": 1, - "misp-attribute": "text" - }, - "zone_time_first": { - "description": "First time that the unique tuple (rrname, rrtype, rdata) record has been seen via master file import", - "ui-priority": 0, - "misp-attribute": "datetime", - "disable_correlation": true - }, - "origin": { - "description": "Origin of the Passive DNS response", - "ui-priority": 0, - "misp-attribute": "text", - "disable_correlation": true - }, - "time_last": { - "description": "Last time that the unique tuple (rrname, rrtype, rdata) record has been seen by the passive DNS", - "ui-priority": 0, - "misp-attribute": "datetime", - "disable_correlation": true - }, - "time_first": { - "description": "First time that the unique tuple (rrname, rrtype, rdata) has been seen by the passive DNS", - "ui-priority": 0, - "misp-attribute": "datetime", - "disable_correlation": true - }, - "bailiwick": { - "description": "Best estimate of the apex of the zone where this data is authoritative", - "ui-priority": 0, - "misp-attribute": "text", - "disable_correlation": true + "ui-priority": 1 }, "sensor_id": { "description": "Sensor information where the record was seen", - "ui-priority": 0, + "disable_correlation": true, "misp-attribute": "text", - "disable_correlation": true + "ui-priority": 0 + }, + "text": { + "description": "Description of the passive DNS record.", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 0 + }, + "time_first": { + "description": "First time that the unique tuple (rrname, rrtype, rdata) has been seen by the passive DNS", + "disable_correlation": true, + "misp-attribute": "datetime", + "ui-priority": 0 + }, + "time_last": { + "description": "Last time that the unique tuple (rrname, rrtype, rdata) record has been seen by the passive DNS", + "disable_correlation": true, + "misp-attribute": "datetime", + "ui-priority": 0 + }, + "zone_time_first": { + "description": "First time that the unique tuple (rrname, rrtype, rdata) record has been seen via master file import", + "disable_correlation": true, + "misp-attribute": "datetime", + "ui-priority": 0 + }, + "zone_time_last": { + "description": "Last time that the unique tuple (rrname, rrtype, rdata) record has been seen via master file import.", + "disable_correlation": true, + "misp-attribute": "datetime", + "ui-priority": 0 } }, - "version": 3, "description": "Passive DNS records as expressed in draft-dulaunoy-dnsop-passive-dns-cof-01", "meta-category": "network", + "name": "passive-dns", + "required": [ + "rrtype", + "rrname", + "rdata" + ], "uuid": "b77b7b1c-66ab-4a41-8da4-83810f6d2d6c", - "name": "passive-dns" -} + "version": 3 +} \ No newline at end of file diff --git a/objects/paste/definition.json b/objects/paste/definition.json index e78808f..f5f8ee1 100644 --- a/objects/paste/definition.json +++ b/objects/paste/definition.json @@ -1,15 +1,27 @@ { - "requiredOneOf": [ - "origin", - "paste" - ], "attributes": { - "paste": { - "description": "Raw text of the paste or post", - "ui-priority": 1, - "misp-attribute": "text" + "first-seen": { + "description": "When the paste has been accessible or seen for the first time.", + "disable_correlation": true, + "misp-attribute": "datetime", + "ui-priority": 0 + }, + "last-seen": { + "description": "When the paste has been accessible or seen for the last time.", + "disable_correlation": true, + "misp-attribute": "datetime", + "ui-priority": 0 + }, + "link": { + "description": "Link to the original source of the source or post (when used legitimately for OSINT source or alike).", + "misp-attribute": "link", + "ui-priority": 0 }, "origin": { + "description": "Original source of the paste or post.", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 0, "values_list": [ "pastebin.com", "pastebin.com_pro", @@ -22,48 +34,36 @@ "ghostbin.com", "paste.ee", "0bin.net" - ], - "description": "Original source of the paste or post.", - "ui-priority": 0, + ] + }, + "paste": { + "description": "Raw text of the paste or post", "misp-attribute": "text", - "disable_correlation": true + "ui-priority": 1 }, "title": { + "description": "Title of the paste or post.", "misp-attribute": "text", - "ui-priority": 0, - "description": "Title of the paste or post." - }, - "username": { - "misp-attribute": "text", - "ui-priority": 0, - "description": "User who posted the post." + "ui-priority": 0 }, "url": { + "description": "Link to the original source of the paste or post (when used maliciously).", "misp-attribute": "url", - "ui-priority": 0, - "description": "Link to the original source of the paste or post (when used maliciously)." + "ui-priority": 0 }, - "link": { - "misp-attribute": "link", - "ui-priority": 0, - "description": "Link to the original source of the source or post (when used legitimately for OSINT source or alike)." - }, - "last-seen": { - "description": "When the paste has been accessible or seen for the last time.", - "disable_correlation": true, - "ui-priority": 0, - "misp-attribute": "datetime" - }, - "first-seen": { - "description": "When the paste has been accessible or seen for the first time.", - "disable_correlation": true, - "ui-priority": 0, - "misp-attribute": "datetime" + "username": { + "description": "User who posted the post.", + "misp-attribute": "text", + "ui-priority": 0 } }, - "version": 5, "description": "Paste or similar post from a website allowing to share privately or publicly posts.", "meta-category": "misc", + "name": "paste", + "requiredOneOf": [ + "origin", + "paste" + ], "uuid": "cedc055c-78aa-49a4-bfd7-4cc30cecef12", - "name": "paste" -} + "version": 5 +} \ No newline at end of file diff --git a/objects/pcap-metadata/definition.json b/objects/pcap-metadata/definition.json index c454f26..36d6594 100644 --- a/objects/pcap-metadata/definition.json +++ b/objects/pcap-metadata/definition.json @@ -1,26 +1,32 @@ { - "requiredOneOf": [ - "text", - "first-packet-seen", - "last-packet-seen" - ], "attributes": { - "capture-length": { - "description": "Capture length set on the captured interface.", - "disable_correlation": true, - "ui-priority": 1, - "misp-attribute": "text" - }, "capture-interface": { "description": "Interface name where the packet capture was running.", "disable_correlation": true, - "ui-priority": 1, - "misp-attribute": "text" + "misp-attribute": "text", + "ui-priority": 1 + }, + "capture-length": { + "description": "Capture length set on the captured interface.", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 1 + }, + "first-packet-seen": { + "description": "When the first packet has been seen.", + "disable_correlation": true, + "misp-attribute": "datetime", + "ui-priority": 0 + }, + "last-packet-seen": { + "description": "When the last packet has been seen.", + "disable_correlation": true, + "misp-attribute": "datetime", + "ui-priority": 0 }, "protocol": { "description": "Capture protocol (linktype name).", "disable_correlation": true, - "ui-priority": 1, "misp-attribute": "text", "sane_default": [ "PER_PACKET", @@ -224,30 +230,24 @@ "JUNIPER_ST", "ETHERNET_MPACKET", "DOCSIS31_XRA31" - ] + ], + "ui-priority": 1 }, "text": { "description": "A description of the packet capture.", "disable_correlation": true, - "ui-priority": 1, - "misp-attribute": "text" - }, - "first-packet-seen": { - "description": "When the first packet has been seen.", - "disable_correlation": true, - "ui-priority": 0, - "misp-attribute": "datetime" - }, - "last-packet-seen": { - "description": "When the last packet has been seen.", - "disable_correlation": true, - "ui-priority": 0, - "misp-attribute": "datetime" + "misp-attribute": "text", + "ui-priority": 1 } }, - "version": 2, "description": "Network packet capture metadata", "meta-category": "network", + "name": "pcap-metadata", + "requiredOneOf": [ + "text", + "first-packet-seen", + "last-packet-seen" + ], "uuid": "0784aefa-ec3a-4eca-a431-c31ed7058bd3", - "name": "pcap-metadata" -} + "version": 2 +} \ No newline at end of file diff --git a/objects/pe-section/definition.json b/objects/pe-section/definition.json index 2ef4c3c..e70c362 100644 --- a/objects/pe-section/definition.json +++ b/objects/pe-section/definition.json @@ -1,4 +1,120 @@ { + "attributes": { + "characteristic": { + "description": "Characteristic of the section", + "misp-attribute": "text", + "sane_default": [ + "read", + "write", + "executable" + ], + "ui-priority": 0 + }, + "entropy": { + "description": "Entropy of the whole section", + "disable_correlation": true, + "misp-attribute": "float", + "ui-priority": 0 + }, + "md5": { + "description": "[Insecure] MD5 hash (128 bits)", + "misp-attribute": "md5", + "recommended": false, + "ui-priority": 1 + }, + "name": { + "description": "Name of the section", + "disable_correlation": true, + "misp-attribute": "text", + "sane_default": [ + ".rsrc", + ".reloc", + ".rdata", + ".data", + ".text" + ], + "ui-priority": 1 + }, + "offset": { + "description": "Section’s offset", + "disable_correlation": true, + "misp-attribute": "hex", + "ui-priority": 1 + }, + "sha1": { + "description": "[Insecure] Secure Hash Algorithm 1 (160 bits)", + "misp-attribute": "sha1", + "recommended": false, + "ui-priority": 1 + }, + "sha224": { + "description": "Secure Hash Algorithm 2 (224 bits)", + "misp-attribute": "sha224", + "recommended": false, + "ui-priority": 0 + }, + "sha256": { + "description": "Secure Hash Algorithm 2 (256 bits)", + "misp-attribute": "sha256", + "ui-priority": 1 + }, + "sha384": { + "description": "Secure Hash Algorithm 2 (384 bits)", + "misp-attribute": "sha384", + "recommended": false, + "ui-priority": 0 + }, + "sha512": { + "description": "Secure Hash Algorithm 2 (512 bits)", + "misp-attribute": "sha512", + "ui-priority": 1 + }, + "sha512/224": { + "description": "Secure Hash Algorithm 2 (224 bits)", + "misp-attribute": "sha512/224", + "recommended": false, + "ui-priority": 0 + }, + "sha512/256": { + "description": "Secure Hash Algorithm 2 (256 bits)", + "misp-attribute": "sha512/256", + "recommended": false, + "ui-priority": 0 + }, + "size-in-bytes": { + "description": "Size of the section, in bytes", + "disable_correlation": true, + "misp-attribute": "size-in-bytes", + "ui-priority": 1 + }, + "ssdeep": { + "description": "Fuzzy hash using context triggered piecewise hashes (CTPH)", + "misp-attribute": "ssdeep", + "ui-priority": 0 + }, + "text": { + "description": "Free text value to attach to the section", + "disable_correlation": true, + "misp-attribute": "text", + "recommended": false, + "ui-priority": 1 + }, + "virtual_address": { + "description": "Section’s virtual address", + "disable_correlation": true, + "misp-attribute": "hex", + "ui-priority": 1 + }, + "virtual_size": { + "description": "Section’s virtual size", + "disable_correlation": true, + "misp-attribute": "size-in-bytes", + "ui-priority": 1 + } + }, + "description": "Object describing a section of a Portable Executable", + "meta-category": "file", + "name": "pe-section", "requiredOneOf": [ "text", "name", @@ -11,122 +127,6 @@ "sha512/224", "sha512/256" ], - "attributes": { - "md5": { - "description": "[Insecure] MD5 hash (128 bits)", - "ui-priority": 1, - "misp-attribute": "md5", - "recommended": false - }, - "sha1": { - "description": "[Insecure] Secure Hash Algorithm 1 (160 bits)", - "ui-priority": 1, - "misp-attribute": "sha1", - "recommended": false - }, - "sha224": { - "description": "Secure Hash Algorithm 2 (224 bits)", - "ui-priority": 0, - "misp-attribute": "sha224", - "recommended": false - }, - "sha256": { - "description": "Secure Hash Algorithm 2 (256 bits)", - "ui-priority": 1, - "misp-attribute": "sha256" - }, - "sha384": { - "description": "Secure Hash Algorithm 2 (384 bits)", - "ui-priority": 0, - "misp-attribute": "sha384", - "recommended": false - }, - "sha512": { - "description": "Secure Hash Algorithm 2 (512 bits)", - "ui-priority": 1, - "misp-attribute": "sha512" - }, - "sha512/224": { - "description": "Secure Hash Algorithm 2 (224 bits)", - "ui-priority": 0, - "misp-attribute": "sha512/224", - "recommended": false - }, - "sha512/256": { - "description": "Secure Hash Algorithm 2 (256 bits)", - "ui-priority": 0, - "misp-attribute": "sha512/256", - "recommended": false - }, - "ssdeep": { - "description": "Fuzzy hash using context triggered piecewise hashes (CTPH)", - "ui-priority": 0, - "misp-attribute": "ssdeep" - }, - "entropy": { - "description": "Entropy of the whole section", - "disable_correlation": true, - "ui-priority": 0, - "misp-attribute": "float" - }, - "name": { - "description": "Name of the section", - "disable_correlation": true, - "sane_default": [ - ".rsrc", - ".reloc", - ".rdata", - ".data", - ".text" - ], - "ui-priority": 1, - "misp-attribute": "text" - }, - "size-in-bytes": { - "description": "Size of the section, in bytes", - "disable_correlation": true, - "ui-priority": 1, - "misp-attribute": "size-in-bytes" - }, - "offset": { - "description": "Section’s offset", - "disable_correlation": true, - "ui-priority": 1, - "misp-attribute": "hex" - }, - "virtual_address": { - "description": "Section’s virtual address", - "disable_correlation": true, - "ui-priority": 1, - "misp-attribute": "hex" - }, - "virtual_size": { - "description": "Section’s virtual size", - "disable_correlation": true, - "ui-priority": 1, - "misp-attribute": "size-in-bytes" - }, - "text": { - "description": "Free text value to attach to the section", - "disable_correlation": true, - "ui-priority": 1, - "misp-attribute": "text", - "recommended": false - }, - "characteristic": { - "description": "Characteristic of the section", - "sane_default": [ - "read", - "write", - "executable" - ], - "ui-priority": 0, - "misp-attribute": "text" - } - }, - "version": 3, - "description": "Object describing a section of a Portable Executable", - "meta-category": "file", "uuid": "198a17d2-a135-4b25-9a32-5aa4e632014a", - "name": "pe-section" -} + "version": 3 +} \ No newline at end of file diff --git a/objects/pe/definition.json b/objects/pe/definition.json index 5b0c0e4..463c679 100644 --- a/objects/pe/definition.json +++ b/objects/pe/definition.json @@ -1,4 +1,120 @@ { + "attributes": { + "company-name": { + "description": "CompanyName in the resources", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 0 + }, + "compilation-timestamp": { + "description": "Compilation timestamp defined in the PE header", + "misp-attribute": "datetime", + "ui-priority": 1 + }, + "entrypoint-address": { + "description": "Address of the entry point", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 0 + }, + "entrypoint-section-at-position": { + "description": "Name of the section and position of the section in the PE", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 0 + }, + "file-description": { + "description": "FileDescription in the resources", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 0 + }, + "file-version": { + "description": "FileVersion in the resources", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 0 + }, + "impfuzzy": { + "description": "Fuzzy Hash (ssdeep) calculated from the import table", + "misp-attribute": "impfuzzy", + "ui-priority": 0 + }, + "imphash": { + "description": "Hash (md5) calculated from the import table", + "misp-attribute": "imphash", + "ui-priority": 0 + }, + "internal-filename": { + "description": "InternalFilename in the resources", + "disable_correlation": true, + "misp-attribute": "filename", + "ui-priority": 0 + }, + "lang-id": { + "description": "Lang ID in the resources", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 0 + }, + "legal-copyright": { + "description": "LegalCopyright in the resources", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 0 + }, + "number-sections": { + "description": "Number of sections", + "disable_correlation": true, + "misp-attribute": "counter", + "ui-priority": 0 + }, + "original-filename": { + "description": "OriginalFilename in the resources", + "disable_correlation": true, + "misp-attribute": "filename", + "ui-priority": 1 + }, + "pehash": { + "description": "Hash of the structural information about a sample. See https://www.usenix.org/legacy/event/leet09/tech/full_papers/wicherski/wicherski_html/", + "misp-attribute": "pehash", + "ui-priority": 0 + }, + "product-name": { + "description": "ProductName in the resources", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 0 + }, + "product-version": { + "description": "ProductVersion in the resources", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 0 + }, + "text": { + "description": "Free text value to attach to the PE", + "disable_correlation": true, + "misp-attribute": "text", + "recommended": false, + "ui-priority": 1 + }, + "type": { + "description": "Type of PE", + "disable_correlation": true, + "misp-attribute": "text", + "sane_default": [ + "exe", + "dll", + "driver", + "unknown" + ], + "ui-priority": 1 + } + }, + "description": "Object describing a Portable Executable", + "meta-category": "file", + "name": "pe", "requiredOneOf": [ "text", "type", @@ -8,122 +124,6 @@ "imphash", "impfuzzy" ], - "attributes": { - "pehash": { - "description": "Hash of the structural information about a sample. See https://www.usenix.org/legacy/event/leet09/tech/full_papers/wicherski/wicherski_html/", - "ui-priority": 0, - "misp-attribute": "pehash" - }, - "impfuzzy": { - "description": "Fuzzy Hash (ssdeep) calculated from the import table", - "ui-priority": 0, - "misp-attribute": "impfuzzy" - }, - "internal-filename": { - "description": "InternalFilename in the resources", - "ui-priority": 0, - "misp-attribute": "filename", - "disable_correlation": true - }, - "original-filename": { - "description": "OriginalFilename in the resources", - "ui-priority": 1, - "misp-attribute": "filename", - "disable_correlation": true - }, - "number-sections": { - "description": "Number of sections", - "disable_correlation": true, - "ui-priority": 0, - "misp-attribute": "counter" - }, - "text": { - "description": "Free text value to attach to the PE", - "disable_correlation": true, - "ui-priority": 1, - "misp-attribute": "text", - "recommended": false - }, - "type": { - "description": "Type of PE", - "sane_default": [ - "exe", - "dll", - "driver", - "unknown" - ], - "disable_correlation": true, - "ui-priority": 1, - "misp-attribute": "text" - }, - "imphash": { - "description": "Hash (md5) calculated from the import table", - "ui-priority": 0, - "misp-attribute": "imphash" - }, - "compilation-timestamp": { - "description": "Compilation timestamp defined in the PE header", - "ui-priority": 1, - "misp-attribute": "datetime" - }, - "entrypoint-section-at-position": { - "description": "Name of the section and position of the section in the PE", - "disable_correlation": true, - "ui-priority": 0, - "misp-attribute": "text" - }, - "entrypoint-address": { - "description": "Address of the entry point", - "disable_correlation": true, - "ui-priority": 0, - "misp-attribute": "text" - }, - "file-description": { - "description": "FileDescription in the resources", - "disable_correlation": true, - "ui-priority": 0, - "misp-attribute": "text" - }, - "file-version": { - "description": "FileVersion in the resources", - "disable_correlation": true, - "ui-priority": 0, - "misp-attribute": "text" - }, - "lang-id": { - "description": "Lang ID in the resources", - "disable_correlation": true, - "ui-priority": 0, - "misp-attribute": "text" - }, - "product-name": { - "description": "ProductName in the resources", - "disable_correlation": true, - "ui-priority": 0, - "misp-attribute": "text" - }, - "product-version": { - "description": "ProductVersion in the resources", - "disable_correlation": true, - "ui-priority": 0, - "misp-attribute": "text" - }, - "company-name": { - "description": "CompanyName in the resources", - "disable_correlation": true, - "ui-priority": 0, - "misp-attribute": "text" - }, - "legal-copyright": { - "description": "LegalCopyright in the resources", - "disable_correlation": true, - "ui-priority": 0, - "misp-attribute": "text" - } - }, - "version": 5, - "description": "Object describing a Portable Executable", - "meta-category": "file", "uuid": "cf7adecc-d4f0-4e88-9d90-f978ee151a07", - "name": "pe" -} + "version": 5 +} \ No newline at end of file diff --git a/objects/person/definition.json b/objects/person/definition.json index 2a0befe..2392889 100644 --- a/objects/person/definition.json +++ b/objects/person/definition.json @@ -1,181 +1,160 @@ { - "requiredOneOf": [ - "first-name", - "last-name", - "alias" - ], "attributes": { - "text": { - "description": "A description of the person or identity.", - "disable_correlation": true, - "ui-priority": 1, - "misp-attribute": "text" - }, - "last-name": { - "description": "Last name of a natural person.", - "ui-priority": 100, - "misp-attribute": "last-name" - }, - "middle-name": { - "description": "Middle name of a natural person.", - "ui-priority": 99, - "misp-attribute": "middle-name" - }, - "first-name": { - "description": "First name of a natural person.", - "ui-priority": 98, - "misp-attribute": "first-name", - "disable_correlation": true - }, - "mothers-name": { - "description": "Mother name, father, second name or other names following country's regulation.", - "ui-priority": 1, - "misp-attribute": "text" - }, - "title": { - "description": "Title of the natural person such as Dr. or equivalent.", - "ui-priority": 101, + "address": { + "description": "Postal address of the person.", "misp-attribute": "text", - "disable_correlation": true + "multiple": true, + "ui-priority": 10 }, "alias": { "description": "Alias name or known as.", - "ui-priority": 97, "misp-attribute": "text", - "multiple": true + "multiple": true, + "ui-priority": 97 + }, + "birth-certificate-number": { + "description": "Birth Certificate Number", + "misp-attribute": "text", + "ui-priority": 0 }, "date-of-birth": { "description": "Date of birth of a natural person (in YYYY-MM-DD format).", - "ui-priority": 0, - "misp-attribute": "date-of-birth" + "misp-attribute": "date-of-birth", + "ui-priority": 0 }, - "place-of-birth": { - "description": "Place of birth of a natural person.", - "ui-priority": 0, - "misp-attribute": "place-of-birth", - "disable_correlation": true + "dni": { + "description": "Spanish National ID", + "misp-attribute": "text", + "multiple": true, + "ui-priority": 10 + }, + "e-mail": { + "description": "Email address of the person.", + "misp-attribute": "email-src", + "multiple": true, + "ui-priority": 10 + }, + "fax-number": { + "description": "Fax number of the person.", + "misp-attribute": "phone-number", + "multiple": true, + "ui-priority": 10 + }, + "first-name": { + "description": "First name of a natural person.", + "disable_correlation": true, + "misp-attribute": "first-name", + "ui-priority": 98 }, "gender": { "description": "The gender of a natural person.", - "ui-priority": 0, + "disable_correlation": true, "misp-attribute": "gender", + "ui-priority": 0, "values_list": [ "Male", "Female", "Other", "Prefer not to say", "Unknown" - ], - "disable_correlation": true + ] }, "identity-card-number": { "description": "The identity card number of a natural person.", - "ui-priority": 0, - "misp-attribute": "identity-card-number" + "misp-attribute": "identity-card-number", + "ui-priority": 0 }, - "passport-number": { - "description": "The passport number of a natural person.", - "ui-priority": 0, - "misp-attribute": "passport-number" + "last-name": { + "description": "Last name of a natural person.", + "misp-attribute": "last-name", + "ui-priority": 100 }, - "passport-country": { - "description": "The country in which the passport was issued.", - "ui-priority": 0, - "misp-attribute": "passport-country", - "disable_correlation": true + "middle-name": { + "description": "Middle name of a natural person.", + "misp-attribute": "middle-name", + "ui-priority": 99 }, - "passport-expiration": { - "description": "The expiration date of a passport.", - "ui-priority": 0, - "misp-attribute": "passport-expiration", - "disable_correlation": true - }, - "redress-number": { - "description": "The Redress Control Number is the record identifier for people who apply for redress through the DHS Travel Redress Inquiry Program (DHS TRIP). DHS TRIP is for travelers who have been repeatedly identified for additional screening and who want to file an inquiry to have erroneous information corrected in DHS systems.", - "ui-priority": 0, - "misp-attribute": "redress-number" - }, - "social-security-number": { - "description": "Social security number.", - "ui-priority": 0, - "misp-attribute": "text" - }, - "birth-certificate-number": { - "description": "Birth Certificate Number", - "ui-priority": 0, - "misp-attribute": "text" - }, - "ofac-identification-number": { - "description": "ofac-identification Number", - "ui-priority": 0, - "misp-attribute": "text" + "mothers-name": { + "description": "Mother name, father, second name or other names following country's regulation.", + "misp-attribute": "text", + "ui-priority": 1 }, "nationality": { "description": "The nationality of a natural person.", - "ui-priority": 0, + "disable_correlation": true, "misp-attribute": "nationality", "multiple": true, - "disable_correlation": true + "ui-priority": 0 }, "nic-hdl": { "description": "NIC Handle (Network Information Centre handle) of the person.", - "ui-priority": 10, "misp-attribute": "text", - "multiple": true - }, - "phone-number": { - "description": "Phone number of the person.", - "ui-priority": 10, - "misp-attribute": "phone-number", - "multiple": true - }, - "fax-number": { - "description": "Fax number of the person.", - "ui-priority": 10, - "misp-attribute": "phone-number", - "multiple": true - }, - "address": { - "description": "Postal address of the person.", - "ui-priority": 10, - "misp-attribute": "text", - "multiple": true - }, - "dni": { - "description": "Spanish National ID", - "ui-priority": 10, - "misp-attribute": "text", - "multiple": true + "multiple": true, + "ui-priority": 10 }, "nie": { "description": "Foreign National ID (Spain)", - "ui-priority": 10, "misp-attribute": "text", - "multiple": true + "multiple": true, + "ui-priority": 10 }, "nif": { "description": "Tax ID Number (Spain)", - "ui-priority": 10, "misp-attribute": "text", - "multiple": true + "multiple": true, + "ui-priority": 10 }, - "e-mail": { - "description": "Email address of the person.", - "ui-priority": 10, - "misp-attribute": "email-src", - "multiple": true + "ofac-identification-number": { + "description": "ofac-identification Number", + "misp-attribute": "text", + "ui-priority": 0 + }, + "passport-country": { + "description": "The country in which the passport was issued.", + "disable_correlation": true, + "misp-attribute": "passport-country", + "ui-priority": 0 + }, + "passport-expiration": { + "description": "The expiration date of a passport.", + "disable_correlation": true, + "misp-attribute": "passport-expiration", + "ui-priority": 0 + }, + "passport-number": { + "description": "The passport number of a natural person.", + "misp-attribute": "passport-number", + "ui-priority": 0 + }, + "phone-number": { + "description": "Phone number of the person.", + "misp-attribute": "phone-number", + "multiple": true, + "ui-priority": 10 + }, + "place-of-birth": { + "description": "Place of birth of a natural person.", + "disable_correlation": true, + "misp-attribute": "place-of-birth", + "ui-priority": 0 }, "portrait": { "description": "Portrait of the person.", - "ui-priority": 10, "misp-attribute": "attachment", - "multiple": true + "multiple": true, + "ui-priority": 10 + }, + "redress-number": { + "description": "The Redress Control Number is the record identifier for people who apply for redress through the DHS Travel Redress Inquiry Program (DHS TRIP). DHS TRIP is for travelers who have been repeatedly identified for additional screening and who want to file an inquiry to have erroneous information corrected in DHS systems.", + "misp-attribute": "redress-number", + "ui-priority": 0 }, "role": { "description": "The role of a person.", - "ui-priority": 0, + "disable_correlation": true, "misp-attribute": "text", "multiple": true, + "ui-priority": 0, "values_list": [ "Suspect", "Victim", @@ -185,13 +164,34 @@ "Accomplice", "Witness", "Target" - ], - "disable_correlation": true + ] + }, + "social-security-number": { + "description": "Social security number.", + "misp-attribute": "text", + "ui-priority": 0 + }, + "text": { + "description": "A description of the person or identity.", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 1 + }, + "title": { + "description": "Title of the natural person such as Dr. or equivalent.", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 101 } }, - "version": 10, "description": "An object which describes a person or an identity.", "meta-category": "misc", + "name": "person", + "requiredOneOf": [ + "first-name", + "last-name", + "alias" + ], "uuid": "a15b0477-e9d1-4b9c-9546-abe78a4f4248", - "name": "person" -} + "version": 10 +} \ No newline at end of file diff --git a/objects/pgp-meta/definition.json b/objects/pgp-meta/definition.json index c040538..d5c4914 100644 --- a/objects/pgp-meta/definition.json +++ b/objects/pgp-meta/definition.json @@ -1,30 +1,30 @@ { - "required": [ - "key-id" - ], "attributes": { "key-id": { "description": "Key ID in hexadecimal", - "ui-priority": 1, "misp-attribute": "text", - "multiple": true + "multiple": true, + "ui-priority": 1 }, "user-id-email": { "description": "User ID packet, email address of the key holder (UTF-8 text)", - "ui-priority": 1, "misp-attribute": "text", - "multiple": true + "multiple": true, + "ui-priority": 1 }, "user-id-name": { "description": "User ID packet, name of the key holder", - "ui-priority": 1, "misp-attribute": "text", - "multiple": true + "multiple": true, + "ui-priority": 1 } }, - "version": 1, "description": "Metadata extracted from a PGP keyblock, message or signature", "meta-category": "misc", + "name": "pgp-meta", + "required": [ + "key-id" + ], "uuid": "4c9134c4-b3e8-4d9f-b3c0-c683e70ec1dd", - "name": "pgp-meta" -} + "version": 1 +} \ No newline at end of file diff --git a/objects/phishing-kit/definition.json b/objects/phishing-kit/definition.json index 2112d20..c183c3b 100644 --- a/objects/phishing-kit/definition.json +++ b/objects/phishing-kit/definition.json @@ -1,95 +1,95 @@ { - "name": "phishing-kit", - "uuid": "f452c16b-12fa-4f87-84a2-15a9e8ca6e7c", - "meta-category": "network", - "description": "Object to describe a phishing-kit.", - "version": 3, "attributes": { + "date-found": { + "description": "Date when the phishing kit was found", + "disable_correlation": true, + "misp-attribute": "datetime", + "multiple": true, + "to_ids": false, + "ui-priority": 0 + }, + "email-type": { + "description": "Type of the Email", + "disable_correlation": true, + "misp-attribute": "text", + "multiple": false, + "ui-priority": 0 + }, "internal reference": { "categories": [ "Internal reference" ], + "description": "Internal reference such as ticket ID", "misp-attribute": "text", - "ui-priority": 1, - "description": "Internal reference such as ticket ID" - }, - "date-found": { - "multiple": true, - "misp-attribute": "datetime", - "ui-priority": 0, - "description": "Date when the phishing kit was found", - "to_ids": false, - "disable_correlation": true - }, - "reference-link": { - "to_ids": false, - "multiple": true, - "ui-priority": 1, - "misp-attribute": "link", - "description": "Link where the Phishing Kit was observed" - }, - "threat-actor-email": { - "description": "Email of the Threat Actor", - "multiple": true, - "ui-priority": 0, - "misp-attribute": "email-src" - }, - "email-type": { - "description": "Type of the Email", - "multiple": false, - "ui-priority": 0, - "misp-attribute": "text", - "disable_correlation": true + "ui-priority": 1 }, "kit-mailer": { "description": "Mailer Kit Used", - "multiple": true, - "ui-priority": 0, - "misp-attribute": "text", - "disable_correlation": true - }, - "target": { - "description": "What was targeted using this phishing kit", - "multiple": true, - "ui-priority": 1, - "misp-attribute": "text" - }, - "phishing-domain": { - "description": "Domain used for Phishing", - "multiple": true, - "ui-priority": 1, - "misp-attribute": "url" - }, - "online": { "disable_correlation": true, "misp-attribute": "text", - "values_list": [ - "Yes", - "No" - ], - "ui-priority": 0, - "description": "If the phishing kit is online and operational, by default is yes" - }, - "kit-url": { - "misp-attribute": "url", - "ui-priority": 1, - "description": "URL of Phishing Kit" - }, - "threat-actor": { - "description": "Identified threat actor", - "ui-priority": 0, "multiple": true, - "misp-attribute": "text" + "ui-priority": 0 }, "kit-name": { "description": "Name of the Phishing Kit", - "ui-priority": 10, - "misp-attribute": "text" + "misp-attribute": "text", + "ui-priority": 10 + }, + "kit-url": { + "description": "URL of Phishing Kit", + "misp-attribute": "url", + "ui-priority": 1 + }, + "online": { + "description": "If the phishing kit is online and operational, by default is yes", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 0, + "values_list": [ + "Yes", + "No" + ] + }, + "phishing-domain": { + "description": "Domain used for Phishing", + "misp-attribute": "url", + "multiple": true, + "ui-priority": 1 + }, + "reference-link": { + "description": "Link where the Phishing Kit was observed", + "misp-attribute": "link", + "multiple": true, + "to_ids": false, + "ui-priority": 1 + }, + "target": { + "description": "What was targeted using this phishing kit", + "misp-attribute": "text", + "multiple": true, + "ui-priority": 1 + }, + "threat-actor": { + "description": "Identified threat actor", + "misp-attribute": "text", + "multiple": true, + "ui-priority": 0 + }, + "threat-actor-email": { + "description": "Email of the Threat Actor", + "misp-attribute": "email-src", + "multiple": true, + "ui-priority": 0 } }, + "description": "Object to describe a phishing-kit.", + "meta-category": "network", + "name": "phishing-kit", "requiredOneOf": [ "kit-url", "reference-link", "kit-name" - ] -} + ], + "uuid": "f452c16b-12fa-4f87-84a2-15a9e8ca6e7c", + "version": 3 +} \ No newline at end of file diff --git a/objects/phishing/definition.json b/objects/phishing/definition.json index deadb3c..806f200 100644 --- a/objects/phishing/definition.json +++ b/objects/phishing/definition.json @@ -1,117 +1,117 @@ { - "name": "phishing", - "uuid": "2dad6f9d-d425-4217-8fda-0b0a2d815307", - "meta-category": "network", - "description": "Phishing template to describe a phishing website and its analysis.", - "version": 5, "attributes": { + "hostname": { + "description": "host of the phishing website", + "misp-attribute": "hostname", + "multiple": true, + "ui-priority": 1 + }, "internal reference": { "categories": [ "Internal reference" ], + "description": "Internal reference such as ticket ID", "misp-attribute": "text", - "ui-priority": 1, - "description": "Internal reference such as ticket ID" - }, - "screenshot": { - "multiple": true, - "categories": [ - "External analysis" - ], - "ui-priority": 1, - "disable_correlation": true, - "misp-attribute": "attachment", - "description": "Screenshot of phishing site" - }, - "target": { - "multiple": true, - "misp-attribute": "text", - "ui-priority": 0, - "description": "Targeted organisation by the phishing" - }, - "takedown-request-to": { - "to_ids": false, - "multiple": true, - "categories": [ - "Other" - ], - "ui-priority": 1, - "disable_correlation": true, - "misp-attribute": "text", - "description": "Destination email address for take-down request" - }, - "takedown-request": { - "disable_correlation": true, - "misp-attribute": "datetime", - "ui-priority": 0, - "description": "When the phishing was requested to be taken down" - }, - "takedown-time": { - "disable_correlation": true, - "misp-attribute": "datetime", - "ui-priority": 0, - "description": "When the phishing was taken down" + "ui-priority": 1 }, "online": { + "description": "If the phishing is online and operational, by default is yes", "disable_correlation": true, "misp-attribute": "text", + "ui-priority": 0, "values_list": [ "Yes", "No" - ], - "ui-priority": 0, - "description": "If the phishing is online and operational, by default is yes" - }, - "url": { - "misp-attribute": "url", - "ui-priority": 1, - "description": "Original URL of the phishing website" - }, - "url-redirect": { - "multiple": true, - "misp-attribute": "url", - "ui-priority": 1, - "description": "Redirect URL of the phishing website" - }, - "hostname": { - "multiple": true, - "misp-attribute": "hostname", - "ui-priority": 1, - "description": "host of the phishing website" - }, - "phishtank-id": { - "misp-attribute": "text", - "ui-priority": 1, - "description": "Phishtank ID of the reported phishing" + ] }, "phishtank-detail-url": { - "ui-priority": 1, + "description": "Phishtank detail URL to the reported phishing", "misp-attribute": "link", - "description": "Phishtank detail URL to the reported phishing" + "ui-priority": 1 + }, + "phishtank-id": { + "description": "Phishtank ID of the reported phishing", + "misp-attribute": "text", + "ui-priority": 1 + }, + "screenshot": { + "categories": [ + "External analysis" + ], + "description": "Screenshot of phishing site", + "disable_correlation": true, + "misp-attribute": "attachment", + "multiple": true, + "ui-priority": 1 }, "submission-time": { + "description": "When the phishing was submitted and/or reported", "misp-attribute": "datetime", - "ui-priority": 0, - "description": "When the phishing was submitted and/or reported" + "ui-priority": 0 }, - "verified": { + "takedown-request": { + "description": "When the phishing was requested to be taken down", + "disable_correlation": true, + "misp-attribute": "datetime", + "ui-priority": 0 + }, + "takedown-request-to": { + "categories": [ + "Other" + ], + "description": "Destination email address for take-down request", "disable_correlation": true, "misp-attribute": "text", + "multiple": true, + "to_ids": false, + "ui-priority": 1 + }, + "takedown-time": { + "description": "When the phishing was taken down", + "disable_correlation": true, + "misp-attribute": "datetime", + "ui-priority": 0 + }, + "target": { + "description": "Targeted organisation by the phishing", + "misp-attribute": "text", + "multiple": true, + "ui-priority": 0 + }, + "url": { + "description": "Original URL of the phishing website", + "misp-attribute": "url", + "ui-priority": 1 + }, + "url-redirect": { + "description": "Redirect URL of the phishing website", + "misp-attribute": "url", + "multiple": true, + "ui-priority": 1 + }, + "verification-time": { + "description": "When the phishing was verified", + "disable_correlation": true, + "misp-attribute": "datetime", + "ui-priority": 0 + }, + "verified": { + "description": "The phishing has been verified by the team handling the phishing", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 0, "values_list": [ "No", "Yes" - ], - "ui-priority": 0, - "description": "The phishing has been verified by the team handling the phishing" - }, - "verification-time": { - "disable_correlation": true, - "misp-attribute": "datetime", - "ui-priority": 0, - "description": "When the phishing was verified" + ] } }, + "description": "Phishing template to describe a phishing website and its analysis.", + "meta-category": "network", + "name": "phishing", "requiredOneOf": [ "url" - ] -} + ], + "uuid": "2dad6f9d-d425-4217-8fda-0b0a2d815307", + "version": 5 +} \ No newline at end of file diff --git a/objects/phone/definition.json b/objects/phone/definition.json index 0f2c0d7..b25a2c2 100644 --- a/objects/phone/definition.json +++ b/objects/phone/definition.json @@ -1,33 +1,15 @@ { - "requiredOneOf": [ - "text", - "first-seen", - "last-seen", - "imei", - "imsi", - "msisdn", - "tmsi", - "guti" - ], "attributes": { - "imei": { - "description": "International Mobile Equipment Identity (IMEI) is a number, usually unique, to identify 3GPP and iDEN mobile phones, as well as some satellite phones.", + "brand": { + "description": "Brand of the phone.", + "disable_correlation": true, "misp-attribute": "text", "ui-priority": 1 }, - "imsi": { - "description": "A usually unique International Mobile Subscriber Identity (IMSI) is allocated to each mobile subscriber in the GSM/UMTS/EPS system. IMSI can also refer to International Mobile Station Identity in the ITU nomenclature.", - "misp-attribute": "text", - "ui-priority": 1 - }, - "msisdn": { - "description": "MSISDN (pronounced as /'em es ai es di en/ or misden) is a number uniquely identifying a subscription in a GSM or a UMTS mobile network. Simply put, it is the mapping of the telephone number to the SIM card in a mobile/cellular phone. This abbreviation has a several interpretations, the most common one being Mobile Station International Subscriber Directory Number.", - "misp-attribute": "text", - "ui-priority": 1 - }, - "tmsi": { - "description": "Temporary Mobile Subscriber Identities (TMSI) to visiting mobile subscribers can be allocated.", - "misp-attribute": "text", + "first-seen": { + "description": "When the phone has been accessible or seen for the first time.", + "disable_correlation": true, + "misp-attribute": "datetime", "ui-priority": 0 }, "gummei": { @@ -40,6 +22,33 @@ "misp-attribute": "text", "ui-priority": 0 }, + "imei": { + "description": "International Mobile Equipment Identity (IMEI) is a number, usually unique, to identify 3GPP and iDEN mobile phones, as well as some satellite phones.", + "misp-attribute": "text", + "ui-priority": 1 + }, + "imsi": { + "description": "A usually unique International Mobile Subscriber Identity (IMSI) is allocated to each mobile subscriber in the GSM/UMTS/EPS system. IMSI can also refer to International Mobile Station Identity in the ITU nomenclature.", + "misp-attribute": "text", + "ui-priority": 1 + }, + "last-seen": { + "description": "When the phone has been accessible or seen for the last time.", + "disable_correlation": true, + "misp-attribute": "datetime", + "ui-priority": 0 + }, + "model": { + "description": "Model of the phone.", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 1 + }, + "msisdn": { + "description": "MSISDN (pronounced as /'em es ai es di en/ or misden) is a number uniquely identifying a subscription in a GSM or a UMTS mobile network. Simply put, it is the mapping of the telephone number to the SIM card in a mobile/cellular phone. This abbreviation has a several interpretations, the most common one being Mobile Station International Subscriber Directory Number.", + "misp-attribute": "text", + "ui-priority": 1 + }, "serial-number": { "description": "Serial Number.", "misp-attribute": "text", @@ -48,37 +57,28 @@ "text": { "description": "A description of the phone.", "disable_correlation": true, - "ui-priority": 1, - "misp-attribute": "text" + "misp-attribute": "text", + "ui-priority": 1 }, - "brand": { - "description": "Brand of the phone.", - "disable_correlation": true, - "ui-priority": 1, - "misp-attribute": "text" - }, - "model": { - "description": "Model of the phone.", - "disable_correlation": true, - "ui-priority": 1, - "misp-attribute": "text" - }, - "last-seen": { - "description": "When the phone has been accessible or seen for the last time.", - "disable_correlation": true, - "ui-priority": 0, - "misp-attribute": "datetime" - }, - "first-seen": { - "description": "When the phone has been accessible or seen for the first time.", - "disable_correlation": true, - "ui-priority": 0, - "misp-attribute": "datetime" + "tmsi": { + "description": "Temporary Mobile Subscriber Identities (TMSI) to visiting mobile subscribers can be allocated.", + "misp-attribute": "text", + "ui-priority": 0 } }, - "version": 4, "description": "A phone or mobile phone object which describe a phone.", "meta-category": "misc", + "name": "phone", + "requiredOneOf": [ + "text", + "first-seen", + "last-seen", + "imei", + "imsi", + "msisdn", + "tmsi", + "guti" + ], "uuid": "d7e4fbdd-b551-4862-bddb-a0b470a38509", - "name": "phone" -} + "version": 4 +} \ No newline at end of file diff --git a/objects/process/definition.json b/objects/process/definition.json index 9e3146b..c6698ae 100644 --- a/objects/process/definition.json +++ b/objects/process/definition.json @@ -1,142 +1,142 @@ { - "name": "process", - "uuid": "02aeef94-ac23-455c-addb-731757ceafb5", - "meta-category": "misc", - "description": "Object describing a system process.", - "version": 7, "attributes": { - "creation-time": { - "description": "Local date/time at which the process was created", - "ui-priority": 0, - "misp-attribute": "datetime", - "disable_correlation": true - }, - "start-time": { - "description": "Local date/time at which the process was started", - "ui-priority": 0, - "misp-attribute": "datetime", - "disable_correlation": true - }, - "name": { - "description": "Name of the process", - "ui-priority": 1, - "misp-attribute": "text" - }, - "pid": { - "description": "Process ID of the process", - "ui-priority": 1, + "args": { + "description": "Arguments of the process", + "disable_correlation": true, "misp-attribute": "text", - "disable_correlation": true - }, - "pgid": { - "description": "Identifier of the group of processes the process belong to", - "ui-priority": 1, - "misp-attribute": "text", - "disable_correlation": true - }, - "guid": { - "description": "The globally unique identifier of the assigned by the vendor product", - "ui-priority": 1, - "misp-attribute": "text" - }, - "parent-pid": { - "description": "Process ID of the parent process", - "ui-priority": 1, - "misp-attribute": "text", - "disable_correlation": true - }, - "parent-guid": { - "description": "The globally unique idenifier of the parent process assigned by the vendor product", - "ui-priority": 1, - "misp-attribute": "text" + "ui-priority": 1 }, "child-pid": { "description": "Process ID of the child(ren) process", - "ui-priority": 1, + "disable_correlation": true, "misp-attribute": "text", "multiple": true, - "disable_correlation": true - }, - "port": { - "description": "Port(s) owned by the process", - "ui-priority": 1, - "misp-attribute": "port", - "multiple": true, - "disable_correlation": true + "ui-priority": 1 }, "command-line": { "description": "Command line of the process", - "ui-priority": 1, - "misp-attribute": "text" - }, - "args": { - "description": "Arguments of the process", - "ui-priority": 1, "misp-attribute": "text", - "disable_correlation": true + "ui-priority": 1 + }, + "creation-time": { + "description": "Local date/time at which the process was created", + "disable_correlation": true, + "misp-attribute": "datetime", + "ui-priority": 0 }, "current-directory": { "description": "Current working directory of the process", - "ui-priority": 2, + "disable_correlation": true, "misp-attribute": "text", - "disable_correlation": true + "ui-priority": 2 + }, + "guid": { + "description": "The globally unique identifier of the assigned by the vendor product", + "misp-attribute": "text", + "ui-priority": 1 + }, + "hidden": { + "description": "Specifies whether the process is hidden", + "disable_correlation": true, + "misp-attribute": "boolean", + "ui-priority": 1 }, "image": { "description": "Path of process image", - "ui-priority": 1, - "misp-attribute": "filename" - }, - "parent-command-line": { - "description": "Command line of the parent process", - "ui-priority": 1, - "misp-attribute": "text" - }, - "parent-image": { - "description": "Path of parent process image", - "ui-priority": 1, - "misp-attribute": "filename" - }, - "parent-process-name": { - "description": "Process name of the parent", - "ui-priority": 1, - "misp-attribute": "text" - }, - "parent-process-path": { - "description": "Parent process path of the parent", - "ui-priority": 1, - "misp-attribute": "text" - }, - "user": { - "description": "User context of the process", - "ui-priority": 2, - "misp-attribute": "text", - "disable_correlation": true + "misp-attribute": "filename", + "ui-priority": 1 }, "integrity-level": { "description": "Integrity level of the process", - "ui-priority": 2, - "misp-attribute": "text", "disable_correlation": true, + "misp-attribute": "text", "sane_default": [ "system", "high", "medium", "low", "untrusted" - ] + ], + "ui-priority": 2 }, - "hidden": { - "description": "Specifies whether the process is hidden", - "ui-priority": 1, - "misp-attribute": "boolean", - "disable_correlation": true + "name": { + "description": "Name of the process", + "misp-attribute": "text", + "ui-priority": 1 + }, + "parent-command-line": { + "description": "Command line of the parent process", + "misp-attribute": "text", + "ui-priority": 1 + }, + "parent-guid": { + "description": "The globally unique idenifier of the parent process assigned by the vendor product", + "misp-attribute": "text", + "ui-priority": 1 + }, + "parent-image": { + "description": "Path of parent process image", + "misp-attribute": "filename", + "ui-priority": 1 + }, + "parent-pid": { + "description": "Process ID of the parent process", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 1 + }, + "parent-process-name": { + "description": "Process name of the parent", + "misp-attribute": "text", + "ui-priority": 1 + }, + "parent-process-path": { + "description": "Parent process path of the parent", + "misp-attribute": "text", + "ui-priority": 1 + }, + "pgid": { + "description": "Identifier of the group of processes the process belong to", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 1 + }, + "pid": { + "description": "Process ID of the process", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 1 + }, + "port": { + "description": "Port(s) owned by the process", + "disable_correlation": true, + "misp-attribute": "port", + "multiple": true, + "ui-priority": 1 + }, + "start-time": { + "description": "Local date/time at which the process was started", + "disable_correlation": true, + "misp-attribute": "datetime", + "ui-priority": 0 + }, + "user": { + "description": "User context of the process", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 2 } }, + "description": "Object describing a system process.", + "meta-category": "misc", + "name": "process", "requiredOneOf": [ "name", "pid", "image", "command-line", "current-directory" - ] -} + ], + "uuid": "02aeef94-ac23-455c-addb-731757ceafb5", + "version": 7 +} \ No newline at end of file diff --git a/objects/python-etvx-event-log/definition.json b/objects/python-etvx-event-log/definition.json index a2f9a7b..9505a44 100644 --- a/objects/python-etvx-event-log/definition.json +++ b/objects/python-etvx-event-log/definition.json @@ -1,40 +1,104 @@ { - "required": [ - "source", - "event-type", - "name" - ], "attributes": { - "event-id": { - "description": "A unique number which identifies the event.", - "ui-priority": 1, + "Computer": { + "description": "Computer name on which the event occurred", + "disable_correlation": true, "misp-attribute": "text", - "disable_correlation": true + "ui-priority": 0 }, - "name": { - "description": "Name of the event.", - "ui-priority": 2, + "Correlation-ID": { + "description": "Unique activity identity which relates the event to a process. ", "misp-attribute": "text", - "disable_correlation": true + "ui-priority": 0 + }, + "Event-data": { + "description": "Event data description.", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 0 + }, + "Keywords": { + "description": "Tags used for the event for the purpose of filtering or searching.", + "misp-attribute": "text", + "sane_default": [ + "Network", + "Security", + "Resource not found", + "other" + ], + "ui-priority": 0 + }, + "Operational-code": { + "description": "The opcode (numeric value or name) associated with the activity carried out by the event.", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 0 + }, + "Processor-ID": { + "description": "ID of the processor that processed the event.", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 0 + }, + "Relative-Correlation-ID": { + "description": "Related activity ID which identity similar activities which occurred as a part of the event.", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 0 + }, + "Session-ID": { + "description": "Terminal server session ID.", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 0 + }, + "Thread-ID": { + "description": "Thread id that generated the event.", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 0 + }, + "User": { + "description": "Name or the User ID the event is associated with.", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 0 + }, + "comment": { + "description": "Additional comments.", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 0 }, "event-channel": { "description": " Channel through which the event occurred", - "ui-priority": 3, - "misp-attribute": "text", "disable_correlation": true, + "misp-attribute": "text", "sane_default": [ "Application", "System", "Security", "Setup", "other" - ] + ], + "ui-priority": 3 + }, + "event-date-time": { + "description": "Date and time when the event was logged.", + "disable_correlation": true, + "misp-attribute": "datetime", + "ui-priority": 0 + }, + "event-id": { + "description": "A unique number which identifies the event.", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 1 }, "event-type": { "description": "Event-type assigned to the event", - "ui-priority": 0, - "misp-attribute": "text", "disable_correlation": true, + "misp-attribute": "text", "sane_default": [ "Admin", "Operational", @@ -42,22 +106,17 @@ "Analytic", "Debug", "other" - ] + ], + "ui-priority": 0 }, - "source": { - "description": "The source of the event log - application/software that logged the event.", - "ui-priority": 0, - "misp-attribute": "text" - }, - "event-date-time": { - "description": "Date and time when the event was logged.", - "ui-priority": 0, + "kernel-time": { + "description": "Execution time of the kernel mode instruction.", + "disable_correlation": true, "misp-attribute": "datetime", - "disable_correlation": true + "ui-priority": 0 }, "level": { "description": "Determines the event severity.", - "ui-priority": 0, "misp-attribute": "text", "sane_default": [ "Information", @@ -66,106 +125,47 @@ "Critical", "Success Audit", "Failure Audit" - ] - }, - "Computer": { - "description": "Computer name on which the event occurred", - "ui-priority": 0, - "misp-attribute": "text", - "disable_correlation": true - }, - "User": { - "description": "Name or the User ID the event is associated with.", - "ui-priority": 0, - "misp-attribute": "text", - "disable_correlation": true - }, - "Operational-code": { - "description": "The opcode (numeric value or name) associated with the activity carried out by the event.", - "ui-priority": 0, - "misp-attribute": "text", - "disable_correlation": true + ], + "ui-priority": 0 }, "log": { "description": "Log file where the event was recorded.", - "ui-priority": 0, + "disable_correlation": true, "misp-attribute": "text", - "disable_correlation": true + "ui-priority": 0 + }, + "name": { + "description": "Name of the event.", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 2 + }, + "source": { + "description": "The source of the event log - application/software that logged the event.", + "misp-attribute": "text", + "ui-priority": 0 }, "task-category": { "description": "Activity by the event publisher", - "ui-priority": 0, + "disable_correlation": true, "misp-attribute": "text", - "disable_correlation": true - }, - "Keywords": { - "description": "Tags used for the event for the purpose of filtering or searching.", - "ui-priority": 0, - "misp-attribute": "text", - "sane_default": [ - "Network", - "Security", - "Resource not found", - "other" - ] - }, - "Processor-ID": { - "description": "ID of the processor that processed the event.", - "ui-priority": 0, - "misp-attribute": "text", - "disable_correlation": true - }, - "Thread-ID": { - "description": "Thread id that generated the event.", - "ui-priority": 0, - "misp-attribute": "text", - "disable_correlation": true - }, - "Session-ID": { - "description": "Terminal server session ID.", - "ui-priority": 0, - "misp-attribute": "text", - "disable_correlation": true - }, - "Correlation-ID": { - "description": "Unique activity identity which relates the event to a process. ", - "ui-priority": 0, - "misp-attribute": "text" - }, - "Relative-Correlation-ID": { - "description": "Related activity ID which identity similar activities which occurred as a part of the event.", - "ui-priority": 0, - "misp-attribute": "text", - "disable_correlation": true - }, - "kernel-time": { - "description": "Execution time of the kernel mode instruction.", - "ui-priority": 0, - "misp-attribute": "datetime", - "disable_correlation": true + "ui-priority": 0 }, "user-time": { "description": "Date and time when the user instruction was executed.", - "ui-priority": 0, + "disable_correlation": true, "misp-attribute": "datetime", - "disable_correlation": true - }, - "Event-data": { - "description": "Event data description.", - "ui-priority": 0, - "misp-attribute": "text", - "disable_correlation": true - }, - "comment": { - "description": "Additional comments.", - "ui-priority": 0, - "misp-attribute": "text", - "disable_correlation": true + "ui-priority": 0 } }, - "version": 1, "description": "Event log object template to share information of the activities conducted on a system. ", "meta-category": "misc", + "name": "python-etvx-event-log", + "required": [ + "source", + "event-type", + "name" + ], "uuid": "94e3aee9-cb99-4503-9bf6-7da3db5de55e", - "name": "python-etvx-event-log" -} + "version": 1 +} \ No newline at end of file diff --git a/objects/r2graphity/definition.json b/objects/r2graphity/definition.json index 5f3f9ce..bb95ee9 100644 --- a/objects/r2graphity/definition.json +++ b/objects/r2graphity/definition.json @@ -1,144 +1,144 @@ { - "requiredOneOf": [ - "r2-commit-version" - ], "attributes": { "callback-average": { "description": "Average size of a callback", "disable_correlation": true, - "ui-priority": 0, - "misp-attribute": "counter" - }, - "callbacks": { - "description": "Amount of callbacks (functions started as thread)", - "disable_correlation": true, - "ui-priority": 0, - "misp-attribute": "counter" - }, - "shortest-path-to-create-thread": { - "description": "Shortest path to the first time the binary calls CreateThread", - "disable_correlation": true, - "ui-priority": 0, - "misp-attribute": "counter" - }, - "create-thread": { - "description": "Amount of calls to CreateThread", - "disable_correlation": true, - "ui-priority": 0, - "misp-attribute": "counter" - }, - "memory-allocations": { - "description": "Amount of memory allocations", - "disable_correlation": true, - "ui-priority": 0, - "misp-attribute": "counter" - }, - "get-proc-address": { - "description": "Amount of calls to GetProcAddress", - "disable_correlation": true, - "ui-priority": 0, - "misp-attribute": "counter" - }, - "dangling-strings": { - "description": "Amount of dangling strings (string with a code cross reference, that is not within a function. Radare2 failed to detect that function.)", - "disable_correlation": true, - "ui-priority": 0, - "misp-attribute": "counter" - }, - "referenced-strings": { - "description": "Amount of referenced strings", - "disable_correlation": true, - "ui-priority": 0, - "misp-attribute": "counter" + "misp-attribute": "counter", + "ui-priority": 0 }, "callback-largest": { "description": "Largest callback", "disable_correlation": true, - "ui-priority": 0, - "misp-attribute": "counter" + "misp-attribute": "counter", + "ui-priority": 0 + }, + "callbacks": { + "description": "Amount of callbacks (functions started as thread)", + "disable_correlation": true, + "misp-attribute": "counter", + "ui-priority": 0 + }, + "create-thread": { + "description": "Amount of calls to CreateThread", + "disable_correlation": true, + "misp-attribute": "counter", + "ui-priority": 0 + }, + "dangling-strings": { + "description": "Amount of dangling strings (string with a code cross reference, that is not within a function. Radare2 failed to detect that function.)", + "disable_correlation": true, + "misp-attribute": "counter", + "ui-priority": 0 + }, + "get-proc-address": { + "description": "Amount of calls to GetProcAddress", + "disable_correlation": true, + "misp-attribute": "counter", + "ui-priority": 0 }, "gml": { "description": "Graph export in G>raph Modelling Language format", "disable_correlation": true, - "ui-priority": 0, - "misp-attribute": "attachment" - }, - "r2-commit-version": { - "description": "Radare2 commit ID used to generate this object", - "disable_correlation": true, - "ui-priority": 0, - "misp-attribute": "text" - }, - "text": { - "description": "Description of the r2graphity object", - "disable_correlation": true, - "ui-priority": 1, - "misp-attribute": "text" - }, - "miss-api": { - "description": "Amount of API call reference that does not resolve to a function offset", - "disable_correlation": true, - "ui-priority": 0, - "misp-attribute": "counter" - }, - "total-api": { - "description": "Total amount of API calls", - "disable_correlation": true, - "ui-priority": 0, - "misp-attribute": "counter" - }, - "unknown-references": { - "description": "Amount of API calls not ending in a function (Radare2 bug, probalby)", - "disable_correlation": true, - "ui-priority": 0, - "misp-attribute": "counter" - }, - "refsglobalvar": { - "description": "Amount of API calls outside of code section (glob var, dynamic API)", - "disable_correlation": true, - "ui-priority": 0, - "misp-attribute": "counter" + "misp-attribute": "attachment", + "ui-priority": 0 }, "local-references": { "description": "Amount of API calls inside a code section", "disable_correlation": true, - "ui-priority": 0, - "misp-attribute": "counter" + "misp-attribute": "counter", + "ui-priority": 0 }, - "total-functions": { - "description": "Total amount of functions in the file.", + "memory-allocations": { + "description": "Amount of memory allocations", "disable_correlation": true, - "ui-priority": 0, - "misp-attribute": "counter" + "misp-attribute": "counter", + "ui-priority": 0 + }, + "miss-api": { + "description": "Amount of API call reference that does not resolve to a function offset", + "disable_correlation": true, + "misp-attribute": "counter", + "ui-priority": 0 }, "not-referenced-strings": { "description": "Amount of not referenced strings", "disable_correlation": true, - "ui-priority": 0, - "misp-attribute": "counter" + "misp-attribute": "counter", + "ui-priority": 0 }, - "ratio-functions": { - "description": "Ratio: amount of functions per kilobyte of code section", + "r2-commit-version": { + "description": "Radare2 commit ID used to generate this object", "disable_correlation": true, - "ui-priority": 0, - "misp-attribute": "float" + "misp-attribute": "text", + "ui-priority": 0 }, "ratio-api": { "description": "Ratio: amount of API calls per kilobyte of code section", "disable_correlation": true, - "ui-priority": 0, - "misp-attribute": "float" + "misp-attribute": "float", + "ui-priority": 0 + }, + "ratio-functions": { + "description": "Ratio: amount of functions per kilobyte of code section", + "disable_correlation": true, + "misp-attribute": "float", + "ui-priority": 0 }, "ratio-string": { "description": "Ratio: amount of referenced strings per kilobyte of code section", "disable_correlation": true, - "ui-priority": 0, - "misp-attribute": "float" + "misp-attribute": "float", + "ui-priority": 0 + }, + "referenced-strings": { + "description": "Amount of referenced strings", + "disable_correlation": true, + "misp-attribute": "counter", + "ui-priority": 0 + }, + "refsglobalvar": { + "description": "Amount of API calls outside of code section (glob var, dynamic API)", + "disable_correlation": true, + "misp-attribute": "counter", + "ui-priority": 0 + }, + "shortest-path-to-create-thread": { + "description": "Shortest path to the first time the binary calls CreateThread", + "disable_correlation": true, + "misp-attribute": "counter", + "ui-priority": 0 + }, + "text": { + "description": "Description of the r2graphity object", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 1 + }, + "total-api": { + "description": "Total amount of API calls", + "disable_correlation": true, + "misp-attribute": "counter", + "ui-priority": 0 + }, + "total-functions": { + "description": "Total amount of functions in the file.", + "disable_correlation": true, + "misp-attribute": "counter", + "ui-priority": 0 + }, + "unknown-references": { + "description": "Amount of API calls not ending in a function (Radare2 bug, probalby)", + "disable_correlation": true, + "misp-attribute": "counter", + "ui-priority": 0 } }, - "version": 2, "description": "Indicators extracted from files using radare2 and graphml", "meta-category": "file", + "name": "r2graphity", + "requiredOneOf": [ + "r2-commit-version" + ], "uuid": "b6abe0e0-52ea-4424-ba42-761c2e027b76", - "name": "r2graphity" -} + "version": 2 +} \ No newline at end of file diff --git a/objects/regexp/definition.json b/objects/regexp/definition.json index 5322b71..fc77bb0 100644 --- a/objects/regexp/definition.json +++ b/objects/regexp/definition.json @@ -1,18 +1,20 @@ { - "requiredOneOf": [ - "regexp" - ], "attributes": { "comment": { "description": "A description of the regular expression.", - "ui-priority": 0, - "misp-attribute": "comment" + "misp-attribute": "comment", + "ui-priority": 0 + }, + "regexp": { + "description": "regexp", + "misp-attribute": "text", + "ui-priority": 0 }, "regexp-type": { "description": "Type of the regular expression syntax.", "disable_correlation": true, - "ui-priority": 0, "misp-attribute": "text", + "ui-priority": 0, "values_list": [ "PCRE", "PCRE2", @@ -20,12 +22,10 @@ "POSIX ERE" ] }, - "regexp": { - "description": "regexp", - "ui-priority": 0, - "misp-attribute": "text" - }, "type": { + "description": "Specify which type corresponds to this regex.", + "disable_correlation": true, + "misp-attribute": "text", "sane_default": [ "hostname", "domain", @@ -41,15 +41,15 @@ "windows-service-name", "windows-scheduled-task" ], - "description": "Specify which type corresponds to this regex.", - "disable_correlation": true, - "ui-priority": 0, - "misp-attribute": "text" + "ui-priority": 0 } }, - "version": 4, "description": "An object describing a regular expression (regex or regexp). The object can be linked via a relationship to other attributes or objects to describe how it can be represented as a regular expression.", "meta-category": "misc", + "name": "regexp", + "requiredOneOf": [ + "regexp" + ], "uuid": "ceffad66-71e5-4e20-9370-1b3fb694c648", - "name": "regexp" -} + "version": 4 +} \ No newline at end of file diff --git a/objects/registry-key/definition.json b/objects/registry-key/definition.json index ce8ca1c..0eea7a7 100644 --- a/objects/registry-key/definition.json +++ b/objects/registry-key/definition.json @@ -1,23 +1,20 @@ { - "requiredOneOf": [ - "key", - "name", - "data" - ], "attributes": { - "last-modified": { - "description": "Last time the registry key has been modified", - "categories": [ - "Other" - ], - "ui-priority": 0, - "misp-attribute": "datetime" - }, - "data-type": { - "description": "Registry value type", + "data": { "categories": [ "Persistence mechanism" ], + "description": "Data stored in the registry key", + "misp-attribute": "text", + "ui-priority": 1 + }, + "data-type": { + "categories": [ + "Persistence mechanism" + ], + "description": "Registry value type", + "disable_correlation": true, + "misp-attribute": "text", "sane_default": [ "REG_NONE", "REG_SZ", @@ -34,45 +31,45 @@ "REG_QWORD", "REG_QWORD_LITTLE_ENDIAN" ], - "ui-priority": 0, - "disable_correlation": true, - "misp-attribute": "text" - }, - "data": { - "description": "Data stored in the registry key", - "categories": [ - "Persistence mechanism" - ], - "ui-priority": 1, - "misp-attribute": "text" - }, - "name": { - "description": "Name of the registry key", - "categories": [ - "Persistence mechanism" - ], - "ui-priority": 1, - "misp-attribute": "text" - }, - "key": { - "description": "Full key path", - "categories": [ - "Persistence mechanism" - ], - "ui-priority": 1, - "misp-attribute": "regkey" + "ui-priority": 0 }, "hive": { - "description": "Hive used to store the registry key (file on disk)", "categories": [ "Persistence mechanism" ], - "ui-priority": 1, + "description": "Hive used to store the registry key (file on disk)", "disable_correlation": true, - "misp-attribute": "text" + "misp-attribute": "text", + "ui-priority": 1 + }, + "key": { + "categories": [ + "Persistence mechanism" + ], + "description": "Full key path", + "misp-attribute": "regkey", + "ui-priority": 1 + }, + "last-modified": { + "categories": [ + "Other" + ], + "description": "Last time the registry key has been modified", + "misp-attribute": "datetime", + "ui-priority": 0 + }, + "name": { + "categories": [ + "Persistence mechanism" + ], + "description": "Name of the registry key", + "misp-attribute": "text", + "ui-priority": 1 }, "root-keys": { "description": "Root key of the Windows registry (extracted from the key)", + "disable_correlation": true, + "misp-attribute": "text", "sane_default": [ "HKCC", "HKCR", @@ -89,14 +86,17 @@ "HKPD", "HKU" ], - "ui-priority": 0, - "misp-attribute": "text", - "disable_correlation": true + "ui-priority": 0 } }, - "version": 4, "description": "Registry key object describing a Windows registry key with value and last-modified timestamp", "meta-category": "file", + "name": "registry-key", + "requiredOneOf": [ + "key", + "name", + "data" + ], "uuid": "8b3228ad-6d82-4fe6-b2ae-05426308f1d5", - "name": "registry-key" -} + "version": 4 +} \ No newline at end of file diff --git a/objects/regripper-NTUser/definition.json b/objects/regripper-NTUser/definition.json index b9ed227..91087ac 100644 --- a/objects/regripper-NTUser/definition.json +++ b/objects/regripper-NTUser/definition.json @@ -1,98 +1,98 @@ { + "attributes": { + "applications-installed": { + "description": "List of applications installed.", + "misp-attribute": "text", + "multiple": true, + "ui-priority": 0 + }, + "applications-run": { + "description": "List of applications set to run on the system.", + "misp-attribute": "text", + "multiple": true, + "ui-priority": 0 + }, + "comments": { + "description": "Additional information related to the user profile", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 0 + }, + "external-devices": { + "description": "List of external devices connected to the system by the user.", + "misp-attribute": "text", + "multiple": true, + "ui-priority": 0 + }, + "key": { + "description": "Registry key where the information is retrieved from.", + "misp-attribute": "text", + "ui-priority": 0 + }, + "key-last-write-time": { + "description": "Date and time when the key was last updated.", + "disable_correlation": true, + "misp-attribute": "datetime", + "ui-priority": 0 + }, + "logon-user-name": { + "description": "Name assigned to the user profile.", + "misp-attribute": "text", + "ui-priority": 0 + }, + "mount-points": { + "description": "Details of the mount points created on the system.", + "disable_correlation": true, + "misp-attribute": "text", + "multiple": true, + "ui-priority": 0 + }, + "network-connected-to": { + "description": "List of networks the user connected the system to.", + "misp-attribute": "text", + "multiple": true, + "ui-priority": 0 + }, + "nukeOnDelete": { + "description": "Determines if the Recycle bin option has been disabled.", + "disable_correlation": true, + "misp-attribute": "boolean", + "ui-priority": 0 + }, + "recent-files-accessed": { + "description": "List of recent files accessed by the user.", + "misp-attribute": "text", + "multiple": true, + "ui-priority": 0 + }, + "recent-folders-accessed": { + "description": "List of recent folders accessed by the user.", + "misp-attribute": "text", + "multiple": true, + "ui-priority": 0 + }, + "typed-urls": { + "description": "Urls typed by the user in internet explorer", + "misp-attribute": "text", + "multiple": true, + "ui-priority": 0 + }, + "user-init": { + "description": "Applications or processes set to run when the user logs onto the windows system.", + "misp-attribute": "text", + "multiple": true, + "ui-priority": 0 + } + }, + "description": "Regripper Object template designed to present user specific configuration details extracted from the NTUSER.dat hive.", + "meta-category": "misc", + "name": "regripper-NTUser", "required": [ "key" ], "requiredOneOf": [ "logon-user-name" ], - "attributes": { - "key": { - "description": "Registry key where the information is retrieved from.", - "ui-priority": 0, - "misp-attribute": "text" - }, - "key-last-write-time": { - "description": "Date and time when the key was last updated.", - "ui-priority": 0, - "misp-attribute": "datetime", - "disable_correlation": true - }, - "logon-user-name": { - "description": "Name assigned to the user profile.", - "ui-priority": 0, - "misp-attribute": "text" - }, - "recent-folders-accessed": { - "description": "List of recent folders accessed by the user.", - "ui-priority": 0, - "misp-attribute": "text", - "multiple": true - }, - "recent-files-accessed": { - "description": "List of recent files accessed by the user.", - "ui-priority": 0, - "misp-attribute": "text", - "multiple": true - }, - "typed-urls": { - "description": "Urls typed by the user in internet explorer", - "ui-priority": 0, - "misp-attribute": "text", - "multiple": true - }, - "applications-installed": { - "description": "List of applications installed.", - "ui-priority": 0, - "misp-attribute": "text", - "multiple": true - }, - "applications-run": { - "description": "List of applications set to run on the system.", - "ui-priority": 0, - "misp-attribute": "text", - "multiple": true - }, - "external-devices": { - "description": "List of external devices connected to the system by the user.", - "ui-priority": 0, - "misp-attribute": "text", - "multiple": true - }, - "user-init": { - "description": "Applications or processes set to run when the user logs onto the windows system.", - "ui-priority": 0, - "misp-attribute": "text", - "multiple": true - }, - "nukeOnDelete": { - "description": "Determines if the Recycle bin option has been disabled.", - "ui-priority": 0, - "misp-attribute": "boolean", - "disable_correlation": true - }, - "network-connected-to": { - "description": "List of networks the user connected the system to.", - "ui-priority": 0, - "misp-attribute": "text", - "multiple": true - }, - "mount-points": { - "description": "Details of the mount points created on the system.", - "ui-priority": 0, - "misp-attribute": "text", - "multiple": true, - "disable_correlation": true - }, - "comments": { - "description": "Additional information related to the user profile", - "ui-priority": 0, - "misp-attribute": "text", - "disable_correlation": true - } - }, - "version": 1, - "description": "Regripper Object template designed to present user specific configuration details extracted from the NTUSER.dat hive.", - "meta-category": "misc", "uuid": "f9dc7b7e-8ab1-4dde-95d9-67e41b461c65", - "name": "regripper-NTUser" -} + "version": 1 +} \ No newline at end of file diff --git a/objects/regripper-sam-hive-single-user/definition.json b/objects/regripper-sam-hive-single-user/definition.json index 0bef376..82eb06a 100644 --- a/objects/regripper-sam-hive-single-user/definition.json +++ b/objects/regripper-sam-hive-single-user/definition.json @@ -1,4 +1,60 @@ { + "attributes": { + "comments": { + "description": "Full name assigned to the user profile.", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 0 + }, + "full-user-name": { + "description": "Full name assigned to the user profile.", + "misp-attribute": "text", + "ui-priority": 0 + }, + "key": { + "description": "Registry key where the information is retrieved from.", + "misp-attribute": "text", + "ui-priority": 0 + }, + "key-last-write-time": { + "description": "Date and time when the key was last updated.", + "disable_correlation": true, + "misp-attribute": "datetime", + "ui-priority": 0 + }, + "last-login-time": { + "description": "Date and time when the user last logged onto the system.", + "disable_correlation": true, + "misp-attribute": "datetime", + "ui-priority": 0 + }, + "login-count": { + "description": "Number of times the user logged-in onto the system.", + "disable_correlation": true, + "misp-attribute": "counter", + "ui-priority": 0 + }, + "pwd-fail-date": { + "description": "Date and time when a password last failed for this user profile.", + "disable_correlation": true, + "misp-attribute": "datetime", + "ui-priority": 0 + }, + "pwd-reset-time": { + "description": "Date and time when the password was last reset.", + "disable_correlation": true, + "misp-attribute": "datetime", + "ui-priority": 0 + }, + "user-name": { + "description": "User name assigned to the user profile.", + "misp-attribute": "text", + "ui-priority": 0 + } + }, + "description": "Regripper Object template designed to present user profile details extracted from the SAM hive.", + "meta-category": "misc", + "name": "regripper-sam-hive-single-user", "required": [ "key" ], @@ -7,62 +63,6 @@ "last-login-time", "login-count" ], - "attributes": { - "key": { - "description": "Registry key where the information is retrieved from.", - "ui-priority": 0, - "misp-attribute": "text" - }, - "key-last-write-time": { - "description": "Date and time when the key was last updated.", - "ui-priority": 0, - "misp-attribute": "datetime", - "disable_correlation": true - }, - "user-name": { - "description": "User name assigned to the user profile.", - "ui-priority": 0, - "misp-attribute": "text" - }, - "full-user-name": { - "description": "Full name assigned to the user profile.", - "ui-priority": 0, - "misp-attribute": "text" - }, - "last-login-time": { - "description": "Date and time when the user last logged onto the system.", - "ui-priority": 0, - "misp-attribute": "datetime", - "disable_correlation": true - }, - "pwd-reset-time": { - "description": "Date and time when the password was last reset.", - "ui-priority": 0, - "misp-attribute": "datetime", - "disable_correlation": true - }, - "pwd-fail-date": { - "description": "Date and time when a password last failed for this user profile.", - "ui-priority": 0, - "misp-attribute": "datetime", - "disable_correlation": true - }, - "login-count": { - "description": "Number of times the user logged-in onto the system.", - "ui-priority": 0, - "misp-attribute": "counter", - "disable_correlation": true - }, - "comments": { - "description": "Full name assigned to the user profile.", - "ui-priority": 0, - "misp-attribute": "text", - "disable_correlation": true - } - }, - "version": 1, - "description": "Regripper Object template designed to present user profile details extracted from the SAM hive.", - "meta-category": "misc", "uuid": "112efd9a-2137-4198-92ed-7c91043e2cd4", - "name": "regripper-sam-hive-single-user" -} + "version": 1 +} \ No newline at end of file diff --git a/objects/regripper-sam-hive-user-group/definition.json b/objects/regripper-sam-hive-user-group/definition.json index 55df836..d7652d5 100644 --- a/objects/regripper-sam-hive-user-group/definition.json +++ b/objects/regripper-sam-hive-user-group/definition.json @@ -1,54 +1,54 @@ { + "attributes": { + "full-name": { + "description": "Full name assigned to the profile.", + "misp-attribute": "text", + "ui-priority": 0 + }, + "group-comment": { + "description": "Any group comment added.", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 0 + }, + "group-name": { + "description": "Name assigned to the profile.", + "misp-attribute": "text", + "ui-priority": 0 + }, + "group-users": { + "description": "Users belonging to the group", + "misp-attribute": "text", + "multiple": true, + "ui-priority": 0 + }, + "key": { + "description": "Registry key where the information is retrieved from.", + "misp-attribute": "text", + "ui-priority": 0 + }, + "key-last-write-time": { + "description": "Date and time when the key was last updated.", + "disable_correlation": true, + "misp-attribute": "datetime", + "ui-priority": 0 + }, + "last-write-date-time": { + "description": "Date and time when the group key was updated.", + "disable_correlation": true, + "misp-attribute": "datetime", + "ui-priority": 0 + } + }, + "description": "Regripper Object template designed to present group profile details extracted from the SAM hive.", + "meta-category": "misc", + "name": "regripper-sam-hive-user-group", "required": [ "key" ], "requiredOneOf": [ "group-name" ], - "attributes": { - "key": { - "description": "Registry key where the information is retrieved from.", - "ui-priority": 0, - "misp-attribute": "text" - }, - "key-last-write-time": { - "description": "Date and time when the key was last updated.", - "ui-priority": 0, - "misp-attribute": "datetime", - "disable_correlation": true - }, - "group-name": { - "description": "Name assigned to the profile.", - "ui-priority": 0, - "misp-attribute": "text" - }, - "full-name": { - "description": "Full name assigned to the profile.", - "ui-priority": 0, - "misp-attribute": "text" - }, - "last-write-date-time": { - "description": "Date and time when the group key was updated.", - "ui-priority": 0, - "misp-attribute": "datetime", - "disable_correlation": true - }, - "group-comment": { - "description": "Any group comment added.", - "ui-priority": 0, - "misp-attribute": "text", - "disable_correlation": true - }, - "group-users": { - "description": "Users belonging to the group", - "ui-priority": 0, - "misp-attribute": "text", - "multiple": true - } - }, - "version": 1, - "description": "Regripper Object template designed to present group profile details extracted from the SAM hive.", - "meta-category": "misc", "uuid": "b924bae1-2dec-4d2d-a8c2-b03305222b7c", - "name": "regripper-sam-hive-user-group" -} + "version": 1 +} \ No newline at end of file diff --git a/objects/regripper-software-hive-BHO/definition.json b/objects/regripper-software-hive-BHO/definition.json index 3c392f6..9c08d02 100644 --- a/objects/regripper-software-hive-BHO/definition.json +++ b/objects/regripper-software-hive-BHO/definition.json @@ -1,59 +1,59 @@ { + "attributes": { + "BHO-key-last-write-time": { + "description": "Date and time when the BHO key was last updated.", + "disable_correlation": true, + "misp-attribute": "datetime", + "ui-priority": 0 + }, + "BHO-name": { + "description": "Name of the browser helper object.", + "misp-attribute": "text", + "ui-priority": 0 + }, + "class": { + "description": "Class to which the BHO belongs to.", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 0 + }, + "comments": { + "description": "Additional comments.", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 0 + }, + "key": { + "description": "Software hive key where the information is retrieved from.", + "misp-attribute": "text", + "ui-priority": 0 + }, + "last-write-time": { + "description": "Date and time when the key was last updated.", + "disable_correlation": true, + "misp-attribute": "datetime", + "ui-priority": 0 + }, + "module": { + "description": "DLL module the BHO belongs to.", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 0 + }, + "references": { + "description": "References to the BHO.", + "misp-attribute": "link", + "multiple": true, + "ui-priority": 0 + } + }, + "description": "Regripper Object template designed to gather information of the browser helper objects installed on the system.", + "meta-category": "misc", + "name": "regripper-software-hive-BHO", "required": [ "key", "BHO-name" ], - "attributes": { - "key": { - "description": "Software hive key where the information is retrieved from.", - "ui-priority": 0, - "misp-attribute": "text" - }, - "last-write-time": { - "description": "Date and time when the key was last updated.", - "ui-priority": 0, - "misp-attribute": "datetime", - "disable_correlation": true - }, - "BHO-name": { - "description": "Name of the browser helper object.", - "ui-priority": 0, - "misp-attribute": "text" - }, - "BHO-key-last-write-time": { - "description": "Date and time when the BHO key was last updated.", - "ui-priority": 0, - "misp-attribute": "datetime", - "disable_correlation": true - }, - "class": { - "description": "Class to which the BHO belongs to.", - "ui-priority": 0, - "misp-attribute": "text", - "disable_correlation": true - }, - "module": { - "description": "DLL module the BHO belongs to.", - "ui-priority": 0, - "misp-attribute": "text", - "disable_correlation": true - }, - "comments": { - "description": "Additional comments.", - "ui-priority": 0, - "misp-attribute": "text", - "disable_correlation": true - }, - "references": { - "description": "References to the BHO.", - "ui-priority": 0, - "misp-attribute": "link", - "multiple": true - } - }, - "version": 1, - "description": "Regripper Object template designed to gather information of the browser helper objects installed on the system.", - "meta-category": "misc", "uuid": "e7b46b5a-d2d2-4a05-bc25-2ac8d4683ae2", - "name": "regripper-software-hive-BHO" -} + "version": 1 +} \ No newline at end of file diff --git a/objects/regripper-software-hive-appInit-DLLS/definition.json b/objects/regripper-software-hive-appInit-DLLS/definition.json index 7bd9395..8e03ffa 100644 --- a/objects/regripper-software-hive-appInit-DLLS/definition.json +++ b/objects/regripper-software-hive-appInit-DLLS/definition.json @@ -1,53 +1,53 @@ { + "attributes": { + "DLL-last-write-time": { + "description": "Date and time when the DLL file was last updated.", + "disable_correlation": true, + "misp-attribute": "datetime", + "ui-priority": 0 + }, + "DLL-name": { + "description": "Name of the DLL file.", + "misp-attribute": "text", + "ui-priority": 0 + }, + "DLL-path": { + "description": "Path where the DLL file is stored.", + "misp-attribute": "text", + "ui-priority": 0 + }, + "comments": { + "description": "Additional comments.", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 0 + }, + "key": { + "description": "Software hive key where the information is retrieved from.", + "misp-attribute": "text", + "ui-priority": 0 + }, + "last-write-time": { + "description": "Date and time when the key was last updated.", + "disable_correlation": true, + "misp-attribute": "datetime", + "ui-priority": 0 + }, + "references": { + "description": "References to the DLL file.", + "misp-attribute": "link", + "multiple": true, + "ui-priority": 0 + } + }, + "description": "Regripper Object template designed to gather information of the DLL files installed on the system.", + "meta-category": "misc", + "name": "regripper-software-hive-appInit-DLLS", "required": [ "key", "DLL-name", "DLL-path" ], - "attributes": { - "key": { - "description": "Software hive key where the information is retrieved from.", - "ui-priority": 0, - "misp-attribute": "text" - }, - "last-write-time": { - "description": "Date and time when the key was last updated.", - "ui-priority": 0, - "misp-attribute": "datetime", - "disable_correlation": true - }, - "DLL-name": { - "description": "Name of the DLL file.", - "ui-priority": 0, - "misp-attribute": "text" - }, - "DLL-path": { - "description": "Path where the DLL file is stored.", - "ui-priority": 0, - "misp-attribute": "text" - }, - "DLL-last-write-time": { - "description": "Date and time when the DLL file was last updated.", - "ui-priority": 0, - "misp-attribute": "datetime", - "disable_correlation": true - }, - "comments": { - "description": "Additional comments.", - "ui-priority": 0, - "misp-attribute": "text", - "disable_correlation": true - }, - "references": { - "description": "References to the DLL file.", - "ui-priority": 0, - "misp-attribute": "link", - "multiple": true - } - }, - "version": 1, - "description": "Regripper Object template designed to gather information of the DLL files installed on the system.", - "meta-category": "misc", "uuid": "7893be05-8398-451e-ab1e-5e25ea4a8859", - "name": "regripper-software-hive-appInit-DLLS" -} + "version": 1 +} \ No newline at end of file diff --git a/objects/regripper-software-hive-application-paths/definition.json b/objects/regripper-software-hive-application-paths/definition.json index 62aacc5..0bb988f 100644 --- a/objects/regripper-software-hive-application-paths/definition.json +++ b/objects/regripper-software-hive-application-paths/definition.json @@ -1,49 +1,49 @@ { + "attributes": { + "comments": { + "description": "Additional comments.", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 0 + }, + "executable-file-name": { + "description": "Name of the executable file.", + "misp-attribute": "text", + "multiple": true, + "ui-priority": 0 + }, + "key": { + "description": "Software hive key where the information is retrieved from.", + "misp-attribute": "text", + "ui-priority": 0 + }, + "last-write-time": { + "description": "Date and time when the key was last updated.", + "disable_correlation": true, + "misp-attribute": "datetime", + "ui-priority": 0 + }, + "path": { + "description": "Path of the executable file.", + "misp-attribute": "text", + "multiple": true, + "ui-priority": 0 + }, + "references": { + "description": "References to the application installed.", + "misp-attribute": "link", + "multiple": true, + "ui-priority": 0 + } + }, + "description": "Regripper Object template designed to gather information of the application paths.", + "meta-category": "misc", + "name": "regripper-software-hive-application-paths", "required": [ "key", "executable-file-name", "path" ], - "attributes": { - "key": { - "description": "Software hive key where the information is retrieved from.", - "ui-priority": 0, - "misp-attribute": "text" - }, - "last-write-time": { - "description": "Date and time when the key was last updated.", - "ui-priority": 0, - "misp-attribute": "datetime", - "disable_correlation": true - }, - "executable-file-name": { - "description": "Name of the executable file.", - "ui-priority": 0, - "misp-attribute": "text", - "multiple": true - }, - "path": { - "description": "Path of the executable file.", - "ui-priority": 0, - "misp-attribute": "text", - "multiple": true - }, - "comments": { - "description": "Additional comments.", - "ui-priority": 0, - "misp-attribute": "text", - "disable_correlation": true - }, - "references": { - "description": "References to the application installed.", - "ui-priority": 0, - "misp-attribute": "link", - "multiple": true - } - }, - "version": 1, - "description": "Regripper Object template designed to gather information of the application paths.", - "meta-category": "misc", "uuid": "9f2d3c9b-9a82-42a7-82c2-733115d101c8", - "name": "regripper-software-hive-application-paths" -} + "version": 1 +} \ No newline at end of file diff --git a/objects/regripper-software-hive-applications-installed/definition.json b/objects/regripper-software-hive-applications-installed/definition.json index 2b7d153..1d2edbe 100644 --- a/objects/regripper-software-hive-applications-installed/definition.json +++ b/objects/regripper-software-hive-applications-installed/definition.json @@ -1,57 +1,57 @@ { + "attributes": { + "app-last-write-time": { + "description": "Date and time when the application key was last updated.", + "disable_correlation": true, + "misp-attribute": "datetime", + "ui-priority": 0 + }, + "app-name": { + "description": "Name of the application.", + "misp-attribute": "text", + "ui-priority": 0 + }, + "comments": { + "description": "Additional comments.", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 0 + }, + "key": { + "description": "Software hive key where the information is retrieved from.", + "misp-attribute": "text", + "ui-priority": 0 + }, + "key-path": { + "description": "Path of the key.", + "misp-attribute": "text", + "ui-priority": 0 + }, + "last-write-time": { + "description": "Date and time when the key was last updated.", + "disable_correlation": true, + "misp-attribute": "datetime", + "ui-priority": 0 + }, + "references": { + "description": "References to the application installed.", + "misp-attribute": "link", + "multiple": true, + "ui-priority": 0 + }, + "version": { + "description": "Version of the application.", + "misp-attribute": "text", + "ui-priority": 0 + } + }, + "description": "Regripper Object template designed to gather information of the applications installed on the system.", + "meta-category": "misc", + "name": "regripper-software-hive-applications-installed", "required": [ "key", "app-name" ], - "attributes": { - "key": { - "description": "Software hive key where the information is retrieved from.", - "ui-priority": 0, - "misp-attribute": "text" - }, - "key-path": { - "description": "Path of the key.", - "ui-priority": 0, - "misp-attribute": "text" - }, - "last-write-time": { - "description": "Date and time when the key was last updated.", - "ui-priority": 0, - "misp-attribute": "datetime", - "disable_correlation": true - }, - "app-name": { - "description": "Name of the application.", - "ui-priority": 0, - "misp-attribute": "text" - }, - "app-last-write-time": { - "description": "Date and time when the application key was last updated.", - "ui-priority": 0, - "misp-attribute": "datetime", - "disable_correlation": true - }, - "version": { - "description": "Version of the application.", - "ui-priority": 0, - "misp-attribute": "text" - }, - "comments": { - "description": "Additional comments.", - "ui-priority": 0, - "misp-attribute": "text", - "disable_correlation": true - }, - "references": { - "description": "References to the application installed.", - "ui-priority": 0, - "misp-attribute": "link", - "multiple": true - } - }, - "version": 1, - "description": "Regripper Object template designed to gather information of the applications installed on the system.", - "meta-category": "misc", "uuid": "7a8fb6b4-cbbd-4de5-b893-7b0a5c4858cd", - "name": "regripper-software-hive-applications-installed" -} + "version": 1 +} \ No newline at end of file diff --git a/objects/regripper-software-hive-command-shell/definition.json b/objects/regripper-software-hive-command-shell/definition.json index 0245221..3fa138c 100644 --- a/objects/regripper-software-hive-command-shell/definition.json +++ b/objects/regripper-software-hive-command-shell/definition.json @@ -1,24 +1,30 @@ { - "required": [ - "key", - "shell", - "shell-path" - ], "attributes": { + "command": { + "description": "Command executed.", + "misp-attribute": "text", + "ui-priority": 0 + }, + "comments": { + "description": "Additional comments.", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 0 + }, "key": { "description": "Software hive key where the information is retrieved from.", - "ui-priority": 0, - "misp-attribute": "text" + "misp-attribute": "text", + "ui-priority": 0 }, "last-write-time": { "description": "Date and time when the key was last updated.", - "ui-priority": 0, + "disable_correlation": true, "misp-attribute": "datetime", - "disable_correlation": true + "ui-priority": 0 }, "shell": { "description": "Type of shell used to execute the command.", - "ui-priority": 0, + "disable_correlation": true, "misp-attribute": "text", "sane_default": [ "exe", @@ -28,28 +34,22 @@ "pif", "Other" ], - "disable_correlation": true + "ui-priority": 0 }, "shell-path": { "description": "Path of the shell.", - "ui-priority": 0, - "misp-attribute": "text" - }, - "command": { - "description": "Command executed.", - "ui-priority": 0, - "misp-attribute": "text" - }, - "comments": { - "description": "Additional comments.", - "ui-priority": 0, "misp-attribute": "text", - "disable_correlation": true + "ui-priority": 0 } }, - "version": 1, "description": "Regripper Object template designed to gather information of the shell commands executed on the system.", "meta-category": "misc", + "name": "regripper-software-hive-command-shell", + "required": [ + "key", + "shell", + "shell-path" + ], "uuid": "a7dc3697-89ce-46dc-a64d-0b1015457978", - "name": "regripper-software-hive-command-shell" -} + "version": 1 +} \ No newline at end of file diff --git a/objects/regripper-software-hive-software-run/definition.json b/objects/regripper-software-hive-software-run/definition.json index 5e26a8a..969d6db 100644 --- a/objects/regripper-software-hive-software-run/definition.json +++ b/objects/regripper-software-hive-software-run/definition.json @@ -1,13 +1,27 @@ { - "required": [ - "key", - "application-name", - "application-path" - ], "attributes": { + "application-name": { + "description": "Name of the application run.", + "misp-attribute": "text", + "multiple": true, + "ui-priority": 0 + }, + "application-path": { + "description": "Path where the application is installed.", + "misp-attribute": "text", + "multiple": true, + "ui-priority": 0 + }, + "comments": { + "description": "Additional comments.", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 0 + }, "key": { "description": "Software hive key where the information is retrieved from.", - "ui-priority": 0, + "disable_correlation": true, + "misp-attribute": "text", "sane_default": [ "Run", "RunOnce", @@ -15,49 +29,35 @@ "Terminal", "Other" ], - "misp-attribute": "text", - "disable_correlation": true + "ui-priority": 0 }, "key-path": { "description": "Path of the key.", - "ui-priority": 0, + "disable_correlation": true, "misp-attribute": "text", - "disable_correlation": true + "ui-priority": 0 }, "last-write-time": { "description": "Date and time when the key was last updated.", - "ui-priority": 0, + "disable_correlation": true, "misp-attribute": "datetime", - "disable_correlation": true - }, - "application-name": { - "description": "Name of the application run.", - "ui-priority": 0, - "misp-attribute": "text", - "multiple": true - }, - "application-path": { - "description": "Path where the application is installed.", - "ui-priority": 0, - "misp-attribute": "text", - "multiple": true - }, - "comments": { - "description": "Additional comments.", - "ui-priority": 0, - "misp-attribute": "text", - "disable_correlation": true + "ui-priority": 0 }, "references": { "description": "References to the applications.", - "ui-priority": 0, "misp-attribute": "link", - "multiple": true + "multiple": true, + "ui-priority": 0 } }, - "version": 1, "description": "Regripper Object template designed to gather information of the applications set to run on the system.", "meta-category": "misc", + "name": "regripper-software-hive-software-run", + "required": [ + "key", + "application-name", + "application-path" + ], "uuid": "4bae06d1-3996-4028-88ec-7c7d54cc1d94", - "name": "regripper-software-hive-software-run" -} + "version": 1 +} \ No newline at end of file diff --git a/objects/regripper-software-hive-userprofile-winlogon/definition.json b/objects/regripper-software-hive-userprofile-winlogon/definition.json index 15a3efc..b4c4bb1 100644 --- a/objects/regripper-software-hive-userprofile-winlogon/definition.json +++ b/objects/regripper-software-hive-userprofile-winlogon/definition.json @@ -1,160 +1,160 @@ { + "attributes": { + "AutoAdminLogon": { + "description": "Flag value to determine if autologon is enabled for a user without entering the password.", + "disable_correlation": true, + "misp-attribute": "boolean", + "ui-priority": 0 + }, + "AutoRestartShell": { + "description": "Value of the flag set to auto restart the shell if it crashes or shuts down automatically.", + "disable_correlation": true, + "misp-attribute": "boolean", + "ui-priority": 0 + }, + "CachedLogonCount": { + "description": "Number of times the user has logged into the system.", + "disable_correlation": true, + "misp-attribute": "counter", + "ui-priority": 0 + }, + "Comments": { + "description": "Additional comments.", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 0 + }, + "DefaultUserName": { + "description": "user-name of the default user.", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 0 + }, + "DisableCAD": { + "description": "Flag to determine if user login is enabled by pressing Ctrl+ALT+Delete.", + "disable_correlation": true, + "misp-attribute": "boolean", + "ui-priority": 0 + }, + "Legal-notice-caption": { + "description": "Message title set to display when the user logs-in.", + "disable_correlation": true, + "misp-attribute": "text", + "multiple": true, + "ui-priority": 0 + }, + "Legal-notice-text": { + "description": "Message set to display when the user logs-in.", + "disable_correlation": true, + "misp-attribute": "text", + "multiple": true, + "ui-priority": 0 + }, + "PasswordExpiryWarining": { + "description": "Number of times the password expiry warning appeared.", + "disable_correlation": true, + "misp-attribute": "counter", + "ui-priority": 0 + }, + "PowerdownAfterShutDown": { + "description": "Flag value- if the system is set to power down after it is shutdown.", + "disable_correlation": true, + "misp-attribute": "boolean", + "ui-priority": 0 + }, + "PreCreateKnownFolders": { + "description": "create known folders key", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 0 + }, + "ReportBootOk": { + "description": "Flag to check if the reboot was successful.", + "disable_correlation": true, + "misp-attribute": "boolean", + "ui-priority": 0 + }, + "SID": { + "description": "Security identifier assigned to the user profile.", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 0 + }, + "Shell": { + "description": "Shell set to run when the user logs onto the system.", + "disable_correlation": true, + "misp-attribute": "text", + "multiple": true, + "ui-priority": 0 + }, + "ShutdownFlags": { + "description": "Number of times shutdown is initiated from a process when the user is logged-in.", + "disable_correlation": true, + "misp-attribute": "counter", + "ui-priority": 0 + }, + "ShutdownWithoutLogon": { + "description": "Value of the flag set to enable shutdown without requiring a user to login.", + "disable_correlation": true, + "misp-attribute": "boolean", + "ui-priority": 0 + }, + "UserInit": { + "description": "Applications and files set to run when the user logs onto the system (User logon activity).", + "misp-attribute": "text", + "multiple": true, + "ui-priority": 0 + }, + "WinStationsDisabled": { + "description": "Flag value set to enable/disable logons to the system.", + "disable_correlation": true, + "misp-attribute": "boolean", + "ui-priority": 0 + }, + "user-profile-key-last-write-time": { + "description": "Date and time when the key was last updated.", + "disable_correlation": true, + "misp-attribute": "datetime", + "ui-priority": 0 + }, + "user-profile-key-path": { + "description": "key where the user-profile information is retrieved from.", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 0 + }, + "user-profile-last-write-time": { + "description": "Date and time when the user profile was last updated.", + "disable_correlation": true, + "misp-attribute": "datetime", + "ui-priority": 0 + }, + "user-profile-path": { + "description": "Path of the user profile on the system", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 0 + }, + "winlogon-key-last-write-time": { + "description": "Date and time when the winlogon key was last updated.", + "disable_correlation": true, + "misp-attribute": "datetime", + "ui-priority": 0 + }, + "winlogon-key-path": { + "description": "winlogon key referred in order to retrieve default user information", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 0 + } + }, + "description": "Regripper Object template designed to gather user profile information when the user logs onto the system, gathered from the software hive.", + "meta-category": "misc", + "name": "regripper-software-hive-userprofile-winlogon", "required": [ "user-profile-key-path", "SID" ], - "attributes": { - "user-profile-key-path": { - "description": "key where the user-profile information is retrieved from.", - "ui-priority": 0, - "misp-attribute": "text", - "disable_correlation": true - }, - "user-profile-key-last-write-time": { - "description": "Date and time when the key was last updated.", - "ui-priority": 0, - "misp-attribute": "datetime", - "disable_correlation": true - }, - "user-profile-path": { - "description": "Path of the user profile on the system", - "ui-priority": 0, - "misp-attribute": "text", - "disable_correlation": true - }, - "SID": { - "description": "Security identifier assigned to the user profile.", - "ui-priority": 0, - "misp-attribute": "text", - "disable_correlation": true - }, - "user-profile-last-write-time": { - "description": "Date and time when the user profile was last updated.", - "ui-priority": 0, - "misp-attribute": "datetime", - "disable_correlation": true - }, - "winlogon-key-path": { - "description": "winlogon key referred in order to retrieve default user information", - "ui-priority": 0, - "misp-attribute": "text", - "disable_correlation": true - }, - "winlogon-key-last-write-time": { - "description": "Date and time when the winlogon key was last updated.", - "ui-priority": 0, - "misp-attribute": "datetime", - "disable_correlation": true - }, - "DefaultUserName": { - "description": "user-name of the default user.", - "ui-priority": 0, - "misp-attribute": "text", - "disable_correlation": true - }, - "Shell": { - "description": "Shell set to run when the user logs onto the system.", - "ui-priority": 0, - "misp-attribute": "text", - "disable_correlation": true, - "multiple": true - }, - "UserInit": { - "description": "Applications and files set to run when the user logs onto the system (User logon activity).", - "ui-priority": 0, - "misp-attribute": "text", - "multiple": true - }, - "Legal-notice-caption": { - "description": "Message title set to display when the user logs-in.", - "ui-priority": 0, - "misp-attribute": "text", - "multiple": true, - "disable_correlation": true - }, - "Legal-notice-text": { - "description": "Message set to display when the user logs-in.", - "ui-priority": 0, - "misp-attribute": "text", - "multiple": true, - "disable_correlation": true - }, - "PreCreateKnownFolders": { - "description": "create known folders key", - "ui-priority": 0, - "misp-attribute": "text", - "disable_correlation": true - }, - "ReportBootOk": { - "description": "Flag to check if the reboot was successful.", - "ui-priority": 0, - "misp-attribute": "boolean", - "disable_correlation": true - }, - "AutoRestartShell": { - "description": "Value of the flag set to auto restart the shell if it crashes or shuts down automatically.", - "ui-priority": 0, - "misp-attribute": "boolean", - "disable_correlation": true - }, - "PasswordExpiryWarining": { - "description": "Number of times the password expiry warning appeared.", - "ui-priority": 0, - "misp-attribute": "counter", - "disable_correlation": true - }, - "PowerdownAfterShutDown": { - "description": "Flag value- if the system is set to power down after it is shutdown.", - "ui-priority": 0, - "misp-attribute": "boolean", - "disable_correlation": true - }, - "ShutdownWithoutLogon": { - "description": "Value of the flag set to enable shutdown without requiring a user to login.", - "ui-priority": 0, - "misp-attribute": "boolean", - "disable_correlation": true - }, - "WinStationsDisabled": { - "description": "Flag value set to enable/disable logons to the system.", - "ui-priority": 0, - "misp-attribute": "boolean", - "disable_correlation": true - }, - "DisableCAD": { - "description": "Flag to determine if user login is enabled by pressing Ctrl+ALT+Delete.", - "ui-priority": 0, - "misp-attribute": "boolean", - "disable_correlation": true - }, - "AutoAdminLogon": { - "description": "Flag value to determine if autologon is enabled for a user without entering the password.", - "ui-priority": 0, - "misp-attribute": "boolean", - "disable_correlation": true - }, - "CachedLogonCount": { - "description": "Number of times the user has logged into the system.", - "ui-priority": 0, - "misp-attribute": "counter", - "disable_correlation": true - }, - "ShutdownFlags": { - "description": "Number of times shutdown is initiated from a process when the user is logged-in.", - "ui-priority": 0, - "misp-attribute": "counter", - "disable_correlation": true - }, - "Comments": { - "description": "Additional comments.", - "ui-priority": 0, - "misp-attribute": "text", - "disable_correlation": true - } - }, - "version": 1, - "description": "Regripper Object template designed to gather user profile information when the user logs onto the system, gathered from the software hive.", - "meta-category": "misc", "uuid": "df03d0e4-3e6b-4e56-951a-142eae4cad59", - "name": "regripper-software-hive-userprofile-winlogon" -} + "version": 1 +} \ No newline at end of file diff --git a/objects/regripper-software-hive-windows-general-info/definition.json b/objects/regripper-software-hive-windows-general-info/definition.json index e1ed4d5..d0aad96 100644 --- a/objects/regripper-software-hive-windows-general-info/definition.json +++ b/objects/regripper-software-hive-windows-general-info/definition.json @@ -1,126 +1,126 @@ { - "required": [ - "win-cv-path", - "CurrentVersion" - ], "attributes": { - "win-cv-path": { - "description": "key where the windows information is retrieved from", - "ui-priority": 0, - "misp-attribute": "text" + "BuildGUID": { + "description": "Build ID.", + "misp-attribute": "text", + "ui-priority": 0 }, - "last-write-time": { - "description": "Date and time when the key was last updated.", - "ui-priority": 0, - "misp-attribute": "datetime", - "disable_correlation": true + "BuildLab": { + "description": "Windows BuildLab string.", + "misp-attribute": "text", + "ui-priority": 0 }, - "RegisteredOrganization": { - "description": "Name of the registered organization.", - "ui-priority": 0, - "misp-attribute": "text" + "BuildLabEx": { + "description": "Windows BuildLabEx string.", + "misp-attribute": "text", + "ui-priority": 0 }, - "RegisteredOwner": { - "description": "Name of the registered owner.", - "ui-priority": 0, - "misp-attribute": "text" - }, - "CurrentVersion": { - "description": "Current version of windows", - "ui-priority": 0, - "disable_correlation": true, - "misp-attribute": "text" + "CSDVersion": { + "description": "Version of the service pack installed.", + "misp-attribute": "text", + "ui-priority": 0 }, "CurrentBuild": { "description": "Build number of the windows OS.", - "ui-priority": 0, - "misp-attribute": "text" + "misp-attribute": "text", + "ui-priority": 0 + }, + "CurrentBuildType": { + "description": "Current build type of the OS.", + "misp-attribute": "text", + "ui-priority": 0 + }, + "CurrentVersion": { + "description": "Current version of windows", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 0 + }, + "EditionID": { + "description": "Windows edition.", + "misp-attribute": "text", + "ui-priority": 0 + }, + "InstallDate": { + "description": "Date when windows was installed.", + "disable_correlation": true, + "misp-attribute": "datetime", + "ui-priority": 0 + }, + "InstallationType": { + "description": "Type of windows installation.", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 0 + }, + "PathName": { + "description": "Path to the root directory.", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 0 + }, + "ProductID": { + "description": "ID of the product version.", + "misp-attribute": "text", + "ui-priority": 0 + }, + "ProductName": { + "description": "Name of the windows version.", + "misp-attribute": "text", + "ui-priority": 0 + }, + "RegisteredOrganization": { + "description": "Name of the registered organization.", + "misp-attribute": "text", + "ui-priority": 0 + }, + "RegisteredOwner": { + "description": "Name of the registered owner.", + "misp-attribute": "text", + "ui-priority": 0 }, "SoftwareType": { "description": "Software type of windows.", - "ui-priority": 0, + "disable_correlation": true, + "misp-attribute": "text", "sane_default": [ "System", "Application", "other" ], - "misp-attribute": "text", - "disable_correlation": true - }, - "InstallationType": { - "description": "Type of windows installation.", - "ui-priority": 0, - "misp-attribute": "text", - "disable_correlation": true - }, - "InstallDate": { - "description": "Date when windows was installed.", - "ui-priority": 0, - "misp-attribute": "datetime", - "disable_correlation": true + "ui-priority": 0 }, "SystemRoot": { "description": "Root directory.", - "ui-priority": 0, + "disable_correlation": true, "misp-attribute": "text", - "disable_correlation": true - }, - "PathName": { - "description": "Path to the root directory.", - "ui-priority": 0, - "misp-attribute": "text", - "disable_correlation": true - }, - "EditionID": { - "description": "Windows edition.", - "ui-priority": 0, - "misp-attribute": "text" - }, - "ProductName": { - "description": "Name of the windows version.", - "ui-priority": 0, - "misp-attribute": "text" - }, - "ProductID": { - "description": "ID of the product version.", - "ui-priority": 0, - "misp-attribute": "text" - }, - "CSDVersion": { - "description": "Version of the service pack installed.", - "ui-priority": 0, - "misp-attribute": "text" - }, - "CurrentBuildType": { - "description": "Current build type of the OS.", - "ui-priority": 0, - "misp-attribute": "text" - }, - "BuildLab": { - "description": "Windows BuildLab string.", - "ui-priority": 0, - "misp-attribute": "text" - }, - "BuildGUID": { - "description": "Build ID.", - "ui-priority": 0, - "misp-attribute": "text" - }, - "BuildLabEx": { - "description": "Windows BuildLabEx string.", - "ui-priority": 0, - "misp-attribute": "text" + "ui-priority": 0 }, "comment": { "description": "Additional comments.", - "ui-priority": 0, + "disable_correlation": true, "misp-attribute": "comment", - "disable_correlation": true + "ui-priority": 0 + }, + "last-write-time": { + "description": "Date and time when the key was last updated.", + "disable_correlation": true, + "misp-attribute": "datetime", + "ui-priority": 0 + }, + "win-cv-path": { + "description": "key where the windows information is retrieved from", + "misp-attribute": "text", + "ui-priority": 0 } }, - "version": 1, "description": "Regripper Object template designed to gather general windows information extracted from the software-hive.", "meta-category": "misc", + "name": "regripper-software-hive-windows-general-info", + "required": [ + "win-cv-path", + "CurrentVersion" + ], "uuid": "03200c25-4bf5-4282-9852-001a51ab20f1", - "name": "regripper-software-hive-windows-general-info" -} + "version": 1 +} \ No newline at end of file diff --git a/objects/regripper-system-hive-firewall-configuration/definition.json b/objects/regripper-system-hive-firewall-configuration/definition.json index b7e5fb6..72fd527 100644 --- a/objects/regripper-system-hive-firewall-configuration/definition.json +++ b/objects/regripper-system-hive-firewall-configuration/definition.json @@ -1,11 +1,33 @@ { - "required": [ - "profile" - ], "attributes": { + "comment": { + "description": "Additional comments.", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 0 + }, + "disable-notification": { + "description": "Boolean flag to determine if firewall notifications are enabled.", + "disable_correlation": true, + "misp-attribute": "boolean", + "ui-priority": 0 + }, + "enbled-firewall": { + "description": "Boolean flag to determine if the firewall is enabled.", + "disable_correlation": true, + "misp-attribute": "boolean", + "ui-priority": 0 + }, + "last-write-time": { + "description": "Date and time when the firewall profile policy was last updated.", + "disable_correlation": true, + "misp-attribute": "datetime", + "ui-priority": 0 + }, "profile": { "description": "Firewall Profile type", - "ui-priority": 0, + "disable_correlation": true, + "misp-attribute": "text", "sane_default": [ "Domain Profile", "Standard Profile", @@ -14,37 +36,15 @@ "Private Profile", "other" ], - "misp-attribute": "text", - "disable_correlation": true - }, - "last-write-time": { - "description": "Date and time when the firewall profile policy was last updated.", - "ui-priority": 0, - "misp-attribute": "datetime", - "disable_correlation": true - }, - "enbled-firewall": { - "description": "Boolean flag to determine if the firewall is enabled.", - "ui-priority": 0, - "misp-attribute": "boolean", - "disable_correlation": true - }, - "disable-notification": { - "description": "Boolean flag to determine if firewall notifications are enabled.", - "ui-priority": 0, - "misp-attribute": "boolean", - "disable_correlation": true - }, - "comment": { - "description": "Additional comments.", - "ui-priority": 0, - "misp-attribute": "text", - "disable_correlation": true + "ui-priority": 0 } }, - "version": 1, "description": "Regripper Object template designed to present firewall configuration information extracted from the system-hive.", "meta-category": "misc", + "name": "regripper-system-hive-firewall-configuration", + "required": [ + "profile" + ], "uuid": "d9839b3c-c013-4ba7-b5e5-2787198b9e07", - "name": "regripper-system-hive-firewall-configuration" -} + "version": 1 +} \ No newline at end of file diff --git a/objects/regripper-system-hive-general-configuration/definition.json b/objects/regripper-system-hive-general-configuration/definition.json index 2851077..72efd8b 100644 --- a/objects/regripper-system-hive-general-configuration/definition.json +++ b/objects/regripper-system-hive-general-configuration/definition.json @@ -1,89 +1,89 @@ { - "required": [ - "computer-name" - ], "attributes": { + "comment": { + "description": "Additional comments.", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 0 + }, "computer-name": { "description": "name of the computer under analysis", - "ui-priority": 0, - "misp-attribute": "text" - }, - "last-write-time": { - "description": "Date and time when the key was last updated.", - "ui-priority": 0, - "misp-attribute": "datetime", - "disable_correlation": true - }, - "shutdown-time": { - "description": "Date and time when the system was shutdown.", - "ui-priority": 0, - "misp-attribute": "datetime", - "disable_correlation": true - }, - "timezone-last-write-time": { - "description": "Date and time when the timezone key was last updated.", - "ui-priority": 0, - "misp-attribute": "datetime", - "disable_correlation": true - }, - "timezone-bias": { - "description": "Offset in minutes from UTC. Offset added to the local time to get a UTC value.", - "ui-priority": 0, "misp-attribute": "text", - "disable_correlation": true - }, - "timezone-standard-name": { - "description": "Timezone standard name used during non-daylight saving months.", - "ui-priority": 0, - "misp-attribute": "text", - "disable_correlation": true - }, - "timezone-standard-date": { - "description": "Standard date - non daylight saving months", - "ui-priority": 0, - "misp-attribute": "datetime", - "disable_correlation": true - }, - "timezone-standard-bias": { - "description": "value in minutes to be added to the value of timezone-bias to generate the bias used during standard time.", - "ui-priority": 0, - "misp-attribute": "text", - "disable_correlation": true - }, - "timezone-daylight-name": { - "description": "Timezone name used during daylight saving months.", - "ui-priority": 0, - "misp-attribute": "text", - "disable_correlation": true - }, - "timezone-daylight-date": { - "description": "Daylight date - daylight saving months", - "ui-priority": 0, - "misp-attribute": "datetime", - "disable_correlation": true - }, - "timezone-daylight-bias": { - "description": "value in minutes to be added to the value of timezone-bias to generate the bias used during daylight time.", - "ui-priority": 0, - "misp-attribute": "text", - "disable_correlation": true + "ui-priority": 0 }, "fDenyTSConnections:": { "description": "Specifies whether remote connections are enabled or disabled on the system.", - "ui-priority": 0, + "disable_correlation": true, "misp-attribute": "boolean", - "disable_correlation": true + "ui-priority": 0 }, - "comment": { - "description": "Additional comments.", - "ui-priority": 0, + "last-write-time": { + "description": "Date and time when the key was last updated.", + "disable_correlation": true, + "misp-attribute": "datetime", + "ui-priority": 0 + }, + "shutdown-time": { + "description": "Date and time when the system was shutdown.", + "disable_correlation": true, + "misp-attribute": "datetime", + "ui-priority": 0 + }, + "timezone-bias": { + "description": "Offset in minutes from UTC. Offset added to the local time to get a UTC value.", + "disable_correlation": true, "misp-attribute": "text", - "disable_correlation": true + "ui-priority": 0 + }, + "timezone-daylight-bias": { + "description": "value in minutes to be added to the value of timezone-bias to generate the bias used during daylight time.", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 0 + }, + "timezone-daylight-date": { + "description": "Daylight date - daylight saving months", + "disable_correlation": true, + "misp-attribute": "datetime", + "ui-priority": 0 + }, + "timezone-daylight-name": { + "description": "Timezone name used during daylight saving months.", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 0 + }, + "timezone-last-write-time": { + "description": "Date and time when the timezone key was last updated.", + "disable_correlation": true, + "misp-attribute": "datetime", + "ui-priority": 0 + }, + "timezone-standard-bias": { + "description": "value in minutes to be added to the value of timezone-bias to generate the bias used during standard time.", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 0 + }, + "timezone-standard-date": { + "description": "Standard date - non daylight saving months", + "disable_correlation": true, + "misp-attribute": "datetime", + "ui-priority": 0 + }, + "timezone-standard-name": { + "description": "Timezone standard name used during non-daylight saving months.", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 0 } }, - "version": 2, "description": "Regripper Object template designed to present general system properties extracted from the system-hive.", "meta-category": "misc", + "name": "regripper-system-hive-general-configuration", + "required": [ + "computer-name" + ], "uuid": "5ac85401-cbf1-4d05-a85e-1784546881e4", - "name": "regripper-system-hive-general-configuration" -} + "version": 2 +} \ No newline at end of file diff --git a/objects/regripper-system-hive-network-information/definition.json b/objects/regripper-system-hive-network-information/definition.json index 7676c59..845cd3d 100644 --- a/objects/regripper-system-hive-network-information/definition.json +++ b/objects/regripper-system-hive-network-information/definition.json @@ -1,106 +1,106 @@ { - "required": [ - "network-key" - ], "attributes": { - "network-key": { - "description": "Registry key assigned to the network", - "ui-priority": 0, - "misp-attribute": "text" - }, - "network-key-last-write-time": { - "description": "Date and time when the network key was last updated.", - "ui-priority": 0, - "misp-attribute": "datetime", - "disable_correlation": true - }, - "network-key-path": { - "description": "Path of the key where the information is retrieved from.", - "ui-priority": 0, - "misp-attribute": "text", - "disable_correlation": true - }, - "TCPIP-key": { - "description": "TCPIP key", - "ui-priority": 0, - "misp-attribute": "text" - }, - "TCPIP-key-last-write-time": { - "description": "Datetime when the key was last updated.", - "ui-priority": 0, - "misp-attribute": "datetime", - "disable_correlation": true + "DHCP-IP-address": { + "description": "DHCP service - IP address", + "misp-attribute": "ip-dst", + "ui-priority": 0 }, "DHCP-domain": { "description": "Name of the DHCP domain service", - "ui-priority": 0, - "misp-attribute": "text" - }, - "DHCP-IP-address": { - "description": "DHCP service - IP address", - "ui-priority": 0, - "misp-attribute": "ip-dst" - }, - "DHCP-subnet-mask": { - "description": "DHCP subnet mask - IP address.", - "ui-priority": 0, - "misp-attribute": "ip-dst" + "misp-attribute": "text", + "ui-priority": 0 }, "DHCP-name-server": { "description": "DHCP Name server - IP address.", - "ui-priority": 0, - "misp-attribute": "ip-dst" + "misp-attribute": "ip-dst", + "ui-priority": 0 }, "DHCP-server": { "description": "DHCP server - IP address.", - "ui-priority": 0, - "misp-attribute": "ip-dst" + "misp-attribute": "ip-dst", + "ui-priority": 0 }, - "interface-GUID": { - "description": "GUID value assigned to the interface.", - "ui-priority": 0, + "DHCP-subnet-mask": { + "description": "DHCP subnet mask - IP address.", + "misp-attribute": "ip-dst", + "ui-priority": 0 + }, + "TCPIP-key": { + "description": "TCPIP key", "misp-attribute": "text", - "disable_correlation": true + "ui-priority": 0 }, - "interface-last-write-time": { - "description": "Last date and time when the interface key was updated.", - "ui-priority": 0, + "TCPIP-key-last-write-time": { + "description": "Datetime when the key was last updated.", + "disable_correlation": true, "misp-attribute": "datetime", - "disable_correlation": true - }, - "interface-name": { - "description": "Name of the interface.", - "ui-priority": 0, - "misp-attribute": "text" - }, - "interface-PnpInstanceID": { - "description": "Plug and Play instance ID assigned to the interface.", - "ui-priority": 0, - "misp-attribute": "text", - "disable_correlation": true - }, - "interface-MediaSubType": { - "description": "", - "ui-priority": 0, - "misp-attribute": "text", - "disable_correlation": true - }, - "interface-IPcheckingEnabled": { - "description": "", - "ui-priority": 0, - "misp-attribute": "boolean", - "disable_correlation": true + "ui-priority": 0 }, "additional-comments": { "description": "Comments.", - "ui-priority": 0, + "disable_correlation": true, "misp-attribute": "text", - "disable_correlation": true + "ui-priority": 0 + }, + "interface-GUID": { + "description": "GUID value assigned to the interface.", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 0 + }, + "interface-IPcheckingEnabled": { + "description": "", + "disable_correlation": true, + "misp-attribute": "boolean", + "ui-priority": 0 + }, + "interface-MediaSubType": { + "description": "", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 0 + }, + "interface-PnpInstanceID": { + "description": "Plug and Play instance ID assigned to the interface.", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 0 + }, + "interface-last-write-time": { + "description": "Last date and time when the interface key was updated.", + "disable_correlation": true, + "misp-attribute": "datetime", + "ui-priority": 0 + }, + "interface-name": { + "description": "Name of the interface.", + "misp-attribute": "text", + "ui-priority": 0 + }, + "network-key": { + "description": "Registry key assigned to the network", + "misp-attribute": "text", + "ui-priority": 0 + }, + "network-key-last-write-time": { + "description": "Date and time when the network key was last updated.", + "disable_correlation": true, + "misp-attribute": "datetime", + "ui-priority": 0 + }, + "network-key-path": { + "description": "Path of the key where the information is retrieved from.", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 0 } }, - "version": 1, "description": "Regripper object template designed to gather network information from the system-hive.", "meta-category": "misc", + "name": "regripper-system-hive-network-information", + "required": [ + "network-key" + ], "uuid": "a5a3ba3a-ba2e-42a4-be45-b36809ae56f0", - "name": "regripper-system-hive-network-information." -} + "version": 1 +} \ No newline at end of file diff --git a/objects/regripper-system-hive-services-drivers/definition.json b/objects/regripper-system-hive-services-drivers/definition.json index 38a560a..3f60f13 100644 --- a/objects/regripper-system-hive-services-drivers/definition.json +++ b/objects/regripper-system-hive-services-drivers/definition.json @@ -1,59 +1,20 @@ { - "required": [ - "name" - ], "attributes": { - "name": { - "description": "name of the key", - "ui-priority": 0, - "misp-attribute": "text" - }, - "last-write-time": { - "description": "Date and time when the key was last updated.", - "ui-priority": 0, - "misp-attribute": "datetime", - "disable_correlation": true + "comment": { + "description": "Additional comments.", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 0 }, "display": { "description": "Display name/information of the service or the driver.", - "ui-priority": 0, - "misp-attribute": "text" - }, - "image-path": { - "description": "Path of the service/drive", - "ui-priority": 0, - "misp-attribute": "text" - }, - "type": { - "description": "Service/driver type.", - "ui-priority": 0, - "sane_default": [ - "Kernel driver", - "File system driver", - "Own process", - "Share process", - "Interactive", - "Other" - ], "misp-attribute": "text", - "disable_correlation": true - }, - "start": { - "description": "When the service/driver starts or executes.", - "ui-priority": 0, - "sane_default": [ - "Boot start", - "System start", - "Auto start", - "Manual", - "Disabled" - ], - "misp-attribute": "text", - "disable_correlation": true + "ui-priority": 0 }, "group": { "description": "Group to which the system/driver belong to.", - "ui-priority": 0, + "disable_correlation": true, + "misp-attribute": "text", "sane_default": [ "Base", "Boot Bus Extender", @@ -80,19 +41,58 @@ "Video Save", "other" ], - "misp-attribute": "text", - "disable_correlation": true + "ui-priority": 0 }, - "comment": { - "description": "Additional comments.", - "ui-priority": 0, + "image-path": { + "description": "Path of the service/drive", "misp-attribute": "text", - "disable_correlation": true + "ui-priority": 0 + }, + "last-write-time": { + "description": "Date and time when the key was last updated.", + "disable_correlation": true, + "misp-attribute": "datetime", + "ui-priority": 0 + }, + "name": { + "description": "name of the key", + "misp-attribute": "text", + "ui-priority": 0 + }, + "start": { + "description": "When the service/driver starts or executes.", + "disable_correlation": true, + "misp-attribute": "text", + "sane_default": [ + "Boot start", + "System start", + "Auto start", + "Manual", + "Disabled" + ], + "ui-priority": 0 + }, + "type": { + "description": "Service/driver type.", + "disable_correlation": true, + "misp-attribute": "text", + "sane_default": [ + "Kernel driver", + "File system driver", + "Own process", + "Share process", + "Interactive", + "Other" + ], + "ui-priority": 0 } }, - "version": 2, "description": "Regripper Object template designed to gather information regarding the services/drivers from the system-hive.", "meta-category": "misc", + "name": "regripper-system-hive-services-drivers", + "required": [ + "name" + ], "uuid": "78cdae45-2061-4b49-b1d6-71f562094a73", - "name": "regripper-system-hive-services-drivers" -} + "version": 2 +} \ No newline at end of file diff --git a/objects/report/definition.json b/objects/report/definition.json index 053677d..316823f 100644 --- a/objects/report/definition.json +++ b/objects/report/definition.json @@ -1,37 +1,37 @@ { - "required": [ - "summary" - ], "attributes": { - "summary": { - "description": "Free text summary of the report", - "ui-priority": 100, + "case-number": { + "categories": [ + "Internal reference", + "Other" + ], + "description": "Case number", "misp-attribute": "text", + "ui-priority": 1 + }, + "report-file(s)": { + "description": "Attachment(s) that is related to the report", + "misp-attribute": "attachment", + "multiple": true, + "ui-priority": 99 + }, + "summary": { "categories": [ "Other", "Internal reference" ], - "multiple": true - }, - "case-number": { - "description": "Case number", - "ui-priority": 1, + "description": "Free text summary of the report", "misp-attribute": "text", - "categories": [ - "Internal reference", - "Other" - ] - }, - "report-file(s)": { - "description": "Attachment(s) that is related to the report", - "ui-priority": 99, - "misp-attribute": "attachment", - "multiple": true + "multiple": true, + "ui-priority": 100 } }, - "version": 1, "description": "Metadata used to generate an executive level report", "meta-category": "misc", + "name": "report", + "required": [ + "summary" + ], "uuid": "70a68471-df22-4e3f-aa1a-5a3be19f82df", - "name": "report" -} + "version": 1 +} \ No newline at end of file diff --git a/objects/research-scanner/definition.json b/objects/research-scanner/definition.json index 8822c4e..2cb71c1 100644 --- a/objects/research-scanner/definition.json +++ b/objects/research-scanner/definition.json @@ -1,80 +1,80 @@ { - "required": [ - "project", - "scanning_ip" - ], "attributes": { - "project": { - "description": "Description of scanning project", - "ui-priority": 1, - "disable_correlation": true, - "misp-attribute": "text" - }, - "scanning_ip": { - "description": "IP address used by project", - "categories": [ - "Network activity", - "External analysis" - ], - "ui-priority": 1, - "misp-attribute": "ip-src", - "multiple": true - }, - "domain": { - "description": "Domain related to project", - "ui-priority": 1, - "multiple": true, - "misp-attribute": "domain" - }, "asn": { "description": "Autonomous System Number related to project", - "ui-priority": 0, "disable_correlation": true, - "misp-attribute": "AS" - }, - "scheduled_start": { - "description": "Scheduled start of scanning activity", - "disable_correlation": true, - "ui-priority": 1, - "multiple": true, - "misp-attribute": "datetime" - }, - "scheduled_end": { - "description": "Scheduled end of scanning activity", - "disable_correlation": true, - "ui-priority": 0, - "multiple": true, - "misp-attribute": "datetime" + "misp-attribute": "AS", + "ui-priority": 0 }, "contact_email": { - "description": "Project contact information", - "disable_correlation": true, "categories": [ "Network activity", "Social network" ], - "ui-priority": 1, + "description": "Project contact information", + "disable_correlation": true, "misp-attribute": "email-dst", - "multiple": true + "multiple": true, + "ui-priority": 1 }, "contact_phone": { "description": "Phone number related to project", "disable_correlation": true, - "ui-priority": 0, "misp-attribute": "phone-number", - "multiple": true + "multiple": true, + "ui-priority": 0 + }, + "domain": { + "description": "Domain related to project", + "misp-attribute": "domain", + "multiple": true, + "ui-priority": 1 + }, + "project": { + "description": "Description of scanning project", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 1 }, "project_url": { "description": "URL related to project", "disable_correlation": true, - "ui-priority": 1, "misp-attribute": "link", - "multiple": true + "multiple": true, + "ui-priority": 1 + }, + "scanning_ip": { + "categories": [ + "Network activity", + "External analysis" + ], + "description": "IP address used by project", + "misp-attribute": "ip-src", + "multiple": true, + "ui-priority": 1 + }, + "scheduled_end": { + "description": "Scheduled end of scanning activity", + "disable_correlation": true, + "misp-attribute": "datetime", + "multiple": true, + "ui-priority": 0 + }, + "scheduled_start": { + "description": "Scheduled start of scanning activity", + "disable_correlation": true, + "misp-attribute": "datetime", + "multiple": true, + "ui-priority": 1 } }, - "version": 20190102, "description": "Information related to known scanning activity (e.g. from research projects)", "meta-category": "network", + "name": "research-scanner", + "required": [ + "project", + "scanning_ip" + ], "uuid": "d690e956-fc8a-11e8-8eb2-f2801f1b9fd1", - "name": "research-scanner" -} + "version": 20190102 +} \ No newline at end of file diff --git a/objects/rogue-dns/definition.json b/objects/rogue-dns/definition.json index 3e6e4a9..9198de5 100644 --- a/objects/rogue-dns/definition.json +++ b/objects/rogue-dns/definition.json @@ -1,46 +1,46 @@ { - "required": [ - "rogue-dns" - ], "attributes": { - "timestamp": { - "description": "Last time that the rogue DNS value was seen.", - "ui-priority": 0, - "misp-attribute": "datetime", - "disable_correlation": true + "hijacked-domain": { + "categories": [ + "Network activity" + ], + "description": "Domain/hostname hijacked by the the rogue DNS", + "misp-attribute": "hostname", + "ui-priority": 1 + }, + "phishing-ip": { + "description": "Resource records returns by the rogue DNS", + "misp-attribute": "ip-dst", + "ui-priority": 1 }, "rogue-dns": { "description": "IP address of the rogue DNS", - "ui-priority": 0, - "misp-attribute": "ip-dst" + "misp-attribute": "ip-dst", + "ui-priority": 0 }, "status": { "description": "How many authoritative DNS answers were received at the Passive DNS Server's collectors with exactly the given set of values as answers.", - "ui-priority": 0, + "disable_correlation": true, "misp-attribute": "text", "sane_default": [ "ROGUE DNS", "Unknown" ], - "disable_correlation": true + "ui-priority": 0 }, - "hijacked-domain": { - "description": "Domain/hostname hijacked by the the rogue DNS", - "categories": [ - "Network activity" - ], - "ui-priority": 1, - "misp-attribute": "hostname" - }, - "phishing-ip": { - "description": "Resource records returns by the rogue DNS", - "ui-priority": 1, - "misp-attribute": "ip-dst" + "timestamp": { + "description": "Last time that the rogue DNS value was seen.", + "disable_correlation": true, + "misp-attribute": "datetime", + "ui-priority": 0 } }, - "version": 1, "description": "Rogue DNS as defined by CERT.br", "meta-category": "network", + "name": "rogue-dns", + "required": [ + "rogue-dns" + ], "uuid": "b7e7859b-6872-4fd2-ac49-f66ccb904505", - "name": "rogue-dns" -} + "version": 1 +} \ No newline at end of file diff --git a/objects/rtir/definition.json b/objects/rtir/definition.json index c705b47..be3f7c2 100644 --- a/objects/rtir/definition.json +++ b/objects/rtir/definition.json @@ -1,44 +1,36 @@ { - "requiredOneOf": [ - "ticket-number" - ], "attributes": { "classification": { "description": "Classification of the RTIR ticket", - "ui-priority": 1, "misp-attribute": "text", - "multiple": true - }, - "ip": { - "description": "IPs automatically extracted from the RTIR ticket", - "ui-priority": 0, - "misp-attribute": "ip-dst", - "multiple": true + "multiple": true, + "ui-priority": 1 }, "constituency": { "description": "Constituency of the RTIR ticket", - "ui-priority": 0, - "misp-attribute": "text" + "misp-attribute": "text", + "ui-priority": 0 + }, + "ip": { + "description": "IPs automatically extracted from the RTIR ticket", + "misp-attribute": "ip-dst", + "multiple": true, + "ui-priority": 0 }, "queue": { "description": "Queue of the RTIR ticket", - "ui-priority": 0, "misp-attribute": "text", "sane_default": [ "incident", "investigations", "blocks", "incident reports" - ] - }, - "subject": { - "description": "Subject of the RTIR ticket", - "ui-priority": 0, - "misp-attribute": "text" + ], + "ui-priority": 0 }, "status": { "description": "Status of the RTIR ticket", - "ui-priority": 0, + "disable_correlation": true, "misp-attribute": "text", "sane_default": [ "new", @@ -48,17 +40,25 @@ "rejected", "deleted" ], - "disable_correlation": true + "ui-priority": 0 + }, + "subject": { + "description": "Subject of the RTIR ticket", + "misp-attribute": "text", + "ui-priority": 0 }, "ticket-number": { "description": "ticket-number of the RTIR ticket", - "ui-priority": 0, - "misp-attribute": "text" + "misp-attribute": "text", + "ui-priority": 0 } }, - "version": 2, "description": "RTIR - Request Tracker for Incident Response", "meta-category": "misc", + "name": "rtir", + "requiredOneOf": [ + "ticket-number" + ], "uuid": "7534ee19-0a1f-4f46-a197-e6e73e457943", - "name": "rtir" -} + "version": 2 +} \ No newline at end of file diff --git a/objects/sandbox-report/definition.json b/objects/sandbox-report/definition.json index eeb637d..c0e38ab 100644 --- a/objects/sandbox-report/definition.json +++ b/objects/sandbox-report/definition.json @@ -1,75 +1,9 @@ { - "required": [ - "sandbox-type" - ], - "requiredOneOf": [ - "web-sandbox", - "on-premise-sandbox", - "saas-sandbox" - ], "attributes": { - "permalink": { - "description": "Permalink reference", - "categories": [ - "External analysis" - ], - "ui-priority": 2, - "misp-attribute": "link" - }, - "score": { - "description": "Score", - "disable_correlation": true, - "categories": [ - "External analysis" - ], - "ui-priority": 1, - "misp-attribute": "text" - }, - "results": { - "description": "Freetext result values", - "disable_correlation": true, - "categories": [ - "External analysis" - ], - "ui-priority": 1, - "misp-attribute": "text", - "multiple": true - }, - "raw-report": { - "description": "Raw report from sandbox", - "disable_correlation": true, - "categories": [ - "External analysis" - ], - "ui-priority": 0, - "misp-attribute": "text" - }, - "sandbox-file": { - "description": "File related to sandbox run", - "misp-attribute": "attachment", - "disable_correlation": true, - "ui-priority": 1, - "categories": [ - "External analysis" - ], - "multiple": true - }, - "sandbox-type": { - "description": "The type of sandbox used", - "misp-attribute": "text", - "disable_correlation": true, - "ui-priority": 1, - "sane_default": [ - "on-premise", - "web", - "saas" - ] - }, "on-premise-sandbox": { "description": "The on-premise sandbox used", - "misp-attribute": "text", "disable_correlation": true, - "ui-priority": 1, + "misp-attribute": "text", "sane_default": [ "cuckoo", "symantec-cas-on-premise", @@ -78,33 +12,99 @@ "fireeye-ax", "vmray", "joe-sandbox-on-premise" - ] + ], + "ui-priority": 1 }, - "web-sandbox": { - "description": "A web sandbox where results are publicly available via an URL", - "misp-attribute": "text", + "permalink": { + "categories": [ + "External analysis" + ], + "description": "Permalink reference", + "misp-attribute": "link", + "ui-priority": 2 + }, + "raw-report": { + "categories": [ + "External analysis" + ], + "description": "Raw report from sandbox", "disable_correlation": true, - "ui-priority": 1, - "sane_default": [ - "malwr", - "hybrid-analysis" - ] + "misp-attribute": "text", + "ui-priority": 0 + }, + "results": { + "categories": [ + "External analysis" + ], + "description": "Freetext result values", + "disable_correlation": true, + "misp-attribute": "text", + "multiple": true, + "ui-priority": 1 }, "saas-sandbox": { "description": "A non-on-premise sandbox, also results are not publicly available", - "misp-attribute": "text", "disable_correlation": true, - "ui-priority": 1, + "misp-attribute": "text", "sane_default": [ "forticloud-sandbox", "joe-sandbox-cloud", "symantec-cas-cloud" - ] + ], + "ui-priority": 1 + }, + "sandbox-file": { + "categories": [ + "External analysis" + ], + "description": "File related to sandbox run", + "disable_correlation": true, + "misp-attribute": "attachment", + "multiple": true, + "ui-priority": 1 + }, + "sandbox-type": { + "description": "The type of sandbox used", + "disable_correlation": true, + "misp-attribute": "text", + "sane_default": [ + "on-premise", + "web", + "saas" + ], + "ui-priority": 1 + }, + "score": { + "categories": [ + "External analysis" + ], + "description": "Score", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 1 + }, + "web-sandbox": { + "description": "A web sandbox where results are publicly available via an URL", + "disable_correlation": true, + "misp-attribute": "text", + "sane_default": [ + "malwr", + "hybrid-analysis" + ], + "ui-priority": 1 } }, - "version": 2, "description": "Sandbox report", "meta-category": "misc", + "name": "sandbox-report", + "required": [ + "sandbox-type" + ], + "requiredOneOf": [ + "web-sandbox", + "on-premise-sandbox", + "saas-sandbox" + ], "uuid": "4d3fffd2-cd07-4357-96e0-a51c988faaef", - "name": "sandbox-report" -} + "version": 2 +} \ No newline at end of file diff --git a/objects/sb-signature/definition.json b/objects/sb-signature/definition.json index 2ee7cde..ce59299 100644 --- a/objects/sb-signature/definition.json +++ b/objects/sb-signature/definition.json @@ -1,49 +1,49 @@ { + "attributes": { + "datetime": { + "categories": [ + "Other" + ], + "description": "Datetime", + "disable_correlation": true, + "misp-attribute": "datetime", + "ui-priority": 0 + }, + "signature": { + "categories": [ + "External analysis" + ], + "description": "Name of detection signature - set the description of the detection signature as a comment", + "misp-attribute": "text", + "multiple": true, + "ui-priority": 2 + }, + "software": { + "categories": [ + "External analysis" + ], + "description": "Name of Sandbox software", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 1 + }, + "text": { + "categories": [ + "Other" + ], + "description": "Additional signature description", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 0 + } + }, + "description": "Sandbox detection signature", + "meta-category": "misc", + "name": "sb-signature", "required": [ "software", "signature" ], - "attributes": { - "software": { - "description": "Name of Sandbox software", - "disable_correlation": true, - "categories": [ - "External analysis" - ], - "ui-priority": 1, - "misp-attribute": "text" - }, - "signature": { - "description": "Name of detection signature - set the description of the detection signature as a comment", - "categories": [ - "External analysis" - ], - "ui-priority": 2, - "misp-attribute": "text", - "multiple": true - }, - "text": { - "description": "Additional signature description", - "disable_correlation": true, - "categories": [ - "Other" - ], - "ui-priority": 0, - "misp-attribute": "text" - }, - "datetime": { - "description": "Datetime", - "disable_correlation": true, - "categories": [ - "Other" - ], - "ui-priority": 0, - "misp-attribute": "datetime" - } - }, - "version": 2, - "description": "Sandbox detection signature", - "meta-category": "misc", "uuid": "984c5c39-be7f-4e1e-b034-d3213bac51cb", - "name": "sb-signature" -} + "version": 2 +} \ No newline at end of file diff --git a/objects/scheduled-event/definition.json b/objects/scheduled-event/definition.json index b57c53b..f92201e 100644 --- a/objects/scheduled-event/definition.json +++ b/objects/scheduled-event/definition.json @@ -1,27 +1,58 @@ { - "requiredOneOf": [ - "event-name", - "event-alias", - "archive", - "attachment" - ], "attributes": { - "event-name": { - "description": "The name of the event.", - "ui-priority": 1, - "misp-attribute": "text" + "address": { + "description": "Postal address of the event.", + "misp-attribute": "text", + "multiple": true, + "ui-priority": 10 + }, + "administrator": { + "description": "A user account who is an owner or admin of the event.", + "misp-attribute": "text", + "multiple": true, + "ui-priority": 1 + }, + "archive": { + "description": "Archive of the original event (Internet Archive, Archive.is, etc).", + "misp-attribute": "link", + "multiple": true, + "ui-priority": 1 + }, + "attachment": { + "description": "A screen capture or other attachment relevant to the event.", + "misp-attribute": "attachment", + "multiple": true, + "ui-priority": 1 + }, + "e-mail": { + "description": "Email address of the event contact.", + "misp-attribute": "email-src", + "multiple": true, + "ui-priority": 10 + }, + "embedded-link": { + "description": "Link embedded in the event description (potentially malicious).", + "misp-attribute": "url", + "multiple": true, + "ui-priority": 0 + }, + "embedded-safe-link": { + "description": "Link embedded in the event description (supposed safe).", + "misp-attribute": "link", + "multiple": true, + "to_ids": false, + "ui-priority": 0 }, "event-alias": { "description": "Aliases of event.", - "ui-priority": 1, + "misp-attribute": "text", "multiple": true, - "misp-attribute": "text" + "ui-priority": 1 }, "event-listing": { "description": "Social media and other platforms on which the event is advertised.", - "ui-priority": 1, - "misp-attribute": "text", "disable_correlation": true, + "misp-attribute": "text", "multiple": true, "sane_default": [ "Twitter", @@ -29,101 +60,70 @@ "Meetup", "Eventbrite", "Other" - ] + ], + "ui-priority": 1 }, - "username": { - "description": "A user account who is going to the event.", - "ui-priority": 1, + "event-name": { + "description": "The name of the event.", "misp-attribute": "text", - "multiple": true - }, - "person-name": { - "description": "A person who is going to the event.", - "ui-priority": 1, - "misp-attribute": "text", - "multiple": true - }, - "administrator": { - "description": "A user account who is an owner or admin of the event.", - "ui-priority": 1, - "misp-attribute": "text", - "multiple": true - }, - "hashtag": { - "description": "Hashtag used to identify or promote the event.", - "ui-priority": 0, - "misp-attribute": "text", - "multiple": true - }, - "url": { - "description": "Original URL location of the event (potentially malicious).", - "ui-priority": 1, - "misp-attribute": "url" - }, - "link": { - "description": "Original link into the event (supposed harmless).", - "ui-priority": 1, - "misp-attribute": "link" - }, - "phone-number": { - "description": "Phone number of the event contact.", - "ui-priority": 10, - "misp-attribute": "phone-number", - "multiple": true + "ui-priority": 1 }, "fax-number": { "description": "Fax number of the event contact.", - "ui-priority": 10, "misp-attribute": "phone-number", - "multiple": true + "multiple": true, + "ui-priority": 10 }, - "address": { - "description": "Postal address of the event.", - "ui-priority": 10, + "hashtag": { + "description": "Hashtag used to identify or promote the event.", "misp-attribute": "text", - "multiple": true + "multiple": true, + "ui-priority": 0 }, - "e-mail": { - "description": "Email address of the event contact.", - "ui-priority": 10, - "misp-attribute": "email-src", - "multiple": true - }, - "embedded-link": { - "description": "Link embedded in the event description (potentially malicious).", - "ui-priority": 0, - "misp-attribute": "url", - "multiple": true - }, - "embedded-safe-link": { - "description": "Link embedded in the event description (supposed safe).", - "ui-priority": 0, + "link": { + "description": "Original link into the event (supposed harmless).", "misp-attribute": "link", - "multiple": true, - "to_ids": false + "ui-priority": 1 }, - "archive": { - "description": "Archive of the original event (Internet Archive, Archive.is, etc).", - "ui-priority": 1, + "person-name": { + "description": "A person who is going to the event.", + "misp-attribute": "text", "multiple": true, - "misp-attribute": "link" + "ui-priority": 1 }, - "attachment": { - "description": "A screen capture or other attachment relevant to the event.", - "ui-priority": 1, + "phone-number": { + "description": "Phone number of the event contact.", + "misp-attribute": "phone-number", "multiple": true, - "misp-attribute": "attachment" + "ui-priority": 10 }, "scheduled-date": { "description": "Initial creation of the microblog post", - "ui-priority": 0, + "misp-attribute": "datetime", "multiple": true, - "misp-attribute": "datetime" + "ui-priority": 0 + }, + "url": { + "description": "Original URL location of the event (potentially malicious).", + "misp-attribute": "url", + "ui-priority": 1 + }, + "username": { + "description": "A user account who is going to the event.", + "misp-attribute": "text", + "multiple": true, + "ui-priority": 1 } }, - "version": 1, "description": "Event object template describing a gathering of individuals in meatspace.", "meta-category": "misc", + "name": "scheduled-event", + "requiredOneOf": [ + "event-name", + "event-alias", + "archive", + "attachment" + ], "uuid": "40ba0098-cfd8-4b54-b5a8-9adcdf47533d", - "name": "scheduled-event" -} + "version": 1 +} \ No newline at end of file diff --git a/objects/scrippsco2-c13-daily/definition.json b/objects/scrippsco2-c13-daily/definition.json index 9c5d932..d89f572 100644 --- a/objects/scrippsco2-c13-daily/definition.json +++ b/objects/scrippsco2-c13-daily/definition.json @@ -1,4 +1,45 @@ { + "attributes": { + "c13-value": { + "description": "C13 value (ppm) - C13 concentrations are measured on the '08A' Calibration Scale", + "disable_correlation": true, + "misp-attribute": "float", + "ui-priority": 1 + }, + "flag": { + "description": "Flag (see taxonomy for details).", + "disable_correlation": true, + "misp-attribute": "counter", + "ui-priority": 0 + }, + "number-flask": { + "description": "Number of flasks used in daily average.", + "disable_correlation": true, + "misp-attribute": "counter", + "ui-priority": 1 + }, + "sample-date-excel": { + "description": "M$Excel spreadsheet date format.", + "disable_correlation": true, + "misp-attribute": "float", + "ui-priority": 1 + }, + "sample-date-fractional": { + "description": "Decimal year and fractional year.", + "disable_correlation": true, + "misp-attribute": "float", + "ui-priority": 1 + }, + "sample-datetime": { + "description": "Datetime the sample has been taken", + "disable_correlation": true, + "misp-attribute": "datetime", + "ui-priority": 1 + } + }, + "description": "Daily average C13 concentrations (ppm) derived from flask air samples.", + "meta-category": "climate", + "name": "scrippsco2-c13-daily", "requiredOneOf": [ "sample-datetime", "sample-date-excel", @@ -7,47 +48,6 @@ "flag", "c13-value" ], - "attributes": { - "sample-datetime": { - "description": "Datetime the sample has been taken", - "ui-priority": 1, - "misp-attribute": "datetime", - "disable_correlation": true - }, - "sample-date-excel": { - "description": "M$Excel spreadsheet date format.", - "ui-priority": 1, - "misp-attribute": "float", - "disable_correlation": true - }, - "sample-date-fractional": { - "description": "Decimal year and fractional year.", - "ui-priority": 1, - "misp-attribute": "float", - "disable_correlation": true - }, - "number-flask": { - "description": "Number of flasks used in daily average.", - "misp-attribute": "counter", - "disable_correlation": true, - "ui-priority": 1 - }, - "flag": { - "description": "Flag (see taxonomy for details).", - "misp-attribute": "counter", - "disable_correlation": true, - "ui-priority": 0 - }, - "c13-value": { - "description": "C13 value (ppm) - C13 concentrations are measured on the '08A' Calibration Scale", - "misp-attribute": "float", - "disable_correlation": true, - "ui-priority": 1 - } - }, - "version": 2, - "description": "Daily average C13 concentrations (ppm) derived from flask air samples.", - "meta-category": "climate", "uuid": "5f71a99e-4a56-45b5-b7d6-19949d22409a", - "name": "scrippsco2-c13-daily" -} + "version": 2 +} \ No newline at end of file diff --git a/objects/scrippsco2-c13-monthly/definition.json b/objects/scrippsco2-c13-monthly/definition.json index 65aaff2..2e8ed27 100644 --- a/objects/scrippsco2-c13-monthly/definition.json +++ b/objects/scrippsco2-c13-monthly/definition.json @@ -1,56 +1,56 @@ { + "attributes": { + "monthly-c13": { + "description": "Monthly C13 concentrations in micro-mol C13 per mole (ppm) reported on the 2008A SIO manometric mole fraction scale. This is the standard version of the data most often sought.", + "disable_correlation": true, + "misp-attribute": "float", + "ui-priority": 1 + }, + "monthly-c13-seasonal-adjustment": { + "description": "Same data after a seasonal adjustment to remove the quasi-regular seasonal cycle. The adjustment involves subtracting from the data a 4-harmonic fit with a linear gain factor.", + "disable_correlation": true, + "misp-attribute": "float", + "ui-priority": 0 + }, + "monthly-c13-smoothed": { + "description": "Smoothed version of the data generated from a stiff cubic spline function plus 4-harmonic functions with linear gain.", + "disable_correlation": true, + "misp-attribute": "float", + "ui-priority": 1 + }, + "monthly-c13-smoothed-seasonal-adjustment": { + "description": "Same smoothed version with the seasonal cycle removed.", + "disable_correlation": true, + "misp-attribute": "float", + "ui-priority": 1 + }, + "sample-date-excel": { + "description": "M$Excel spreadsheet date format.", + "disable_correlation": true, + "misp-attribute": "float", + "ui-priority": 1 + }, + "sample-date-fractional": { + "description": "Decimal year and fractional year.", + "disable_correlation": true, + "misp-attribute": "float", + "ui-priority": 1 + }, + "sample-datetime": { + "description": "The monthly values have been adjusted to 24:00 hours on the 15th of each month.", + "disable_correlation": true, + "misp-attribute": "datetime", + "ui-priority": 1 + } + }, + "description": "Monthly average C13 concentrations (ppm) derived from flask air samples.", + "meta-category": "climate", + "name": "scrippsco2-c13-monthly", "required": [ "sample-datetime", "sample-date-excel", "sample-date-fractional" ], - "attributes": { - "sample-datetime": { - "description": "The monthly values have been adjusted to 24:00 hours on the 15th of each month.", - "ui-priority": 1, - "misp-attribute": "datetime", - "disable_correlation": true - }, - "sample-date-excel": { - "description": "M$Excel spreadsheet date format.", - "ui-priority": 1, - "misp-attribute": "float", - "disable_correlation": true - }, - "sample-date-fractional": { - "description": "Decimal year and fractional year.", - "ui-priority": 1, - "misp-attribute": "float", - "disable_correlation": true - }, - "monthly-c13": { - "description": "Monthly C13 concentrations in micro-mol C13 per mole (ppm) reported on the 2008A SIO manometric mole fraction scale. This is the standard version of the data most often sought.", - "misp-attribute": "float", - "disable_correlation": true, - "ui-priority": 1 - }, - "monthly-c13-seasonal-adjustment": { - "description": "Same data after a seasonal adjustment to remove the quasi-regular seasonal cycle. The adjustment involves subtracting from the data a 4-harmonic fit with a linear gain factor.", - "misp-attribute": "float", - "disable_correlation": true, - "ui-priority": 0 - }, - "monthly-c13-smoothed": { - "description": "Smoothed version of the data generated from a stiff cubic spline function plus 4-harmonic functions with linear gain.", - "misp-attribute": "float", - "disable_correlation": true, - "ui-priority": 1 - }, - "monthly-c13-smoothed-seasonal-adjustment": { - "description": "Same smoothed version with the seasonal cycle removed.", - "misp-attribute": "float", - "disable_correlation": true, - "ui-priority": 1 - } - }, - "version": 2, - "description": "Monthly average C13 concentrations (ppm) derived from flask air samples.", - "meta-category": "climate", "uuid": "812125c7-47de-4503-8bbc-19067d3a1c38", - "name": "scrippsco2-c13-monthly" -} + "version": 2 +} \ No newline at end of file diff --git a/objects/scrippsco2-co2-daily/definition.json b/objects/scrippsco2-co2-daily/definition.json index ae44d9d..03dc7b1 100644 --- a/objects/scrippsco2-co2-daily/definition.json +++ b/objects/scrippsco2-co2-daily/definition.json @@ -1,4 +1,45 @@ { + "attributes": { + "co2-value": { + "description": "CO2 value (ppm) - CO2 concentrations are measured on the '08A' Calibration Scale", + "disable_correlation": true, + "misp-attribute": "float", + "ui-priority": 1 + }, + "flag": { + "description": "Flag (see taxonomy for details).", + "disable_correlation": true, + "misp-attribute": "counter", + "ui-priority": 0 + }, + "number-flask": { + "description": "Number of flasks used in daily average.", + "disable_correlation": true, + "misp-attribute": "counter", + "ui-priority": 1 + }, + "sample-date-excel": { + "description": "M$Excel spreadsheet date format.", + "disable_correlation": true, + "misp-attribute": "float", + "ui-priority": 1 + }, + "sample-date-fractional": { + "description": "Decimal year and fractional year.", + "disable_correlation": true, + "misp-attribute": "float", + "ui-priority": 1 + }, + "sample-datetime": { + "description": "Datetime the sample has been taken", + "disable_correlation": true, + "misp-attribute": "datetime", + "ui-priority": 1 + } + }, + "description": "Daily average CO2 concentrations (ppm) derived from flask air samples.", + "meta-category": "climate", + "name": "scrippsco2-co2-daily", "requiredOneOf": [ "sample-datetime", "sample-date-excel", @@ -7,47 +48,6 @@ "flag", "co2-value" ], - "attributes": { - "sample-datetime": { - "description": "Datetime the sample has been taken", - "ui-priority": 1, - "misp-attribute": "datetime", - "disable_correlation": true - }, - "sample-date-excel": { - "description": "M$Excel spreadsheet date format.", - "ui-priority": 1, - "misp-attribute": "float", - "disable_correlation": true - }, - "sample-date-fractional": { - "description": "Decimal year and fractional year.", - "ui-priority": 1, - "misp-attribute": "float", - "disable_correlation": true - }, - "number-flask": { - "description": "Number of flasks used in daily average.", - "misp-attribute": "counter", - "disable_correlation": true, - "ui-priority": 1 - }, - "flag": { - "description": "Flag (see taxonomy for details).", - "misp-attribute": "counter", - "disable_correlation": true, - "ui-priority": 0 - }, - "co2-value": { - "description": "CO2 value (ppm) - CO2 concentrations are measured on the '08A' Calibration Scale", - "misp-attribute": "float", - "disable_correlation": true, - "ui-priority": 1 - } - }, - "version": 2, - "description": "Daily average CO2 concentrations (ppm) derived from flask air samples.", - "meta-category": "climate", "uuid": "0779baca-06b9-491e-9ab7-ccc3e1538fd3", - "name": "scrippsco2-co2-daily" -} + "version": 2 +} \ No newline at end of file diff --git a/objects/scrippsco2-co2-monthly/definition.json b/objects/scrippsco2-co2-monthly/definition.json index 9363014..5e62947 100644 --- a/objects/scrippsco2-co2-monthly/definition.json +++ b/objects/scrippsco2-co2-monthly/definition.json @@ -1,56 +1,56 @@ { + "attributes": { + "monthly-co2": { + "description": "Monthly CO2 concentrations in micro-mol CO2 per mole (ppm) reported on the 2008A SIO manometric mole fraction scale. This is the standard version of the data most often sought.", + "disable_correlation": true, + "misp-attribute": "float", + "ui-priority": 1 + }, + "monthly-co2-seasonal-adjustment": { + "description": "Same data after a seasonal adjustment to remove the quasi-regular seasonal cycle. The adjustment involves subtracting from the data a 4-harmonic fit with a linear gain factor.", + "disable_correlation": true, + "misp-attribute": "float", + "ui-priority": 0 + }, + "monthly-co2-smoothed": { + "description": "Smoothed version of the data generated from a stiff cubic spline function plus 4-harmonic functions with linear gain.", + "disable_correlation": true, + "misp-attribute": "float", + "ui-priority": 1 + }, + "monthly-co2-smoothed-seasonal-adjustment": { + "description": "Same smoothed version with the seasonal cycle removed.", + "disable_correlation": true, + "misp-attribute": "float", + "ui-priority": 1 + }, + "sample-date-excel": { + "description": "M$Excel spreadsheet date format.", + "disable_correlation": true, + "misp-attribute": "float", + "ui-priority": 1 + }, + "sample-date-fractional": { + "description": "Decimal year and fractional year.", + "disable_correlation": true, + "misp-attribute": "float", + "ui-priority": 1 + }, + "sample-datetime": { + "description": "The monthly values have been adjusted to 24:00 hours on the 15th of each month.", + "disable_correlation": true, + "misp-attribute": "datetime", + "ui-priority": 1 + } + }, + "description": "Monthly average CO2 concentrations (ppm) derived from flask air samples.", + "meta-category": "climate", + "name": "scrippsco2-co2-monthly", "required": [ "sample-datetime", "sample-date-excel", "sample-date-fractional" ], - "attributes": { - "sample-datetime": { - "description": "The monthly values have been adjusted to 24:00 hours on the 15th of each month.", - "ui-priority": 1, - "misp-attribute": "datetime", - "disable_correlation": true - }, - "sample-date-excel": { - "description": "M$Excel spreadsheet date format.", - "ui-priority": 1, - "misp-attribute": "float", - "disable_correlation": true - }, - "sample-date-fractional": { - "description": "Decimal year and fractional year.", - "ui-priority": 1, - "misp-attribute": "float", - "disable_correlation": true - }, - "monthly-co2": { - "description": "Monthly CO2 concentrations in micro-mol CO2 per mole (ppm) reported on the 2008A SIO manometric mole fraction scale. This is the standard version of the data most often sought.", - "misp-attribute": "float", - "disable_correlation": true, - "ui-priority": 1 - }, - "monthly-co2-seasonal-adjustment": { - "description": "Same data after a seasonal adjustment to remove the quasi-regular seasonal cycle. The adjustment involves subtracting from the data a 4-harmonic fit with a linear gain factor.", - "misp-attribute": "float", - "disable_correlation": true, - "ui-priority": 0 - }, - "monthly-co2-smoothed": { - "description": "Smoothed version of the data generated from a stiff cubic spline function plus 4-harmonic functions with linear gain.", - "misp-attribute": "float", - "disable_correlation": true, - "ui-priority": 1 - }, - "monthly-co2-smoothed-seasonal-adjustment": { - "description": "Same smoothed version with the seasonal cycle removed.", - "misp-attribute": "float", - "disable_correlation": true, - "ui-priority": 1 - } - }, - "version": 2, - "description": "Monthly average CO2 concentrations (ppm) derived from flask air samples.", - "meta-category": "climate", "uuid": "3350fc46-7120-4fb1-b5b3-c931465c9b2a", - "name": "scrippsco2-co2-monthly" -} + "version": 2 +} \ No newline at end of file diff --git a/objects/scrippsco2-o18-daily/definition.json b/objects/scrippsco2-o18-daily/definition.json index 98ed102..06ca182 100644 --- a/objects/scrippsco2-o18-daily/definition.json +++ b/objects/scrippsco2-o18-daily/definition.json @@ -1,4 +1,45 @@ { + "attributes": { + "flag": { + "description": "Flag (see taxonomy for details).", + "disable_correlation": true, + "misp-attribute": "counter", + "ui-priority": 0 + }, + "number-flask": { + "description": "Number of flasks used in daily average.", + "disable_correlation": true, + "misp-attribute": "counter", + "ui-priority": 1 + }, + "o18-value": { + "description": "O18 value (ppm) - O18 concentrations are measured on the '08A' Calibration Scale", + "disable_correlation": true, + "misp-attribute": "float", + "ui-priority": 1 + }, + "sample-date-excel": { + "description": "M$Excel spreadsheet date format.", + "disable_correlation": true, + "misp-attribute": "float", + "ui-priority": 1 + }, + "sample-date-fractional": { + "description": "Decimal year and fractional year.", + "disable_correlation": true, + "misp-attribute": "float", + "ui-priority": 1 + }, + "sample-datetime": { + "description": "Datetime the sample has been taken", + "disable_correlation": true, + "misp-attribute": "datetime", + "ui-priority": 1 + } + }, + "description": "Daily average O18 concentrations (ppm) derived from flask air samples.", + "meta-category": "climate", + "name": "scrippsco2-o18-daily", "requiredOneOf": [ "sample-datetime", "sample-date-excel", @@ -7,47 +48,6 @@ "flag", "o18-value" ], - "attributes": { - "sample-datetime": { - "description": "Datetime the sample has been taken", - "ui-priority": 1, - "misp-attribute": "datetime", - "disable_correlation": true - }, - "sample-date-excel": { - "description": "M$Excel spreadsheet date format.", - "ui-priority": 1, - "misp-attribute": "float", - "disable_correlation": true - }, - "sample-date-fractional": { - "description": "Decimal year and fractional year.", - "ui-priority": 1, - "misp-attribute": "float", - "disable_correlation": true - }, - "number-flask": { - "description": "Number of flasks used in daily average.", - "misp-attribute": "counter", - "disable_correlation": true, - "ui-priority": 1 - }, - "flag": { - "description": "Flag (see taxonomy for details).", - "misp-attribute": "counter", - "disable_correlation": true, - "ui-priority": 0 - }, - "o18-value": { - "description": "O18 value (ppm) - O18 concentrations are measured on the '08A' Calibration Scale", - "misp-attribute": "float", - "disable_correlation": true, - "ui-priority": 1 - } - }, - "version": 2, - "description": "Daily average O18 concentrations (ppm) derived from flask air samples.", - "meta-category": "climate", "uuid": "8b6878a7-577d-4845-b165-ead6e58bec04", - "name": "scrippsco2-o18-daily" -} + "version": 2 +} \ No newline at end of file diff --git a/objects/scrippsco2-o18-monthly/definition.json b/objects/scrippsco2-o18-monthly/definition.json index 0782b5f..a27b459 100644 --- a/objects/scrippsco2-o18-monthly/definition.json +++ b/objects/scrippsco2-o18-monthly/definition.json @@ -1,56 +1,56 @@ { + "attributes": { + "monthly-o18": { + "description": "Monthly O18 concentrations in micro-mol O18 per mole (ppm) reported on the 2008A SIO manometric mole fraction scale. This is the standard version of the data most often sought.", + "disable_correlation": true, + "misp-attribute": "float", + "ui-priority": 1 + }, + "monthly-o18-seasonal-adjustment": { + "description": "Same data after a seasonal adjustment to remove the quasi-regular seasonal cycle. The adjustment involves subtracting from the data a 4-harmonic fit with a linear gain factor.", + "disable_correlation": true, + "misp-attribute": "float", + "ui-priority": 0 + }, + "monthly-o18-smoothed": { + "description": "Smoothed version of the data generated from a stiff cubic spline function plus 4-harmonic functions with linear gain.", + "disable_correlation": true, + "misp-attribute": "float", + "ui-priority": 1 + }, + "monthly-o18-smoothed-seasonal-adjustment": { + "description": "Same smoothed version with the seasonal cycle removed.", + "disable_correlation": true, + "misp-attribute": "float", + "ui-priority": 1 + }, + "sample-date-excel": { + "description": "M$Excel spreadsheet date format.", + "disable_correlation": true, + "misp-attribute": "float", + "ui-priority": 1 + }, + "sample-date-fractional": { + "description": "Decimal year and fractional year.", + "disable_correlation": true, + "misp-attribute": "float", + "ui-priority": 1 + }, + "sample-datetime": { + "description": "The monthly values have been adjusted to 24:00 hours on the 15th of each month.", + "disable_correlation": true, + "misp-attribute": "datetime", + "ui-priority": 1 + } + }, + "description": "Monthly average O18 concentrations (ppm) derived from flask air samples.", + "meta-category": "climate", + "name": "scrippsco2-o18-monthly", "required": [ "sample-datetime", "sample-date-excel", "sample-date-fractional" ], - "attributes": { - "sample-datetime": { - "description": "The monthly values have been adjusted to 24:00 hours on the 15th of each month.", - "ui-priority": 1, - "misp-attribute": "datetime", - "disable_correlation": true - }, - "sample-date-excel": { - "description": "M$Excel spreadsheet date format.", - "ui-priority": 1, - "misp-attribute": "float", - "disable_correlation": true - }, - "sample-date-fractional": { - "description": "Decimal year and fractional year.", - "ui-priority": 1, - "misp-attribute": "float", - "disable_correlation": true - }, - "monthly-o18": { - "description": "Monthly O18 concentrations in micro-mol O18 per mole (ppm) reported on the 2008A SIO manometric mole fraction scale. This is the standard version of the data most often sought.", - "misp-attribute": "float", - "disable_correlation": true, - "ui-priority": 1 - }, - "monthly-o18-seasonal-adjustment": { - "description": "Same data after a seasonal adjustment to remove the quasi-regular seasonal cycle. The adjustment involves subtracting from the data a 4-harmonic fit with a linear gain factor.", - "misp-attribute": "float", - "disable_correlation": true, - "ui-priority": 0 - }, - "monthly-o18-smoothed": { - "description": "Smoothed version of the data generated from a stiff cubic spline function plus 4-harmonic functions with linear gain.", - "misp-attribute": "float", - "disable_correlation": true, - "ui-priority": 1 - }, - "monthly-o18-smoothed-seasonal-adjustment": { - "description": "Same smoothed version with the seasonal cycle removed.", - "misp-attribute": "float", - "disable_correlation": true, - "ui-priority": 1 - } - }, - "version": 2, - "description": "Monthly average O18 concentrations (ppm) derived from flask air samples.", - "meta-category": "climate", "uuid": "86bd588b-cd0c-486a-8ea0-17fd95312fa0", - "name": "scrippsco2-o18-monthly" -} + "version": 2 +} \ No newline at end of file diff --git a/objects/script/definition.json b/objects/script/definition.json index 0b35fa8..35ee043 100644 --- a/objects/script/definition.json +++ b/objects/script/definition.json @@ -1,30 +1,21 @@ { - "requiredOneOf": [ - "script", - "filename", - "script-as-attachment" - ], "attributes": { - "script": { - "description": "Free text of the script.", - "ui-priority": 10, - "misp-attribute": "text" - }, - "script-as-attachment": { - "description": "Attachment of the script.", - "ui-priority": 10, - "misp-attribute": "attachment" - }, "comment": { "description": "Comment associated to the script.", - "ui-priority": 1, - "misp-attribute": "text" + "misp-attribute": "text", + "ui-priority": 1 + }, + "filename": { + "description": "Filename used for the script.", + "disable_correlation": true, + "misp-attribute": "filename", + "multiple": true, + "ui-priority": 8 }, "language": { "description": "Scripting language used for the script.", - "ui-priority": 9, - "misp-attribute": "text", "disable_correlation": true, + "misp-attribute": "text", "sane_default": [ "PowerShell", "VBScript", @@ -40,21 +31,25 @@ "AutoIt", "PHP", "Nim" - ] + ], + "ui-priority": 9 }, - "filename": { - "description": "Filename used for the script.", - "ui-priority": 8, - "misp-attribute": "filename", - "multiple": true, - "disable_correlation": true + "script": { + "description": "Free text of the script.", + "misp-attribute": "text", + "ui-priority": 10 + }, + "script-as-attachment": { + "description": "Attachment of the script.", + "misp-attribute": "attachment", + "ui-priority": 10 }, "state": { - "misp-attribute": "text", - "ui-priority": 0, "description": "Known state of the script.", - "multiple": true, "disable_correlation": true, + "misp-attribute": "text", + "multiple": true, + "ui-priority": 0, "values_list": [ "Malicious", "Unknown", @@ -63,9 +58,14 @@ ] } }, - "version": 7, "description": "Object describing a computer program written to be run in a special run-time environment. The script or shell script can be used for malicious activities but also as support tools for threat analysts.", "meta-category": "misc", + "name": "script", + "requiredOneOf": [ + "script", + "filename", + "script-as-attachment" + ], "uuid": "6bce7d01-dbec-4054-b3c2-3655a19382e2", - "name": "script" -} + "version": 7 +} \ No newline at end of file diff --git a/objects/shell-commands/definition.json b/objects/shell-commands/definition.json index 895eb24..91f4734 100644 --- a/objects/shell-commands/definition.json +++ b/objects/shell-commands/definition.json @@ -1,23 +1,14 @@ { - "required": [ - "shell-command" - ], "attributes": { - "script": { - "description": "Free text of the script if available which executed the shell commands.", - "ui-priority": 10, - "misp-attribute": "text" - }, "comment": { "description": "Comment associated to the shell commands executed.", - "ui-priority": 1, - "misp-attribute": "text" + "misp-attribute": "text", + "ui-priority": 1 }, "language": { "description": "Scripting language used for the shell commands executed.", - "ui-priority": 9, - "misp-attribute": "text", "disable_correlation": true, + "misp-attribute": "text", "sane_default": [ "PowerShell", "VBScript", @@ -32,20 +23,26 @@ "Winbatch", "AutoIt", "PHP" - ] + ], + "ui-priority": 9 + }, + "script": { + "description": "Free text of the script if available which executed the shell commands.", + "misp-attribute": "text", + "ui-priority": 10 }, "shell-command": { "description": "", - "ui-priority": 0, "misp-attribute": "text", - "multiple": true + "multiple": true, + "ui-priority": 0 }, "state": { - "misp-attribute": "text", - "ui-priority": 0, "description": "Known state of the script.", - "multiple": true, "disable_correlation": true, + "misp-attribute": "text", + "multiple": true, + "ui-priority": 0, "values_list": [ "Malicious", "Unknown", @@ -54,9 +51,12 @@ ] } }, - "version": 2, "description": "Object describing a series of shell commands executed. This object can be linked with malicious files in order to describe a specific execution of shell commands.", "meta-category": "misc", + "name": "shell-commands", + "required": [ + "shell-command" + ], "uuid": "fee65efa-eb64-4516-8611-1db76c589f79", - "name": "shell-commands" -} + "version": 2 +} \ No newline at end of file diff --git a/objects/shodan-report/definition.json b/objects/shodan-report/definition.json index 13cef41..cc3c444 100644 --- a/objects/shodan-report/definition.json +++ b/objects/shodan-report/definition.json @@ -1,4 +1,61 @@ { + "attributes": { + "banner": { + "categories": [ + "Network activity", + "External analysis" + ], + "description": "server banner reported", + "misp-attribute": "text", + "ui-priority": 1 + }, + "hostname": { + "categories": [ + "Network activity", + "External analysis" + ], + "description": "Hostnames found", + "misp-attribute": "domain", + "multiple": true, + "ui-priority": 1 + }, + "ip": { + "categories": [ + "Network activity", + "External analysis" + ], + "description": "IP Address Queried", + "misp-attribute": "ip-dst", + "ui-priority": 1 + }, + "org": { + "categories": [ + "Network activity", + "External analysis" + ], + "description": "Associated Organization", + "misp-attribute": "text", + "ui-priority": 1 + }, + "port": { + "categories": [ + "Network activity", + "External analysis" + ], + "description": "Listening Port", + "misp-attribute": "port", + "ui-priority": 1 + }, + "text": { + "description": "A description of the report", + "misp-attribute": "text", + "recommended": false, + "ui-priority": 1 + } + }, + "description": "Shodan Report for a given IP", + "meta-category": "network", + "name": "shodan-report", "required": [ "ip" ], @@ -8,63 +65,6 @@ "port", "banner" ], - "attributes": { - "text": { - "description": "A description of the report", - "ui-priority": 1, - "misp-attribute": "text", - "recommended": false - }, - "ip": { - "description": "IP Address Queried", - "categories": [ - "Network activity", - "External analysis" - ], - "ui-priority": 1, - "misp-attribute": "ip-dst" - }, - "hostname": { - "description": "Hostnames found", - "categories": [ - "Network activity", - "External analysis" - ], - "ui-priority": 1, - "misp-attribute": "domain", - "multiple": true - }, - "org": { - "description": "Associated Organization", - "categories": [ - "Network activity", - "External analysis" - ], - "ui-priority": 1, - "misp-attribute": "text" - }, - "port": { - "description": "Listening Port", - "categories": [ - "Network activity", - "External analysis" - ], - "ui-priority": 1, - "misp-attribute": "port" - }, - "banner": { - "description": "server banner reported", - "categories": [ - "Network activity", - "External analysis" - ], - "ui-priority": 1, - "misp-attribute": "text" - } - }, - "version": 1, - "description": "Shodan Report for a given IP", - "meta-category": "network", "uuid": "10b03d93-3694-4a79-9cd1-4a273746303a", - "name": "shodan-report" -} + "version": 1 +} \ No newline at end of file diff --git a/objects/short-message-service/definition.json b/objects/short-message-service/definition.json index 1475aa3..ec95603 100644 --- a/objects/short-message-service/definition.json +++ b/objects/short-message-service/definition.json @@ -1,57 +1,57 @@ { + "attributes": { + "body": { + "description": "Message body of the SMS", + "misp-attribute": "text", + "ui-priority": 1 + }, + "from": { + "description": "Phone number used to send the SMS", + "misp-attribute": "phone-number", + "multiple": true, + "ui-priority": 1 + }, + "name": { + "description": "Sender name", + "misp-attribute": "text", + "ui-priority": 0 + }, + "received-date": { + "description": "Received date of the SMS", + "disable_correlation": true, + "misp-attribute": "datetime", + "ui-priority": 0 + }, + "sent-date": { + "description": "Initial sent date of the SMS", + "disable_correlation": true, + "misp-attribute": "datetime", + "ui-priority": 0 + }, + "smsc": { + "description": "SMS Message Center", + "misp-attribute": "phone-number", + "ui-priority": 0 + }, + "to": { + "description": "Phone number receiving the SMS", + "misp-attribute": "phone-number", + "multiple": true, + "ui-priority": 1 + }, + "url-rfc5724": { + "description": "url representing SMS using RFC 5724 (not url contained in the SMS which should use an url object)", + "misp-attribute": "url", + "ui-priority": 6 + } + }, + "description": "Short Message Service (SMS) object template describing one or more SMS message. Restriction of the initial format 3GPP 23.038 GSM character set doesn't apply.", + "meta-category": "misc", + "name": "short-message-service", "requiredOneOf": [ "body", "from" ], - "attributes": { - "body": { - "description": "Message body of the SMS", - "ui-priority": 1, - "misp-attribute": "text" - }, - "url-rfc5724": { - "description": "url representing SMS using RFC 5724 (not url contained in the SMS which should use an url object)", - "ui-priority": 6, - "misp-attribute": "url" - }, - "from": { - "description": "Phone number used to send the SMS", - "ui-priority": 1, - "misp-attribute": "phone-number", - "multiple": true - }, - "to": { - "description": "Phone number receiving the SMS", - "ui-priority": 1, - "misp-attribute": "phone-number", - "multiple": true - }, - "sent-date": { - "description": "Initial sent date of the SMS", - "ui-priority": 0, - "misp-attribute": "datetime", - "disable_correlation": true - }, - "received-date": { - "description": "Received date of the SMS", - "ui-priority": 0, - "misp-attribute": "datetime", - "disable_correlation": true - }, - "smsc": { - "description": "SMS Message Center", - "ui-priority": 0, - "misp-attribute": "phone-number" - }, - "name": { - "description": "Sender name", - "ui-priority": 0, - "misp-attribute": "text" - } - }, - "version": 3, - "description": "Short Message Service (SMS) object template describing one or more SMS message. Restriction of the initial format 3GPP 23.038 GSM character set doesn't apply.", - "meta-category": "misc", "uuid": "4851a3dc-e1a6-43ac-9d97-f0d13a099fd2", - "name": "short-message-service" -} + "version": 3 +} \ No newline at end of file diff --git a/objects/shortened-link/definition.json b/objects/shortened-link/definition.json index a2a2ff6..0b90ad9 100644 --- a/objects/shortened-link/definition.json +++ b/objects/shortened-link/definition.json @@ -1,44 +1,44 @@ { + "attributes": { + "credential": { + "description": "Credential (username, password)", + "misp-attribute": "text", + "ui-priority": 0 + }, + "domain": { + "description": "Full domain", + "misp-attribute": "domain", + "ui-priority": 0 + }, + "first-seen": { + "description": "First time this shortened URL has been seen", + "disable_correlation": true, + "misp-attribute": "datetime", + "ui-priority": 0 + }, + "redirect-url": { + "description": "Redirected to URL", + "misp-attribute": "url", + "ui-priority": 1 + }, + "shortened-url": { + "description": "Shortened URL", + "misp-attribute": "url", + "ui-priority": 1 + }, + "text": { + "description": "Description and context of the shortened URL ", + "misp-attribute": "text", + "ui-priority": 0 + } + }, + "description": "Shortened link and its redirect target", + "meta-category": "network", + "name": "shortened-link", "required": [ "redirect-url", "shortened-url" ], - "attributes": { - "first-seen": { - "description": "First time this shortened URL has been seen", - "disable_correlation": true, - "ui-priority": 0, - "misp-attribute": "datetime" - }, - "redirect-url": { - "description": "Redirected to URL", - "ui-priority": 1, - "misp-attribute": "url" - }, - "shortened-url": { - "description": "Shortened URL", - "ui-priority": 1, - "misp-attribute": "url" - }, - "domain": { - "description": "Full domain", - "ui-priority": 0, - "misp-attribute": "domain" - }, - "credential": { - "description": "Credential (username, password)", - "ui-priority": 0, - "misp-attribute": "text" - }, - "text": { - "description": "Description and context of the shortened URL ", - "ui-priority": 0, - "misp-attribute": "text" - } - }, - "version": 2018060501, - "description": "Shortened link and its redirect target", - "meta-category": "network", "uuid": "361c0ae8-68bd-11e8-adc0-fa7ae01bbebc", - "name": "shortened-link" -} + "version": 2018060501 +} \ No newline at end of file diff --git a/objects/social-media-group/definition.json b/objects/social-media-group/definition.json index 25a9927..a005b05 100644 --- a/objects/social-media-group/definition.json +++ b/objects/social-media-group/definition.json @@ -1,102 +1,102 @@ { + "attributes": { + "administrator": { + "description": "A user account who is an owner or admin of the group.", + "misp-attribute": "text", + "multiple": true, + "ui-priority": 1 + }, + "archive": { + "description": "Archive of the original group (Internet Archive, Archive.is, etc).", + "disable_correlation": true, + "misp-attribute": "link", + "multiple": true, + "ui-priority": 1 + }, + "attachment": { + "description": "A screen capture or exported list of contacts, group members, etc.", + "misp-attribute": "attachment", + "multiple": true, + "ui-priority": 1 + }, + "description": { + "description": "A description of the group, channel or community.", + "misp-attribute": "text", + "ui-priority": 1 + }, + "embedded-link": { + "description": "Link embedded in the group description (potentially malicious).", + "misp-attribute": "url", + "multiple": true, + "ui-priority": 0 + }, + "embedded-safe-link": { + "description": "Link embedded in the group description (supposed safe).", + "misp-attribute": "link", + "multiple": true, + "to_ids": false, + "ui-priority": 0 + }, + "group-alias": { + "description": "Aliases of group, channel or community.", + "misp-attribute": "text", + "multiple": true, + "ui-priority": 1 + }, + "group-name": { + "description": "The name of the group, channel or community.", + "misp-attribute": "text", + "ui-priority": 1 + }, + "hashtag": { + "description": "Hashtag used to identify or promote the group.", + "misp-attribute": "text", + "multiple": true, + "ui-priority": 0 + }, + "link": { + "description": "Original link into the group (supposed harmless).", + "misp-attribute": "link", + "ui-priority": 1 + }, + "person-name": { + "description": "A person who is a member of the group.", + "misp-attribute": "text", + "multiple": true, + "ui-priority": 1 + }, + "platform": { + "description": "The social media platform used.", + "disable_correlation": true, + "misp-attribute": "text", + "multiple": true, + "sane_default": [ + "Facebook", + "Twitter" + ], + "ui-priority": 1 + }, + "url": { + "description": "Original URL location of the group (potentially malicious).", + "misp-attribute": "url", + "ui-priority": 1 + }, + "username": { + "description": "A user account who is a member of the group.", + "misp-attribute": "text", + "multiple": true, + "ui-priority": 1 + } + }, + "description": "Social media group object template describing a public or private group or channel.", + "meta-category": "misc", + "name": "social-media-group", "requiredOneOf": [ "group-name", "group-alias", "archive", "description" ], - "attributes": { - "group-name": { - "description": "The name of the group, channel or community.", - "ui-priority": 1, - "misp-attribute": "text" - }, - "description": { - "description": "A description of the group, channel or community.", - "ui-priority": 1, - "misp-attribute": "text" - }, - "group-alias": { - "description": "Aliases of group, channel or community.", - "ui-priority": 1, - "multiple": true, - "misp-attribute": "text" - }, - "platform": { - "description": "The social media platform used.", - "ui-priority": 1, - "misp-attribute": "text", - "disable_correlation": true, - "multiple": true, - "sane_default": [ - "Facebook", - "Twitter" - ] - }, - "username": { - "description": "A user account who is a member of the group.", - "ui-priority": 1, - "misp-attribute": "text", - "multiple": true - }, - "administrator": { - "description": "A user account who is an owner or admin of the group.", - "ui-priority": 1, - "misp-attribute": "text", - "multiple": true - }, - "person-name": { - "description": "A person who is a member of the group.", - "ui-priority": 1, - "misp-attribute": "text", - "multiple": true - }, - "hashtag": { - "description": "Hashtag used to identify or promote the group.", - "ui-priority": 0, - "misp-attribute": "text", - "multiple": true - }, - "url": { - "description": "Original URL location of the group (potentially malicious).", - "ui-priority": 1, - "misp-attribute": "url" - }, - "link": { - "description": "Original link into the group (supposed harmless).", - "ui-priority": 1, - "misp-attribute": "link" - }, - "embedded-link": { - "description": "Link embedded in the group description (potentially malicious).", - "ui-priority": 0, - "misp-attribute": "url", - "multiple": true - }, - "embedded-safe-link": { - "description": "Link embedded in the group description (supposed safe).", - "ui-priority": 0, - "misp-attribute": "link", - "multiple": true, - "to_ids": false - }, - "archive": { - "description": "Archive of the original group (Internet Archive, Archive.is, etc).", - "ui-priority": 1, - "multiple": true, - "disable_correlation": true, - "misp-attribute": "link" - }, - "attachment": { - "description": "A screen capture or exported list of contacts, group members, etc.", - "ui-priority": 1, - "multiple": true, - "misp-attribute": "attachment" - } - }, - "version": 1, - "description": "Social media group object template describing a public or private group or channel.", - "meta-category": "misc", "uuid": "c4939ec4-ab53-4c35-9a98-3d4d4caf5b6c", - "name": "social-media-group" -} + "version": 1 +} \ No newline at end of file diff --git a/objects/splunk/definition.json b/objects/splunk/definition.json index 2ebaff4..fb0c9cd 100644 --- a/objects/splunk/definition.json +++ b/objects/splunk/definition.json @@ -1,60 +1,60 @@ { - "version": 1, + "attributes": { + "description": { + "description": "Description", + "disable_correlation": true, + "misp-attribute": "comment", + "ui-priority": 0 + }, + "drill-down": { + "description": "Drilldown", + "disable_correlation": true, + "misp-attribute": "text", + "multiple": true, + "ui-priority": 0 + }, + "earliest": { + "description": "Earliest time", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 0 + }, + "latest": { + "description": "Latest time", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 0 + }, + "response-action": { + "description": "Response action", + "disable_correlation": true, + "misp-attribute": "text", + "multiple": true, + "sane_default": [ + "notable", + "risk" + ], + "ui-priority": 0 + }, + "schedule": { + "description": "Schedule", + "disable_correlation": true, + "misp-attribute": "other", + "ui-priority": 0 + }, + "search": { + "description": "Search / Correlation search", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 0 + } + }, "description": "Splunk / Splunk ES object", "meta-category": "misc", - "uuid": "fd9b7bf8-df7b-4df9-bcd8-28591edcaab8", "name": "splunk", "required": [ "search" ], - "attributes": { - "search": { - "description": "Search / Correlation search", - "ui-priority": 0, - "misp-attribute": "text", - "disable_correlation": true - }, - "drill-down": { - "description": "Drilldown", - "ui-priority": 0, - "misp-attribute": "text", - "disable_correlation": true, - "multiple": true - }, - "response-action": { - "description": "Response action", - "ui-priority": 0, - "misp-attribute": "text", - "multiple": true, - "disable_correlation": true, - "sane_default": [ - "notable", - "risk" - ] - }, - "schedule": { - "description": "Schedule", - "ui-priority": 0, - "misp-attribute": "other", - "disable_correlation": true - }, - "earliest": { - "description": "Earliest time", - "ui-priority": 0, - "misp-attribute": "text", - "disable_correlation": true - }, - "latest": { - "description": "Latest time", - "ui-priority": 0, - "misp-attribute": "text", - "disable_correlation": true - }, - "description": { - "description": "Description", - "ui-priority": 0, - "misp-attribute": "comment", - "disable_correlation": true - } - } -} + "uuid": "fd9b7bf8-df7b-4df9-bcd8-28591edcaab8", + "version": 1 +} \ No newline at end of file diff --git a/objects/ss7-attack/definition.json b/objects/ss7-attack/definition.json index 7f9b138..d3f6138 100644 --- a/objects/ss7-attack/definition.json +++ b/objects/ss7-attack/definition.json @@ -1,10 +1,10 @@ { - "requiredOneOf": [ - "text" - ], "attributes": { "Category": { "description": "Category", + "disable_correlation": true, + "misp-attribute": "text", + "multiple": true, "sane_default": [ "Cat0", "Cat1", @@ -16,162 +16,162 @@ "CatSMS", "CatSpoofing" ], - "misp-attribute": "text", - "disable_correlation": true, - "multiple": true, "ui-priority": 1 }, + "MapApplicationContext": { + "description": "MAP application context in OID format.", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 0 + }, + "MapGmlc": { + "description": "MAP GMLC. Phone number.", + "misp-attribute": "text", + "ui-priority": 0 + }, + "MapGsmscfGT": { + "description": "MAP GSMSCF GT. Phone number.", + "misp-attribute": "text", + "ui-priority": 0 + }, + "MapImsi": { + "description": "MAP IMSI. Phone number starting with MCC/MNC.", + "misp-attribute": "text", + "multiple": true, + "ui-priority": 0 + }, + "MapMscGT": { + "description": "MAP MSC GT. Phone number.", + "misp-attribute": "text", + "ui-priority": 0 + }, + "MapMsisdn": { + "description": "MAP MSISDN. Phone number.", + "misp-attribute": "text", + "multiple": true, + "ui-priority": 0 + }, + "MapOpCode": { + "description": "MAP operation codes - Decimal value between 0-99.", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 0 + }, + "MapSmsTP-DCS": { + "description": "MAP SMS TP-DCS.", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 0 + }, + "MapSmsTP-OA": { + "description": "MAP SMS TP-OA. Phone number.", + "misp-attribute": "text", + "ui-priority": 0 + }, + "MapSmsTP-PID": { + "description": "MAP SMS TP-PID.", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 0 + }, + "MapSmsText": { + "description": "MAP SMS Text. Important indicators in SMS text.", + "misp-attribute": "text", + "ui-priority": 0 + }, + "MapSmsTypeNumber": { + "description": "MAP SMS TypeNumber.", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 0 + }, + "MapSmscGT": { + "description": "MAP SMSC. Phone number.", + "misp-attribute": "text", + "multiple": true, + "ui-priority": 0 + }, + "MapUssdCoding": { + "description": "MAP USSD Content.", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 0 + }, + "MapUssdContent": { + "description": "MAP USSD Content.", + "misp-attribute": "text", + "ui-priority": 0 + }, "MapVersion": { "description": "Map version.", + "disable_correlation": true, + "misp-attribute": "text", "sane_default": [ "1", "2", "3" ], + "ui-priority": 0 + }, + "MapVlrGT": { + "description": "MAP VLR GT. Phone number.", "misp-attribute": "text", + "ui-priority": 0 + }, + "SccpCdGT": { + "description": "Signaling Connection Control Part (SCCP) CdGT - Phone number.", + "misp-attribute": "text", + "ui-priority": 0 + }, + "SccpCdPC": { + "description": "Signaling Connection Control Part (SCCP) CdPC - Phone number.", + "misp-attribute": "text", + "ui-priority": 0 + }, + "SccpCdSSN": { + "description": "Signaling Connection Control Part (SCCP) - Decimal value between 0-255.", "disable_correlation": true, + "misp-attribute": "text", "ui-priority": 0 }, "SccpCgGT": { "description": "Signaling Connection Control Part (SCCP) CgGT - Phone number.", + "misp-attribute": "text", "multiple": true, - "ui-priority": 0, - "misp-attribute": "text" - }, - "SccpCdGT": { - "description": "Signaling Connection Control Part (SCCP) CdGT - Phone number.", - "ui-priority": 0, - "misp-attribute": "text" + "ui-priority": 0 }, "SccpCgPC": { "description": "Signaling Connection Control Part (SCCP) CgPC - Phone number.", + "misp-attribute": "text", "multiple": true, - "ui-priority": 0, - "misp-attribute": "text" - }, - "SccpCdPC": { - "description": "Signaling Connection Control Part (SCCP) CdPC - Phone number.", - "ui-priority": 0, - "misp-attribute": "text" + "ui-priority": 0 }, "SccpCgSSN": { "description": "Signaling Connection Control Part (SCCP) - Decimal value between 0-255.", - "ui-priority": 0, - "misp-attribute": "text", - "disable_correlation": true - }, - "SccpCdSSN": { - "description": "Signaling Connection Control Part (SCCP) - Decimal value between 0-255.", - "ui-priority": 0, - "misp-attribute": "text", - "disable_correlation": true - }, - "MapOpCode": { - "description": "MAP operation codes - Decimal value between 0-99.", - "ui-priority": 0, - "misp-attribute": "text", - "disable_correlation": true - }, - "MapApplicationContext": { - "description": "MAP application context in OID format.", - "ui-priority": 0, - "misp-attribute": "text", - "disable_correlation": true - }, - "MapImsi": { - "description": "MAP IMSI. Phone number starting with MCC/MNC.", - "multiple": true, - "ui-priority": 0, - "misp-attribute": "text" - }, - "MapMsisdn": { - "description": "MAP MSISDN. Phone number.", - "multiple": true, - "ui-priority": 0, - "misp-attribute": "text" - }, - "MapMscGT": { - "description": "MAP MSC GT. Phone number.", - "ui-priority": 0, - "misp-attribute": "text" - }, - "MapGsmscfGT": { - "description": "MAP GSMSCF GT. Phone number.", - "ui-priority": 0, - "misp-attribute": "text" - }, - "MapVlrGT": { - "description": "MAP VLR GT. Phone number.", - "ui-priority": 0, - "misp-attribute": "text" - }, - "MapGmlc": { - "description": "MAP GMLC. Phone number.", - "ui-priority": 0, - "misp-attribute": "text" - }, - "MapSmscGT": { - "description": "MAP SMSC. Phone number.", - "ui-priority": 0, - "multiple": true, - "misp-attribute": "text" - }, - "MapSmsTP-OA": { - "description": "MAP SMS TP-OA. Phone number.", - "ui-priority": 0, - "misp-attribute": "text" - }, - "MapSmsText": { - "description": "MAP SMS Text. Important indicators in SMS text.", - "ui-priority": 0, - "misp-attribute": "text" - }, - "MapSmsTP-PID": { - "description": "MAP SMS TP-PID.", - "ui-priority": 0, - "misp-attribute": "text", - "disable_correlation": true - }, - "MapSmsTP-DCS": { - "description": "MAP SMS TP-DCS.", - "ui-priority": 0, - "misp-attribute": "text", - "disable_correlation": true - }, - "MapSmsTypeNumber": { - "description": "MAP SMS TypeNumber.", - "ui-priority": 0, - "misp-attribute": "text", - "disable_correlation": true - }, - "MapUssdContent": { - "description": "MAP USSD Content.", - "ui-priority": 0, - "misp-attribute": "text" - }, - "MapUssdCoding": { - "description": "MAP USSD Content.", - "ui-priority": 0, - "misp-attribute": "text", - "disable_correlation": true - }, - "text": { - "description": "A description of the attack seen via SS7 logging.", "disable_correlation": true, - "ui-priority": 0, - "multiple": true, - "misp-attribute": "text" + "misp-attribute": "text", + "ui-priority": 0 }, "first-seen": { "description": "When the attack has been seen for the first time.", "disable_correlation": true, - "ui-priority": 0, - "misp-attribute": "datetime" + "misp-attribute": "datetime", + "ui-priority": 0 + }, + "text": { + "description": "A description of the attack seen via SS7 logging.", + "disable_correlation": true, + "misp-attribute": "text", + "multiple": true, + "ui-priority": 0 } }, - "version": 2, "description": "SS7 object of an attack seen on a GSM, UMTS or LTE network via SS7 logging.", "meta-category": "network", + "name": "ss7-attack", + "requiredOneOf": [ + "text" + ], "uuid": "f3493d8b-a7ab-48d0-a775-046c4d64d782", - "name": "ss7-attack" -} + "version": 2 +} \ No newline at end of file diff --git a/objects/ssh-authorized-keys/definition.json b/objects/ssh-authorized-keys/definition.json index 3e6f047..18ae555 100644 --- a/objects/ssh-authorized-keys/definition.json +++ b/objects/ssh-authorized-keys/definition.json @@ -1,72 +1,72 @@ { + "attributes": { + "first-seen": { + "description": "First time the ssh authorized keys file has been seen", + "disable_correlation": true, + "misp-attribute": "datetime", + "ui-priority": 0 + }, + "full-line": { + "description": "One full-line of the authorized key file", + "misp-attribute": "text", + "multiple": true, + "ui-priority": 0 + }, + "hostname": { + "categories": [ + "Network activity", + "External analysis" + ], + "description": "hostname", + "misp-attribute": "hostname", + "multiple": true, + "ui-priority": 1 + }, + "ip": { + "categories": [ + "Network activity", + "External analysis" + ], + "description": "IP Address", + "misp-attribute": "ip-dst", + "multiple": true, + "ui-priority": 1 + }, + "key": { + "description": "Public key in base64 as found in the authorized key file", + "misp-attribute": "text", + "multiple": true, + "ui-priority": 0 + }, + "key-id": { + "description": "Key-id and option part of the public key line", + "misp-attribute": "text", + "multiple": true, + "ui-priority": 0 + }, + "last-seen": { + "description": "Last time the ssh authorized keys file has been seen", + "disable_correlation": true, + "misp-attribute": "datetime", + "ui-priority": 0 + }, + "text": { + "description": "A description of the ssh authorized keys", + "disable_correlation": true, + "misp-attribute": "text", + "recommended": false, + "ui-priority": 1 + } + }, + "description": "An object to store ssh authorized keys file.", + "meta-category": "network", + "name": "ssh-authorized-keys", "requiredOneOf": [ "ip", "hostname", "full-line", "key" ], - "attributes": { - "text": { - "description": "A description of the ssh authorized keys", - "disable_correlation": true, - "ui-priority": 1, - "misp-attribute": "text", - "recommended": false - }, - "last-seen": { - "description": "Last time the ssh authorized keys file has been seen", - "disable_correlation": true, - "ui-priority": 0, - "misp-attribute": "datetime" - }, - "first-seen": { - "description": "First time the ssh authorized keys file has been seen", - "disable_correlation": true, - "ui-priority": 0, - "misp-attribute": "datetime" - }, - "full-line": { - "description": "One full-line of the authorized key file", - "ui-priority": 0, - "misp-attribute": "text", - "multiple": true - }, - "key": { - "description": "Public key in base64 as found in the authorized key file", - "ui-priority": 0, - "misp-attribute": "text", - "multiple": true - }, - "key-id": { - "description": "Key-id and option part of the public key line", - "ui-priority": 0, - "misp-attribute": "text", - "multiple": true - }, - "hostname": { - "description": "hostname", - "categories": [ - "Network activity", - "External analysis" - ], - "ui-priority": 1, - "misp-attribute": "hostname", - "multiple": true - }, - "ip": { - "description": "IP Address", - "categories": [ - "Network activity", - "External analysis" - ], - "ui-priority": 1, - "misp-attribute": "ip-dst", - "multiple": true - } - }, - "version": 1, - "description": "An object to store ssh authorized keys file.", - "meta-category": "network", "uuid": "d1db3e4d-c932-4d8b-a915-4cff088cb678", - "name": "ssh-authorized-keys" -} + "version": 1 +} \ No newline at end of file diff --git a/objects/stix2-pattern/definition.json b/objects/stix2-pattern/definition.json index ab49a22..e2ed24e 100644 --- a/objects/stix2-pattern/definition.json +++ b/objects/stix2-pattern/definition.json @@ -1,30 +1,30 @@ { - "requiredOneOf": [ - "stix2-pattern" - ], "attributes": { "comment": { "description": "A description of the stix2-pattern.", - "ui-priority": 0, - "misp-attribute": "comment" + "misp-attribute": "comment", + "ui-priority": 0 }, "stix2-pattern": { "description": "STIX 2 pattern", - "ui-priority": 0, - "misp-attribute": "stix2-pattern" + "misp-attribute": "stix2-pattern", + "ui-priority": 0 }, "version": { "description": "Version of STIX 2 pattern.", - "ui-priority": 0, "misp-attribute": "text", "sane_default": [ "stix 2.0" - ] + ], + "ui-priority": 0 } }, - "version": 2, "description": "An object describing a STIX pattern. The object can be linked via a relationship to other attributes or objects to describe how it can be represented as a STIX pattern.", "meta-category": "misc", + "name": "stix2-pattern", + "requiredOneOf": [ + "stix2-pattern" + ], "uuid": "0c5bd072-7c3e-4d45-86f7-a8104d9143b9", - "name": "stix2-pattern" -} + "version": 2 +} \ No newline at end of file diff --git a/objects/suricata/definition.json b/objects/suricata/definition.json index dce6dea..2756d35 100644 --- a/objects/suricata/definition.json +++ b/objects/suricata/definition.json @@ -1,33 +1,33 @@ { - "requiredOneOf": [ - "suricata" - ], "attributes": { "comment": { "description": "A description of the Suricata rule(s).", - "ui-priority": 0, - "misp-attribute": "comment" - }, - "suricata": { - "description": "Suricata rule.", - "ui-priority": 0, - "misp-attribute": "snort", - "multiple": true - }, - "version": { - "description": "Version of the Suricata rule depending where the suricata rule is known to work as expected.", - "ui-priority": 0, - "misp-attribute": "text" + "misp-attribute": "comment", + "ui-priority": 0 }, "ref": { "description": "Reference to the Suricata rule such as origin of the rule or alike.", "misp-attribute": "link", "ui-priority": 0 + }, + "suricata": { + "description": "Suricata rule.", + "misp-attribute": "snort", + "multiple": true, + "ui-priority": 0 + }, + "version": { + "description": "Version of the Suricata rule depending where the suricata rule is known to work as expected.", + "misp-attribute": "text", + "ui-priority": 0 } }, - "version": 2, "description": "An object describing one or more Suricata rule(s) along with version and contextual information.", "meta-category": "network", + "name": "suricata", + "requiredOneOf": [ + "suricata" + ], "uuid": "3c177337-fb80-405a-a6c1-1b2ddea8684a", - "name": "suricata" -} + "version": 2 +} \ No newline at end of file diff --git a/objects/target-system/definition.json b/objects/target-system/definition.json index 6ed6cc0..b46210c 100644 --- a/objects/target-system/definition.json +++ b/objects/target-system/definition.json @@ -1,39 +1,39 @@ { - "name": "target-system", - "uuid": "3110944f-eca0-4c94-9d61-a84d022228a4", - "meta-category": "internal", - "description": "Description about an targeted system, this could potentially be a compromissed internal system", - "version": 1, "attributes": { - "targeted_machine": { - "description": "Targeted system", - "ui-priority": 1, - "misp-attribute": "target-machine", - "disable_correlation": true, - "categories": [ - "Targeting data" - ] - }, "targeted_ip_of_system": { - "description": "Targeted system IP address", - "ui-priority": 1, - "misp-attribute": "ip-src", - "disable_correlation": true, "categories": [ "Network activity" - ] + ], + "description": "Targeted system IP address", + "disable_correlation": true, + "misp-attribute": "ip-src", + "ui-priority": 1 + }, + "targeted_machine": { + "categories": [ + "Targeting data" + ], + "description": "Targeted system", + "disable_correlation": true, + "misp-attribute": "target-machine", + "ui-priority": 1 }, "timestamp_seen": { - "description": "Registered date and time", - "ui-priority": 1, - "misp-attribute": "datetime", - "disable_correlation": true, "categories": [ "Other" - ] + ], + "description": "Registered date and time", + "disable_correlation": true, + "misp-attribute": "datetime", + "ui-priority": 1 } }, + "description": "Description about an targeted system, this could potentially be a compromissed internal system", + "meta-category": "internal", + "name": "target-system", "requiredOneOf": [ "targeted_machine" - ] -} + ], + "uuid": "3110944f-eca0-4c94-9d61-a84d022228a4", + "version": 1 +} \ No newline at end of file diff --git a/objects/threatgrid-report/definition.json b/objects/threatgrid-report/definition.json index e98da6b..72df099 100644 --- a/objects/threatgrid-report/definition.json +++ b/objects/threatgrid-report/definition.json @@ -1,79 +1,79 @@ { + "attributes": { + "analysis_submitted_at": { + "categories": [ + "Other" + ], + "description": "Submission date", + "misp-attribute": "text", + "ui-priority": 0 + }, + "heuristic_raw_score": { + "categories": [ + "External analysis" + ], + "description": "heuristic_raw_score", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 1 + }, + "heuristic_score": { + "categories": [ + "Other" + ], + "description": "heuristic_score", + "misp-attribute": "text", + "ui-priority": 0 + }, + "id": { + "categories": [ + "Other" + ], + "description": "ThreatGrid ID", + "misp-attribute": "text", + "ui-priority": 0 + }, + "iocs": { + "categories": [ + "Other" + ], + "description": "iocs", + "misp-attribute": "text", + "multiple": true, + "ui-priority": 0 + }, + "original_filename": { + "categories": [ + "Other" + ], + "description": "Original filename", + "misp-attribute": "text", + "ui-priority": 0 + }, + "permalink": { + "categories": [ + "Other" + ], + "description": "permalink", + "misp-attribute": "text", + "ui-priority": 0 + }, + "threat_score": { + "categories": [ + "External analysis" + ], + "description": "threat_score", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 0 + } + }, + "description": "ThreatGrid report", + "meta-category": "misc", + "name": "threatgrid-report", "required": [ "threat_score" ], - "attributes": { - "threat_score": { - "description": "threat_score", - "disable_correlation": true, - "categories": [ - "External analysis" - ], - "ui-priority": 0, - "misp-attribute": "text" - }, - "heuristic_raw_score": { - "description": "heuristic_raw_score", - "disable_correlation": true, - "categories": [ - "External analysis" - ], - "ui-priority": 1, - "misp-attribute": "text" - }, - "heuristic_score": { - "description": "heuristic_score", - "categories": [ - "Other" - ], - "ui-priority": 0, - "misp-attribute": "text" - }, - "analysis_submitted_at": { - "description": "Submission date", - "categories": [ - "Other" - ], - "ui-priority": 0, - "misp-attribute": "text" - }, - "original_filename": { - "description": "Original filename", - "categories": [ - "Other" - ], - "ui-priority": 0, - "misp-attribute": "text" - }, - "permalink": { - "description": "permalink", - "categories": [ - "Other" - ], - "ui-priority": 0, - "misp-attribute": "text" - }, - "id": { - "description": "ThreatGrid ID", - "categories": [ - "Other" - ], - "ui-priority": 0, - "misp-attribute": "text" - }, - "iocs": { - "description": "iocs", - "categories": [ - "Other" - ], - "ui-priority": 0, - "multiple": true, - "misp-attribute": "text" - } - }, - "version": 6, - "description": "ThreatGrid report", - "meta-category": "misc", "uuid": "23b3576b-2e68-4a86-a103-68820daef1d5", - "name": "threatgrid-report" -} + "version": 6 +} \ No newline at end of file diff --git a/objects/timecode/definition.json b/objects/timecode/definition.json index 8a2c6ff..3c6b5e7 100644 --- a/objects/timecode/definition.json +++ b/objects/timecode/definition.json @@ -1,4 +1,44 @@ { + "attributes": { + "description": { + "description": "Description of the video sequence", + "misp-attribute": "text", + "ui-priority": 1 + }, + "end-marker-timecode": { + "description": "End marker timecode in the format hh:mm:ss;ff", + "misp-attribute": "text", + "multiple": true, + "ui-priority": 0 + }, + "end-timecode": { + "description": "End marker timecode in the format hh:mm:ss.mms", + "misp-attribute": "text", + "multiple": true, + "ui-priority": 0 + }, + "recording-date": { + "description": "Date of recording of the video sequence", + "misp-attribute": "datetime", + "multiple": true, + "ui-priority": 0 + }, + "start-marker-timecode": { + "description": "Start marker timecode in the format hh:mm:ss;ff", + "misp-attribute": "text", + "multiple": true, + "ui-priority": 0 + }, + "start-timecode": { + "description": "Start marker timecode in the format hh:mm:ss.mms", + "misp-attribute": "text", + "multiple": true, + "ui-priority": 0 + } + }, + "description": "Timecode object to describe a start of video sequence (e.g. CCTV evidence) and the end of the video sequence.", + "meta-category": "misc", + "name": "timecode", "requiredOneOf": [ "description", "start-marker-timecode", @@ -7,46 +47,6 @@ "end-timecode", "recording-date" ], - "attributes": { - "description": { - "description": "Description of the video sequence", - "ui-priority": 1, - "misp-attribute": "text" - }, - "start-marker-timecode": { - "description": "Start marker timecode in the format hh:mm:ss;ff", - "ui-priority": 0, - "misp-attribute": "text", - "multiple": true - }, - "end-marker-timecode": { - "description": "End marker timecode in the format hh:mm:ss;ff", - "ui-priority": 0, - "misp-attribute": "text", - "multiple": true - }, - "start-timecode": { - "description": "Start marker timecode in the format hh:mm:ss.mms", - "ui-priority": 0, - "misp-attribute": "text", - "multiple": true - }, - "end-timecode": { - "description": "End marker timecode in the format hh:mm:ss.mms", - "ui-priority": 0, - "misp-attribute": "text", - "multiple": true - }, - "recording-date": { - "description": "Date of recording of the video sequence", - "ui-priority": 0, - "misp-attribute": "datetime", - "multiple": true - } - }, - "version": 1, - "description": "Timecode object to describe a start of video sequence (e.g. CCTV evidence) and the end of the video sequence.", - "meta-category": "misc", "uuid": "60141eac-71d2-4173-930d-91dba8106c40", - "name": "timecode" -} + "version": 1 +} \ No newline at end of file diff --git a/objects/timesketch-timeline/definition.json b/objects/timesketch-timeline/definition.json index 02d76bd..16348f5 100644 --- a/objects/timesketch-timeline/definition.json +++ b/objects/timesketch-timeline/definition.json @@ -1,33 +1,33 @@ { + "attributes": { + "datetime": { + "description": "When the log entry was seen", + "misp-attribute": "datetime", + "ui-priority": 0 + }, + "message": { + "description": "Informative message of the event", + "misp-attribute": "text", + "ui-priority": 0 + }, + "timestamp": { + "description": "When the log entry was seen in microseconds since Unix epoch", + "misp-attribute": "text", + "ui-priority": 0 + }, + "timestamp_desc": { + "description": "Text explaining what type of timestamp is it", + "misp-attribute": "text", + "ui-priority": 0 + } + }, + "description": "A timesketch timeline object based on mandatory field in timesketch to describe a log entry.", + "meta-category": "misc", + "name": "timesketch-timeline", "requiredOneOf": [ "message", "datetime" ], - "attributes": { - "message": { - "description": "Informative message of the event", - "ui-priority": 0, - "misp-attribute": "text" - }, - "timestamp": { - "description": "When the log entry was seen in microseconds since Unix epoch", - "ui-priority": 0, - "misp-attribute": "text" - }, - "timestamp_desc": { - "description": "Text explaining what type of timestamp is it", - "ui-priority": 0, - "misp-attribute": "text" - }, - "datetime": { - "description": "When the log entry was seen", - "ui-priority": 0, - "misp-attribute": "datetime" - } - }, - "version": 3, - "description": "A timesketch timeline object based on mandatory field in timesketch to describe a log entry.", - "meta-category": "misc", "uuid": "06db0221-cbc0-4ffc-ad98-7f34549310f1", - "name": "timesketch-timeline" -} + "version": 3 +} \ No newline at end of file diff --git a/objects/timesketch_message/definition.json b/objects/timesketch_message/definition.json index 9185646..384faf8 100644 --- a/objects/timesketch_message/definition.json +++ b/objects/timesketch_message/definition.json @@ -1,26 +1,26 @@ { - "required": [ - "datetime", - "message" - ], "attributes": { "datetime": { "description": "datetime of the message", "disable_correlation": true, - "ui-priority": 1, "misp-attribute": "datetime", - "recommended": true + "recommended": true, + "ui-priority": 1 }, "message": { "description": "message", "disable_correlation": true, - "ui-priority": 0, - "misp-attribute": "text" + "misp-attribute": "text", + "ui-priority": 0 } }, - "version": 1, "description": "A timesketch message entry.", "meta-category": "misc", + "name": "timesketch_message", + "required": [ + "datetime", + "message" + ], "uuid": "ef27fb19-7e71-43e0-b6f6-6f03ab67666f", - "name": "timesketch_message" -} + "version": 1 +} \ No newline at end of file diff --git a/objects/timestamp/definition.json b/objects/timestamp/definition.json index c1a8da0..3cad3c5 100644 --- a/objects/timestamp/definition.json +++ b/objects/timestamp/definition.json @@ -1,18 +1,20 @@ { - "requiredOneOf": [ - "first-seen", - "last-seen" - ], "attributes": { - "text": { - "description": "Description of the time object.", - "ui-priority": 0, - "misp-attribute": "text", - "disable_correlation": true + "first-seen": { + "description": "First time that the linked object or attribute has been seen.", + "disable_correlation": true, + "misp-attribute": "datetime", + "ui-priority": 0 + }, + "last-seen": { + "description": "First time that the linked object or attribute has been seen.", + "disable_correlation": true, + "misp-attribute": "datetime", + "ui-priority": 0 }, "precision": { "description": "Timestamp precision represents the precision given to first_seen and/or last_seen in this object.", - "ui-priority": 0, + "disable_correlation": true, "misp-attribute": "text", "sane_default": [ "year", @@ -22,24 +24,22 @@ "minute", "full" ], - "disable_correlation": true + "ui-priority": 0 }, - "first-seen": { - "description": "First time that the linked object or attribute has been seen.", - "ui-priority": 0, - "misp-attribute": "datetime", - "disable_correlation": true - }, - "last-seen": { - "description": "First time that the linked object or attribute has been seen.", - "ui-priority": 0, - "misp-attribute": "datetime", - "disable_correlation": true + "text": { + "description": "Description of the time object.", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 0 } }, - "version": 1, "description": "A generic timestamp object to represent time including first time and last time seen. Relationship will then define the kind of time relationship.", "meta-category": "misc", + "name": "timestamp", + "requiredOneOf": [ + "first-seen", + "last-seen" + ], "uuid": "c8c91e23-4221-4533-8bf7-64e12b05f265", - "name": "timestamp" -} + "version": 1 +} \ No newline at end of file diff --git a/objects/tor-hiddenservice/definition.json b/objects/tor-hiddenservice/definition.json index 0ff9fa5..361c05b 100644 --- a/objects/tor-hiddenservice/definition.json +++ b/objects/tor-hiddenservice/definition.json @@ -1,41 +1,41 @@ { + "attributes": { + "address": { + "description": "onion address of the Tor node seen.", + "misp-attribute": "text", + "ui-priority": 1 + }, + "description": { + "description": "Tor onion service comment.", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 1 + }, + "first-seen": { + "description": "When the Tor hidden service was been seen for the first time.", + "disable_correlation": true, + "misp-attribute": "datetime", + "ui-priority": 0 + }, + "last-seen": { + "description": "When the Tor hidden service was seen for the last time.", + "disable_correlation": true, + "misp-attribute": "datetime", + "ui-priority": 0 + } + }, + "description": "Tor hidden service (onion service) object.", + "meta-category": "misc", + "name": "tor-hiddenservice", + "required": [ + "address" + ], "requiredOneOf": [ "address", "first-seen", "last-seen", "description" ], - "required": [ - "address" - ], - "attributes": { - "description": { - "description": "Tor onion service comment.", - "disable_correlation": true, - "ui-priority": 1, - "misp-attribute": "text" - }, - "address": { - "description": "onion address of the Tor node seen.", - "ui-priority": 1, - "misp-attribute": "text" - }, - "last-seen": { - "description": "When the Tor hidden service was seen for the last time.", - "disable_correlation": true, - "ui-priority": 0, - "misp-attribute": "datetime" - }, - "first-seen": { - "description": "When the Tor hidden service was been seen for the first time.", - "disable_correlation": true, - "ui-priority": 0, - "misp-attribute": "datetime" - } - }, - "version": 1, - "description": "Tor hidden service (onion service) object.", - "meta-category": "misc", "uuid": "cbac07d6-fbe9-43b8-8d91-d515812ce330", - "name": "tor-hiddenservice" -} + "version": 1 +} \ No newline at end of file diff --git a/objects/tor-node/definition.json b/objects/tor-node/definition.json index c5d218b..e8cb927 100644 --- a/objects/tor-node/definition.json +++ b/objects/tor-node/definition.json @@ -1,4 +1,80 @@ { + "attributes": { + "address": { + "description": "IP address of the Tor node seen.", + "misp-attribute": "ip-src", + "ui-priority": 1 + }, + "description": { + "description": "Tor node description.", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 1 + }, + "document": { + "description": "Raw document from the consensus.", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 0 + }, + "fingerprint": { + "description": "router's fingerprint.", + "disable_correlation": false, + "misp-attribute": "text", + "ui-priority": 0 + }, + "first-seen": { + "description": "When the Tor node designed by the IP address has been seen for the first time.", + "disable_correlation": true, + "misp-attribute": "datetime", + "ui-priority": 0 + }, + "flags": { + "description": "list of flag associated with the node.", + "misp-attribute": "text", + "ui-priority": 0 + }, + "last-seen": { + "description": "When the Tor node designed by the IP address has been seen for the last time.", + "disable_correlation": true, + "misp-attribute": "datetime", + "ui-priority": 0 + }, + "nickname": { + "description": "router's nickname.", + "disable_correlation": false, + "misp-attribute": "text", + "ui-priority": 0 + }, + "published": { + "description": "router's publication time. This can be different from first-seen and last-seen.", + "disable_correlation": true, + "misp-attribute": "datetime", + "ui-priority": 0 + }, + "text": { + "description": "Tor node comment.", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 1 + }, + "version": { + "description": "parsed version of tor, this is None if the relay's using a new versioning scheme.", + "misp-attribute": "text", + "ui-priority": 0 + }, + "version_line": { + "description": "versioning information reported by the node.", + "misp-attribute": "text", + "ui-priority": 0 + } + }, + "description": "Tor node (which protects your privacy on the internet by hiding the connection between users Internet address and the services used by the users) description which are part of the Tor network at a time.", + "meta-category": "misc", + "name": "tor-node", + "required": [ + "address" + ], "requiredOneOf": [ "address", "first-seen", @@ -6,82 +82,6 @@ "description", "text" ], - "required": [ - "address" - ], - "attributes": { - "description": { - "description": "Tor node description.", - "disable_correlation": true, - "ui-priority": 1, - "misp-attribute": "text" - }, - "nickname": { - "description": "router's nickname.", - "disable_correlation": false, - "ui-priority": 0, - "misp-attribute": "text" - }, - "fingerprint": { - "description": "router's fingerprint.", - "disable_correlation": false, - "ui-priority": 0, - "misp-attribute": "text" - }, - "text": { - "description": "Tor node comment.", - "disable_correlation": true, - "ui-priority": 1, - "misp-attribute": "text" - }, - "address": { - "description": "IP address of the Tor node seen.", - "ui-priority": 1, - "misp-attribute": "ip-src" - }, - "flags": { - "description": "list of flag associated with the node.", - "ui-priority": 0, - "misp-attribute": "text" - }, - "version": { - "description": "parsed version of tor, this is None if the relay's using a new versioning scheme.", - "ui-priority": 0, - "misp-attribute": "text" - }, - "version_line": { - "description": "versioning information reported by the node.", - "ui-priority": 0, - "misp-attribute": "text" - }, - "published": { - "description": "router's publication time. This can be different from first-seen and last-seen.", - "disable_correlation": true, - "ui-priority": 0, - "misp-attribute": "datetime" - }, - "last-seen": { - "description": "When the Tor node designed by the IP address has been seen for the last time.", - "disable_correlation": true, - "ui-priority": 0, - "misp-attribute": "datetime" - }, - "first-seen": { - "description": "When the Tor node designed by the IP address has been seen for the first time.", - "disable_correlation": true, - "ui-priority": 0, - "misp-attribute": "datetime" - }, - "document": { - "description": "Raw document from the consensus.", - "disable_correlation": true, - "ui-priority": 0, - "misp-attribute": "text" - } - }, - "version": 2, - "description": "Tor node (which protects your privacy on the internet by hiding the connection between users Internet address and the services used by the users) description which are part of the Tor network at a time.", - "meta-category": "misc", "uuid": "a5fde1c8-318e-4658-a3ea-85ea000bdd33", - "name": "tor-node" -} + "version": 2 +} \ No newline at end of file diff --git a/objects/tracking-id/definition.json b/objects/tracking-id/definition.json index 79c374a..0e7cb0e 100644 --- a/objects/tracking-id/definition.json +++ b/objects/tracking-id/definition.json @@ -1,16 +1,35 @@ { - "requiredOneOf": [ - "id" - ], "attributes": { + "description": { + "description": "Description of the tracking id", + "misp-attribute": "text", + "ui-priority": 1 + }, + "first-seen": { + "description": "First time the tracking code was seen", + "disable_correlation": true, + "misp-attribute": "datetime", + "ui-priority": 0 + }, + "hostname": { + "description": "hostname where the tracking id was found", + "misp-attribute": "hostname", + "multiple": true, + "ui-priority": 0 + }, "id": { "description": "Tracking code", - "ui-priority": 1, - "misp-attribute": "text" + "misp-attribute": "text", + "ui-priority": 1 + }, + "last-seen": { + "description": "Last time the tracking code was seen", + "disable_correlation": true, + "misp-attribute": "datetime", + "ui-priority": 0 }, "tracker": { "description": "Name of the tracker - organisation doing the tracking and/or analytics", - "ui-priority": 1, "misp-attribute": "text", "sane_default": [ "Google Analytics", @@ -18,41 +37,22 @@ "Kissmetrics", "Woopra", "Chartbeat" - ] - }, - "description": { - "description": "Description of the tracking id", - "ui-priority": 1, - "misp-attribute": "text" + ], + "ui-priority": 1 }, "url": { "description": "URL where the tracking id was found", - "ui-priority": 1, + "misp-attribute": "url", "multiple": true, - "misp-attribute": "url" - }, - "hostname": { - "description": "hostname where the tracking id was found", - "ui-priority": 0, - "misp-attribute": "hostname", - "multiple": true - }, - "first-seen": { - "description": "First time the tracking code was seen", - "disable_correlation": true, - "ui-priority": 0, - "misp-attribute": "datetime" - }, - "last-seen": { - "description": "Last time the tracking code was seen", - "disable_correlation": true, - "ui-priority": 0, - "misp-attribute": "datetime" + "ui-priority": 1 } }, - "version": 2, "description": "Analytics and tracking ID such as used in Google Analytics or other analytic platform.", "meta-category": "network", + "name": "tracking-id", + "requiredOneOf": [ + "id" + ], "uuid": "3681c62a-2c75-48d8-99f2-6a3444ce2393", - "name": "tracking-id" -} + "version": 2 +} \ No newline at end of file diff --git a/objects/transaction/definition.json b/objects/transaction/definition.json index 5dc404e..54a6e6a 100644 --- a/objects/transaction/definition.json +++ b/objects/transaction/definition.json @@ -1,116 +1,116 @@ { + "attributes": { + "amount": { + "description": "The value of the transaction in local currency.", + "misp-attribute": "text", + "ui-priority": 0 + }, + "authorized": { + "description": "Person who autorized the transaction.", + "misp-attribute": "text", + "ui-priority": 0 + }, + "date": { + "description": "Date and time of the transaction.", + "misp-attribute": "datetime", + "ui-priority": 0 + }, + "date-posting": { + "description": "Date of posting, if different from date of transaction.", + "misp-attribute": "datetime", + "ui-priority": 0 + }, + "from-country": { + "description": "Origin country of a transaction.", + "misp-attribute": "text", + "ui-priority": 0 + }, + "from-funds-code": { + "description": "Type of funds used to initiate a transaction.", + "disable_correlation": true, + "misp-attribute": "text", + "sane_default": [ + "A Deposit", + "C Currency exchange", + "D Casino chips", + "E Bank draft", + "F Money order", + "G Traveler’s cheques", + "H Life insurance policy", + "I Real estate", + "J Securities", + "K Cash", + "O Other", + "P Cheque" + ], + "ui-priority": 0 + }, + "location": { + "description": "Location where the transaction took place.", + "misp-attribute": "text", + "ui-priority": 0 + }, + "teller": { + "description": "Person who conducted the transaction.", + "misp-attribute": "text", + "ui-priority": 0 + }, + "text": { + "description": "A description of the transaction.", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 1 + }, + "to-country": { + "description": "Target country of a transaction.", + "misp-attribute": "text", + "ui-priority": 0 + }, + "to-funds-code": { + "description": "Type of funds used to finalize a transaction.", + "disable_correlation": true, + "misp-attribute": "text", + "sane_default": [ + "A Deposit", + "C Currency exchange", + "D Casino chips", + "E Bank draft", + "F Money order", + "G Traveler’s cheques", + "H Life insurance policy", + "I Real estate", + "J Securities", + "K Cash", + "O Other", + "P Cheque" + ], + "ui-priority": 0 + }, + "transaction-number": { + "description": "A unique number identifying a transaction.", + "misp-attribute": "text", + "ui-priority": 0 + }, + "transmode-code": { + "description": "How the transaction was conducted.", + "misp-attribute": "text", + "ui-priority": 0 + }, + "transmode-comment": { + "description": "Comment describing transmode-code, if needed.", + "misp-attribute": "text", + "ui-priority": 0 + } + }, + "description": "An object to describe a financial transaction.", + "meta-category": "financial", + "name": "transaction", "requiredOneOf": [ "transaction-number", "date", "amount", "transmode-code" ], - "attributes": { - "text": { - "description": "A description of the transaction.", - "disable_correlation": true, - "ui-priority": 1, - "misp-attribute": "text" - }, - "transaction-number": { - "description": "A unique number identifying a transaction.", - "ui-priority": 0, - "misp-attribute": "text" - }, - "location": { - "description": "Location where the transaction took place.", - "ui-priority": 0, - "misp-attribute": "text" - }, - "transmode-code": { - "description": "How the transaction was conducted.", - "ui-priority": 0, - "misp-attribute": "text" - }, - "transmode-comment": { - "description": "Comment describing transmode-code, if needed.", - "ui-priority": 0, - "misp-attribute": "text" - }, - "teller": { - "description": "Person who conducted the transaction.", - "ui-priority": 0, - "misp-attribute": "text" - }, - "authorized": { - "description": "Person who autorized the transaction.", - "ui-priority": 0, - "misp-attribute": "text" - }, - "date": { - "description": "Date and time of the transaction.", - "ui-priority": 0, - "misp-attribute": "datetime" - }, - "amount": { - "description": "The value of the transaction in local currency.", - "ui-priority": 0, - "misp-attribute": "text" - }, - "date-posting": { - "description": "Date of posting, if different from date of transaction.", - "ui-priority": 0, - "misp-attribute": "datetime" - }, - "from-funds-code": { - "description": "Type of funds used to initiate a transaction.", - "ui-priority": 0, - "misp-attribute": "text", - "disable_correlation": true, - "sane_default": [ - "A Deposit", - "C Currency exchange", - "D Casino chips", - "E Bank draft", - "F Money order", - "G Traveler’s cheques", - "H Life insurance policy", - "I Real estate", - "J Securities", - "K Cash", - "O Other", - "P Cheque" - ] - }, - "to-funds-code": { - "description": "Type of funds used to finalize a transaction.", - "ui-priority": 0, - "misp-attribute": "text", - "disable_correlation": true, - "sane_default": [ - "A Deposit", - "C Currency exchange", - "D Casino chips", - "E Bank draft", - "F Money order", - "G Traveler’s cheques", - "H Life insurance policy", - "I Real estate", - "J Securities", - "K Cash", - "O Other", - "P Cheque" - ] - }, - "from-country": { - "description": "Origin country of a transaction.", - "ui-priority": 0, - "misp-attribute": "text" - }, - "to-country": { - "description": "Target country of a transaction.", - "ui-priority": 0, - "misp-attribute": "text" - } - }, - "version": 1, - "description": "An object to describe a financial transaction.", - "meta-category": "financial", "uuid": "a47fa26a-01b6-4747-a394-5144e34456dc", - "name": "transaction" -} + "version": 1 +} \ No newline at end of file diff --git a/objects/translation/definition.json b/objects/translation/definition.json index 3733c09..5003746 100644 --- a/objects/translation/definition.json +++ b/objects/translation/definition.json @@ -1,122 +1,114 @@ { - "requiredOneOf": [ - "original-text", - "translated-text", - "original-language", - "translation-language", - "translation-type" - ], "attributes": { + "original-language": { + "description": "Language of the original text", + "misp-attribute": "text", + "sane_default": [ + "Mandarin (language family)", + "Spanish", + "English", + "Hindi", + "Bengali", + "Portuguese", + "Russian", + "Japanese", + "Western Punjabi", + "Marathi", + "Telugu", + "Wu (language family)", + "Turkish", + "Korean", + "French", + "German", + "Vietnamese", + "Tamil", + "Yue (language family)", + "Urdu", + "Javanese", + "Italian", + "Egyptian Arabic", + "Gujarati", + "Iranian Persian", + "Bhojpuri", + "Min Nan (language family)", + "Hakka", + "Jinyu", + "Hausa", + "Kannada", + "Indonesian (Indonesian Malay)", + "Polish", + "Yoruba", + "Xiang Chinese (language family)", + "Malayalam", + "Odia", + "Maithili", + "Burmese", + "Eastern Punjabi", + "Sunda", + "Sudanese Arabic", + "Algerian Arabic", + "Moroccan Arabic", + "Ukrainian", + "Igbo", + "Northern Uzbek", + "Sindhi", + "North Levantine Arabic", + "Romanian", + "Tagalog", + "Dutch", + "Saʽidi Arabic", + "Gan", + "Amharic", + "Northern Pashto", + "Magahi", + "Thai", + "Saraiki", + "Khmer", + "Chhattisgarhi", + "Somali", + "Malay (Malaysian Malay)", + "Cebuano", + "Nepali", + "Mesopotamian Arabic", + "Assamese", + "Sinhala", + "Northern Kurdish", + "Hejazi Arabic", + "Nigerian Fulfulde", + "South Azerbaijani", + "Greek", + "Chittagonian", + "Kazakh", + "Deccan", + "Hungarian", + "Kinyarwanda", + "Zulu", + "South Levantine Arabic", + "Tunisian Arabic", + "Sanaani Spoken Arabic", + "Min Bei Chinese (language family)", + "Southern Pashto", + "Rundi", + "Czech", + "Taʽizzi-Adeni Arabic", + "Uyghur", + "Min Dong Chinese (language family)", + "Sylheti " + ], + "ui-priority": 1 + }, "original-text": { "description": "Original text", - "ui-priority": 1, - "misp-attribute": "text" + "misp-attribute": "text", + "ui-priority": 1 }, "translated-text": { "description": "Text after translation", - "ui-priority": 1, - "misp-attribute": "text" - }, - "original-language": { - "description": "Language of the original text", - "ui-priority": 1, "misp-attribute": "text", - "sane_default": [ - "Mandarin (language family)", - "Spanish", - "English", - "Hindi", - "Bengali", - "Portuguese", - "Russian", - "Japanese", - "Western Punjabi", - "Marathi", - "Telugu", - "Wu (language family)", - "Turkish", - "Korean", - "French", - "German", - "Vietnamese", - "Tamil", - "Yue (language family)", - "Urdu", - "Javanese", - "Italian", - "Egyptian Arabic", - "Gujarati", - "Iranian Persian", - "Bhojpuri", - "Min Nan (language family)", - "Hakka", - "Jinyu", - "Hausa", - "Kannada", - "Indonesian (Indonesian Malay)", - "Polish", - "Yoruba", - "Xiang Chinese (language family)", - "Malayalam", - "Odia", - "Maithili", - "Burmese", - "Eastern Punjabi", - "Sunda", - "Sudanese Arabic", - "Algerian Arabic", - "Moroccan Arabic", - "Ukrainian", - "Igbo", - "Northern Uzbek", - "Sindhi", - "North Levantine Arabic", - "Romanian", - "Tagalog", - "Dutch", - "Saʽidi Arabic", - "Gan", - "Amharic", - "Northern Pashto", - "Magahi", - "Thai", - "Saraiki", - "Khmer", - "Chhattisgarhi", - "Somali", - "Malay (Malaysian Malay)", - "Cebuano", - "Nepali", - "Mesopotamian Arabic", - "Assamese", - "Sinhala", - "Northern Kurdish", - "Hejazi Arabic", - "Nigerian Fulfulde", - "South Azerbaijani", - "Greek", - "Chittagonian", - "Kazakh", - "Deccan", - "Hungarian", - "Kinyarwanda", - "Zulu", - "South Levantine Arabic", - "Tunisian Arabic", - "Sanaani Spoken Arabic", - "Min Bei Chinese (language family)", - "Southern Pashto", - "Rundi", - "Czech", - "Taʽizzi-Adeni Arabic", - "Uyghur", - "Min Dong Chinese (language family)", - "Sylheti " - ] + "ui-priority": 1 }, "translation-language": { "description": "Language of translation", - "ui-priority": 1, "misp-attribute": "text", "sane_default": [ "Mandarin (language family)", @@ -209,11 +201,11 @@ "Uyghur", "Min Dong Chinese (language family)", "Sylheti " - ] + ], + "ui-priority": 1 }, "translation-service": { "description": "translation service used for the translation", - "ui-priority": 1, "misp-attribute": "text", "sane_default": [ "Google Translate", @@ -223,21 +215,29 @@ "Dict.cc", "Linguee", "unknown" - ] + ], + "ui-priority": 1 }, "translation-type": { "description": "type of translation", - "ui-priority": 1, "misp-attribute": "text", "sane_default": [ "Automated translation", "Manual translation" - ] + ], + "ui-priority": 1 } }, - "version": 1, "description": "Used to keep a text and its translation", "meta-category": "misc", + "name": "translation", + "requiredOneOf": [ + "original-text", + "translated-text", + "original-language", + "translation-language", + "translation-type" + ], "uuid": "a43b54fa-dac9-11e9-9b0d-97296aceae1a", - "name": "translation" -} + "version": 1 +} \ No newline at end of file diff --git a/objects/trustar_report/definition.json b/objects/trustar_report/definition.json index a8dd5bb..6a529c0 100644 --- a/objects/trustar_report/definition.json +++ b/objects/trustar_report/definition.json @@ -78,4 +78,4 @@ "name": "trustar_report", "uuid": "8ff46cf1-db04-4453-ba46-d004e1ef6b7a", "version": 1 -} +} \ No newline at end of file diff --git a/objects/tsk-chats/definition.json b/objects/tsk-chats/definition.json index 05b18a2..40d16c3 100644 --- a/objects/tsk-chats/definition.json +++ b/objects/tsk-chats/definition.json @@ -1,12 +1,62 @@ { - "required": [ - "message-type", - "message" - ], "attributes": { + "Source": { + "description": "Source of the message.(Contact details)", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 0 + }, + "additional-comments": { + "categories": [ + "External analysis" + ], + "description": "Comments.", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 0 + }, + "app-used": { + "description": "Application used to send the message.", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 0 + }, + "attachments": { + "categories": [ + "External analysis" + ], + "description": "External references", + "misp-attribute": "link", + "multiple": true, + "ui-priority": 0 + }, + "datetime-received": { + "description": "date and time when the message was received.", + "disable_correlation": true, + "misp-attribute": "datetime", + "multiple": true, + "ui-priority": 0 + }, + "datetime-sent": { + "description": "date and the time when the message was sent.", + "disable_correlation": true, + "misp-attribute": "datetime", + "ui-priority": 0 + }, + "destination": { + "description": "Destination of the message.(Contact details)", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 0 + }, + "message": { + "description": "Message exchanged.", + "misp-attribute": "text", + "ui-priority": 0 + }, "message-type": { "description": "the type of message extracted from the forensic-evidence.", - "ui-priority": 0, + "disable_correlation": true, "misp-attribute": "text", "sane_default": [ "SMS", @@ -14,71 +64,21 @@ "Instant Message (IM)", "Voice Message" ], - "disable_correlation": true - }, - "datetime-sent": { - "description": "date and the time when the message was sent.", - "ui-priority": 0, - "misp-attribute": "datetime", - "disable_correlation": true - }, - "datetime-received": { - "description": "date and time when the message was received.", - "multiple": true, - "ui-priority": 0, - "misp-attribute": "datetime", - "disable_correlation": true - }, - "Source": { - "description": "Source of the message.(Contact details)", - "ui-priority": 0, - "misp-attribute": "text", - "disable_correlation": true - }, - "destination": { - "description": "Destination of the message.(Contact details)", - "ui-priority": 0, - "misp-attribute": "text", - "disable_correlation": true - }, - "app-used": { - "description": "Application used to send the message.", - "ui-priority": 0, - "misp-attribute": "text", - "disable_correlation": true + "ui-priority": 0 }, "subject": { "description": "Subject of the message if any.", - "ui-priority": 0, - "misp-attribute": "text" - }, - "message": { - "description": "Message exchanged.", - "ui-priority": 0, - "misp-attribute": "text" - }, - "attachments": { - "description": "External references", - "multiple": true, - "ui-priority": 0, - "categories": [ - "External analysis" - ], - "misp-attribute": "link" - }, - "additional-comments": { - "description": "Comments.", - "ui-priority": 0, "misp-attribute": "text", - "categories": [ - "External analysis" - ], - "disable_correlation": true + "ui-priority": 0 } }, - "version": 1, "description": "An Object Template to gather information from evidential or interesting exchange of messages identified during a digital forensic investigation.", "meta-category": "misc", + "name": "tsk-chats", + "required": [ + "message-type", + "message" + ], "uuid": "6b71f231-c502-467f-bc67-1423cd5bf800", - "name": "tsk-chats" -} + "version": 1 +} \ No newline at end of file diff --git a/objects/tsk-web-bookmark/definition.json b/objects/tsk-web-bookmark/definition.json index 28fca9e..df81e42 100644 --- a/objects/tsk-web-bookmark/definition.json +++ b/objects/tsk-web-bookmark/definition.json @@ -1,33 +1,22 @@ { - "required": [ - "URL" - ], "attributes": { "URL": { "description": "The URL saved as bookmark.", - "ui-priority": 0, - "misp-attribute": "link" + "misp-attribute": "link", + "ui-priority": 0 }, - "datetime-bookmarked": { - "description": "date and time when the URL was added to favorites.", - "ui-priority": 0, - "misp-attribute": "datetime", - "disable_correlation": true - }, - "name": { - "description": "Book mark name. ", - "ui-priority": 0, + "additional-comments": { + "categories": [ + "External analysis" + ], + "description": "Comments.", + "disable_correlation": true, "misp-attribute": "text", - "disable_correlation": true - }, - "title": { - "description": "Title of the web page", - "ui-priority": 0, - "misp-attribute": "text" + "ui-priority": 0 }, "browser": { "description": "Browser used to access the URL.", - "ui-priority": 0, + "disable_correlation": true, "misp-attribute": "text", "sane_default": [ "IE", @@ -37,31 +26,42 @@ "Opera mini", "Chromium" ], - "disable_correlation": true + "ui-priority": 0 }, - "domain-name": { - "description": "Domain of the URL.", - "ui-priority": 0, - "misp-attribute": "text" + "datetime-bookmarked": { + "description": "date and time when the URL was added to favorites.", + "disable_correlation": true, + "misp-attribute": "datetime", + "ui-priority": 0 }, "domain-ip": { "description": "IP of the URL domain.", - "ui-priority": 0, - "misp-attribute": "ip-src" + "misp-attribute": "ip-src", + "ui-priority": 0 }, - "additional-comments": { - "description": "Comments.", - "ui-priority": 0, + "domain-name": { + "description": "Domain of the URL.", "misp-attribute": "text", - "categories": [ - "External analysis" - ], - "disable_correlation": true + "ui-priority": 0 + }, + "name": { + "description": "Book mark name. ", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 0 + }, + "title": { + "description": "Title of the web page", + "misp-attribute": "text", + "ui-priority": 0 } }, - "version": 1, "description": "An Object Template to add evidential bookmarks identified during a digital forensic investigation.", "meta-category": "misc", + "name": "tsk-web-bookmark", + "required": [ + "URL" + ], "uuid": "7d9a88a8-9934-4caa-a85b-f76bc97d5373", - "name": "tsk-web-bookmark" -} + "version": 1 +} \ No newline at end of file diff --git a/objects/tsk-web-cookie/definition.json b/objects/tsk-web-cookie/definition.json index 03e841e..81a7833 100644 --- a/objects/tsk-web-cookie/definition.json +++ b/objects/tsk-web-cookie/definition.json @@ -1,34 +1,22 @@ { - "required": [ - "URL", - "name", - "value" - ], "attributes": { "URL": { "description": "The website URL that created the cookie.", - "ui-priority": 0, - "misp-attribute": "link" + "misp-attribute": "link", + "ui-priority": 0 }, - "datetime-created": { - "description": "date and time when the cookie was created.", - "ui-priority": 0, - "misp-attribute": "datetime", - "disable_correlation": true - }, - "name": { - "description": "Name of the cookie ", - "ui-priority": 0, - "misp-attribute": "text" - }, - "value": { - "description": "Value assigned to the cookie.", - "ui-priority": 0, - "misp-attribute": "text" + "additional-comments": { + "categories": [ + "External analysis" + ], + "description": "Comments.", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 0 }, "browser": { "description": "Browser on which the cookie was created.", - "ui-priority": 0, + "misp-attribute": "text", "sane_default": [ "IE", "Safari", @@ -37,31 +25,43 @@ "Opera mini", "Chromium" ], - "misp-attribute": "text" + "ui-priority": 0 }, - "domain-name": { - "description": "Domain of the URL that created the cookie.", - "ui-priority": 0, - "misp-attribute": "text" + "datetime-created": { + "description": "date and time when the cookie was created.", + "disable_correlation": true, + "misp-attribute": "datetime", + "ui-priority": 0 }, "domain-ip": { "description": "IP of the domain that created the URL.", - "ui-priority": 0, - "misp-attribute": "ip-src" + "misp-attribute": "ip-src", + "ui-priority": 0 }, - "additional-comments": { - "description": "Comments.", - "ui-priority": 0, + "domain-name": { + "description": "Domain of the URL that created the cookie.", "misp-attribute": "text", - "categories": [ - "External analysis" - ], - "disable_correlation": true + "ui-priority": 0 + }, + "name": { + "description": "Name of the cookie ", + "misp-attribute": "text", + "ui-priority": 0 + }, + "value": { + "description": "Value assigned to the cookie.", + "misp-attribute": "text", + "ui-priority": 0 } }, - "version": 1, "description": "An TSK-Autopsy Object Template to represent cookies identified during a forensic investigation.", "meta-category": "misc", + "name": "tsk-web-cookie", + "required": [ + "URL", + "name", + "value" + ], "uuid": "40d23a4f-43be-4c9e-8328-382a2188eb1d", - "name": "tsk-web-cookie" -} + "version": 1 +} \ No newline at end of file diff --git a/objects/tsk-web-downloads/definition.json b/objects/tsk-web-downloads/definition.json index ba60ce2..ea56feb 100644 --- a/objects/tsk-web-downloads/definition.json +++ b/objects/tsk-web-downloads/definition.json @@ -1,55 +1,55 @@ { + "attributes": { + "additional-comments": { + "categories": [ + "External analysis" + ], + "description": "Comments.", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 0 + }, + "attachment": { + "description": "The downloaded file itself.", + "disable_correlation": true, + "misp-attribute": "attachment", + "ui-priority": 1 + }, + "datetime-accessed": { + "description": "date and time when the file was downloaded.", + "disable_correlation": true, + "misp-attribute": "datetime", + "ui-priority": 0 + }, + "name": { + "description": "Name of the file downloaded.", + "misp-attribute": "text", + "ui-priority": 0 + }, + "path-downloadedTo": { + "description": "Location the file was downloaded to.", + "misp-attribute": "text", + "ui-priority": 0 + }, + "pathID": { + "description": "Id of the attribute file where the information is gathered from.", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 0 + }, + "url": { + "description": "The URL used to download the file.", + "misp-attribute": "url", + "ui-priority": 0 + } + }, + "description": "An Object Template to add web-downloads", + "meta-category": "file", + "name": "tsk-web-downloads", "required": [ "url", "name" ], - "attributes": { - "url": { - "description": "The URL used to download the file.", - "ui-priority": 0, - "misp-attribute": "url" - }, - "datetime-accessed": { - "description": "date and time when the file was downloaded.", - "ui-priority": 0, - "misp-attribute": "datetime", - "disable_correlation": true - }, - "name": { - "description": "Name of the file downloaded.", - "ui-priority": 0, - "misp-attribute": "text" - }, - "path-downloadedTo": { - "description": "Location the file was downloaded to.", - "ui-priority": 0, - "misp-attribute": "text" - }, - "pathID": { - "description": "Id of the attribute file where the information is gathered from.", - "ui-priority": 0, - "misp-attribute": "text", - "disable_correlation": true - }, - "attachment": { - "description": "The downloaded file itself.", - "ui-priority": 1, - "misp-attribute": "attachment", - "disable_correlation": true - }, - "additional-comments": { - "description": "Comments.", - "ui-priority": 0, - "misp-attribute": "text", - "categories": [ - "External analysis" - ], - "disable_correlation": true - } - }, - "version": 1, - "description": "An Object Template to add web-downloads", - "meta-category": "file", "uuid": "ab9603a1-9dcc-48e8-a51c-b8bccc7bcc26", - "name": "tsk-web-downloads" -} + "version": 1 +} \ No newline at end of file diff --git a/objects/tsk-web-history/definition.json b/objects/tsk-web-history/definition.json index b38fd8d..6dde384 100644 --- a/objects/tsk-web-history/definition.json +++ b/objects/tsk-web-history/definition.json @@ -1,44 +1,22 @@ { - "required": [ - "URL", - "datetime-accessed" - ], "attributes": { "URL": { "description": "The URL accessed.", - "ui-priority": 0, - "misp-attribute": "link" + "misp-attribute": "link", + "ui-priority": 0 }, - "datetime-accessed": { - "description": "date and the time when the URL was accessed.", - "ui-priority": 0, - "misp-attribute": "datetime", - "disable_correlation": true - }, - "referrer": { - "description": "where the URL was referred from ", - "ui-priority": 0, + "additional-comments": { + "categories": [ + "External analysis" + ], + "description": "Comments.", + "disable_correlation": true, "misp-attribute": "text", - "disable_correlation": true - }, - "title": { - "description": "Title of the web page", - "ui-priority": 0, - "misp-attribute": "text" - }, - "domain-name": { - "description": "Domain of the URL.", - "ui-priority": 0, - "misp-attribute": "text" - }, - "domain-ip": { - "description": "IP of the URL domain.", - "ui-priority": 0, - "misp-attribute": "ip-src" + "ui-priority": 0 }, "browser": { "description": "Browser used to access the URL.", - "ui-priority": 0, + "disable_correlation": true, "misp-attribute": "text", "sane_default": [ "IE", @@ -48,21 +26,43 @@ "Opera mini", "Chromium" ], - "disable_correlation": true + "ui-priority": 0 }, - "additional-comments": { - "description": "Comments.", - "ui-priority": 0, + "datetime-accessed": { + "description": "date and the time when the URL was accessed.", + "disable_correlation": true, + "misp-attribute": "datetime", + "ui-priority": 0 + }, + "domain-ip": { + "description": "IP of the URL domain.", + "misp-attribute": "ip-src", + "ui-priority": 0 + }, + "domain-name": { + "description": "Domain of the URL.", "misp-attribute": "text", - "categories": [ - "External analysis" - ], - "disable_correlation": true + "ui-priority": 0 + }, + "referrer": { + "description": "where the URL was referred from ", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 0 + }, + "title": { + "description": "Title of the web page", + "misp-attribute": "text", + "ui-priority": 0 } }, - "version": 1, "description": "An Object Template to share web history information", "meta-category": "misc", + "name": "tsk-web-history", + "required": [ + "URL", + "datetime-accessed" + ], "uuid": "e1325e52-e52e-49b1-89ad-d503c127c698", - "name": "tsk-web-history" -} + "version": 1 +} \ No newline at end of file diff --git a/objects/tsk-web-search-query/definition.json b/objects/tsk-web-search-query/definition.json index 0b0afdd..b4f7998 100644 --- a/objects/tsk-web-search-query/definition.json +++ b/objects/tsk-web-search-query/definition.json @@ -1,36 +1,17 @@ { - "required": [ - "domain", - "text" - ], "attributes": { - "domain": { - "description": "The domain of the search engine.", - "ui-priority": 0, - "misp-attribute": "link", - "sane_default": [ - "Google", - "Yahoo", - "Bing", - "Alta Vista", - "MSN" + "additional-comments": { + "categories": [ + "External analysis" ], - "disable_correlation": true - }, - "text": { - "description": "the search word or sentence.", - "ui-priority": 0, - "misp-attribute": "text" - }, - "datetime-searched": { - "description": "date and time when the search was conducted.", - "ui-priority": 0, - "misp-attribute": "datetime", - "disable_correlation": true + "description": "Comments.", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 0 }, "browser": { "description": "Browser used.", - "ui-priority": 0, + "disable_correlation": true, "misp-attribute": "text", "sane_default": [ "IE", @@ -40,27 +21,46 @@ "Opera mini", "Chromium" ], - "disable_correlation": true + "ui-priority": 0 + }, + "datetime-searched": { + "description": "date and time when the search was conducted.", + "disable_correlation": true, + "misp-attribute": "datetime", + "ui-priority": 0 + }, + "domain": { + "description": "The domain of the search engine.", + "disable_correlation": true, + "misp-attribute": "link", + "sane_default": [ + "Google", + "Yahoo", + "Bing", + "Alta Vista", + "MSN" + ], + "ui-priority": 0 + }, + "text": { + "description": "the search word or sentence.", + "misp-attribute": "text", + "ui-priority": 0 }, "username": { "description": "User name or ID associated with the search.", - "ui-priority": 0, + "disable_correlation": true, "misp-attribute": "text", - "disable_correlation": true - }, - "additional-comments": { - "description": "Comments.", - "ui-priority": 0, - "misp-attribute": "text", - "categories": [ - "External analysis" - ], - "disable_correlation": true + "ui-priority": 0 } }, - "version": 1, "description": "An Object Template to share web search query information", "meta-category": "misc", + "name": "tsk-web-search-query", + "required": [ + "domain", + "text" + ], "uuid": "16b3f8d0-fd09-4812-a42c-b5aeff2d4c2e", - "name": "tsk-web-search-query" -} + "version": 1 +} \ No newline at end of file diff --git a/objects/url/definition.json b/objects/url/definition.json index 29f8f40..b456cc0 100644 --- a/objects/url/definition.json +++ b/objects/url/definition.json @@ -1,29 +1,70 @@ { - "requiredOneOf": [ - "url", - "resource_path" - ], "attributes": { + "credential": { + "description": "Credential (username, password)", + "misp-attribute": "text", + "ui-priority": 0 + }, + "domain": { + "description": "Full domain", + "misp-attribute": "domain", + "ui-priority": 0 + }, + "domain_without_tld": { + "description": "Domain without Top-Level Domain", + "misp-attribute": "text", + "ui-priority": 0 + }, + "first-seen": { + "description": "First time this URL has been seen", + "disable_correlation": true, + "misp-attribute": "datetime", + "ui-priority": 0 + }, "fragment": { "description": "Fragment identifier is a short string of characters that refers to a resource that is subordinate to another, primary resource.", - "ui-priority": 0, "misp-attribute": "text", - "multiple": true + "multiple": true, + "ui-priority": 0 }, - "tld": { - "description": "Top-Level Domain", - "ui-priority": 0, - "misp-attribute": "text", - "disable_correlation": true + "host": { + "description": "Full hostname", + "misp-attribute": "hostname", + "ui-priority": 0 + }, + "ip": { + "description": "Better type when the host is an IP.", + "misp-attribute": "ip-dst", + "ui-priority": 0 + }, + "last-seen": { + "description": "Last time this URL has been seen", + "disable_correlation": true, + "misp-attribute": "datetime", + "ui-priority": 0 }, "port": { "description": "Port number", - "ui-priority": 0, + "disable_correlation": true, "misp-attribute": "port", - "disable_correlation": true + "ui-priority": 0 + }, + "query_string": { + "description": "Query (after path, preceded by '?')", + "misp-attribute": "text", + "multiple": true, + "ui-priority": 0 + }, + "resource_path": { + "description": "Path (between hostname:port and query)", + "misp-attribute": "text", + "multiple": true, + "ui-priority": 0 }, "scheme": { "description": "Scheme", + "disable_correlation": true, + "misp-attribute": "text", "sane_default": [ "http", "https", @@ -31,79 +72,38 @@ "gopher", "sip" ], - "ui-priority": 0, - "misp-attribute": "text", - "disable_correlation": true - }, - "first-seen": { - "description": "First time this URL has been seen", - "disable_correlation": true, - "ui-priority": 0, - "misp-attribute": "datetime" - }, - "resource_path": { - "description": "Path (between hostname:port and query)", - "ui-priority": 0, - "misp-attribute": "text", - "multiple": true - }, - "query_string": { - "description": "Query (after path, preceded by '?')", - "ui-priority": 0, - "misp-attribute": "text", - "multiple": true - }, - "url": { - "description": "Full URL", - "ui-priority": 1, - "misp-attribute": "url" - }, - "domain_without_tld": { - "description": "Domain without Top-Level Domain", - "ui-priority": 0, - "misp-attribute": "text" - }, - "domain": { - "description": "Full domain", - "ui-priority": 0, - "misp-attribute": "domain" + "ui-priority": 0 }, "subdomain": { "description": "Subdomain", - "ui-priority": 0, + "disable_correlation": true, "misp-attribute": "text", - "disable_correlation": true - }, - "credential": { - "description": "Credential (username, password)", - "ui-priority": 0, - "misp-attribute": "text" + "ui-priority": 0 }, "text": { "description": "Description of the URL ", - "ui-priority": 0, - "misp-attribute": "text" + "misp-attribute": "text", + "ui-priority": 0 }, - "last-seen": { - "description": "Last time this URL has been seen", + "tld": { + "description": "Top-Level Domain", "disable_correlation": true, - "ui-priority": 0, - "misp-attribute": "datetime" + "misp-attribute": "text", + "ui-priority": 0 }, - "ip": { - "description": "Better type when the host is an IP.", - "ui-priority": 0, - "misp-attribute": "ip-dst" - }, - "host": { - "description": "Full hostname", - "ui-priority": 0, - "misp-attribute": "hostname" + "url": { + "description": "Full URL", + "misp-attribute": "url", + "ui-priority": 1 } }, - "version": 8, "description": "url object describes an url along with its normalized field (like extracted using faup parsing library) and its metadata.", "meta-category": "network", + "name": "url", + "requiredOneOf": [ + "url", + "resource_path" + ], "uuid": "60efb77b-40b5-4c46-871b-ed1ed999fce5", - "name": "url" -} + "version": 8 +} \ No newline at end of file diff --git a/objects/user-account/definition.json b/objects/user-account/definition.json index 6f0e863..a0e70b9 100644 --- a/objects/user-account/definition.json +++ b/objects/user-account/definition.json @@ -1,50 +1,7 @@ { - "name": "user-account", - "uuid": "49606b06-22f0-4ac8-8eee-2f12ad46f3d3", - "meta-category": "misc", - "description": "", - "version": 3, - "requiredOneOf": [ - "password", - "username", - "user-id" - ], "attributes": { - "text": { - "description": "A description of the user account.", - "disable_correlation": true, - "ui-priority": 1, - "misp-attribute": "text" - }, - "username": { - "description": "Username related to the password.", - "ui-priority": 1, - "misp-attribute": "text" - }, - "user-id": { - "description": "Identifier of the account.", - "ui-priority": 1, - "misp-attribute": "text" - }, - "user-avatar": { - "description": "A user profile picture or avatar.", - "ui-priority": 1, - "multiple": true, - "misp-attribute": "attachment" - }, - "password": { - "description": "Password related to the username.", - "ui-priority": 1, - "misp-attribute": "text" - }, - "display-name": { - "description": "Display name of the account.", - "ui-priority": 1, - "misp-attribute": "text" - }, "account-type": { "description": "Type of the account.", - "ui-priority": 1, "misp-attribute": "text", "sane_default": [ "facebook", @@ -58,91 +15,134 @@ "unix", "windows-local", "windows-domain" - ] - }, - "link": { - "description": "Original link into the account page (Supposed harmless)", - "ui-priority": 1, - "misp-attribute": "link" - }, - "is_service_account": { - "description": "Specifies if the account is associated with a network service.", - "disable_correlation": true, - "ui-priority": 1, - "misp-attribute": "boolean" - }, - "privileged": { - "description": "Specifies if the account has privileges such as root rights.", - "disable_correlation": true, - "ui-priority": 1, - "misp-attribute": "boolean" + ], + "ui-priority": 1 }, "can_escalate_privs": { "description": "Specifies if the account has the ability to escalate privileges.", "disable_correlation": true, - "ui-priority": 1, - "misp-attribute": "boolean" - }, - "disabled": { - "description": "Specifies if the account is desabled.", - "disable_correlation": true, - "ui-priority": 1, - "misp-attribute": "boolean" + "misp-attribute": "boolean", + "ui-priority": 1 }, "created": { "description": "Creation time of the account.", "disable_correlation": true, - "ui-priority": 1, - "misp-attribute": "datetime" + "misp-attribute": "datetime", + "ui-priority": 1 + }, + "disabled": { + "description": "Specifies if the account is desabled.", + "disable_correlation": true, + "misp-attribute": "boolean", + "ui-priority": 1 + }, + "display-name": { + "description": "Display name of the account.", + "misp-attribute": "text", + "ui-priority": 1 }, "expires": { "description": "Expiration time of the account", "disable_correlation": true, - "ui-priority": 1, - "misp-attribute": "datetime" + "misp-attribute": "datetime", + "ui-priority": 1 }, "first_login": { "description": "First time someone logged in to the account.", "disable_correlation": true, - "ui-priority": 1, - "misp-attribute": "datetime" - }, - "last_login": { - "description": "Last time someone logged in to the account.", - "disable_correlation": true, - "ui-priority": 1, - "misp-attribute": "datetime" - }, - "password_last_changed": { - "description": "Last time the password has been changed.", - "disable_correlation": true, - "ui-priority": 1, - "misp-attribute": "datetime" - }, - "group-id": { - "description": "Identifier of the primary group of the account, in case of a UNIX account.", - "disable_correlation": true, - "ui-priority": 1, - "misp-attribute": "text" + "misp-attribute": "datetime", + "ui-priority": 1 }, "group": { "description": "UNIX group(s) the account is member of.", "disable_correlation": true, - "ui-priority": 1, "misp-attribute": "text", - "multiple": true + "multiple": true, + "ui-priority": 1 + }, + "group-id": { + "description": "Identifier of the primary group of the account, in case of a UNIX account.", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 1 }, "home_dir": { "description": "Home directory of the UNIX account.", "disable_correlation": true, - "ui-priority": 1, - "misp-attribute": "text" + "misp-attribute": "text", + "ui-priority": 1 + }, + "is_service_account": { + "description": "Specifies if the account is associated with a network service.", + "disable_correlation": true, + "misp-attribute": "boolean", + "ui-priority": 1 + }, + "last_login": { + "description": "Last time someone logged in to the account.", + "disable_correlation": true, + "misp-attribute": "datetime", + "ui-priority": 1 + }, + "link": { + "description": "Original link into the account page (Supposed harmless)", + "misp-attribute": "link", + "ui-priority": 1 + }, + "password": { + "description": "Password related to the username.", + "misp-attribute": "text", + "ui-priority": 1 + }, + "password_last_changed": { + "description": "Last time the password has been changed.", + "disable_correlation": true, + "misp-attribute": "datetime", + "ui-priority": 1 + }, + "privileged": { + "description": "Specifies if the account has privileges such as root rights.", + "disable_correlation": true, + "misp-attribute": "boolean", + "ui-priority": 1 }, "shell": { "description": "UNIX command shell of the account.", "disable_correlation": true, - "ui-priority": 1, - "misp-attribute": "text" + "misp-attribute": "text", + "ui-priority": 1 + }, + "text": { + "description": "A description of the user account.", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 1 + }, + "user-avatar": { + "description": "A user profile picture or avatar.", + "misp-attribute": "attachment", + "multiple": true, + "ui-priority": 1 + }, + "user-id": { + "description": "Identifier of the account.", + "misp-attribute": "text", + "ui-priority": 1 + }, + "username": { + "description": "Username related to the password.", + "misp-attribute": "text", + "ui-priority": 1 } - } -} + }, + "description": "", + "meta-category": "misc", + "name": "user-account", + "requiredOneOf": [ + "password", + "username", + "user-id" + ], + "uuid": "49606b06-22f0-4ac8-8eee-2f12ad46f3d3", + "version": 3 +} \ No newline at end of file diff --git a/objects/vehicle/definition.json b/objects/vehicle/definition.json index 9a6d1fc..9d68828 100644 --- a/objects/vehicle/definition.json +++ b/objects/vehicle/definition.json @@ -1,48 +1,86 @@ { - "requiredOneOf": [ - "description", - "make", - "model", - "license-plate-number", - "vin", - "dyno-power", - "date-first-registration", - "image-url", - "gearbox", - "exterior color", - "interior color", - "type", - "state", - "indicative-value" - ], "attributes": { + "date-first-registration": { + "description": "Date of first registration", + "misp-attribute": "text", + "multiple": true, + "ui-priority": 0 + }, "description": { "description": "Description of the vehicle", - "ui-priority": 1, + "disable_correlation": true, "misp-attribute": "text", - "disable_correlation": true + "ui-priority": 1 + }, + "dyno-power": { + "description": "Dyno power output", + "misp-attribute": "text", + "multiple": true, + "ui-priority": 0 }, "exterior color": { "description": "Exterior color of the vehicule", - "ui-priority": 0, + "disable_correlation": true, "misp-attribute": "text", - "disable_correlation": true + "ui-priority": 0 }, - "state": { - "description": "State of the vehicule (stolen or recovered)", - "ui-priority": 0, + "gearbox": { + "description": "Gearbox", "misp-attribute": "text", - "disable_correlation": true + "multiple": true, + "ui-priority": 0 + }, + "image": { + "description": "Image of the vehicle.", + "misp-attribute": "attachment", + "multiple": true, + "ui-priority": 0 + }, + "image-url": { + "description": "Image URL", + "misp-attribute": "text", + "multiple": true, + "ui-priority": 0 + }, + "indicative-value": { + "description": "Indicative value", + "misp-attribute": "text", + "multiple": true, + "ui-priority": 0 }, "interior color": { "description": "Interior color of the vehicule", - "ui-priority": 0, + "disable_correlation": true, "misp-attribute": "text", - "disable_correlation": true + "ui-priority": 0 + }, + "license-plate-number": { + "description": "License plate number", + "misp-attribute": "text", + "multiple": true, + "ui-priority": 0 + }, + "make": { + "description": "Manufacturer of the vehicle", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 0 + }, + "model": { + "description": "Model of the vehicle", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 0 + }, + "state": { + "description": "State of the vehicule (stolen or recovered)", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 0 }, "type": { "description": "Type of the vehicule", - "ui-priority": 0, + "disable_correlation": true, "misp-attribute": "text", "sane_default": [ "car", @@ -59,71 +97,33 @@ "trailer", "van" ], - "disable_correlation": true - }, - "make": { - "description": "Manufacturer of the vehicle", - "ui-priority": 0, - "misp-attribute": "text", - "disable_correlation": true - }, - "model": { - "description": "Model of the vehicle", - "ui-priority": 0, - "misp-attribute": "text", - "disable_correlation": true + "ui-priority": 0 }, "vin": { "description": "Vehicle identification number (VIN)", - "ui-priority": 0, - "misp-attribute": "text" - }, - "license-plate-number": { - "description": "License plate number", - "ui-priority": 0, "misp-attribute": "text", - "multiple": true - }, - "dyno-power": { - "description": "Dyno power output", - "ui-priority": 0, - "misp-attribute": "text", - "multiple": true - }, - "date-first-registration": { - "description": "Date of first registration", - "ui-priority": 0, - "misp-attribute": "text", - "multiple": true - }, - "image-url": { - "description": "Image URL", - "ui-priority": 0, - "misp-attribute": "text", - "multiple": true - }, - "image": { - "description": "Image of the vehicle.", - "ui-priority": 0, - "misp-attribute": "attachment", - "multiple": true - }, - "gearbox": { - "description": "Gearbox", - "ui-priority": 0, - "misp-attribute": "text", - "multiple": true - }, - "indicative-value": { - "description": "Indicative value", - "ui-priority": 0, - "misp-attribute": "text", - "multiple": true + "ui-priority": 0 } }, - "version": 3, "description": "Vehicle object template to describe a vehicle information and registration", "meta-category": "misc", + "name": "vehicle", + "requiredOneOf": [ + "description", + "make", + "model", + "license-plate-number", + "vin", + "dyno-power", + "date-first-registration", + "image-url", + "gearbox", + "exterior color", + "interior color", + "type", + "state", + "indicative-value" + ], "uuid": "683c076c-f695-4ff2-8efa-e98a418049f4", - "name": "vehicle" -} + "version": 3 +} \ No newline at end of file diff --git a/objects/victim/definition.json b/objects/victim/definition.json index f7259a5..c83972e 100644 --- a/objects/victim/definition.json +++ b/objects/victim/definition.json @@ -1,57 +1,81 @@ { - "requiredOneOf": [ - "name", - "regions", - "sectors" - ], "attributes": { - "description": { - "description": "Description of the victim", - "ui-priority": 1, - "misp-attribute": "text" - }, - "name": { - "description": "The name of the department(s) or organisation(s) targeted.", - "ui-priority": 1, - "misp-attribute": "target-org", - "multiple": true - }, - "external": { - "description": "External target organisations affected by this attack.", - "ui-priority": 1, - "misp-attribute": "target-external", - "multiple": true - }, - "reference": { - "description": "External reference to the victim/case.", - "ui-priority": 1, - "misp-attribute": "text", - "multiple": true - }, "classification": { "description": "The type of entity being targeted.", - "misp-attribute": "text", "disable_correlation": true, - "ui-priority": 1, + "misp-attribute": "text", "sane_default": [ "individual", "group", "organization", "class", "unknown" - ] + ], + "ui-priority": 1 + }, + "description": { + "description": "Description of the victim", + "misp-attribute": "text", + "ui-priority": 1 + }, + "domain": { + "description": "Domain name of the organisation targeted.", + "misp-attribute": "domain", + "multiple": true, + "ui-priority": 1 + }, + "email": { + "description": "The email address(es) of the user targeted.", + "misp-attribute": "target-email", + "multiple": true, + "ui-priority": 1 + }, + "external": { + "description": "External target organisations affected by this attack.", + "misp-attribute": "target-external", + "multiple": true, + "ui-priority": 1 + }, + "ip-address": { + "description": "IP address(es) of the node targeted.", + "misp-attribute": "ip-dst", + "multiple": true, + "ui-priority": 1 + }, + "name": { + "description": "The name of the department(s) or organisation(s) targeted.", + "misp-attribute": "target-org", + "multiple": true, + "ui-priority": 1 + }, + "node": { + "description": "Name(s) of node that was targeted.", + "misp-attribute": "target-machine", + "multiple": true, + "ui-priority": 1 + }, + "reference": { + "description": "External reference to the victim/case.", + "misp-attribute": "text", + "multiple": true, + "ui-priority": 1 + }, + "regions": { + "description": "The list of regions or locations from the victim targeted. ISO 3166 should be used.", + "misp-attribute": "target-location", + "multiple": true, + "ui-priority": 1 }, "roles": { "description": "The list of roles targeted within the victim.", - "multiple": true, "misp-attribute": "text", + "multiple": true, "ui-priority": 1 }, "sectors": { "description": "The list of sectors that the victim belong to", - "multiple": true, "misp-attribute": "text", - "ui-priority": 1, + "multiple": true, "sane_default": [ "agriculture", "aerospace", @@ -81,48 +105,24 @@ "telecommunications", "transportation", "utilities" - ] - }, - "regions": { - "description": "The list of regions or locations from the victim targeted. ISO 3166 should be used.", - "multiple": true, - "misp-attribute": "target-location", + ], "ui-priority": 1 }, "user": { "description": "The username(s) of the user targeted.", "misp-attribute": "target-user", - "ui-priority": 1, - "multiple": true - }, - "email": { - "description": "The email address(es) of the user targeted.", - "misp-attribute": "target-email", - "ui-priority": 1, - "multiple": true - }, - "node": { - "description": "Name(s) of node that was targeted.", - "misp-attribute": "target-machine", - "ui-priority": 1, - "multiple": true - }, - "ip-address": { - "description": "IP address(es) of the node targeted.", - "misp-attribute": "ip-dst", - "ui-priority": 1, - "multiple": true - }, - "domain": { - "description": "Domain name of the organisation targeted.", - "misp-attribute": "domain", - "ui-priority": 1, - "multiple": true + "multiple": true, + "ui-priority": 1 } }, - "version": 6, "description": "Victim object describes the target of an attack or abuse.", "meta-category": "misc", + "name": "victim", + "requiredOneOf": [ + "name", + "regions", + "sectors" + ], "uuid": "a8806e40-39ad-435f-be02-ac2a13d6fc7d", - "name": "victim" -} + "version": 6 +} \ No newline at end of file diff --git a/objects/virustotal-graph/definition.json b/objects/virustotal-graph/definition.json index 22ed6a5..aefcf54 100644 --- a/objects/virustotal-graph/definition.json +++ b/objects/virustotal-graph/definition.json @@ -1,52 +1,52 @@ { - "required": [ - "permalink" - ], "attributes": { "access": { - "description": "Access to the VirusTotal graph", - "disable_correlation": true, "categories": [ "External analysis" ], - "ui-priority": 1, + "description": "Access to the VirusTotal graph", + "disable_correlation": true, "misp-attribute": "text", + "ui-priority": 1, "values_list": [ "Private", "Public" ] }, - "permalink": { - "description": "Permalink Reference to the VirusTotal graph", - "categories": [ - "External analysis" - ], - "ui-priority": 2, - "misp-attribute": "link" - }, "comment": { - "description": "Comment related to this VirusTotal graph", "categories": [ "External analysis" ], + "description": "Comment related to this VirusTotal graph", + "disable_correlation": true, "misp-attribute": "text", - "ui-priority": 2, "multiple": true, - "disable_correlation": true + "ui-priority": 2 + }, + "permalink": { + "categories": [ + "External analysis" + ], + "description": "Permalink Reference to the VirusTotal graph", + "misp-attribute": "link", + "ui-priority": 2 }, "screenshot": { - "description": "Screenshot of the VirusTotal graph", - "misp-attribute": "attachment", - "disable_correlation": true, - "ui-priority": 1, "categories": [ "External analysis" - ] + ], + "description": "Screenshot of the VirusTotal graph", + "disable_correlation": true, + "misp-attribute": "attachment", + "ui-priority": 1 } }, - "version": 1, "description": "VirusTotal graph", "meta-category": "misc", + "name": "virustotal-graph", + "required": [ + "permalink" + ], "uuid": "9b421055-b1bb-4c33-9ead-7fa3f39e2232", - "name": "virustotal-graph" -} + "version": 1 +} \ No newline at end of file diff --git a/objects/virustotal-report/definition.json b/objects/virustotal-report/definition.json index bc07cca..0a85f4c 100644 --- a/objects/virustotal-report/definition.json +++ b/objects/virustotal-report/definition.json @@ -1,63 +1,63 @@ { + "attributes": { + "comment": { + "categories": [ + "External analysis" + ], + "description": "Comment related to this hash", + "misp-attribute": "text", + "multiple": true, + "ui-priority": 2 + }, + "community-score": { + "categories": [ + "External analysis" + ], + "description": "Community Score", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 0 + }, + "detection-ratio": { + "categories": [ + "External analysis" + ], + "description": "Detection Ratio", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 1 + }, + "first-submission": { + "categories": [ + "Other" + ], + "description": "First Submission", + "misp-attribute": "datetime", + "ui-priority": 0 + }, + "last-submission": { + "categories": [ + "Other" + ], + "description": "Last Submission", + "misp-attribute": "datetime", + "ui-priority": 0 + }, + "permalink": { + "categories": [ + "External analysis" + ], + "description": "Permalink Reference", + "misp-attribute": "link", + "ui-priority": 2 + } + }, + "description": "VirusTotal report", + "meta-category": "misc", + "name": "virustotal-report", "required": [ "permalink" ], - "attributes": { - "community-score": { - "description": "Community Score", - "disable_correlation": true, - "categories": [ - "External analysis" - ], - "ui-priority": 0, - "misp-attribute": "text" - }, - "detection-ratio": { - "description": "Detection Ratio", - "disable_correlation": true, - "categories": [ - "External analysis" - ], - "ui-priority": 1, - "misp-attribute": "text" - }, - "first-submission": { - "description": "First Submission", - "categories": [ - "Other" - ], - "ui-priority": 0, - "misp-attribute": "datetime" - }, - "last-submission": { - "description": "Last Submission", - "categories": [ - "Other" - ], - "ui-priority": 0, - "misp-attribute": "datetime" - }, - "permalink": { - "description": "Permalink Reference", - "categories": [ - "External analysis" - ], - "ui-priority": 2, - "misp-attribute": "link" - }, - "comment": { - "description": "Comment related to this hash", - "categories": [ - "External analysis" - ], - "misp-attribute": "text", - "ui-priority": 2, - "multiple": true - } - }, - "version": 3, - "description": "VirusTotal report", - "meta-category": "misc", "uuid": "d7dd0154-e04f-4c34-a2fb-79f3a3a52aa4", - "name": "virustotal-report" -} + "version": 3 +} \ No newline at end of file diff --git a/objects/vulnerability/definition.json b/objects/vulnerability/definition.json index d381ffd..1bfca53 100644 --- a/objects/vulnerability/definition.json +++ b/objects/vulnerability/definition.json @@ -1,4 +1,89 @@ { + "attributes": { + "created": { + "description": "First time when the vulnerability was discovered", + "disable_correlation": true, + "misp-attribute": "datetime", + "ui-priority": 0 + }, + "credit": { + "description": "Who reported/found the vulnerability such as an organisation, person or nickname.", + "disable_correlation": true, + "misp-attribute": "text", + "multiple": true, + "ui-priority": 0 + }, + "cvss-score": { + "description": "Score of the Common Vulnerability Scoring System (version 3).", + "disable_correlation": true, + "misp-attribute": "float", + "ui-priority": 1 + }, + "cvss-string": { + "description": "String of the Common Vulnerability Scoring System (version 3).", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 1 + }, + "description": { + "description": "Description of the vulnerability", + "misp-attribute": "text", + "ui-priority": 0 + }, + "id": { + "description": "Vulnerability ID (generally CVE, but not necessarely). The id is not required as the object itself has an UUID and the CVE id can be update or assigned later.", + "misp-attribute": "text", + "multiple": true, + "ui-priority": 0 + }, + "modified": { + "description": "Last modification date", + "disable_correlation": true, + "misp-attribute": "datetime", + "ui-priority": 0 + }, + "published": { + "description": "Initial publication date", + "disable_correlation": true, + "misp-attribute": "datetime", + "ui-priority": 0 + }, + "references": { + "description": "External references", + "misp-attribute": "link", + "multiple": true, + "ui-priority": 0 + }, + "state": { + "description": "State of the vulnerability. A vulnerability can have multiple states depending of the current actions performed.", + "disable_correlation": true, + "misp-attribute": "text", + "multiple": true, + "sane_default": [ + "Published", + "Embargo", + "Reviewed", + "Vulnerability ID Assigned", + "Reported", + "Fixed" + ], + "ui-priority": 0 + }, + "summary": { + "description": "Summary of the vulnerability", + "misp-attribute": "text", + "ui-priority": 0 + }, + "vulnerable-configuration": { + "description": "The vulnerable configuration is described in CPE format", + "misp-attribute": "text", + "multiple": true, + "ui-priority": 0 + } + }, + "description": "Vulnerability object describing a common vulnerability enumeration which can describe published, unpublished, under review or embargo vulnerability for software, equipments or hardware.", + "meta-category": "vulnerability", + "name": "vulnerability", "requiredOneOf": [ "published", "modified", @@ -8,91 +93,6 @@ "description", "id" ], - "attributes": { - "id": { - "description": "Vulnerability ID (generally CVE, but not necessarely). The id is not required as the object itself has an UUID and the CVE id can be update or assigned later.", - "ui-priority": 0, - "misp-attribute": "text", - "multiple": true - }, - "description": { - "description": "Description of the vulnerability", - "ui-priority": 0, - "misp-attribute": "text" - }, - "summary": { - "description": "Summary of the vulnerability", - "ui-priority": 0, - "misp-attribute": "text" - }, - "vulnerable-configuration": { - "description": "The vulnerable configuration is described in CPE format", - "multiple": true, - "ui-priority": 0, - "misp-attribute": "text" - }, - "modified": { - "description": "Last modification date", - "ui-priority": 0, - "misp-attribute": "datetime", - "disable_correlation": true - }, - "published": { - "description": "Initial publication date", - "ui-priority": 0, - "misp-attribute": "datetime", - "disable_correlation": true - }, - "created": { - "description": "First time when the vulnerability was discovered", - "ui-priority": 0, - "misp-attribute": "datetime", - "disable_correlation": true - }, - "references": { - "description": "External references", - "multiple": true, - "ui-priority": 0, - "misp-attribute": "link" - }, - "state": { - "description": "State of the vulnerability. A vulnerability can have multiple states depending of the current actions performed.", - "multiple": true, - "ui-priority": 0, - "sane_default": [ - "Published", - "Embargo", - "Reviewed", - "Vulnerability ID Assigned", - "Reported", - "Fixed" - ], - "disable_correlation": true, - "misp-attribute": "text" - }, - "cvss-score": { - "description": "Score of the Common Vulnerability Scoring System (version 3).", - "ui-priority": 1, - "disable_correlation": true, - "misp-attribute": "float" - }, - "cvss-string": { - "description": "String of the Common Vulnerability Scoring System (version 3).", - "ui-priority": 1, - "disable_correlation": true, - "misp-attribute": "text" - }, - "credit": { - "description": "Who reported/found the vulnerability such as an organisation, person or nickname.", - "ui-priority": 0, - "disable_correlation": true, - "misp-attribute": "text", - "multiple": true - } - }, - "version": 6, - "description": "Vulnerability object describing a common vulnerability enumeration which can describe published, unpublished, under review or embargo vulnerability for software, equipments or hardware.", - "meta-category": "vulnerability", "uuid": "81650945-f186-437b-8945-9f31715d32da", - "name": "vulnerability" -} + "version": 6 +} \ No newline at end of file diff --git a/objects/weakness/definition.json b/objects/weakness/definition.json index cc0c881..0ddf154 100644 --- a/objects/weakness/definition.json +++ b/objects/weakness/definition.json @@ -1,52 +1,52 @@ { - "requiredOneOf": [ - "id", - "name", - "description" - ], "attributes": { - "id": { - "description": "Weakness ID (generally CWE).", - "ui-priority": 0, - "misp-attribute": "text" - }, "description": { "description": "Description of the weakness.", - "ui-priority": 0, - "misp-attribute": "text" + "misp-attribute": "text", + "ui-priority": 0 + }, + "id": { + "description": "Weakness ID (generally CWE).", + "misp-attribute": "text", + "ui-priority": 0 }, "name": { "description": "Name of the weakness.", - "ui-priority": 0, - "misp-attribute": "text" + "misp-attribute": "text", + "ui-priority": 0 }, "status": { "description": "Status of the weakness.", - "ui-priority": 0, + "disable_correlation": true, + "misp-attribute": "text", "sane_default": [ "Incomplete", "Deprecated", "Draft", "Usable" ], - "disable_correlation": true, - "misp-attribute": "text" + "ui-priority": 0 }, "weakness-abs": { "description": "Abstraction of the weakness.", - "ui-priority": 0, + "disable_correlation": true, + "misp-attribute": "text", "sane_default": [ "Class", "Base", "Variant" ], - "disable_correlation": true, - "misp-attribute": "text" + "ui-priority": 0 } }, - "version": 1, "description": "Weakness object describing a common weakness enumeration which can describe usable, incomplete, draft or deprecated weakness for software, equipment of hardware.", "meta-category": "vulnerability", + "name": "weakness", + "requiredOneOf": [ + "id", + "name", + "description" + ], "uuid": "b8713fc0-d7a2-4b27-a182-38ed47966802", - "name": "weakness" -} + "version": 1 +} \ No newline at end of file diff --git a/objects/whois/definition.json b/objects/whois/definition.json index ed91c86..fc1bd3e 100644 --- a/objects/whois/definition.json +++ b/objects/whois/definition.json @@ -1,4 +1,87 @@ { + "attributes": { + "comment": { + "description": "Comment of the whois entry", + "misp-attribute": "text", + "ui-priority": 0 + }, + "creation-date": { + "description": "Initial creation of the whois entry", + "disable_correlation": true, + "misp-attribute": "datetime", + "ui-priority": 0 + }, + "domain": { + "categories": [ + "Network activity", + "External analysis" + ], + "description": "Domain of the whois entry", + "misp-attribute": "domain", + "multiple": true, + "ui-priority": 0 + }, + "expiration-date": { + "description": "Expiration of the whois entry", + "disable_correlation": true, + "misp-attribute": "datetime", + "ui-priority": 0 + }, + "ip-address": { + "description": "IP address of the whois entry", + "misp-attribute": "ip-src", + "multiple": true, + "ui-priority": 0 + }, + "modification-date": { + "description": "Last update of the whois entry", + "disable_correlation": true, + "misp-attribute": "datetime", + "ui-priority": 0 + }, + "nameserver": { + "description": "Nameserver", + "disable_correlation": true, + "misp-attribute": "hostname", + "multiple": true, + "to_ids": false, + "ui-priority": 0 + }, + "registrant-email": { + "description": "Registrant email address", + "misp-attribute": "whois-registrant-email", + "ui-priority": 1 + }, + "registrant-name": { + "description": "Registrant name", + "misp-attribute": "whois-registrant-name", + "ui-priority": 0 + }, + "registrant-org": { + "description": "Registrant organisation", + "misp-attribute": "whois-registrant-org", + "ui-priority": 1 + }, + "registrant-phone": { + "description": "Registrant phone number", + "misp-attribute": "whois-registrant-phone", + "ui-priority": 0 + }, + "registrar": { + "description": "Registrar of the whois entry", + "misp-attribute": "whois-registrar", + "ui-priority": 0 + }, + "text": { + "description": "Full whois entry", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 1 + } + }, + "description": "Whois records information for a domain name or an IP address.", + "meta-category": "network", + "name": "whois", "requiredOneOf": [ "registrant-email", "registrant-phone", @@ -9,89 +92,6 @@ "domain", "ip-address" ], - "attributes": { - "text": { - "description": "Full whois entry", - "disable_correlation": true, - "ui-priority": 1, - "misp-attribute": "text" - }, - "registrar": { - "description": "Registrar of the whois entry", - "ui-priority": 0, - "misp-attribute": "whois-registrar" - }, - "registrant-name": { - "description": "Registrant name", - "ui-priority": 0, - "misp-attribute": "whois-registrant-name" - }, - "registrant-phone": { - "description": "Registrant phone number", - "ui-priority": 0, - "misp-attribute": "whois-registrant-phone" - }, - "registrant-email": { - "description": "Registrant email address", - "ui-priority": 1, - "misp-attribute": "whois-registrant-email" - }, - "registrant-org": { - "description": "Registrant organisation", - "ui-priority": 1, - "misp-attribute": "whois-registrant-org" - }, - "creation-date": { - "description": "Initial creation of the whois entry", - "disable_correlation": true, - "ui-priority": 0, - "misp-attribute": "datetime" - }, - "modification-date": { - "description": "Last update of the whois entry", - "disable_correlation": true, - "ui-priority": 0, - "misp-attribute": "datetime" - }, - "expiration-date": { - "description": "Expiration of the whois entry", - "disable_correlation": true, - "ui-priority": 0, - "misp-attribute": "datetime" - }, - "nameserver": { - "description": "Nameserver", - "ui-priority": 0, - "misp-attribute": "hostname", - "disable_correlation": true, - "multiple": true, - "to_ids": false - }, - "domain": { - "description": "Domain of the whois entry", - "categories": [ - "Network activity", - "External analysis" - ], - "ui-priority": 0, - "multiple": true, - "misp-attribute": "domain" - }, - "comment": { - "description": "Comment of the whois entry", - "ui-priority": 0, - "misp-attribute": "text" - }, - "ip-address": { - "description": "IP address of the whois entry", - "ui-priority": 0, - "multiple": true, - "misp-attribute": "ip-src" - } - }, - "version": 10, - "description": "Whois records information for a domain name or an IP address.", - "meta-category": "network", "uuid": "429faea1-34ff-47af-8a00-7c62d3be5a6a", - "name": "whois" -} + "version": 10 +} \ No newline at end of file diff --git a/objects/x509/definition.json b/objects/x509/definition.json index f97b462..f292cda 100644 --- a/objects/x509/definition.json +++ b/objects/x509/definition.json @@ -1,4 +1,149 @@ { + "attributes": { + "dns_names": { + "description": "Subject Alternative Name - DNS names", + "misp-attribute": "hostname", + "multiple": true, + "ui-priority": 0 + }, + "email": { + "description": "Subject Alternative Name - emails", + "misp-attribute": "email-dst", + "multiple": true, + "ui-priority": 0 + }, + "ip": { + "description": "Subject Alternative Name - IP", + "misp-attribute": "ip-dst", + "multiple": true, + "ui-priority": 0 + }, + "is_ca": { + "description": "CA certificate", + "disable_correlation": true, + "misp-attribute": "boolean", + "ui-priority": 0 + }, + "issuer": { + "description": "Issuer of the certificate", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 0 + }, + "pem": { + "description": "Raw certificate in PEM formati (Unix-like newlines)", + "misp-attribute": "text", + "ui-priority": 0 + }, + "pubkey-info-algorithm": { + "description": "Algorithm of the public key", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 0 + }, + "pubkey-info-exponent": { + "description": "Exponent of the public key - in decimal", + "misp-attribute": "text", + "ui-priority": 0 + }, + "pubkey-info-modulus": { + "description": "Modulus of the public key - in Hexadecimal - no 0x, no :", + "misp-attribute": "text", + "ui-priority": 0 + }, + "pubkey-info-size": { + "description": "Length of the public key (in bits expressed in decimal: eg. 256 bits)", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 0 + }, + "raw-base64": { + "description": "Raw certificate base64 encoded (DER format)", + "misp-attribute": "text", + "ui-priority": 0 + }, + "rid": { + "description": "Subject Alternative Name - RID", + "misp-attribute": "text", + "multiple": true, + "ui-priority": 0 + }, + "self_signed": { + "description": "Self-signed certificate", + "disable_correlation": true, + "misp-attribute": "boolean", + "ui-priority": 0 + }, + "serial-number": { + "description": "Serial number of the certificate", + "misp-attribute": "text", + "ui-priority": 0 + }, + "signature_algorithm": { + "description": "Signature algorithm", + "disable_correlation": true, + "misp-attribute": "text", + "sane_default": [ + "SHA1_WITH_RSA_ENCRYPTION", + "SHA256_WITH_RSA_ENCRYPTION" + ], + "ui-priority": 0 + }, + "subject": { + "description": "Subject of the certificate", + "misp-attribute": "text", + "ui-priority": 1 + }, + "text": { + "description": "Free text description of the certificate", + "misp-attribute": "text", + "ui-priority": 1 + }, + "uri": { + "description": "Subject Alternative Name - URI", + "misp-attribute": "uri", + "multiple": true, + "ui-priority": 0 + }, + "validity-not-after": { + "description": "Certificate invalid after that date", + "disable_correlation": true, + "misp-attribute": "datetime", + "ui-priority": 0 + }, + "validity-not-before": { + "description": "Certificate invalid before that date", + "disable_correlation": true, + "misp-attribute": "datetime", + "ui-priority": 0 + }, + "version": { + "description": "Version of the certificate", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 0 + }, + "x509-fingerprint-md5": { + "description": "[Insecure] MD5 hash (128 bits)", + "misp-attribute": "x509-fingerprint-md5", + "recommended": false, + "ui-priority": 1 + }, + "x509-fingerprint-sha1": { + "description": "[Insecure] Secure Hash Algorithm 1 (160 bits)", + "misp-attribute": "x509-fingerprint-sha1", + "recommended": false, + "ui-priority": 1 + }, + "x509-fingerprint-sha256": { + "description": "Secure Hash Algorithm 2 (256 bits)", + "misp-attribute": "x509-fingerprint-sha256", + "ui-priority": 1 + } + }, + "description": "x509 object describing a X.509 certificate", + "meta-category": "network", + "name": "x509", "requiredOneOf": [ "x509-fingerprint-md5", "x509-fingerprint-sha1", @@ -6,151 +151,6 @@ "serial-number", "issuer" ], - "attributes": { - "subject": { - "description": "Subject of the certificate", - "ui-priority": 1, - "misp-attribute": "text" - }, - "pubkey-info-algorithm": { - "description": "Algorithm of the public key", - "ui-priority": 0, - "misp-attribute": "text", - "disable_correlation": true - }, - "pubkey-info-size": { - "description": "Length of the public key (in bits expressed in decimal: eg. 256 bits)", - "ui-priority": 0, - "misp-attribute": "text", - "disable_correlation": true - }, - "pubkey-info-exponent": { - "description": "Exponent of the public key - in decimal", - "ui-priority": 0, - "misp-attribute": "text" - }, - "pubkey-info-modulus": { - "description": "Modulus of the public key - in Hexadecimal - no 0x, no :", - "ui-priority": 0, - "misp-attribute": "text" - }, - "x509-fingerprint-md5": { - "description": "[Insecure] MD5 hash (128 bits)", - "ui-priority": 1, - "misp-attribute": "x509-fingerprint-md5", - "recommended": false - }, - "x509-fingerprint-sha1": { - "description": "[Insecure] Secure Hash Algorithm 1 (160 bits)", - "ui-priority": 1, - "misp-attribute": "x509-fingerprint-sha1", - "recommended": false - }, - "x509-fingerprint-sha256": { - "description": "Secure Hash Algorithm 2 (256 bits)", - "ui-priority": 1, - "misp-attribute": "x509-fingerprint-sha256" - }, - "raw-base64": { - "description": "Raw certificate base64 encoded (DER format)", - "ui-priority": 0, - "misp-attribute": "text" - }, - "pem": { - "description": "Raw certificate in PEM formati (Unix-like newlines)", - "ui-priority": 0, - "misp-attribute": "text" - }, - "text": { - "description": "Free text description of the certificate", - "ui-priority": 1, - "misp-attribute": "text" - }, - "validity-not-before": { - "description": "Certificate invalid before that date", - "ui-priority": 0, - "misp-attribute": "datetime", - "disable_correlation": true - }, - "validity-not-after": { - "description": "Certificate invalid after that date", - "ui-priority": 0, - "misp-attribute": "datetime", - "disable_correlation": true - }, - "issuer": { - "description": "Issuer of the certificate", - "ui-priority": 0, - "misp-attribute": "text", - "disable_correlation": true - }, - "serial-number": { - "description": "Serial number of the certificate", - "ui-priority": 0, - "misp-attribute": "text" - }, - "version": { - "description": "Version of the certificate", - "ui-priority": 0, - "misp-attribute": "text", - "disable_correlation": true - }, - "self_signed": { - "description": "Self-signed certificate", - "ui-priority": 0, - "misp-attribute": "boolean", - "disable_correlation": true - }, - "is_ca": { - "description": "CA certificate", - "ui-priority": 0, - "misp-attribute": "boolean", - "disable_correlation": true - }, - "dns_names": { - "description": "Subject Alternative Name - DNS names", - "multiple": true, - "misp-attribute": "hostname", - "ui-priority": 0 - }, - "email": { - "description": "Subject Alternative Name - emails", - "multiple": true, - "misp-attribute": "email-dst", - "ui-priority": 0 - }, - "ip": { - "description": "Subject Alternative Name - IP", - "multiple": true, - "misp-attribute": "ip-dst", - "ui-priority": 0 - }, - "uri": { - "description": "Subject Alternative Name - URI", - "multiple": true, - "misp-attribute": "uri", - "ui-priority": 0 - }, - "rid": { - "description": "Subject Alternative Name - RID", - "multiple": true, - "misp-attribute": "text", - "ui-priority": 0 - }, - "signature_algorithm": { - "description": "Signature algorithm", - "misp-attribute": "text", - "ui-priority": 0, - "disable_correlation": true, - "sane_default": [ - "SHA1_WITH_RSA_ENCRYPTION", - "SHA256_WITH_RSA_ENCRYPTION" - ] - } - }, - "version": 12, - "description": "x509 object describing a X.509 certificate", - "meta-category": "network", "uuid": "d1ab756a-26b5-4349-9f43-765630f0911c", - "name": "x509" -} + "version": 12 +} \ No newline at end of file diff --git a/objects/yabin/definition.json b/objects/yabin/definition.json index 6c0003d..836d77c 100644 --- a/objects/yabin/definition.json +++ b/objects/yabin/definition.json @@ -1,40 +1,40 @@ { - "requiredOneOf": [ - "yara", - "yara-hunt" - ], "attributes": { - "version": { - "description": "yabin.py and regex.txt version used for the generation of the yara rules.", - "ui-priority": 0, - "misp-attribute": "comment" - }, "comment": { "description": "A description of Yara rule generated.", - "ui-priority": 0, - "misp-attribute": "comment" + "misp-attribute": "comment", + "ui-priority": 0 + }, + "version": { + "description": "yabin.py and regex.txt version used for the generation of the yara rules.", + "misp-attribute": "comment", + "ui-priority": 0 }, "whitelist": { "description": "Whitelist name used to generate the rules.", - "ui-priority": 0, - "misp-attribute": "comment" - }, - "yara-hunt": { - "description": "Wide yara rule generated from -yh.", - "disable_correlation": true, - "ui-priority": 0, - "misp-attribute": "yara" + "misp-attribute": "comment", + "ui-priority": 0 }, "yara": { "description": "Yara rule generated from -y.", "disable_correlation": true, - "ui-priority": 0, - "misp-attribute": "yara" + "misp-attribute": "yara", + "ui-priority": 0 + }, + "yara-hunt": { + "description": "Wide yara rule generated from -yh.", + "disable_correlation": true, + "misp-attribute": "yara", + "ui-priority": 0 } }, - "version": 2, "description": "yabin.py generates Yara rules from function prologs, for matching and hunting binaries. ref: https://github.com/AlienVault-OTX/yabin", "meta-category": "file", + "name": "yabin", + "requiredOneOf": [ + "yara", + "yara-hunt" + ], "uuid": "35b4dd03-4fa9-4e0e-97d8-a2867b11c956", - "name": "yabin" -} + "version": 2 +} \ No newline at end of file diff --git a/objects/yara/definition.json b/objects/yara/definition.json index 4b9ba94..01d747c 100644 --- a/objects/yara/definition.json +++ b/objects/yara/definition.json @@ -1,47 +1,47 @@ { - "requiredOneOf": [ - "yara", - "yara-rule-name" - ], "attributes": { "comment": { "description": "A description of the YARA rule.", - "ui-priority": 0, - "misp-attribute": "comment" - }, - "yara": { - "description": "YARA rule.", - "ui-priority": 0, - "misp-attribute": "yara" - }, - "yara-rule-name": { - "description": "YARA rule name.", - "ui-priority": 0, - "misp-attribute": "text" - }, - "version": { - "sane_default": [ - "3.7.1" - ], - "description": "Version of the YARA rule depending where the yara rule is known to work as expected.", - "ui-priority": 0, - "misp-attribute": "text" + "misp-attribute": "comment", + "ui-priority": 0 }, "context": { "description": "Context where the YARA rule can be applied", + "misp-attribute": "text", "sane_default": [ "all", "disk", "memory", "network" ], + "ui-priority": 0 + }, + "version": { + "description": "Version of the YARA rule depending where the yara rule is known to work as expected.", + "misp-attribute": "text", + "sane_default": [ + "3.7.1" + ], + "ui-priority": 0 + }, + "yara": { + "description": "YARA rule.", + "misp-attribute": "yara", + "ui-priority": 0 + }, + "yara-rule-name": { + "description": "YARA rule name.", "misp-attribute": "text", "ui-priority": 0 } }, - "version": 4, "description": "An object describing a YARA rule (or a YARA rule name) along with its version.", "meta-category": "misc", + "name": "yara", + "requiredOneOf": [ + "yara", + "yara-rule-name" + ], "uuid": "b5acf82e-ecca-4868-82fe-9dbdf4d808c3", - "name": "yara" -} + "version": 4 +} \ No newline at end of file