MISP
/
misp-objects
mirror of https://github.com/MISP/misp-objects
2
0
Fork 0
Code Issues Releases Wiki Activity

Network connection object

pull/98/head
chrisr3d 2018-05-03 14:11:14 +02:00
parent 3b5db95174
commit e07f2d5c62
No known key found for this signature in database
GPG Key ID: 6BBED1B63A6D639F
1 changed files with 86 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

86
objects/network-connection/definition.json Normal file
View File

@ -0,0 +1,86 @@
{
"name": "network-connection",
"uuid": "af16764b-f8e5-4603-9de1-de34d272f80b",
"meta-category": "network",
"description": "",
"version": 1,
"attributes":{
"ip-src": {
"description": "Source IP address of the nework connection.",
"ui-priority": 1,
"categories": [
"Network activity",
"External analysis"
],
"misp-attribute": "ip-src"
},
"ip-dst": {
"description": "Destination IP address of the nework connection.",
"ui-priority": 1,
"categories": [
"Network activity",
"External analysis"
],
"misp-attribute": "ip-dst"
},
"src-port": {
"description": "Source port of the nework connection.",
"ui-priority": 1,
"categories": [
"Network activity",
"External analysis"
],
"misp-attribute": "port"
},
"dst-port": {
"description": "Destination port of the nework connection.",
"ui-priority": 1,
"categories": [
"Network activity",
"External analysis"
],
"misp-attribute": "port"
},
"layer3-protocol": {
"description": "Layer 3 protocol of the network connection.",
"ui-priority": 0,
"sane_default": [
"IP",
"ICMP",
"ARP"
],
"misp-attribute": "text"
},
"layer4-protocol": {
"description": "Layer 4 protocol of the network connection.",
"ui-priority": 0,
"sane_default": [
"TCP",
"UDP"
],
"misp-attribute": "text"
},
"layer7-protocol": {
"description": "Layer 7 protocol of the network connection.",
"ui-priority": 0,
"sane_default": [
"HTTP",
"HTTPS",
"FTP"
],
"misp-attribute": "text"
},
"first-packet-seen": {
"misp-attribute": "datetime",
"ui-priority": 1,
"description": "Datetime of the first packet seen."
}
},
"requireOneOf": [
"first-packet-seen",
"ip-src",
"ip-dst",
"src-port",
"dst-port"
]
}