new misp object for a timesketch message

to be able to push timesketch messages (timesketch.org) to a misp event it is handy to have a specific type of object for it.
pull/130/head
Alexander J 2018-11-23 15:40:57 +01:00 committed by GitHub
parent 7808850ce2
commit e44dd16b18
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 26 additions and 0 deletions

View File

@ -0,0 +1,26 @@
{
"required": [
"datetime",
"message"
],
"attributes": {
"datetime": {
"description": "datetime of the message",
"disable_correlation": true,
"ui-priority": 1,
"misp-attribute": "datetime",
"recommended": true
},
"message": {
"description": "message",
"disable_correlation": true,
"ui-priority": 0,
"misp-attribute": "text"
}
},
"version": 1,
"description": "A timesketch message entry.",
"meta-category": "misc",
"uuid": "ef27fb19-7e71-43e0-b6f6-6f03ab67666f",
"name": "timesketch_message"
}