From e90b1ce4575c122d410f143d5205771614004d9f Mon Sep 17 00:00:00 2001 From: Alexandre Dulaunoy Date: Tue, 28 Aug 2018 14:30:29 +0200 Subject: [PATCH] chg: [ja3] categories removed (default attributes categories will be used) Fix MISP/MISP/issues/3593 --- objects/ja3/definition.json | 22 +++------------------- 1 file changed, 3 insertions(+), 19 deletions(-) diff --git a/objects/ja3/definition.json b/objects/ja3/definition.json index fb60f1c..6dcee9f 100644 --- a/objects/ja3/definition.json +++ b/objects/ja3/definition.json @@ -2,43 +2,27 @@ "name": "ja3", "meta-category": "network", "description": "JA3 is a new technique for creating SSL client fingerprints that are easy to produce and can be easily shared for threat intelligence. Fingerprints are composed of Client Hello packet; SSL Version, Accepted Ciphers, List of Extensions, Elliptic Curves, and Elliptic Curve Formats. https://github.com/salesforce/ja3", - "version": 2, + "version": 3, "uuid": "09b45449-5d6e-492c-a68a-cb2e188cbfac", "attributes": { "ja3-fingerprint-md5": { "description": "Hash identifying source", "misp-attribute": "md5", - "ui-priority": 1, - "categories": [ - "Network activity", - "External analysis" - ] + "ui-priority": 1 }, "description": { "description": "Type of detected software ie software, malware", "misp-attribute": "text", - "ui-priority": 1, - "categories": [ - "Network activity", - "External analysis" - ] + "ui-priority": 1 }, "ip-src": { "description": "Source IP Address", "misp-attribute": "ip-src", - "categories": [ - "Network activity", - "External analysis" - ], "ui-priority": 1 }, "ip-dst": { "description": "Destination IP address", "misp-attribute": "ip-dst", - "categories": [ - "Network activity", - "External analysis" - ], "ui-priority": 1 }, "first-seen": {