From f9bb8bfa9bfe0eb3813df4dc5efa355bece53ce7 Mon Sep 17 00:00:00 2001
From: Alexandre Dulaunoy <a@foo.be>
Date: Mon, 11 Feb 2019 06:45:18 +0100
Subject: [PATCH] chg: [phishing] removed the IDS flag on the email used for
 takedown - and change attribute type

---
 objects/phishing/definition.json | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/objects/phishing/definition.json b/objects/phishing/definition.json
index bb886e7..3b0c4d2 100644
--- a/objects/phishing/definition.json
+++ b/objects/phishing/definition.json
@@ -68,13 +68,14 @@
     },
     "takedown-request-to": {
       "description": "Destination email address for take-down request",
-      "misp-attribute": "email-dst",
+      "misp-attribute": "text",
       "disable_correlation": true,
       "ui-priority": 1,
       "categories": [
-        "Network activity"
+        "Other"
       ],
-      "multiple": true
+      "multiple": true,
+      "to_ids": false
     },
     "target": {
       "description": "Targeted organisation by the phishing",
@@ -99,7 +100,7 @@
       ]
     }
   },
-  "version": 3,
+  "version": 4,
   "description": "Phishing template to describe a phishing website and its analysis.",
   "meta-category": "network",
   "uuid": "2dad6f9d-d425-4217-8fda-0b0a2d815307",