MISP
/
misp-objects
mirror of https://github.com/MISP/misp-objects
2
0
Fork 0
Code Issues Releases Wiki Activity
1,447 Commits
6 Branches
44 Tags
12 MiB
Commit Graph

1012 Commits (6e98779d1a87d7038c7e6e6ac6b8f234d9d93cf2)

Author SHA1 Message Date
Alexandre Dulaunoy 87a40ae57d
chg: [ftm-Company/github] update template version 2022-01-06 16:50:29 +01:00
Alexandre Dulaunoy e9dfbc54c4
chg: [ftm-Company] new line 2022-01-06 16:49:16 +01:00
Alexandre Dulaunoy 74c6943bab
Merge branch 'patch-1' of https://github.com/dreyergustav/misp-objects into dreyergustav-patch-1 2022-01-06 16:48:09 +01:00
chrisr3d b32b7f84fc
add: [github-user] Added the `id` object relation for the GitHub user id 2022-01-06 14:11:57 +01:00
dreyergustav f90a06ce95
Add description to ftm-Company object template 
The empty string value in the description key caused an error when new objects were added to events.
 2022-01-06 13:01:18 +01:00
Alexandre Dulaunoy 0e5fa57d82
chg: [probabilistic-data-structure] updated followng JL feedback 2021-12-29 16:27:26 +01:00
Alexandre Dulaunoy 5a4f7efbc8
new: [probabilistic-data-structure] Probabilistic data structure object describe a space-efficient data structure such as Bloom filter or similar structure. 2021-12-29 15:09:38 +01:00
Alexandre Dulaunoy b75be5cb19
chg: [person] occupation added 2021-12-22 10:25:13 +01:00
Alexandre Dulaunoy 734bfee82f
fix: [temporal-event] newline issue 2021-12-21 08:15:06 +01:00
Alexandre Dulaunoy 6e5db86325
chg: [temporal-event] fix typo in template name 2021-12-21 08:12:21 +01:00
Lucas Magalhães 27fce9e7ec Add sane default for boolean objects 2021-12-20 20:02:29 +00:00
Jeroen Pinoy b63b645635
chg: add requiredOneOf for postal-address 2021-12-20 14:15:10 +01:00
Raphaël Vinot 1c3882581e fix: incorrect entry in CMTMF_ATCKID 2021-12-20 13:17:46 +01:00
Alexandre Dulaunoy 1d93c1ae63
fix: [concordia] new-lines 2021-12-20 11:36:44 +01:00
Alexandre Dulaunoy 3221dc0ed7
new: [concordia-mtmf-intrusion-set] New object intrusion-set for mobile attacks 2021-12-20 11:31:41 +01:00
Alexandre Dulaunoy b3b24473f2
chg: [person/organization] add new role values such as Source, Originator, Informant, Emitter 
Fix #338

Emitter has been added for cases in SIGINT and MASINT where emitter
terminology can be used.
 2021-12-14 17:24:00 +01:00
Alexandre Dulaunoy 9dc7e3578f
new: [temporal-event] temporal event added 2021-12-07 15:26:23 +01:00
Alexandre Dulaunoy 282048b18f
chg: [user-account] fixing the Hungarian leader GitHub edit perversion 2021-11-30 10:34:35 +01:00
Andras Iklody a153553df1
fix: [user-account] added description to avoid issues in MISP 2021-11-30 10:24:06 +01:00
Alexandre Dulaunoy 9ee8f2912d
chg: [person] optional function field added 
Credits: feedback from student at University of Lorraine
 2021-11-27 11:56:39 +01:00
Sami Tainio 56f09c4431 Ran jq_all_the_things_.sh 2021-11-26 15:37:32 +02:00
Sami Tainio 9178943a75
add: [email] Added display name attribute for reply-to 2021-11-26 15:26:40 +02:00
Alexandre Dulaunoy d2606f6688
chg: [ja3s] updated 2021-11-14 22:38:47 +01:00
Alexandre Dulaunoy b9ea4e1278
new: [ja3s] JA3 server object template added Fix #296 2021-11-14 22:33:58 +01:00
iglocska 3ed8f7ae6e
chg: [submarine] fixes and list of types added 2021-11-12 08:39:35 +01:00
iglocska 66c037177e
fix: [naval] meta category fixed 2021-11-12 08:36:00 +01:00
iglocska dba92cbd53
chg: jq all the things 2021-11-12 08:33:24 +01:00
iglocska 6a970c03a4
new: submarine object template added 2021-11-12 08:31:54 +01:00
iglocska 44c7a7fc56
Revert "new: added submarine" 
This reverts commit d1401437cb.
 2021-11-12 08:29:47 +01:00
iglocska d1401437cb
new: added submarine 2021-11-12 08:28:53 +01:00
Jeroen Pinoy e1a809ed2c
new: postal address object 2021-11-03 22:00:49 +01:00
Alexandre Dulaunoy ae6a527bcb
chg: [report] disable correlation on report type 2021-11-02 09:06:18 +01:00
Alexandre Dulaunoy 1cd5a3e9f0
chg: [passive-ssh] newlines disaster 2021-10-26 14:03:24 +02:00
Jean-Louis Huynen fa397128bf
chg: [passive-ssh] change fingerprint type 2021-10-26 11:50:23 +02:00
Alexandre Dulaunoy 95a23d219e
chg: [device] ui-priority added 2021-10-25 16:05:04 +02:00
Alexandre Dulaunoy 570a5c18b6
chg: [devices] fixed missing ui-priority 2021-10-25 15:56:50 +02:00
Alexandre Dulaunoy 3e491aa83b
Merge branch 'main' of github.com:MISP/misp-objects into main 2021-10-25 15:53:12 +02:00
Alexandre Dulaunoy dcc9e4c8be
chg: [device] added hits, status and infection_type (from ShadowServer) 
- request for VarIOT project
 2021-10-25 15:52:34 +02:00
Alexandre Dulaunoy c380279dca
Merge pull request #332 from gallypette/master 
add: [passive-ssh] new object
 2021-10-25 15:36:58 +02:00
Alexandre Dulaunoy 960a03be22
chg: [geolocation] countrycode added as requested for the VarIOT. 2021-10-25 15:35:23 +02:00
misp dac24a50c9 add: [passive-ssh] new object 2021-10-25 12:29:52 +02:00
chrisr3d b0eb0779df
fix: [report] Removed parenthesis from the object relation `report-file` 2021-10-25 12:02:25 +02:00
chrisr3d eb0af71d60
add: [email] Added display name attribute for CC and BCC 2021-10-25 12:00:25 +02:00
Sami Tainio 48e6ff2567 Ran jq_all_the_things_.sh 2021-10-23 10:58:55 +03:00
Sami Tainio aa2aa0814a
chg: [email] add a `bcc` field, `reply-to` can be multiple 
Fix #329
 2021-10-22 23:29:35 +03:00
Quentin JEROME 2394885553 Ran jq_all_the_things.sh 2021-10-06 20:13:39 +02:00
qjerome ce1aea0e14
Update descriptions of edr-report 2021-10-06 19:42:34 +02:00
Quentin JEROME 38303b282f Added edr-report MISP Object definition 2021-10-06 19:42:45 +02:00
Alexandre Dulaunoy 6ad5f18831
chg: [security-playbook] updated 2021-10-05 15:28:26 +02:00
Vasileios Mavroeidis ef16c5fe9a
Update definition.json 
Improved the descriptions of the properties to aid their usability and resolve numerous ambiguities.
 2021-10-02 13:01:11 +02:00
Alexandre Dulaunoy 3d52773e9d
fix: [playbook] it's always a newline story ;-) 2021-09-29 17:08:40 +02:00
Vasileios Mavroeidis 1b3447ffba
Update definition.json 
person-role is not included in the attributes
 2021-09-29 17:03:10 +02:00
Alexandre Dulaunoy 02e00959c4
fix: [security-playbook] newline issue 2021-09-28 14:49:28 +02:00
Alexandre Dulaunoy 4fed830b87
fix: [security-playbook] Categories are case sensitive 2021-09-28 14:48:27 +02:00
Pavel Eis ee9b978c5e new: [security-playbook] security-playbook added 2021-09-28 10:31:45 +02:00
Alexandre Dulaunoy c8cd002a3b
chg: [hashlookup] add KnownMalicious field in hashlookup record 2021-09-24 15:33:53 +02:00
Alexandre Dulaunoy 0ba346f194
chg: [hashlookup] add source, TLSH, SSDEEP fields in the object template 2021-09-24 15:23:04 +02:00
Alexandre Dulaunoy ffa6ed7963
chg: [process] remove ambiguity between user-creator and current user running the process 
Following CISA/DHS feedback

Fix #322
 2021-09-14 08:35:02 +02:00
Alexandre Dulaunoy 3f6a653b0d
fix: [user-account] replace the unclear text in description 
Feedback from CISA/DHS - fix #323
 2021-09-14 08:31:01 +02:00
Alexandre Dulaunoy 8c86f26e78
chg: [domain-ip] newline fix 2021-09-11 07:53:21 +02:00
Andras Iklody 12612abdcb
remove multiple from ip field 2021-09-10 15:24:50 +02:00
Alexandre Dulaunoy b42a9d8fe0
chg: [ss7-attack] order and newline 2021-09-04 10:19:25 +02:00
Alexandre De Oliveira 9f2f46faa7
Added few fields for GT Leasing - v3 2021-09-02 13:57:40 +02:00
chrisr3d d2b93f5aa6
chg: [hashlookup] Using the `filename` type for the FileName attribute instead of `text` 2021-08-26 15:13:14 +02:00
Alexandre Dulaunoy 633a84df03
chg: [hashlookup] newline because you know 2021-08-25 12:02:17 +02:00
Alexandre Dulaunoy 7e849963f1
chg: [hashlookup] filename changed 2021-08-25 12:00:11 +02:00
Alexandre Dulaunoy 1e4f39f728
new: [hashlookup] new hashlookup.circl.lu object 2021-08-25 11:55:57 +02:00
Alexandre Dulaunoy 8ecdd68eb8
chg: [tsk-web-search-query] jq all the things 2021-07-25 09:11:42 +02:00
Alexandre Dulaunoy 7d7cea0459
Fix incorrect type for domain 2021-07-25 09:09:53 +02:00
Alexandre Dulaunoy d37c575ee0
chg: [email] add a from-domain field to add domain when full email is not known or a wild card 
Fix #318

Feedback from Eurocontrol training
 2021-06-22 15:23:41 +02:00
Alexandre Dulaunoy b6366988f4
chg: [paloalto-threat-event] fix newline 2021-05-28 23:07:49 +02:00
phmazzoni df58f2b29f
Disabling some field correlations 
Disabling some field correlations to avoid excessive number of events
 2021-05-27 17:24:58 -03:00
Alexandre Dulaunoy 212e410258
chg: [ddos] fix newline 2021-05-27 16:25:52 +02:00
Alexandre Dulaunoy a31f7d0f26
Multiple fields for port, ip-src,dst-port following feedback from CONCORDIA 
Multiple fields for port, ip-src,dst-port following feedback from CONCORDIA
 2021-05-27 16:19:12 +02:00
Alexandre Dulaunoy 195f0fe46a
fix: [passive-dns-dnsdbflex] newline 2021-05-26 14:12:10 +02:00
aaronkaplan 094d61a51a
dnsdbflex object 2021-05-26 12:34:34 +02:00
Alexandre Dulaunoy 93b99230e3
chg: [jq] all the things 2021-05-25 23:15:59 +02:00
Alexandre Dulaunoy 265f8d3fc7
chg: [geolocation] fix UUID to be valid UUIDv4 2021-05-25 23:11:01 +02:00
Alexandre Dulaunoy d89296b542
new: [open-data-security] new object template based on open data 
security definition

To be used in VARIoT project. https://www.variot.eu/
 2021-05-17 15:55:23 +02:00
Alexandre Dulaunoy 5d986dc25e
chg: [phishing] newline 2021-05-11 15:44:35 +02:00
Alexandre Dulaunoy 8bb8a1d22c
Merge branch 'main' of github.com:MISP/misp-objects into main 2021-05-11 15:01:53 +02:00
Alexandre Dulaunoy d8340c3f67
chg: [phishing] version bump 2021-05-11 15:01:31 +02:00
chrisr3d 3a2e44c442
fix: [network-socket] Typo 2021-05-06 15:42:03 +02:00
chrisr3d 5028d5d99f
add: [network-socket] Added Socket type attribute 2021-05-06 15:17:52 +02:00
Alexandre Dulaunoy 7a476ec4ef
chg: [passive-dns] jq 2021-05-03 07:20:51 +02:00
aaronkaplan b728ed3e29
Re-Do the definition.json, according to the results of the discussion in 
https://github.com/MISP/misp-objects/pull/314

Removing *_ip and *_domain
Keeping bailiwick a domain type
 2021-05-03 00:57:14 +02:00
aaronkaplan bcd133527e
Merge branch 'main' of https://github.com/MISP/misp-objects 2021-05-02 16:03:35 +02:00
aaronkaplan 7b4c9cd6df
As discussed with @rafiot, we can't simply add rdata and rrname as 
text only into MISP objects. Why? Because otherwise we can't use MISP's
correlation engine to correlate attributes (rrname, rdata) inside these
MISP objects with other events. Because "text" would not correlate with
other "ip-src" or "domain" types in other objects/attributes.

Kind of sucks to duplicate the rrname and rdata entries, but that's the
only solution we came up with.

The COF2MISP module will populate both the rrname,rdata as well as the
rrname_{domain,ip} and rdata_{domain,ip} attributes.

Checked with jq_all_the_things.sh.
Thanks for your consideration.
 2021-05-02 15:57:54 +02:00
Alexandre Dulaunoy 4b88a52cf4
chg: [passive-dns] fix 2021-04-27 18:26:23 +02:00
Alexandre Dulaunoy ab84bd837f
fix: [passive-dns] fix the JSON and the version 2021-04-27 18:13:05 +02:00
AaronK df8604a8ca
Update definition.json 
Added time_first_ms, time_last_ms. Clarified a few things in the descriptions.
 2021-04-27 15:37:51 +02:00
Alexandre Dulaunoy 7c21a969d1
fix: [stix2-pattern] disable correlation on version 
Thanks to the new feature in MISP 2.4.142 to find top correlations ;-)
 2021-04-27 05:57:52 +02:00
Alexandre Dulaunoy 5e6f887fa1
Merge branch 'main' of github.com:MISP/misp-objects into main 2021-04-14 09:20:52 +02:00
Alexandre Dulaunoy 6f002cd4c6
chg: [report] add a report type 2021-04-14 09:20:25 +02:00
Raphaël Vinot 067ae49498 fix: Typo 2021-03-05 18:23:11 +01:00
Raphaël Vinot 321a952a66 chg: make jq validation happy 2021-03-05 18:16:46 +01:00
phmazzoni 16a3bed253
Create definition.json 2021-03-05 14:05:39 -03:00
phmazzoni a16d689085
Delete objects/panorama directory 2021-03-05 14:03:37 -03:00
Raphaël Vinot 3fb441b8a0 chg: Make jq validation happy 2021-03-05 15:57:41 +01:00
phmazzoni b3096262f5
Create definition.json 
Create Palo Alto Threat Log Object Template.
 2021-03-05 11:30:00 -03:00