{
  "required": [
    "description",
    "zone"
  ],
  "attributes": {
    "description": {
      "description": "A description of the threat",
      "disable_correlation": true,
      "ui-priority": 0,
      "misp-attribute": "text"
    },
    "zone": {
      "description": "The zone the threat is impacting",
      "disable_correlation": true,
      "ui-priority": 0,
      "misp-attribute": "text",
      "multiple": true
    },
    "capability": {
      "description": "The capability affected",
      "disable_correlation": true,
      "ui-priority": 0,
      "misp-attribute": "text",
      "sane_default": [
        "military port",
        "shipping",
        "water purification",
        "power distribution",
        "power generation",
        "noc",
        "military hq office"
      ]
    },
    "phase": {
      "description": "The phase",
      "disable_correlation": true,
      "ui-priority": 0,
      "misp-attribute": "counter",
      "multiple": true
    },
    "ip": {
      "description": "IP Address",
      "categories": [
        "Network activity",
        "External analysis"
      ],
      "ui-priority": 1,
      "misp-attribute": "ip-src",
      "multiple": true
    },
    "url": {
      "description": "URL",
      "categories": [
        "Network activity",
        "External analysis"
      ],
      "ui-priority": 1,
      "misp-attribute": "url",
      "multiple": true
    },
    "domain": {
      "description": "Domain name",
      "categories": [
        "Network activity",
        "External analysis"
      ],
      "ui-priority": 1,
      "misp-attribute": "domain",
      "multiple": true
    },
    "registry-key": {
      "description": "Registry key",
      "categories": [
        "Persistence mechanism"
      ],
      "ui-priority": 0,
      "multiple": true,
      "misp-attribute": "text"
    },
    "path": {
      "description": "Path of the filename",
      "disable_correlation": true,
      "multiple": true,
      "ui-priority": 0,
      "misp-attribute": "text"
    },
    "md5": {
      "description": "MD5 hash (128 bits)",
      "ui-priority": 1,
      "multiple": true,
      "misp-attribute": "md5"
    },
    "sha1": {
      "description": "Secure Hash Algorithm 1 (160 bits)",
      "ui-priority": 1,
      "multiple": true,
      "misp-attribute": "sha1"
    },
    "sha256": {
      "description": "Secure Hash Algorithm 2 (256 bits)",
      "ui-priority": 1,
      "multiple": true,
      "misp-attribute": "sha256"
    }
  },
  "version": 1,
  "description": "LS Object to inform the command center analysts about the adversary infrastructure and how it is being used to attack you",
  "meta-category": "locked-shields",
  "uuid": "359d4790-dd73-4d8c-bfb4-9e4039c8bf8c",
  "name": "ls-threat-report"
}