Alexandre Dulaunoy 07b6883c93 new: [query] query object to describe search queries on SIEM and other tools ... MISP object template designed following requests and especially this twitter thread: https://twitter.com/castello_johnny/status/1540610057263628289 I added a list of sane default based on the ones I have seen being used: "sane_default": [ "event query language (eql)", "keyword query language (kql)", "Query DSL", "Query (Elastic Search)", "Sigma", "Lucene query", "Google search query", "Ariel Query Language (qradar)", "Grep", "Devo LINQ" ], Thanks to Gianni Castaldi and others for ideas. The object can be expanded and improved over the time and the needs to share new queries.		2022-06-25 11:37:41 +02:00
..
ail-leak	…
ais-info	…
android-app	…
android-permission	…
annotation	…
anonymisation	…
apivoid-email-verification	new: Add apivoid email verification API result object	2022-02-07 17:54:31 +01:00
artifact	new: [artifact] The Artifact object permits capturing an array of bytes (8-bits), as a base64-encoded string, or linking to a file-like payload.	2022-02-01 16:25:24 +01:00
asn	…
attack-pattern	…
authentication-failure-report	…
authenticode-signerinfo	chg: Update objects to match lief output for authenticode	2021-01-19 15:38:31 +01:00
av-signature	…
bank-account	Add sane default for boolean objects	2021-12-20 20:02:29 +00:00
bgp-hijack	…
bgp-ranking	fix: Disabling correlation for all the bgp-ranking object attributes	2020-09-09 10:09:07 +02:00
blog	…
boleto	…
btc-transaction	…
btc-wallet	…
cap-alert	…
cap-info	…
cap-resource	…
cloth	test	2022-03-21 10:08:36 +00:00
coin-address	…
command	…
command-line	…
concordia-mtmf-intrusion-set	fix: incorrect entry in CMTMF_ATCKID	2021-12-20 13:17:46 +01:00
cookie	Add sane default for boolean objects	2021-12-20 20:02:29 +00:00
cortex	Add sane default for boolean objects	2021-12-20 20:02:29 +00:00
cortex-taxonomy	…
course-of-action	…
covid19-csse-daily-report	…
covid19-dxy-live-city	…
covid19-dxy-live-province	…
cowrie	…
cpe-asset	chg: Using the actual attribute type for cpe and weakness instead of text	2020-10-22 22:11:50 +02:00
credential	…
credit-card	…
crypto-material	chg: [crypto-material] add a public field for public cryptographic materials	2020-12-30 14:21:37 +01:00
cytomic-orion-file	…
cytomic-orion-machine	…
dark-pattern-item	…
ddos	chg: [ddos] because newline	2022-03-09 11:06:19 +01:00
device	chg: [device] ui-priority added	2021-10-25 16:05:04 +02:00
diameter-attack	fix: [JSON] updated	2022-02-03 17:44:17 +01:00
dkim	fix: [dkim] clean-up	2021-02-25 07:25:09 +01:00
dns-record	…
domain-crawled	…
domain-ip	chg: [domain-ip] added the multiple flag back to ports	2022-05-30 18:07:25 +02:00
edr-report	Ran jq_all_the_things.sh	2021-10-06 20:13:39 +02:00
elf	…
elf-section	…
email	Ran jq_all_the_things_.sh	2021-11-26 15:37:32 +02:00
employee	add: [employee] Added a `full-name` object_relation for cases when we are not sure which name is the first and the last	2022-03-31 20:21:12 +02:00
error-message	new: [error-message] new template to create error-message from MISP processing scripts	2022-02-17 16:47:08 +01:00
exploit-poc	…
facebook-account	…
facebook-group	…
facebook-page	…
facebook-post	…
facial-composite	…
fail2ban	…
favicon	chg: [favicon] jq all the things	2020-12-27 16:21:09 +01:00
file	chg: can have mutliple text attributes	2020-11-25 16:17:54 +01:00
forensic-case	…
forensic-evidence	…
forged-document	…
ftm-Airplane	…
ftm-Assessment	…
ftm-Asset	…
ftm-Associate	…
ftm-Audio	…
ftm-BankAccount	…
ftm-Call	…
ftm-Company	fix: [template] missing newlines	2022-01-06 16:52:43 +01:00
ftm-Contract	…
ftm-ContractAward	…
ftm-CourtCase	…
ftm-CourtCaseParty	…
ftm-Debt	…
ftm-Directorship	…
ftm-Document	…
ftm-Documentation	…
ftm-EconomicActivity	…
ftm-Email	…
ftm-Event	…
ftm-Family	…
ftm-Folder	…
ftm-HyperText	…
ftm-Image	…
ftm-Land	…
ftm-LegalEntity	…
ftm-License	…
ftm-Membership	…
ftm-Message	…
ftm-Organization	…
ftm-Ownership	…
ftm-Package	…
ftm-Page	…
ftm-Pages	…
ftm-Passport	…
ftm-Payment	…
ftm-Person	…
ftm-PlainText	…
ftm-PublicBody	…
ftm-RealEstate	…
ftm-Representation	…
ftm-Row	…
ftm-Sanction	…
ftm-Succession	…
ftm-Table	…
ftm-TaxRoll	…
ftm-UnknownLink	…
ftm-UserAccount	…
ftm-Vehicle	…
ftm-Vessel	…
ftm-Video	…
ftm-Workbook	…
game-cheat	added cheat types and minor changes	2022-03-15 03:37:26 +01:00
geolocation	chg: [geolocation] countrycode added as requested for the VarIOT.	2021-10-25 15:35:23 +02:00
git-vuln-finder	…
github-user	fix: [template] missing newlines	2022-01-06 16:52:43 +01:00
gitlab-user	chg: [gitlab-user] because -r is important	2020-10-07 09:20:54 +02:00
gtp-attack	fix: [JSON] updated	2022-02-03 17:44:17 +01:00
hashlookup	chg: [hashlookup] add KnownMalicious field in hashlookup record	2021-09-24 15:33:53 +02:00
http-request	…
identity	new: [identity] from STIX 2.1 - 4.5 - new object template	2022-01-31 07:45:38 +01:00
ilr-impact	…
ilr-notification-incident	fix: Validation issue fixed	2020-09-03 14:21:06 +02:00
image	…
impersonation	…
imsi-catcher	…
infrastructure	new: [infrastructure] infrastructure object added (STIX 2.1 - 4.8)	2022-02-14 11:30:09 +01:00
instant-message	chg: [instant-message] Jabber and Twitter added + updated required fields	2022-03-17 09:14:39 +01:00
instant-message-group	chg: [instan-message-*] add Tox as potential chat application	2022-01-16 16:39:06 +01:00
intel471-vulnerability-intelligence	Add sane default for boolean objects	2021-12-20 20:02:29 +00:00
intelmq_event	Add sane default for boolean objects	2021-12-20 20:02:29 +00:00
intelmq_report	…
internal-reference	…
interpol-notice	…
iot-device	…
iot-firmware	…
ip-api-address	fix: Normalised object relations of the ip-api-address object	2020-09-03 14:10:02 +02:00
ip-port	fix: [ip-port] jq all the things	2022-03-11 10:21:09 +01:00
irc	…
ja3	…
ja3s	chg: [ja3s] updated	2021-11-14 22:38:47 +01:00
jarm	chg: [jarm] jq all the things	2021-01-05 14:49:34 +01:00
keybase-account	chg: Sort json	2020-09-16 15:17:43 +02:00
language-content	new: [language-content] New object template language-content based on	2022-02-15 07:21:58 +01:00
leaked-document	…
legal-entity	…
lnk	…
macho	…
macho-section	…
mactime-timeline-analysis	…
malware-config	…
meme-image	Add sane default for boolean objects	2021-12-20 20:02:29 +00:00
microblog	…
mutex	…
narrative	…
netflow	…
network-connection	chg: [network-connection] add a counter following discussion with @chrisr3d	2022-06-17 10:05:09 +02:00
network-profile	chg: [network-element] jq	2021-02-24 06:48:10 +01:00
network-socket	fix: [network-socket] Typo	2021-05-06 15:42:03 +02:00
news-agency	…
news-media	…
open-data-security	new: [open-data-security] new object template based on open data	2021-05-17 15:55:23 +02:00
organization	chg: [organization] NL fixed	2022-04-04 14:49:44 +02:00
original-imported-file	…
paloalto-threat-event	chg: [paloalto-threat-event] Hungary access to the git repository has been sanctioned	2022-05-11 15:38:24 +02:00
parler-account	Add sane default for boolean objects	2021-12-20 20:02:29 +00:00
parler-comment	…
parler-post	Add sane default for boolean objects	2021-12-20 20:02:29 +00:00
passive-dns	chg: [passive-dns] jq	2021-05-03 07:20:51 +02:00
passive-dns-dnsdbflex	fix: [passive-dns-dnsdbflex] newline	2021-05-26 14:12:10 +02:00
passive-ssh	add: [passive-ssh] Added `port` attribute	2022-05-06 17:01:13 +02:00
paste	Typo and version number correction + adding a field in twitter-post	2020-12-14 23:01:12 +01:00
pcap-metadata	…
pe	chg: Update objects to match lief output for authenticode	2021-01-19 15:38:31 +01:00
pe-section	…
person	chg: [person] add new potential direct message chat application	2022-03-17 15:56:16 +01:00
personification	chg: [personification] fixed	2022-03-24 15:42:35 +01:00
pgp-meta	…
phishing	chg: [phishing] newline	2021-05-11 15:44:35 +02:00
phishing-kit	fix: Normalised object relations of the phishing objects	2020-09-03 14:12:05 +02:00
phone	…
postal-address	chg: add requiredOneOf for postal-address	2021-12-20 14:15:10 +01:00
probabilistic-data-structure	chg: [probabilistic-data-structure] updated followng JL feedback	2021-12-29 16:27:26 +01:00
process	Add sane default for boolean objects	2021-12-20 20:02:29 +00:00
publication	…
python-etvx-event-log	…
query	new: [query] query object to describe search queries on SIEM and other tools	2022-06-25 11:37:41 +02:00
r2graphity	…
ransom-negotiation	Added fields	2022-05-20 15:53:29 +02:00
reddit-account	…
reddit-comment	…
reddit-post	…
reddit-subreddit	…
regexp	chg: [regexp] fixed	2021-02-19 21:56:35 +01:00
registry-key	…
regripper-NTUser	Add sane default for boolean objects	2021-12-20 20:02:29 +00:00
regripper-sam-hive-single-user	…
regripper-sam-hive-user-group	…
regripper-software-hive-BHO	…
regripper-software-hive-appInit-DLLS	…
regripper-software-hive-application-paths	…
regripper-software-hive-applications-installed	…
regripper-software-hive-command-shell	…
regripper-software-hive-software-run	…
regripper-software-hive-userprofile-winlogon	Add sane default for boolean objects	2021-12-20 20:02:29 +00:00
regripper-software-hive-windows-general-info	…
regripper-system-hive-firewall-configuration	Add sane default for boolean objects	2021-12-20 20:02:29 +00:00
regripper-system-hive-general-configuration	Add sane default for boolean objects	2021-12-20 20:02:29 +00:00
regripper-system-hive-network-information	Add sane default for boolean objects	2021-12-20 20:02:29 +00:00
regripper-system-hive-services-drivers	…
report	chg: [report] add Zotero item types in addition to the default type	2022-06-18 16:10:41 +02:00
research-scanner	…
rogue-dns	…
rtir	…
sandbox-report	…
sb-signature	…
scheduled-event	…
scrippsco2-c13-daily	…
scrippsco2-c13-monthly	…
scrippsco2-co2-daily	…
scrippsco2-co2-monthly	…
scrippsco2-o18-daily	…
scrippsco2-o18-monthly	…
script	…
security-playbook	chg: [security-playbook] jq all the things	2022-05-18 22:00:41 +02:00
shell-commands	…
shodan-report	…
short-message-service	…
shortened-link	…
social-media-group	…
software	new: [software] software template object added based 6.14 (STIX 2.1)	2022-02-14 11:06:53 +01:00
spearphishing-attachment	formatting after jq_all_the_things	2022-05-20 14:24:40 -05:00
spearphishing-link	formatting after jq_all_the_things	2022-05-20 14:24:40 -05:00
splunk	fix: [splunk] fixed	2021-02-15 15:10:20 +01:00
ss7-attack	modified by ./jq_all_the_things.sh	2022-03-21 15:04:26 +01:00
ssh-authorized-keys	…
stix2-pattern	chg: [stix2-pattern] add STIX 2.1	2022-01-14 16:43:01 +01:00
stock	chg: [stock] newline fixed	2022-06-18 17:00:13 +02:00
submarine	chg: [submarine] fixes and list of types added	2021-11-12 08:39:35 +01:00
suricata	…
target-system	…
tattoo	test	2022-03-21 10:08:36 +00:00
telegram-account	chg: [telegram-account] required attributes	2021-01-26 11:39:22 +01:00
temporal-event	fix: [temporal-event] newline issue	2021-12-21 08:15:06 +01:00
threatgrid-report	…
timecode	…
timesketch-timeline	…
timesketch_message	…
timestamp	…
tor-hiddenservice	…
tor-node	…
tracking-id	…
transaction	…
translation	…
trustar_report	chg: [trustar_report] Updated to add "THREAT_ACTOR"	2021-01-05 09:30:28 +01:00
tsk-chats	…
tsk-web-bookmark	…
tsk-web-cookie	…
tsk-web-downloads	…
tsk-web-history	…
tsk-web-search-query	chg: [tsk-web-search-query] jq all the things	2021-07-25 09:11:42 +02:00
twitter-account	fix: JSON Validation	2020-09-09 10:36:20 +02:00
twitter-list	…
twitter-post	chg: [twitter-post] jq	2020-12-20 10:52:40 +01:00
url	chg: [url] jq all the things	2021-02-02 11:57:41 +01:00
user-account	Add sane default for boolean objects	2021-12-20 20:02:29 +00:00
vehicle	fix: Incorrect relationships in requiredoneof field	2020-09-08 11:17:57 +02:00
victim	…
virustotal-graph	…
virustotal-report	fix: keys order in VT object	2021-02-02 15:31:00 +01:00
virustotal-submission	Fixes wrong category and typo in value list	2022-04-26 15:05:05 +02:00
vulnerability	chg: [vulnerability] fixed	2020-10-15 22:49:29 +02:00
weakness	chg: Using the actual attribute type for cpe and weakness instead of text	2020-10-22 22:11:50 +02:00
whois	…
windows-service	new: [windows-service] windows-service object added	2021-02-13 17:01:44 +01:00
x509	Add sane default for boolean objects	2021-12-20 20:02:29 +00:00
yabin	…
yara	chg: [yara] disable correlations on some fields	2020-12-30 14:46:04 +01:00
youtube-channel	…
youtube-comment	…
youtube-playlist	…
youtube-video	…