misp-objects/objects/instant-message/definition.json

122 lines
3.2 KiB
JSON

{
"attributes": {
"app-used": {
"description": "The IM application used to send the message.",
"disable_correlation": true,
"misp-attribute": "text",
"sane_default": [
"WhatsApp",
"Google Hangouts",
"Facebook Messenger",
"Telegram",
"Signal",
"WeChat",
"BlackBerry Messenger",
"TeamSpeak",
"TorChat",
"Tox",
"RetroShare",
"Slack",
"Wire",
"Threema",
"Discord",
"Mumble",
"Jabber",
"Twitter",
"Mattermost"
],
"ui-priority": 1
},
"archive": {
"description": "Archive of the original message (Internet Archive, Archive.is, etc).",
"misp-attribute": "link",
"multiple": true,
"ui-priority": 1
},
"attachment": {
"description": "The message file or screen capture.",
"misp-attribute": "attachment",
"multiple": true,
"ui-priority": 1
},
"body": {
"description": "Message body of the IM.",
"misp-attribute": "text",
"ui-priority": 1
},
"from-name": {
"description": "Name of the person that sent the message.",
"misp-attribute": "text",
"multiple": true,
"ui-priority": 1
},
"from-number": {
"description": "Phone number used to send the message.",
"misp-attribute": "phone-number",
"multiple": true,
"ui-priority": 1
},
"from-user": {
"description": "User account that sent the message.",
"misp-attribute": "text",
"multiple": true,
"ui-priority": 1
},
"link": {
"description": "Original link into the message (Supposed harmless).",
"misp-attribute": "link",
"ui-priority": 1
},
"received-date": {
"description": "Received date of the message.",
"disable_correlation": true,
"misp-attribute": "datetime",
"ui-priority": 0
},
"sent-date": {
"description": "Initial sent date of the message.",
"disable_correlation": true,
"misp-attribute": "datetime",
"ui-priority": 0
},
"subject": {
"description": "Subject of the message if any.",
"misp-attribute": "text",
"ui-priority": 0
},
"to-name": {
"description": "Name of the person that received the message.",
"misp-attribute": "text",
"multiple": true,
"ui-priority": 1
},
"to-number": {
"description": "Phone number receiving the message.",
"misp-attribute": "phone-number",
"multiple": true,
"ui-priority": 1
},
"to-user": {
"description": "User account that received the message.",
"misp-attribute": "text",
"multiple": true,
"ui-priority": 1
},
"url": {
"description": "Original URL location of the message (potentially malicious).",
"misp-attribute": "url",
"ui-priority": 1
}
},
"description": "Instant Message (IM) object template describing one or more IM message.",
"meta-category": "misc",
"name": "instant-message",
"requiredOneOf": [
"body",
"from-user",
"from-number",
"from-name"
],
"uuid": "5fa51a24-f40f-4696-a77e-d31e26bab5fc",
"version": 3
}