mirror of https://github.com/MISP/misp-objects
90 lines
2.2 KiB
JSON
90 lines
2.2 KiB
JSON
{
|
|
"attributes": {
|
|
"acquisition-method": {
|
|
"description": "Method used for acquisition of the evidence.",
|
|
"disable_correlation": true,
|
|
"misp-attribute": "text",
|
|
"sane_default": [
|
|
"Live acquisition",
|
|
"Dead/Offline acquisition",
|
|
"Physical collection",
|
|
"Logical collection",
|
|
"File system extraction",
|
|
"Chip-off",
|
|
"Other"
|
|
],
|
|
"ui-priority": 0
|
|
},
|
|
"acquisition-tools": {
|
|
"description": "Tools used for acquisition of the evidence.",
|
|
"disable_correlation": true,
|
|
"misp-attribute": "text",
|
|
"multiple": true,
|
|
"sane_default": [
|
|
"dd",
|
|
"dc3dd",
|
|
"dcfldd",
|
|
"EnCase",
|
|
"FTK Imager",
|
|
"FDAS",
|
|
"TrueBack",
|
|
"Guymager",
|
|
"IXimager",
|
|
"Other"
|
|
],
|
|
"ui-priority": 0
|
|
},
|
|
"additional-comments": {
|
|
"description": "Comments.",
|
|
"disable_correlation": true,
|
|
"misp-attribute": "text",
|
|
"ui-priority": 0
|
|
},
|
|
"case-number": {
|
|
"description": "A unique number assigned to the case for unique identification.",
|
|
"misp-attribute": "text",
|
|
"ui-priority": 0
|
|
},
|
|
"evidence-number": {
|
|
"description": "A unique number assigned to the evidence for unique identification.",
|
|
"misp-attribute": "text",
|
|
"ui-priority": 0
|
|
},
|
|
"name": {
|
|
"description": "Name of the evidence acquired.",
|
|
"misp-attribute": "text",
|
|
"ui-priority": 0
|
|
},
|
|
"references": {
|
|
"description": "External references",
|
|
"misp-attribute": "link",
|
|
"multiple": true,
|
|
"ui-priority": 0
|
|
},
|
|
"type": {
|
|
"description": "Evidence type.",
|
|
"disable_correlation": true,
|
|
"misp-attribute": "text",
|
|
"multiple": true,
|
|
"sane_default": [
|
|
"Computer",
|
|
"Network",
|
|
"Mobile Device",
|
|
"Multimedia",
|
|
"Cloud",
|
|
"IoT",
|
|
"Other"
|
|
],
|
|
"ui-priority": 0
|
|
}
|
|
},
|
|
"description": "An object template to describe a digital forensic evidence.",
|
|
"meta-category": "misc",
|
|
"name": "forensic-evidence",
|
|
"required": [
|
|
"case-number",
|
|
"evidence-number"
|
|
],
|
|
"uuid": "fe44c648-63ef-43fc-b3de-af71a2e023e4",
|
|
"version": 2
|
|
} |