mirror of https://github.com/MISP/misp-objects
169 lines
3.9 KiB
JSON
169 lines
3.9 KiB
JSON
{
|
|
"name": "email",
|
|
"uuid": "a0c666e0-fc65-4be8-b48f-3423d788b552",
|
|
"meta-category": "network",
|
|
"description": "Email object describing an email with meta-information",
|
|
"version": 8,
|
|
"attributes": {
|
|
"reply-to": {
|
|
"description": "Email address the reply will be sent to",
|
|
"misp-attribute": "email-reply-to",
|
|
"ui-priority": 1,
|
|
"categories": [
|
|
"Payload delivery"
|
|
]
|
|
},
|
|
"message-id": {
|
|
"description": "Message ID",
|
|
"misp-attribute": "email-message-id",
|
|
"ui-priority": 0,
|
|
"categories": [
|
|
"Payload delivery"
|
|
]
|
|
},
|
|
"to": {
|
|
"description": "Destination email address",
|
|
"misp-attribute": "email-dst",
|
|
"ui-priority": 1,
|
|
"categories": [
|
|
"Payload delivery"
|
|
],
|
|
"multiple": true
|
|
},
|
|
"cc": {
|
|
"description": "Carbon copy",
|
|
"misp-attribute": "email-dst",
|
|
"ui-priority": 1,
|
|
"categories": [
|
|
"Payload delivery"
|
|
],
|
|
"multiple": true
|
|
},
|
|
"to-display-name": {
|
|
"description": "Display name of the receiver",
|
|
"misp-attribute": "email-dst-display-name",
|
|
"ui-priority": 1,
|
|
"categories": [
|
|
"Payload delivery"
|
|
],
|
|
"multiple": true
|
|
},
|
|
"subject": {
|
|
"description": "Subject",
|
|
"misp-attribute": "email-subject",
|
|
"ui-priority": 1,
|
|
"categories": [
|
|
"Payload delivery"
|
|
]
|
|
},
|
|
"screenshot": {
|
|
"description": "Screenshot of email",
|
|
"misp-attribute": "attachment",
|
|
"ui-priority": 1,
|
|
"categories": [
|
|
"External analysis"
|
|
]
|
|
},
|
|
"attachment": {
|
|
"description": "Attachment",
|
|
"misp-attribute": "email-attachment",
|
|
"ui-priority": 0,
|
|
"categories": [
|
|
"Payload delivery"
|
|
],
|
|
"multiple": true
|
|
},
|
|
"x-mailer": {
|
|
"description": "X-Mailer generally tells the program that was used to draft and send the original email",
|
|
"misp-attribute": "email-x-mailer",
|
|
"ui-priority": 0,
|
|
"categories": [
|
|
"Payload delivery"
|
|
]
|
|
},
|
|
"header": {
|
|
"description": "Full headers",
|
|
"misp-attribute": "email-header",
|
|
"ui-priority": 0,
|
|
"categories": [
|
|
"Payload delivery"
|
|
],
|
|
"multiple": true
|
|
},
|
|
"send-date": {
|
|
"description": "Date the email has been sent",
|
|
"misp-attribute": "datetime",
|
|
"ui-priority": 0,
|
|
"disable_correlation": true,
|
|
"categories": [
|
|
"Other"
|
|
]
|
|
},
|
|
"mime-boundary": {
|
|
"description": "MIME Boundary",
|
|
"misp-attribute": "email-mime-boundary",
|
|
"ui-priority": 0,
|
|
"categories": [
|
|
"Payload delivery"
|
|
]
|
|
},
|
|
"thread-index": {
|
|
"description": "Identifies a particular conversation thread",
|
|
"misp-attribute": "email-thread-index",
|
|
"ui-priority": 0,
|
|
"categories": [
|
|
"Payload delivery"
|
|
]
|
|
},
|
|
"from": {
|
|
"description": "Sender email address",
|
|
"misp-attribute": "email-src",
|
|
"ui-priority": 1,
|
|
"categories": [
|
|
"Payload delivery"
|
|
]
|
|
},
|
|
"return-path": {
|
|
"description": "Message return path",
|
|
"misp-attribute": "text",
|
|
"ui-priority": 1,
|
|
"categories": [
|
|
"Payload delivery"
|
|
]
|
|
},
|
|
"from-display-name": {
|
|
"description": "Display name of the sender",
|
|
"misp-attribute": "email-src-display-name",
|
|
"ui-priority": 1,
|
|
"categories": [
|
|
"Payload delivery"
|
|
]
|
|
},
|
|
"email-body": {
|
|
"description": "Body of the email",
|
|
"misp-attribute": "email-body",
|
|
"ui-priority": 1,
|
|
"categories": [
|
|
"Payload delivery"
|
|
]
|
|
}
|
|
},
|
|
"requiredOneOf": [
|
|
"from",
|
|
"from-display-name",
|
|
"to",
|
|
"to-display-name",
|
|
"subject",
|
|
"attachment",
|
|
"message-id",
|
|
"reply-to",
|
|
"send-date",
|
|
"url",
|
|
"mime-boundary",
|
|
"thread-index",
|
|
"header",
|
|
"x-mailer",
|
|
"return-path"
|
|
]
|
|
}
|