mirror of https://github.com/MISP/misp-objects
The idea is to separate the evidences from the case itself as you can have multiple acquisitions for a specific case. Another object template is required such as [forensic-evidence] to be able to link between the forensic-case object and one or more evidences. |
||
|---|---|---|
| .. | ||
| definition.json | ||