misp-objects/objects/python-etvx-event-log/definition.json

{
  "required": [
    "source",
    "event-type",
    "name"
  ],
  "attributes": {
    "event-id": {
      "description": "A unique number which identifies the event.",
      "ui-priority": 1,
      "misp-attribute": "text",
      "disable_correlation": true
    },
    "name": {
      "description": "Name of the event.",
      "ui-priority": 2,
      "misp-attribute": "text",
      "disable_correlation": true
    },
    "event-channel": {
      "description": " Channel through which the event occurred",
      "ui-priority": 3,
      "misp-attribute": "text",
      "disable_correlation": true,
      "sane_default": [
        "Application",
        "System",
        "Security",
        "Setup",
        "other"
      ]
    },
    "event-type": {
      "description": "Event-type assigned to the event",
      "ui-priority": 0,
      "misp-attribute": "text",
      "disable_correlation": true,
      "sane_default": [
        "Admin",
        "Operational",
        "Audit",
        "Analytic",
        "Debug",
        "other"
      ]
    },
    "source": {
      "description": "The source of the event log - application/software that logged the event.",
      "ui-priority": 0,
      "misp-attribute": "text"
    },
    "event-date-time": {
      "description": "Date and time when the event was logged.",
      "ui-priority": 0,
      "misp-attribute": "datetime",
      "disable_correlation": true
    },
    "level": {
      "description": "Determines the event severity.",
      "ui-priority": 0,
      "misp-attribute": "text",
      "sane_default": [
        "Information",
        "Warning",
        "Error",
        "Critical",
        "Success Audit",
        "Failure Audit"
      ]
    },
    "Computer": {
      "description": "Computer name on which the event occurred",
      "ui-priority": 0,
      "misp-attribute": "text",
      "disable_correlation": true
    },
    "User": {
      "description": "Name or the User ID the event is associated with.",
      "ui-priority": 0,
      "misp-attribute": "text",
      "disable_correlation": true
    },
    "Operational-code": {
      "description": "The opcode (numeric value or name) associated with the activity carried out by the event.",
      "ui-priority": 0,
      "misp-attribute": "text",
      "disable_correlation": true
    },
    "log": {
      "description": "Log file where the event was recorded.",
      "ui-priority": 0,
      "misp-attribute": "text",
      "disable_correlation": true
    },
    "task-category": {
      "description": "Activity by the event publisher",
      "ui-priority": 0,
      "misp-attribute": "text",
      "disable_correlation": true
    },
    "Keywords": {
      "description": "Tags used for the event for the purpose of filtering or searching.",
      "ui-priority": 0,
      "misp-attribute": "text",
      "sane_default": [
        "Network",
        "Security",
        "Resource not found",
        "other"
      ]
    },
    "Processor-ID": {
      "description": "ID of the processor that processed the event.",
      "ui-priority": 0,
      "misp-attribute": "text",
      "disable_correlation": true
    },
    "Thread-ID": {
      "description": "Thread id that generated the event.",
      "ui-priority": 0,
      "misp-attribute": "text",
      "disable_correlation": true
    },
    "Session-ID": {
      "description": "Terminal server session ID.",
      "ui-priority": 0,
      "misp-attribute": "text",
      "disable_correlation": true
    },
    "Correlation-ID": {
      "description": "Unique activity identity which relates the event to a process. ",
      "ui-priority": 0,
      "misp-attribute": "text"
    },
    "Relative-Correlation-ID": {
      "description": "Related activity ID which identity similar activities which occurred as a part of the event.",
      "ui-priority": 0,
      "misp-attribute": "text",
      "disable_correlation": true
    },
    "kernel-time": {
      "description": "Execution time of the kernel mode instruction.",
      "ui-priority": 0,
      "misp-attribute": "datetime",
      "disable_correlation": true
    },
    "user-time": {
      "description": "Date and time when the user instruction was executed.",
      "ui-priority": 0,
      "misp-attribute": "datetime",
      "disable_correlation": true
    },
    "Event-data": {
      "description": "Event data description.",
      "ui-priority": 0,
      "misp-attribute": "text",
      "disable_correlation": true
    },
    "comment": {
      "description": "Additional comments.",
      "ui-priority": 0,
      "misp-attribute": "text",
      "disable_correlation": true
    }
  },
  "version": 1,
  "description": "Event log object template to share information of the activities conducted on a system. ",
  "meta-category": "misc",
  "uuid": "94e3aee9-cb99-4503-9bf6-7da3db5de55e",
  "name": "python-etvx-event-log"
}