misp-objects/objects/netflow/definition.json

160 lines
4.0 KiB
JSON

{
"name": "netflow",
"uuid": "bf148c58-3e7e-414e-8de8-5d96379ca77e",
"meta-category": "network",
"description": "Netflow object describes an network object based on the Netflowv5/v9 minimal definition",
"version": 2,
"attributes": {
"ip-dst": {
"misp-attribute": "ip-dst",
"ui-priority": 1,
"categories": [
"Network activity",
"External analysis"
],
"description": "IP address destination of the netflow"
},
"ip-src": {
"misp-attribute": "ip-src",
"ui-priority": 1,
"categories": [
"Network activity",
"External analysis"
],
"description": "IP address source of the netflow"
},
"dst-port": {
"description": "Destination port of the netflow",
"misp-attribute": "port",
"ui-priority": 1,
"categories": [
"Network activity",
"External analysis"
]
},
"src-port": {
"description": "Source port of the netflow",
"misp-attribute": "port",
"ui-priority": 1,
"categories": [
"Network activity",
"External analysis"
]
},
"tcp-flags": {
"misp-attribute": "text",
"ui-priority": 0,
"disable_correlation": true,
"categories": [
"Network activity",
"External analysis"
],
"description": "TCP flags of the flow"
},
"icmp-type": {
"misp-attribute": "text",
"ui-priority": 0,
"disable_correlation": true,
"categories": [
"Network activity",
"External analysis"
],
"description": "ICMP type of the flow (if the traffic is ICMP)"
},
"ip-protocol-number": {
"misp-attribute": "size-in-bytes",
"ui-priority": 0,
"disable_correlation": true,
"description": "IP protocol number of this flow"
},
"protocol": {
"misp-attribute": "text",
"ui-priority": 0,
"disable_correlation": true,
"values_list": [
"TCP",
"UDP",
"ICMP",
"IP"
],
"description": "Protocol used for this flow"
},
"src-as": {
"misp-attribute": "AS",
"ui-priority": 0,
"categories": [
"Network activity",
"External analysis"
],
"description": "Source AS number for this flow"
},
"dst-as": {
"misp-attribute": "AS",
"ui-priority": 0,
"categories": [
"Network activity",
"External analysis"
],
"description": "Destination AS number for this flow"
},
"ip_version": {
"misp-attribute": "counter",
"ui-priority": 0,
"disable_correlation": true,
"description": "IP version of this flow"
},
"direction": {
"misp-attribute": "text",
"ui-priority": 0,
"disable_correlation": true,
"sane_default": [
"Ingress",
"Egress"
],
"description": "Direction of this flow"
},
"flow-count": {
"misp-attribute": "counter",
"ui-priority": 0,
"disable_correlation": true,
"description": "Flows counted in this flow"
},
"packet-count": {
"misp-attribute": "counter",
"ui-priority": 0,
"disable_correlation": true,
"description": "Packets counted in this flow"
},
"byte-count": {
"misp-attribute": "counter",
"ui-priority": 0,
"disable_correlation": true,
"description": "Bytes counted in this flow"
},
"first-packet-seen": {
"misp-attribute": "datetime",
"ui-priority": 1,
"description": "First packet seen in this flow",
"disable_correlation": true
},
"last-packet-seen": {
"misp-attribute": "datetime",
"ui-priority": 0,
"description": "Last packet seen in this flow",
"disable_correlation": true
},
"community-id": {
"misp-attribute": "community-id",
"ui-priority": 0,
"description": "Community id of the represented flow"
}
},
"requiredOneOf": [
"first-packet-seen",
"ip-src",
"ip-dst",
"dst-port",
"community-id"
]
}