misp-objects/objects/victim/definition.json

117 lines
3.0 KiB
JSON

{
"requiredOneOf": [
"name",
"regions",
"sectors"
],
"attributes": {
"description": {
"description": "Description of the victim",
"ui-priority": 1,
"misp-attribute": "text"
},
"name": {
"description": "The name of the department(s) or organisation(s) targeted.",
"ui-priority": 1,
"misp-attribute": "target-org",
"multiple": true
},
"external": {
"description": "External target organisations affected by this attack.",
"ui-priority": 1,
"misp-attribute": "target-external",
"multiple": true
},
"classification": {
"description": "The type of entity being targeted.",
"misp-attribute": "text",
"disable_correlation": true,
"ui-priority": 1,
"sane_default": [
"individual",
"group",
"organization",
"class",
"unknown"
]
},
"roles": {
"description": "The list of roles targeted within the victim.",
"multiple": true,
"misp-attribute": "text",
"ui-priority": 1
},
"sectors": {
"description": "The list of sectors that the victim belong to",
"multiple": true,
"misp-attribute": "text",
"ui-priority": 1,
"sane_default": [
"agriculture",
"aerospace",
"automotive",
"communications",
"construction",
"defence",
"education",
"energy",
"engineering",
"entertainment",
"financial services",
"government national",
"government regional",
"government local",
"government public services",
"healthcare",
"hospitality leisure",
"infrastructure",
"insurance",
"manufacturing",
"mining",
"non profit",
"pharmaceuticals",
"retail",
"technology",
"telecommunications",
"transportation",
"utilities"
]
},
"regions": {
"description": "The list of regions or locations from the victim targeted. ISO 3166 should be used.",
"multiple": true,
"misp-attribute": "target-location",
"ui-priority": 1
},
"user": {
"description": "The username(s) of the user targeted.",
"misp-attribute": "target-user",
"ui-priority": 1,
"multiple": true
},
"email": {
"description": "The email address(es) of the user targeted.",
"misp-attribute": "target-email",
"ui-priority": 1,
"multiple": true
},
"node": {
"description": "Name(s) of node that was targeted.",
"misp-attribute": "target-machine",
"ui-priority": 1,
"multiple": true
},
"ip-address": {
"description": "IP address(es) of the node targeted.",
"misp-attribute": "ip-dst",
"ui-priority": 1,
"multiple": true
}
},
"version": 4,
"description": "Victim object describes the target of an attack or abuse.",
"meta-category": "misc",
"uuid": "a8806e40-39ad-435f-be02-ac2a13d6fc7d",
"name": "victim"
}