diff --git a/misp-core-format/raw.md b/misp-core-format/raw.md index 749c9c8..91ee1fe 100755 --- a/misp-core-format/raw.md +++ b/misp-core-format/raw.md @@ -86,7 +86,8 @@ uuid is represented as a JSON string. uuid **MUST** be present. #### id -id represents the human-readable identifier associated to the event for a specific MISP instance. +id represents the human-readable identifier associated to the event for a specific MISP instance. A human-readable identifier **MUST** be +represented as an unsigned integer. id is represented as a JSON string. id **SHALL** be present. @@ -143,7 +144,7 @@ analysis is represented as a JSON string. analysis **SHALL** be present. #### date -date represents a reference date to the event in ISO 8601 format (date only: YYYY-MM-DD). This date corresponds to the date the event occured, which may be in the past. +date represents a reference date to the event in ISO 8601 format (date only: YYYY-MM-DD). This date corresponds to the date the event occurred, which may be in the past. date is represented as a JSON string. date **MUST** be present. @@ -161,7 +162,8 @@ publish_timestamp is represented as a JSON string. publish_timestamp **MUST** be #### org_id -org_id represents a human-readable identifier referencing an Org object of the organisation which generated the event. +org_id represents a human-readable identifier referencing an Org object of the organisation which generated the event. A human-readable identifier **MUST** be +represented as an unsigned integer. The org_id **MUST** be updated when the event is generated by a new instance. @@ -171,7 +173,7 @@ org_id is represented as a JSON string. org_id **MUST** be present. orgc_id represents a human-readable identifier referencing an Orgc object of the organisation which created the event. -The orgc_id and Orc object **MUST** be preserved for any updates or transfer of the same event. +The orgc_id and Org object **MUST** be preserved for any updates or transfer of the same event. orgc_id is represented as a JSON string. orgc_id **MUST** be present. @@ -204,7 +206,7 @@ distribution is represented by a JSON string. distribution **MUST** be present a #### sharing_group_id -sharing\_group\_id represents a human-readable identifier referencing a Sharing Group object that defines the distribution of the event, if distribution level "4" is set. +sharing\_group\_id represents a human-readable identifier referencing a Sharing Group object that defines the distribution of the event, if distribution level "4" is set. A human-readable identifier **MUST** be represented as an unsigned integer. sharing\_group\_id is represented by a JSON string and **SHOULD** be present. If a distribution level other than "4" is chosen the sharing\_group\_id **MUST** be set to "0". @@ -220,6 +222,7 @@ The organisation UUID is globally assigned to an organisation and **SHALL** be k The name is a readable description of the organisation and **SHOULD** be present. The id is a human-readable identifier generated by the instance and used as reference in the event. +A human-readable identifier **MUST** be represented as an unsigned integer. uuid, name and id are represented as a JSON string. uuid, name and id **MUST** be present. @@ -242,6 +245,7 @@ The organisation UUID is globally assigned to an organisation and **SHALL** be k The name is a readable description of the organisation and **SHOULD** be present. The id is a human-readable identifier generated by the instance and used as reference in the event. +A human-readable identifier **MUST** be represented as an unsigned integer. uuid, name and id are represented as a JSON string. uuid, name and id **MUST** be present. @@ -285,7 +289,8 @@ uuid is represented as a JSON string. uuid **MUST** be present. #### id -id represents the human-readable identifier associated to the event for a specific MISP instance. +id represents the human-readable identifier associated to the event for a specific MISP instance. A human-readable identifier **MUST** be +represented as an unsigned integer. id is represented as a JSON string. id **SHALL** be present. @@ -359,7 +364,8 @@ to\_ids is represented as a JSON boolean. to\_ids **MUST** be present. #### event\_id -event\_id represents a human-readable identifier referencing the Event object that the attribute belongs to. +event\_id represents a human-readable identifier referencing the Event object that the attribute belongs to. A human-readable identifier **MUST** be +represented as an unsigned integer. The event\_id **SHOULD** be updated when the event is imported to reflect the newly created event's id on the instance. @@ -403,7 +409,7 @@ comment is represented by a JSON string. comment **MAY** be present. #### sharing_group_id -sharing\_group\_id represents a human-readable identifier referencing a Sharing Group object that defines the distribution of the attribute, if distribution level "4" is set. +sharing\_group\_id represents a human-readable identifier referencing a Sharing Group object that defines the distribution of the attribute, if distribution level "4" is set. A human-readable identifier **MUST** be represented as an unsigned integer. sharing\_group\_id is represented by a JSON string and **SHOULD** be present. If a distribution level other than "4" is chosen the sharing\_group\_id **MUST** be set to "0". @@ -481,8 +487,7 @@ uuid is represented as a JSON string. uuid **MUST** be present. #### id -id represents the human-readable identifier associated to the event for a specific MISP instance. - +id represents the human-readable identifier associated to the event for a specific MISP instance. human-readable identifier **MUST** be represented as an unsigned integer. id is represented as a JSON string. id **SHALL** be present. #### type @@ -583,7 +588,7 @@ comment is represented by a JSON string. comment **MAY** be present. #### org\_id -org\_id represents a human-readable identifier referencing the proposal creator's Organisation object. +org\_id represents a human-readable identifier referencing the proposal creator's Organisation object. A human-readable identifier **MUST** be represented as an unsigned integer. Whilst attributes can only be created by the event creator organisation, shadow attributes can be created by third parties. org\_id tracks the creator organisation. @@ -619,6 +624,7 @@ The organization UUID is globally assigned to an organization and **SHALL** be k The name is a readable description of the organization and **SHOULD** be present. The id is a human-readable identifier generated by the instance and used as reference in the event. +A human-readable identifier **MUST** be represented as an unsigned integer. uuid, name and id are represented as a JSON string. uuid, name and id **MUST** be present. @@ -695,7 +701,8 @@ for any updates or transfer of the same object. UUID version 4 is **RECOMMENDED* #### id -id represents the human-readable identifier associated to the object for a specific MISP instance. +id represents the human-readable identifier associated to the object for a specific MISP instance. A human-readable identifier **MUST** be +represented as an unsigned integer. id is represented as a JSON string. id **SHALL** be present. @@ -732,7 +739,8 @@ version is represented as a JSON string. version **MUST** be present. #### event_id -event_id represents the human-readable identifier of the event that the object belongs to on a specific MISP instance. +event_id represents the human-readable identifier of the event that the object belongs to on a specific MISP instance. A human-readable identifier **MUST** be +represented as an unsigned integer. event_id is represented as a JSON string. event_id **SHALL** be present. @@ -765,7 +773,7 @@ distribution is represented by a JSON string. distribution **MUST** be present a #### sharing_group_id -sharing\_group\_id represents a human-readable identifier referencing a Sharing Group object that defines the distribution of the object, if distribution level "4" is set. +sharing\_group\_id represents a human-readable identifier referencing a Sharing Group object that defines the distribution of the object, if distribution level "4" is set. A human-readable identifier **MUST** be represented as an unsigned integer. sharing\_group\_id is represented by a JSON string and **SHOULD** be present. If a distribution level other than "4" is chosen the sharing\_group\_id **MUST** be set to "0". @@ -835,13 +843,15 @@ timestamp is represented as a JSON string. timestamp **MUST** be present. #### object_id -object_id represents the human-readable identifier of the object that the object reference belongs to on a specific MISP instance. +object_id represents the human-readable identifier of the object that the object reference belongs to on a specific MISP instance. A human-readable identifier **MUST** be +represented as an unsigned integer. event_id is represented as a JSON string. event_id **SHALL** be present. #### event_id -event_id represents the human-readable identifier of the event that the object reference belongs to on a specific MISP instance. +event_id represents the human-readable identifier of the event that the object reference belongs to on a specific MISP instance. A human-readable identifier **MUST** be +represented as an unsigned integer. event_id is represented as a JSON string. event_id **SHALL** be present. @@ -932,6 +942,8 @@ org_id **MAY** be present along the JSON object describing the organisation. If org_id represents the human-readable identifier of the organisation which did the sighting and belongs to a specific MISP instance. +A human-readable identifier **MUST** be represented as an unsigned integer. + ### Sample Sighting ~~~~