MISP
/
misp-rfc
mirror of https://github.com/MISP/misp-rfc
2
0
Fork 0
Code Issues Releases Wiki Activity

a definition of human-readable id format added - fix #9

pull/10/head
Alexandre Dulaunoy 2018-03-08 14:29:05 +01:00
parent 6c413f5d71
commit 20adf6f11b
No known key found for this signature in database
GPG Key ID: 09E2CD4944E6CBCD
1 changed files with 28 additions and 16 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

44
misp-core-format/raw.md
View File

@ -86,7 +86,8 @@ uuid is represented as a JSON string. uuid **MUST** be present.
#### id #### id
id represents the human-readable identifier associated to the event for a specific MISP instance. id represents the human-readable identifier associated to the event for a specific MISP instance. A human-readable identifier **MUST** be
represented as an unsigned integer.
id is represented as a JSON string. id **SHALL** be present. id is represented as a JSON string. id **SHALL** be present.
@ -143,7 +144,7 @@ analysis is represented as a JSON string. analysis **SHALL** be present.
#### date #### date
date represents a reference date to the event in ISO 8601 format (date only: YYYY-MM-DD). This date corresponds to the date the event occured, which may be in the past. date represents a reference date to the event in ISO 8601 format (date only: YYYY-MM-DD). This date corresponds to the date the event occurred, which may be in the past.
date is represented as a JSON string. date **MUST** be present. date is represented as a JSON string. date **MUST** be present.
@ -161,7 +162,8 @@ publish_timestamp is represented as a JSON string. publish_timestamp **MUST** be
#### org_id #### org_id
org_id represents a human-readable identifier referencing an Org object of the organisation which generated the event. org_id represents a human-readable identifier referencing an Org object of the organisation which generated the event. A human-readable identifier **MUST** be
represented as an unsigned integer.
The org_id **MUST** be updated when the event is generated by a new instance. The org_id **MUST** be updated when the event is generated by a new instance.
@ -171,7 +173,7 @@ org_id is represented as a JSON string. org_id **MUST** be present.
orgc_id represents a human-readable identifier referencing an Orgc object of the organisation which created the event. orgc_id represents a human-readable identifier referencing an Orgc object of the organisation which created the event.
The orgc_id and Orc object **MUST** be preserved for any updates or transfer of the same event. The orgc_id and Org object **MUST** be preserved for any updates or transfer of the same event.
orgc_id is represented as a JSON string. orgc_id **MUST** be present. orgc_id is represented as a JSON string. orgc_id **MUST** be present.
@ -204,7 +206,7 @@ distribution is represented by a JSON string. distribution **MUST** be present a
#### sharing_group_id #### sharing_group_id
sharing\_group\_id represents a human-readable identifier referencing a Sharing Group object that defines the distribution of the event, if distribution level "4" is set. sharing\_group\_id represents a human-readable identifier referencing a Sharing Group object that defines the distribution of the event, if distribution level "4" is set. A human-readable identifier **MUST** be represented as an unsigned integer.
sharing\_group\_id is represented by a JSON string and **SHOULD** be present. If a distribution level other than "4" is chosen the sharing\_group\_id **MUST** be set to "0". sharing\_group\_id is represented by a JSON string and **SHOULD** be present. If a distribution level other than "4" is chosen the sharing\_group\_id **MUST** be set to "0".
@ -220,6 +222,7 @@ The organisation UUID is globally assigned to an organisation and **SHALL** be k
The name is a readable description of the organisation and **SHOULD** be present. The name is a readable description of the organisation and **SHOULD** be present.
The id is a human-readable identifier generated by the instance and used as reference in the event. The id is a human-readable identifier generated by the instance and used as reference in the event.
A human-readable identifier **MUST** be represented as an unsigned integer.
uuid, name and id are represented as a JSON string. uuid, name and id **MUST** be present. uuid, name and id are represented as a JSON string. uuid, name and id **MUST** be present.
@ -242,6 +245,7 @@ The organisation UUID is globally assigned to an organisation and **SHALL** be k
The name is a readable description of the organisation and **SHOULD** be present. The name is a readable description of the organisation and **SHOULD** be present.
The id is a human-readable identifier generated by the instance and used as reference in the event. The id is a human-readable identifier generated by the instance and used as reference in the event.
A human-readable identifier **MUST** be represented as an unsigned integer.
uuid, name and id are represented as a JSON string. uuid, name and id **MUST** be present. uuid, name and id are represented as a JSON string. uuid, name and id **MUST** be present.
@ -285,7 +289,8 @@ uuid is represented as a JSON string. uuid **MUST** be present.
#### id #### id
id represents the human-readable identifier associated to the event for a specific MISP instance. id represents the human-readable identifier associated to the event for a specific MISP instance. A human-readable identifier **MUST** be
represented as an unsigned integer.
id is represented as a JSON string. id **SHALL** be present. id is represented as a JSON string. id **SHALL** be present.
@ -359,7 +364,8 @@ to\_ids is represented as a JSON boolean. to\_ids **MUST** be present.
#### event\_id #### event\_id
event\_id represents a human-readable identifier referencing the Event object that the attribute belongs to. event\_id represents a human-readable identifier referencing the Event object that the attribute belongs to. A human-readable identifier **MUST** be
represented as an unsigned integer.
The event\_id **SHOULD** be updated when the event is imported to reflect the newly created event's id on the instance. The event\_id **SHOULD** be updated when the event is imported to reflect the newly created event's id on the instance.
@ -403,7 +409,7 @@ comment is represented by a JSON string. comment **MAY** be present.
#### sharing_group_id #### sharing_group_id
sharing\_group\_id represents a human-readable identifier referencing a Sharing Group object that defines the distribution of the attribute, if distribution level "4" is set. sharing\_group\_id represents a human-readable identifier referencing a Sharing Group object that defines the distribution of the attribute, if distribution level "4" is set. A human-readable identifier **MUST** be represented as an unsigned integer.
sharing\_group\_id is represented by a JSON string and **SHOULD** be present. If a distribution level other than "4" is chosen the sharing\_group\_id **MUST** be set to "0". sharing\_group\_id is represented by a JSON string and **SHOULD** be present. If a distribution level other than "4" is chosen the sharing\_group\_id **MUST** be set to "0".
@ -481,8 +487,7 @@ uuid is represented as a JSON string. uuid **MUST** be present.
#### id #### id
id represents the human-readable identifier associated to the event for a specific MISP instance. id represents the human-readable identifier associated to the event for a specific MISP instance. human-readable identifier **MUST** be represented as an unsigned integer.
id is represented as a JSON string. id **SHALL** be present. id is represented as a JSON string. id **SHALL** be present.
#### type #### type
@ -583,7 +588,7 @@ comment is represented by a JSON string. comment **MAY** be present.
#### org\_id #### org\_id
org\_id represents a human-readable identifier referencing the proposal creator's Organisation object. org\_id represents a human-readable identifier referencing the proposal creator's Organisation object. A human-readable identifier **MUST** be represented as an unsigned integer.
Whilst attributes can only be created by the event creator organisation, shadow attributes can be created by third parties. org\_id tracks the creator organisation. Whilst attributes can only be created by the event creator organisation, shadow attributes can be created by third parties. org\_id tracks the creator organisation.
@ -619,6 +624,7 @@ The organization UUID is globally assigned to an organization and **SHALL** be k
The name is a readable description of the organization and **SHOULD** be present. The name is a readable description of the organization and **SHOULD** be present.
The id is a human-readable identifier generated by the instance and used as reference in the event. The id is a human-readable identifier generated by the instance and used as reference in the event.
A human-readable identifier **MUST** be represented as an unsigned integer.
uuid, name and id are represented as a JSON string. uuid, name and id **MUST** be present. uuid, name and id are represented as a JSON string. uuid, name and id **MUST** be present.
@ -695,7 +701,8 @@ for any updates or transfer of the same object. UUID version 4 is **RECOMMENDED*
#### id #### id
id represents the human-readable identifier associated to the object for a specific MISP instance. id represents the human-readable identifier associated to the object for a specific MISP instance. A human-readable identifier **MUST** be
represented as an unsigned integer.
id is represented as a JSON string. id **SHALL** be present. id is represented as a JSON string. id **SHALL** be present.
@ -732,7 +739,8 @@ version is represented as a JSON string. version **MUST** be present.
#### event_id #### event_id
event_id represents the human-readable identifier of the event that the object belongs to on a specific MISP instance. event_id represents the human-readable identifier of the event that the object belongs to on a specific MISP instance. A human-readable identifier **MUST** be
represented as an unsigned integer.
event_id is represented as a JSON string. event_id **SHALL** be present. event_id is represented as a JSON string. event_id **SHALL** be present.
@ -765,7 +773,7 @@ distribution is represented by a JSON string. distribution **MUST** be present a
#### sharing_group_id #### sharing_group_id
sharing\_group\_id represents a human-readable identifier referencing a Sharing Group object that defines the distribution of the object, if distribution level "4" is set. sharing\_group\_id represents a human-readable identifier referencing a Sharing Group object that defines the distribution of the object, if distribution level "4" is set. A human-readable identifier **MUST** be represented as an unsigned integer.
sharing\_group\_id is represented by a JSON string and **SHOULD** be present. If a distribution level other than "4" is chosen the sharing\_group\_id **MUST** be set to "0". sharing\_group\_id is represented by a JSON string and **SHOULD** be present. If a distribution level other than "4" is chosen the sharing\_group\_id **MUST** be set to "0".
@ -835,13 +843,15 @@ timestamp is represented as a JSON string. timestamp **MUST** be present.
#### object_id #### object_id
object_id represents the human-readable identifier of the object that the object reference belongs to on a specific MISP instance. object_id represents the human-readable identifier of the object that the object reference belongs to on a specific MISP instance. A human-readable identifier **MUST** be
represented as an unsigned integer.
event_id is represented as a JSON string. event_id **SHALL** be present. event_id is represented as a JSON string. event_id **SHALL** be present.
#### event_id #### event_id
event_id represents the human-readable identifier of the event that the object reference belongs to on a specific MISP instance. event_id represents the human-readable identifier of the event that the object reference belongs to on a specific MISP instance. A human-readable identifier **MUST** be
represented as an unsigned integer.
event_id is represented as a JSON string. event_id **SHALL** be present. event_id is represented as a JSON string. event_id **SHALL** be present.
@ -932,6 +942,8 @@ org_id **MAY** be present along the JSON object describing the organisation. If
org_id represents the human-readable identifier of the organisation which did the sighting and belongs to a specific MISP instance. org_id represents the human-readable identifier of the organisation which did the sighting and belongs to a specific MISP instance.
A human-readable identifier **MUST** be represented as an unsigned integer.
### Sample Sighting ### Sample Sighting
~~~~ ~~~~