MISP
/
misp-rfc
mirror of https://github.com/MISP/misp-rfc
2
0
Fork 0
Code Issues Releases Wiki Activity

Added data field to attributes and shadow attributes

pull/6/head
Iglocska 2016-10-15 14:46:25 +02:00
parent df41edb66e
commit 36eed9b0aa
1 changed files with 14 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
misp-core-format/raw.md
View File

@ -404,6 +404,13 @@ deleted represents a setting that allows attributes to be revoked. Revoked attri
deleted is represented by a JSON boolean. deleted **MUST** be present.
#### data
data contains the base64 encoded contents of an attachment or a malware sample. For malware samples,
the sample **MUST** be encrypted using a password protected zip archive, with the password being "infected".
data is represented by a JSON string in base64 encoding. data **MUST** be set for attributes of type malware-sample and attachment.
#### RelatedAttribute
RelatedAttribute is an array of attributes correlating with the current attribute. Each element in the array represents an JSON object which contains an Attribute dictionnary with the external attributes who correlate. Each Attribute **MUST** include the id, org_id, info and a value. Only the correlations found on the local instance are shown in RelatedAttribute.
@ -578,6 +585,13 @@ deleted represents a setting that allows shadow attributes to be revoked. Revoke
deleted is represented by a JSON boolean. deleted **SHOULD** be present.
#### data
data contains the base64 encoded contents of an attachment or a malware sample. For malware samples,
the sample **MUST** be encrypted using a password protected zip archive, with the password being "infected".
data is represented by a JSON string in base64 encoding. data **MUST** be set for shadow attributes of type malware-sample and attachment.
### Org
An Org object is composed of an uuid, name and id.