From 63d00fc39ed1b1adbbe7f527ee0b7120ea5d2c48 Mon Sep 17 00:00:00 2001 From: Alexandre Dulaunoy Date: Sat, 1 Oct 2016 17:50:05 +0200 Subject: [PATCH] Basic event attributes added --- misp-core-format/raw.md | 30 ++++++++++++ misp-core-format/raw.md.txt | 94 +++++++++++++++++++++++++++++-------- 2 files changed, 105 insertions(+), 19 deletions(-) diff --git a/misp-core-format/raw.md b/misp-core-format/raw.md index 3c97f66..253fdd6 100644 --- a/misp-core-format/raw.md +++ b/misp-core-format/raw.md @@ -40,19 +40,49 @@ or even detailed information about a threat actor. MISP started as an open sourc the MISP format started to be widely used as an exchange format within the community in the past years. The aim of this document is to describe the specification and the MISP core format. +## Conventions and Terminology + +The key words "**MUST**", "**MUST NOT**", "**REQUIRED**", "**SHALL**", "**SHALL NOT**", +"**SHOULD**", "**SHOULD NOT**", "**RECOMMENDED**", "**MAY**", and "**OPTIONAL**" in this +document are to be interpreted as described in RFC 2119 [@!RFC2119]. + # Format ## Overview The MISP core format is in the JSON [@!RFC4627] format. In MISP, an event is composed of a single JSON object. +A capitalized key (like Event, Org) represent a data model and a non-capitalized key is just an attribute. This nomenclature +can support an implementation to represent the MISP format in another data structure. + ## Event An event is a simple meta structure scheme where attributes and meta-data are embedded to compose a coherent set of indicators. An event can be composed from an incident, a security analysis report or a specific threat actor analysis. The meaning of an event only depends of the information embedded in the event. +### Event Attributes +#### uuid + +uuid represents the Universally Unique IDentifier (UUID) [@!RFC4122] of the event. The uuid MUST be preserved +for any updates or transfer of the same event. UUID version 4 is RECOMMENDED when assigning it to a new event. + +uuid is represented as a JSON string. uuid MUST be present. + +#### id + +id represents the human-readable identifier associated to the event for a specific MISP instance. + +id is represented as a JSON string. id SHALL be present. + +#### published + +published represents the event publication state. If the event was published, the published value MUST be true. +In any other publication state, the published value MUST be false. + +published is represented as a JSON boolean. published MUST be present. + MISP Project - Malware Information Sharing Platform and Threat Sharing diff --git a/misp-core-format/raw.md.txt b/misp-core-format/raw.md.txt index 1574ae9..c90b0cc 100644 --- a/misp-core-format/raw.md.txt +++ b/misp-core-format/raw.md.txt @@ -2,7 +2,7 @@ -Network Working Group M. Dulaunoy +Network Working Group A. Dulaunoy Internet-Draft CIRCL Intended status: Informational October 1, 2016 Expires: April 4, 2017 @@ -65,14 +65,16 @@ Internet-Draft MISP core format October 2016 Table of Contents 1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . 2 + 1.1. Conventions and Terminology . . . . . . . . . . . . . . . 2 2. Format . . . . . . . . . . . . . . . . . . . . . . . . . . . 2 2.1. Overview . . . . . . . . . . . . . . . . . . . . . . . . 2 - 2.2. Event . . . . . . . . . . . . . . . . . . . . . . . . . . 2 - 3. References . . . . . . . . . . . . . . . . . . . . . . . . . 2 + 2.2. Event . . . . . . . . . . . . . . . . . . . . . . . . . . 3 + 2.2.1. Event Attributes . . . . . . . . . . . . . . . . . . 3 + 3. References . . . . . . . . . . . . . . . . . . . . . . . . . 3 3.1. Normative References . . . . . . . . . . . . . . . . . . 3 - 3.2. Informative References . . . . . . . . . . . . . . . . . 3 - Appendix A. Acknowledgements . . . . . . . . . . . . . . . . . . 3 - Author's Address . . . . . . . . . . . . . . . . . . . . . . . . 3 + 3.2. Informative References . . . . . . . . . . . . . . . . . 4 + Appendix A. Acknowledgements . . . . . . . . . . . . . . . . . . 4 + Author's Address . . . . . . . . . . . . . . . . . . . . . . . . 4 1. Introduction @@ -85,6 +87,12 @@ Table of Contents format within the community in the past years. The aim of this document is to describe the specification and the MISP core format. +1.1. Conventions and Terminology + + The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", + "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this + document are to be interpreted as described in RFC 2119 [RFC2119]. + 2. Format 2.1. Overview @@ -92,18 +100,10 @@ Table of Contents The MISP core format is in the JSON [RFC4627] format. In MISP, an event is composed of a single JSON object. -2.2. Event - - An event is a simple meta structure scheme where attributes and meta- - data are embedded to compose a coherent set of indicators. An event - can be composed from an incident, a security analysis report or a - specific threat actor analysis. The meaning of an event only depends - of the information embedded in the event. - -3. References - - - + A capitalized key (like Event, Org) represent a data model and a non- + capitalized key is just an attribute. This nomenclature can support + an implementation to represent the MISP format in another data + structure. @@ -114,8 +114,62 @@ Dulaunoy Expires April 4, 2017 [Page 2] Internet-Draft MISP core format October 2016 +2.2. Event + + An event is a simple meta structure scheme where attributes and meta- + data are embedded to compose a coherent set of indicators. An event + can be composed from an incident, a security analysis report or a + specific threat actor analysis. The meaning of an event only depends + of the information embedded in the event. + +2.2.1. Event Attributes + +2.2.1.1. uuid + + uuid represents the Universally Unique IDentifier (UUID) [RFC4122] of + the event. The uuid MUST be preserved for any updates or transfer of + the same event. UUID version 4 is RECOMMENDED when assigning it to a + new event. + + uuid is represented as a JSON string. uuid MUST be present. + +2.2.1.2. id + + id represents the human-readable identifier associated to the event + for a specific MISP instance. + + id is represented as a JSON string. id SHALL be present. + +2.2.1.3. published + + published represents the event publication state. If the event was + published, the published value MUST be true. In any other + publication state, the published value MUST be false. + + published is represented as a JSON boolean. published MUST be + present. + +3. References + 3.1. Normative References + [RFC2119] Bradner, S., "Key words for use in RFCs to Indicate + Requirement Levels", BCP 14, RFC 2119, + DOI 10.17487/RFC2119, March 1997, + . + + [RFC4122] Leach, P., Mealling, M., and R. Salz, "A Universally + Unique IDentifier (UUID) URN Namespace", RFC 4122, + DOI 10.17487/RFC4122, July 2005, + . + + + +Dulaunoy Expires April 4, 2017 [Page 3] + +Internet-Draft MISP core format October 2016 + + [RFC4627] Crockford, D., "The application/json Media Type for JavaScript Object Notation (JSON)", RFC 4627, DOI 10.17487/RFC4627, July 2006, @@ -165,4 +219,6 @@ Author's Address -Dulaunoy Expires April 4, 2017 [Page 3] + + +Dulaunoy Expires April 4, 2017 [Page 4]