MISP
/
misp-rfc
mirror of https://github.com/MISP/misp-rfc
2
0
Fork 0
Code Issues Releases Wiki Activity

Basic event attributes added

Rafiot-patch-1
Alexandre Dulaunoy 2016-10-01 17:50:05 +02:00
parent 3ccfde38a1
commit 63d00fc39e
2 changed files with 105 additions and 19 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

30
misp-core-format/raw.md
View File

@ -40,18 +40,48 @@ or even detailed information about a threat actor. MISP started as an open sourc
the MISP format started to be widely used as an exchange format within the community in the past years. The aim of this document the MISP format started to be widely used as an exchange format within the community in the past years. The aim of this document
is to describe the specification and the MISP core format. is to describe the specification and the MISP core format.
## Conventions and Terminology
The key words "**MUST**", "**MUST NOT**", "**REQUIRED**", "**SHALL**", "**SHALL NOT**",
"**SHOULD**", "**SHOULD NOT**", "**RECOMMENDED**", "**MAY**", and "**OPTIONAL**" in this
document are to be interpreted as described in RFC 2119 [@!RFC2119].
# Format # Format
## Overview ## Overview
The MISP core format is in the JSON [@!RFC4627] format. In MISP, an event is composed of a single JSON object. The MISP core format is in the JSON [@!RFC4627] format. In MISP, an event is composed of a single JSON object.
A capitalized key (like Event, Org) represent a data model and a non-capitalized key is just an attribute. This nomenclature
can support an implementation to represent the MISP format in another data structure.
## Event ## Event
An event is a simple meta structure scheme where attributes and meta-data are embedded to compose a coherent set An event is a simple meta structure scheme where attributes and meta-data are embedded to compose a coherent set
of indicators. An event can be composed from an incident, a security analysis report or a specific threat actor of indicators. An event can be composed from an incident, a security analysis report or a specific threat actor
analysis. The meaning of an event only depends of the information embedded in the event. analysis. The meaning of an event only depends of the information embedded in the event.
### Event Attributes
#### uuid
uuid represents the Universally Unique IDentifier (UUID) [@!RFC4122] of the event. The uuid MUST be preserved
for any updates or transfer of the same event. UUID version 4 is RECOMMENDED when assigning it to a new event.
uuid is represented as a JSON string. uuid MUST be present.
#### id
id represents the human-readable identifier associated to the event for a specific MISP instance.
id is represented as a JSON string. id SHALL be present.
#### published
published represents the event publication state. If the event was published, the published value MUST be true.
In any other publication state, the published value MUST be false.
published is represented as a JSON boolean. published MUST be present.
<reference anchor='MISP-P' target='https://github.com/MISP'> <reference anchor='MISP-P' target='https://github.com/MISP'>
<front> <front>

94
misp-core-format/raw.md.txt
View File

@ -2,7 +2,7 @@
Network Working Group M. Dulaunoy Network Working Group A. Dulaunoy
Internet-Draft CIRCL Internet-Draft CIRCL
Intended status: Informational October 1, 2016 Intended status: Informational October 1, 2016
Expires: April 4, 2017 Expires: April 4, 2017
@ -65,14 +65,16 @@ Internet-Draft MISP core format October 2016
Table of Contents Table of Contents
1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . 2 1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . 2
1.1. Conventions and Terminology . . . . . . . . . . . . . . . 2
2. Format . . . . . . . . . . . . . . . . . . . . . . . . . . . 2 2. Format . . . . . . . . . . . . . . . . . . . . . . . . . . . 2
2.1. Overview . . . . . . . . . . . . . . . . . . . . . . . . 2 2.1. Overview . . . . . . . . . . . . . . . . . . . . . . . . 2
2.2. Event . . . . . . . . . . . . . . . . . . . . . . . . . . 2 2.2. Event . . . . . . . . . . . . . . . . . . . . . . . . . . 3
3. References . . . . . . . . . . . . . . . . . . . . . . . . . 2 2.2.1. Event Attributes . . . . . . . . . . . . . . . . . . 3
3. References . . . . . . . . . . . . . . . . . . . . . . . . . 3
3.1. Normative References . . . . . . . . . . . . . . . . . . 3 3.1. Normative References . . . . . . . . . . . . . . . . . . 3
3.2. Informative References . . . . . . . . . . . . . . . . . 3 3.2. Informative References . . . . . . . . . . . . . . . . . 4
Appendix A. Acknowledgements . . . . . . . . . . . . . . . . . . 3 Appendix A. Acknowledgements . . . . . . . . . . . . . . . . . . 4
Author's Address . . . . . . . . . . . . . . . . . . . . . . . . 3 Author's Address . . . . . . . . . . . . . . . . . . . . . . . . 4
1. Introduction 1. Introduction
@ -85,6 +87,12 @@ Table of Contents
format within the community in the past years. The aim of this format within the community in the past years. The aim of this
document is to describe the specification and the MISP core format. document is to describe the specification and the MISP core format.
1.1. Conventions and Terminology
The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT",
"SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this
document are to be interpreted as described in RFC 2119 [RFC2119].
2. Format 2. Format
2.1. Overview 2.1. Overview
@ -92,18 +100,10 @@ Table of Contents
The MISP core format is in the JSON [RFC4627] format. In MISP, an The MISP core format is in the JSON [RFC4627] format. In MISP, an
event is composed of a single JSON object. event is composed of a single JSON object.
2.2. Event A capitalized key (like Event, Org) represent a data model and a non-
capitalized key is just an attribute. This nomenclature can support
An event is a simple meta structure scheme where attributes and meta- an implementation to represent the MISP format in another data
data are embedded to compose a coherent set of indicators. An event structure.
can be composed from an incident, a security analysis report or a
specific threat actor analysis. The meaning of an event only depends
of the information embedded in the event.
3. References
@ -114,8 +114,62 @@ Dulaunoy Expires April 4, 2017 [Page 2]
Internet-Draft MISP core format October 2016 Internet-Draft MISP core format October 2016
2.2. Event
An event is a simple meta structure scheme where attributes and meta-
data are embedded to compose a coherent set of indicators. An event
can be composed from an incident, a security analysis report or a
specific threat actor analysis. The meaning of an event only depends
of the information embedded in the event.
2.2.1. Event Attributes
2.2.1.1. uuid
uuid represents the Universally Unique IDentifier (UUID) [RFC4122] of
the event. The uuid MUST be preserved for any updates or transfer of
the same event. UUID version 4 is RECOMMENDED when assigning it to a
new event.
uuid is represented as a JSON string. uuid MUST be present.
2.2.1.2. id
id represents the human-readable identifier associated to the event
for a specific MISP instance.
id is represented as a JSON string. id SHALL be present.
2.2.1.3. published
published represents the event publication state. If the event was
published, the published value MUST be true. In any other
publication state, the published value MUST be false.
published is represented as a JSON boolean. published MUST be
present.
3. References
3.1. Normative References 3.1. Normative References
[RFC2119] Bradner, S., "Key words for use in RFCs to Indicate
Requirement Levels", BCP 14, RFC 2119,
DOI 10.17487/RFC2119, March 1997,
<http://www.rfc-editor.org/info/rfc2119>.
[RFC4122] Leach, P., Mealling, M., and R. Salz, "A Universally
Unique IDentifier (UUID) URN Namespace", RFC 4122,
DOI 10.17487/RFC4122, July 2005,
<http://www.rfc-editor.org/info/rfc4122>.
Dulaunoy Expires April 4, 2017 [Page 3]
Internet-Draft MISP core format October 2016
[RFC4627] Crockford, D., "The application/json Media Type for [RFC4627] Crockford, D., "The application/json Media Type for
JavaScript Object Notation (JSON)", RFC 4627, JavaScript Object Notation (JSON)", RFC 4627,
DOI 10.17487/RFC4627, July 2006, DOI 10.17487/RFC4627, July 2006,
@ -165,4 +219,6 @@ Author's Address
Dulaunoy Expires April 4, 2017 [Page 3]
Dulaunoy Expires April 4, 2017 [Page 4]