+
"ObjectReference": {
"id": "195",
"uuid": "59c21a2c-c0ac-4083-93b3-363da07724d1",
"timestamp": "1505892908",
@@ -1336,236 +2621,372 @@
"object_uuid": "59c1134d-8a40-4c14-ad94-0f7ba07724d1",
"referenced_uuid": "59c1133c-9adc-4d06-a34b-0f7ca07724d1",
}
-
-
-
-
uuid represents the Universally Unique IDentifier (UUID) [RFC4122] of the object reference. The uuid MUST be preserved for any updates or transfer of the same object reference. UUID version 4 is RECOMMENDED when assigning it to a new object reference.
-
-
id represents the human-readable identifier associated to the object reference for a specific MISP instance.
-
id is represented as a JSON string. id SHALL be present.
-
-
timestamp represents a reference time when the object was created or last modified. timestamp is expressed in seconds (decimal) since 1st of January 1970 (Unix timestamp). The time zone MUST be UTC.
-
timestamp is represented as a JSON string. timestamp MUST be present.
-
-
object_id represents the human-readable identifier of the object that the object reference belongs to on a specific MISP instance. A human-readable identifier MUST be represented as an unsigned integer.
-
event_id is represented as a JSON string. event_id SHALL be present.
-
-
event_id represents the human-readable identifier of the event that the object reference belongs to on a specific MISP instance. A human-readable identifier MUST be represented as an unsigned integer.
-
event_id is represented as a JSON string. event_id SHALL be present.
-
-
referenced_id represents the human-readable identifier of the object or attribute that the parent object of the object reference points to on a specific MISP instance.
-
referenced_id is represented as a JSON string. referenced_id MAY be present.
-
-
referenced_type represents the numeric value describing what the object reference points to, "0" representing an attribute and "1" representing an object
-
referenced_type is represented as a JSON string. referenced_type MAY be present.
-
-
relationship_type represents the human-readable context of the relationship between an object and another object or attribute as described by the object_reference.
-
referenced_type is represented as a JSON string. relationship_type MUST be present.
-
-
comment is a contextual comment field.
-
comment is represented by a JSON string. comment MAY be present.
-
-
deleted represents a setting that allows object references to be revoked. Revoked object references are not actionable and exist merely to inform other instances of a revocation.
-
deleted is represented by a JSON boolean. deleted MUST be present.
-
-
object_uuid represents the Universally Unique IDentifier (UUID) [RFC4122] of the object that the given object reference belongs to. The object_uuid MUST be preserved to preserve the object reference's association with the object.
-
-
referenced_uuid represents the Universally Unique IDentifier (UUID) [RFC4122] of the object or attribute that is being referenced by the object reference. The referenced_uuid MUST be preserved to preserve the object reference's association with the object or attribute.
-
-
EventReport are used to complement an event with one or more report in Markdown format. The EventReport contains unstructured information which can be linked to Attributes, Objects, Tags or Galaxy with an extension to the Markdown marking language.
-
-
id represents the human-readable identifier associated to the EventReport for a specific MISP instance. A human-readable identifier MUST be represented as an unsigned integer.
-
id is represented as a JSON string. id SHALL be present.
-
-
uuid represents the Universally Unique IDentifier (UUID) [RFC4122] of the EventReport. The uuid MUST be preserved for any updates or transfer of the same EventReport. UUID version 4 is RECOMMENDED when assigning it to a new EventReport.
-
uuid is represented as a JSON string. uuid MUST be present.
-
-
event_id represents the human-readable identifier associating the EventReport to an event on a specific MISP instance. A human-readable identifier MUST be represented as an unsigned integer.
-
event_id is represented as a JSON string. event_id MUST be present.
-
-
name represents the information field of the EventReport. name is a free-text value to provide a human-readable summary of the report. name SHOULD NOT be bigger than 256 characters and SHOULD NOT include new-lines.
-
name is represented as a JSON string. name MUST be present.
-
-
content includes the raw EventReport in Markdown format with or without the specific MISP Markdown markup extension.
-
The markdown extension for MISP is composed with a symbol as prefix then between square bracket the scope (attribute, object, tag or galaxymatrix) followed by the UUID in parenthesis.
-
content is represented as a JSON string. content MUST be present.
-
-
distribution represents the basic distribution rules of the EventReport. The system must adhere to the distribution setting for access control and for dissemination of the EventReport.
-
distribution is represented by a JSON string. distribution MUST be present and be one of the following options:
-
-
-
-- 0
--
-
Your Organisation Only
-- 1
--
-
This Community Only
-- 2
--
-
Connected Communities
-- 3
--
-
All Communities
-- 4
--
-
Sharing Group
-- 5
--
-
Inherit Event
+¶
+
+
+2.4.2.9. comment +
+comment is a contextual comment field.¶
+comment is represented by a JSON string. comment MAY be present.¶
+