MISP
/
misp-rfc
mirror of https://github.com/MISP/misp-rfc
2
0
Fork 0
Code Issues Releases Wiki Activity

chg: [misp-galaxy] meta extended with generic/community field for 

attribution based on the original CFR classification.

suspected-victims, suspected-state-sponsor, type-of-incident,
target-category added

The goal is to ensure a consistent scheme across all galaxies to
allow a community-based attribution. If an attribution is not accepted
at large by the community, specific ones like CFR can be used or
even extended.
pull/21/head
Alexandre Dulaunoy 2018-09-20 07:41:12 +02:00
parent 6671a70466
commit 9a4f035b4b
No known key found for this signature in database
GPG Key ID: 09E2CD4944E6CBCD
1 changed files with 2 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
misp-galaxy-format/raw.md
View File

@ -5,7 +5,7 @@
% ipr= "trust200902"
% area = "Security"
%
% date = 2018-04-01T00:00:00Z
% date = 2018-09-20T00:00:00Z
%
% [[author]]
% initials="A."
@ -104,9 +104,7 @@ Related contains a list of JSON key value pairs which describe the related value
## meta
Meta contains a list of custom defined JSON key value pairs. Users **SHOULD** reuse commonly used keys such as properties, complexity, effectiveness, country, possible_issues, colour, motive, impact, refs, synonyms, status, date, encryption, extensions, ransomnotes, cfr-suspected-victims, cfr-suspected-state-sponsor, cfr-type-of-incident, cfr-target-category wherever applicable.
properties is used to provide clusters with additional properties. Properties are represented as an array containing one or more strings ans **MAY** be present.
Meta contains a list of custom defined JSON key value pairs. Users **SHOULD** reuse commonly used keys such as complexity, effectiveness, country, possible_issues, colour, motive, impact, refs, synonyms, status, date, encryption, extensions, ransomnotes, suspected-victims, suspected-state-sponsor, type-of-incident, target-category, cfr-suspected-victims, cfr-suspected-state-sponsor, cfr-type-of-incident, cfr-target-category wherever applicable.
date, status **MAY** be used to give time information about an cluster. date is represented as a string describing a time or period and **SHALL** be present. status is represented as a string describing the current status of the clusters. It **MAY** also describe a time or period and **SHALL** be present.