MISP
/
misp-rfc
mirror of https://github.com/MISP/misp-rfc
2
0
Fork 0
Code Issues Releases Wiki Activity

chg: [misp-galaxy] removed unused derivated_from field from MISP galaxy 

schema

This has been validated by @Delta-Sierra and schema got updated.

@adulau updated the Internet-Draft following the approval of the TC
at unanimity following a debate of 7 seconds which concluded in
the approval of the removal of the field. The user-groups relying
on the galaxy schema approved that the field was not used and was
superseded by the 'related' field which is more convenient and
already implemented by @cvandeplas (ref:
https://github.com/MISP/misp-galaxy/blob/master/tools/gen_mapping.py)

As the TC strictly follows the PMF methodology, the commit was signed off
by the quorum required to validate a TC decision.

Ref: https://twitter.com/Iglocska/status/1039214679267201026 (TC
approval)
pull/21/head
Alexandre Dulaunoy 2018-09-10 20:11:16 +02:00
parent 8ff4c098a5
commit cfa09fe7f0
No known key found for this signature in database
GPG Key ID: 09E2CD4944E6CBCD
1 changed files with 1 additions and 10 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
misp-galaxy-format/raw.md
View File

@ -104,12 +104,10 @@ Related contains a list of JSON key value pairs which describe the related value
## meta ## meta
Meta contains a list of custom defined JSON key value pairs. Users **SHOULD** reuse commonly used keys such as properties, complexity, effectiveness, country, possible_issues, colour, motive, impact, refs, synonyms, derivated_from, status, date, encryption, extensions, ransomnotes, cfr-suspected-victims, cfr-suspected-state-sponsor, cfr-type-of-incident, cfr-target-category wherever applicable. Meta contains a list of custom defined JSON key value pairs. Users **SHOULD** reuse commonly used keys such as properties, complexity, effectiveness, country, possible_issues, colour, motive, impact, refs, synonyms, status, date, encryption, extensions, ransomnotes, cfr-suspected-victims, cfr-suspected-state-sponsor, cfr-type-of-incident, cfr-target-category wherever applicable.
properties is used to provide clusters with additional properties. Properties are represented as an array containing one or more strings ans **MAY** be present. properties is used to provide clusters with additional properties. Properties are represented as an array containing one or more strings ans **MAY** be present.
derivated_from, refs, synonyms **SHALL** be used to give further informations. refs is represented as an array containing one or more strings and **SHALL** be present. synonyms is represented as an array containing one or more strings and **SHALL** be present. derivated_from is represented as an array containing one or more strings and **SHALL** be present.
date, status **MAY** be used to give time information about an cluster. date is represented as a string describing a time or period and **SHALL** be present. status is represented as a string describing the current status of the clusters. It **MAY** also describe a time or period and **SHALL** be present. date, status **MAY** be used to give time information about an cluster. date is represented as a string describing a time or period and **SHALL** be present. status is represented as a string describing the current status of the clusters. It **MAY** also describe a time or period and **SHALL** be present.
colour fields **MAY** be used at predicates or values level to set a specify colour that **MAY** be used by the implementation. The colour field is described as an RGB colour fill in hexadecimal representation. colour fields **MAY** be used at predicates or values level to set a specify colour that **MAY** be used by the implementation. The colour field is described as an RGB colour fill in hexadecimal representation.
@ -347,13 +345,6 @@ The JSON Schema [@?JSON-SCHEMA] below defines the overall MISP galaxy formats. T
"type": "string" "type": "string"
} }
}, },
"derivated_from": {
"type": "array",
"uniqueItems": true,
"items": {
"type": "string"
}
},
"status": { "status": {
"type": "string" "type": "string"
}, },