From e53e962a6e39ec8d9af132159882314ccb2bb2ad Mon Sep 17 00:00:00 2001 From: Maxime THIEBAUT <46688461+0xThiebaut@users.noreply.github.com> Date: Sun, 6 Feb 2022 10:55:10 +0100 Subject: [PATCH] Improve `Sighting`'s JSON representation discription --- misp-core-format/raw.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/misp-core-format/raw.md b/misp-core-format/raw.md index 1c691cd..2894a57 100755 --- a/misp-core-format/raw.md +++ b/misp-core-format/raw.md @@ -1071,7 +1071,7 @@ date_sighting **MUST** be present. date_sighting is expressed in seconds (decima source **MAY** be present. source is represented as a JSON string and represents the human-readable version of the sighting source, which can be a given piece of software (e.g. SIEM), device or a specific analytical process. -id, event_id and attribute_id **MAY** be present. +id, event_id and attribute_id are represented as a JSON string and **MAY** be present. id represents the human-readable identifier of the sighting reference which belongs to a specific MISP instance. event_id represents the human-readable identifier of the event referenced by the sighting and belongs to a specific MISP instance. @@ -1081,7 +1081,7 @@ org_id **MAY** be present along the JSON object describing the organisation. If org_id represents the human-readable identifier of the organisation which did the sighting and belongs to a specific MISP instance. -A human-readable identifier **MUST** be represented as an unsigned integer. +A human-readable identifier **MUST** be considered as an unsigned integer. ### Sample Sighting