Alexandre Dulaunoy
cfa09fe7f0
schema This has been validated by @Delta-Sierra and schema got updated. @adulau updated the Internet-Draft following the approval of the TC at unanimity following a debate of 7 seconds which concluded in the approval of the removal of the field. The user-groups relying on the galaxy schema approved that the field was not used and was superseded by the 'related' field which is more convenient and already implemented by @cvandeplas (ref: https://github.com/MISP/misp-galaxy/blob/master/tools/gen_mapping.py) As the TC strictly follows the PMF methodology, the commit was signed off by the quorum required to validate a TC decision. Ref: https://twitter.com/Iglocska/status/1039214679267201026 (TC approval) |
||
|---|---|---|
| misp-core-format | ||
| misp-galaxy-format | ||
| misp-noticelist-format | ||
| misp-object-template-format | ||
| misp-taxonomy-format | ||
| misp-warninglist-format | ||
| README.md | ||
README.md
MISP standards
This repository is the official source of the specification and formats used in the MISP project.
The formats are described to support other implementations which reuse the format and ensuring an interoperability with existing MISP software and other Threat Intelligence Platforms.
All the formats can be freely reused by everyone.
MISP Formats in use and implemented in multiple software
- misp-core-format (markdown source) which describes the core JSON format of MISP. Current Internet-Draft: 04
- misp-taxonomy-format (markdown source) which describes the taxonomy JSON format of MISP. Current Internet-Draft: 05
- misp-galaxy-format which describes the galaxy template format used to expand the threat actor modelling of MISP. Current Internet-Draft: 04
- misp-object-template-format which describes the object template format to add combinedand composite object to the MISP core format. Current Internet-Draft: 01
MISP Format in design phase and implemented in at least one software prototype
- misp-modules-protocol which describes the misp-modules protocol used between MISP and misp-modules.
MISP Format in design phase
- misp-collaborative-voting-format which describes the collaborative voting and scoring format for the feeds providers.
Sample files
If you want to see how a threat intelligence can be easily expressed in MISP standard, the following resources might give you some ideas:
Installing MISP is also another option to see the MISP standards in action. The MISP standards are actively used in the MISP threat intelligence platform to support the complete chain from intelligence creation, sharing, distribution and synchronisation.
Contribution
If you want to contribute to the MISP specifications, feel free to open an issue.