diff --git a/build.sh b/build.sh
new file mode 100644
index 0000000..eff3546
--- /dev/null
+++ b/build.sh
@@ -0,0 +1,4 @@
+#!/bin/bash
+
+bundle exec jekyll build
+rsync -v -4 -rz --checksum _site adulau@kb.quuxlabs.com:/home/adulau/website/misp-standard.org/
diff --git a/rfc/misp-standard-core.html b/rfc/misp-standard-core.html
index 747ba01..df62914 100644
--- a/rfc/misp-standard-core.html
+++ b/rfc/misp-standard-core.html
@@ -14,29 +14,28 @@ The JSON format includes the overall structure along with the semantic associate
 respective key. The format is described to support other implementations which reuse the
 format and ensuring an interoperability with existing MISP   software and other Threat Intelligence Platforms. 
     " name="description">
-<meta content="xml2rfc 3.9.1" name="generator">
+<meta content="xml2rfc 3.12.1" name="generator">
 <meta content="draft-00" name="ietf.draft">
 <!-- Generator version information:
-  xml2rfc 3.9.1
-    Python 3.6.9
+  xml2rfc 3.12.1
+    Python 3.8.10
     appdirs 1.4.4
-    ConfigArgParse 1.5.2
-    google-i18n-address 2.3.5
-    html5lib 1.0.1
-    intervaltree 2.1.0
-    Jinja2 2.11.2
+    ConfigArgParse 1.5.3
+    google-i18n-address 2.5.0
+    html5lib 1.1
+    intervaltree 3.1.0
+    Jinja2 2.11.3
     kitchen 1.2.6
-    lxml 4.6.3
+    lxml 4.7.1
     pycairo 1.16.2
-    pycountry 18.12.8
-    pyflakes 2.1.1
+    pycountry 22.1.10
+    pyflakes 2.4.0
     PyYAML 5.4.1
-    requests 2.25.1
-    setuptools 57.1.0
+    requests 2.24.0
+    setuptools 45.2.0
     six 1.15.0
-    WeasyPrint 48
 -->
-<link href="misp-standard-core.xml" rel="alternate" type="application/rfc+xml">
+<link href="raw.md.xml" rel="alternate" type="application/rfc+xml">
 <link href="#copyright" rel="license">
 <style type="text/css">/*
 
@@ -390,6 +389,12 @@ hr {
   float: left;
   margin-bottom: 0;
 }
+/* Fix PDF info block run off issue */
+@media print {
+  #identifiers dd {
+    float: none;
+  }
+}
 #identifiers .authors .author {
   display: inline-block;
   margin-right: 1.5em;
@@ -1084,7 +1089,7 @@ tr:nth-child(2n+1) > td {
 }
 /* Change the approach to avoiding breaks inside artwork etc. */
 figure, pre, table, .artwork, .sourcecode  {
-  break-before: avoid-page;
+  break-before: auto;
   break-after: auto;
 }
 /* Avoid breaks between <dt> and <dd> */
@@ -1185,11 +1190,11 @@ li > p:last-of-type {
 <thead><tr>
 <td class="left">Internet-Draft</td>
 <td class="center">MISP core format</td>
-<td class="right">October 2021</td>
+<td class="right">February 2022</td>
 </tr></thead>
 <tfoot><tr>
 <td class="left">Dulaunoy &amp; Iklody</td>
-<td class="center">Expires 1 May 2022</td>
+<td class="center">Expires 19 August 2022</td>
 <td class="right">[Page]</td>
 </tr></tfoot>
 </table>
@@ -1202,12 +1207,12 @@ li > p:last-of-type {
 <dd class="internet-draft">draft-00</dd>
 <dt class="label-published">Published:</dt>
 <dd class="published">
-<time datetime="2021-10-28" class="published">28 October 2021</time>
+<time datetime="2022-02-15" class="published">15 February 2022</time>
     </dd>
 <dt class="label-intended-status">Intended Status:</dt>
 <dd class="intended-status">Informational</dd>
 <dt class="label-expires">Expires:</dt>
-<dd class="expires"><time datetime="2022-05-01">1 May 2022</time></dd>
+<dd class="expires"><time datetime="2022-08-19">19 August 2022</time></dd>
 <dt class="label-authors">Authors:</dt>
 <dd class="authors">
 <div class="author">
@@ -1249,7 +1254,7 @@ format and ensuring an interoperability with existing MISP <span>[<a href="#MISP
         time. It is inappropriate to use Internet-Drafts as reference
         material or to cite them other than as "work in progress."<a href="#section-boilerplate.1-3" class="pilcrow">¶</a></p>
 <p id="section-boilerplate.1-4">
-        This Internet-Draft will expire on 1 May 2022.<a href="#section-boilerplate.1-4" class="pilcrow">¶</a></p>
+        This Internet-Draft will expire on 19 August 2022.<a href="#section-boilerplate.1-4" class="pilcrow">¶</a></p>
 </section>
 </div>
 <div id="copyright">
@@ -1258,7 +1263,7 @@ format and ensuring an interoperability with existing MISP <span>[<a href="#MISP
 <a href="#name-copyright-notice" class="section-name selfRef">Copyright Notice</a>
         </h2>
 <p id="section-boilerplate.2-1">
-            Copyright (c) 2021 IETF Trust and the persons identified as the
+            Copyright (c) 2022 IETF Trust and the persons identified as the
             document authors. All rights reserved.<a href="#section-boilerplate.2-1" class="pilcrow">¶</a></p>
 <p id="section-boilerplate.2-2">
             This document is subject to BCP 78 and the IETF Trust's Legal
@@ -1274,180 +1279,172 @@ format and ensuring an interoperability with existing MISP <span>[<a href="#MISP
         <a href="#" onclick="scroll(0,0)" class="toplink">▲</a><h2 id="name-table-of-contents">
 <a href="#name-table-of-contents" class="section-name selfRef">Table of Contents</a>
         </h2>
-<nav class="toc"><ul class="ulBare toc compact ulEmpty">
-<li class="ulBare toc compact ulEmpty" id="section-toc.1-1.1">
+<nav class="toc"><ul class="compact toc ulBare ulEmpty">
+<li class="compact toc ulBare ulEmpty" id="section-toc.1-1.1">
             <p id="section-toc.1-1.1.1" class="keepWithNext"><a href="#section-1" class="xref">1</a>.  <a href="#name-introduction" class="xref">Introduction</a></p>
-<ul class="compact ulBare ulEmpty toc">
-<li class="compact ulBare ulEmpty toc" id="section-toc.1-1.1.2.1">
+<ul class="compact toc ulBare ulEmpty">
+<li class="compact toc ulBare ulEmpty" id="section-toc.1-1.1.2.1">
                 <p id="section-toc.1-1.1.2.1.1" class="keepWithNext"><a href="#section-1.1" class="xref">1.1</a>.  <a href="#name-conventions-and-terminology" class="xref">Conventions and Terminology</a></p>
 </li>
             </ul>
 </li>
-          <li class="ulBare toc compact ulEmpty" id="section-toc.1-1.2">
+          <li class="compact toc ulBare ulEmpty" id="section-toc.1-1.2">
             <p id="section-toc.1-1.2.1"><a href="#section-2" class="xref">2</a>.  <a href="#name-format" class="xref">Format</a></p>
-<ul class="compact ulBare ulEmpty toc">
-<li class="compact ulBare ulEmpty toc" id="section-toc.1-1.2.2.1">
+<ul class="compact toc ulBare ulEmpty">
+<li class="compact toc ulBare ulEmpty" id="section-toc.1-1.2.2.1">
                 <p id="section-toc.1-1.2.2.1.1" class="keepWithNext"><a href="#section-2.1" class="xref">2.1</a>.  <a href="#name-overview" class="xref">Overview</a></p>
 </li>
-              <li class="compact ulBare ulEmpty toc" id="section-toc.1-1.2.2.2">
+              <li class="compact toc ulBare ulEmpty" id="section-toc.1-1.2.2.2">
                 <p id="section-toc.1-1.2.2.2.1"><a href="#section-2.2" class="xref">2.2</a>.  <a href="#name-event" class="xref">Event</a></p>
-<ul class="compact ulBare ulEmpty toc">
-<li class="compact ulBare ulEmpty toc" id="section-toc.1-1.2.2.2.2.1">
+<ul class="compact toc ulBare ulEmpty">
+<li class="compact toc ulBare ulEmpty" id="section-toc.1-1.2.2.2.2.1">
                     <p id="section-toc.1-1.2.2.2.2.1.1"><a href="#section-2.2.1" class="xref">2.2.1</a>.  <a href="#name-event-attributes" class="xref">Event Attributes</a></p>
 </li>
-                </ul>
-</li>
-              <li class="compact ulBare ulEmpty toc" id="section-toc.1-1.2.2.3">
-                <p id="section-toc.1-1.2.2.3.1"><a href="#section-2.3" class="xref">2.3</a>.  <a href="#name-objects" class="xref">Objects</a></p>
-<ul class="compact ulBare ulEmpty toc">
-<li class="compact ulBare ulEmpty toc" id="section-toc.1-1.2.2.3.2.1">
-                    <p id="section-toc.1-1.2.2.3.2.1.1"><a href="#section-2.3.1" class="xref">2.3.1</a>.  <a href="#name-org" class="xref">Org</a></p>
-</li>
-                  <li class="compact ulBare ulEmpty toc" id="section-toc.1-1.2.2.3.2.2">
-                    <p id="section-toc.1-1.2.2.3.2.2.1"><a href="#section-2.3.2" class="xref">2.3.2</a>.  <a href="#name-orgc" class="xref">Orgc</a></p>
+                  <li class="compact toc ulBare ulEmpty" id="section-toc.1-1.2.2.2.2.2">
+                    <p id="section-toc.1-1.2.2.2.2.2.1"><a href="#section-2.2.2" class="xref">2.2.2</a>.  <a href="#name-event-objects" class="xref">Event Objects</a></p>
 </li>
                 </ul>
 </li>
-              <li class="compact ulBare ulEmpty toc" id="section-toc.1-1.2.2.4">
-                <p id="section-toc.1-1.2.2.4.1"><a href="#section-2.4" class="xref">2.4</a>.  <a href="#name-attribute" class="xref">Attribute</a></p>
-<ul class="compact ulBare ulEmpty toc">
-<li class="compact ulBare ulEmpty toc" id="section-toc.1-1.2.2.4.2.1">
-                    <p id="section-toc.1-1.2.2.4.2.1.1"><a href="#section-2.4.1" class="xref">2.4.1</a>.  <a href="#name-sample-attribute-object" class="xref">Sample Attribute Object</a></p>
+              <li class="compact toc ulBare ulEmpty" id="section-toc.1-1.2.2.3">
+                <p id="section-toc.1-1.2.2.3.1"><a href="#section-2.3" class="xref">2.3</a>.  <a href="#name-attribute" class="xref">Attribute</a></p>
+<ul class="compact toc ulBare ulEmpty">
+<li class="compact toc ulBare ulEmpty" id="section-toc.1-1.2.2.3.2.1">
+                    <p id="section-toc.1-1.2.2.3.2.1.1"><a href="#section-2.3.1" class="xref">2.3.1</a>.  <a href="#name-sample-attribute-object" class="xref">Sample Attribute Object</a></p>
 </li>
-                  <li class="compact ulBare ulEmpty toc" id="section-toc.1-1.2.2.4.2.2">
-                    <p id="section-toc.1-1.2.2.4.2.2.1"><a href="#section-2.4.2" class="xref">2.4.2</a>.  <a href="#name-attribute-attributes" class="xref">Attribute Attributes</a></p>
+                  <li class="compact toc ulBare ulEmpty" id="section-toc.1-1.2.2.3.2.2">
+                    <p id="section-toc.1-1.2.2.3.2.2.1"><a href="#section-2.3.2" class="xref">2.3.2</a>.  <a href="#name-attribute-attributes" class="xref">Attribute Attributes</a></p>
 </li>
                 </ul>
 </li>
-              <li class="compact ulBare ulEmpty toc" id="section-toc.1-1.2.2.5">
-                <p id="section-toc.1-1.2.2.5.1"><a href="#section-2.5" class="xref">2.5</a>.  <a href="#name-shadowattribute-2" class="xref">ShadowAttribute</a></p>
-<ul class="compact ulBare ulEmpty toc">
-<li class="compact ulBare ulEmpty toc" id="section-toc.1-1.2.2.5.2.1">
-                    <p id="section-toc.1-1.2.2.5.2.1.1"><a href="#section-2.5.1" class="xref">2.5.1</a>.  <a href="#name-sample-attribute-object-2" class="xref">Sample Attribute Object</a></p>
+              <li class="compact toc ulBare ulEmpty" id="section-toc.1-1.2.2.4">
+                <p id="section-toc.1-1.2.2.4.1"><a href="#section-2.4" class="xref">2.4</a>.  <a href="#name-shadowattribute-2" class="xref">ShadowAttribute</a></p>
+<ul class="compact toc ulBare ulEmpty">
+<li class="compact toc ulBare ulEmpty" id="section-toc.1-1.2.2.4.2.1">
+                    <p id="section-toc.1-1.2.2.4.2.1.1"><a href="#section-2.4.1" class="xref">2.4.1</a>.  <a href="#name-sample-attribute-object-2" class="xref">Sample Attribute Object</a></p>
 </li>
-                  <li class="compact ulBare ulEmpty toc" id="section-toc.1-1.2.2.5.2.2">
-                    <p id="section-toc.1-1.2.2.5.2.2.1"><a href="#section-2.5.2" class="xref">2.5.2</a>.  <a href="#name-shadowattribute-attributes" class="xref">ShadowAttribute Attributes</a></p>
+                  <li class="compact toc ulBare ulEmpty" id="section-toc.1-1.2.2.4.2.2">
+                    <p id="section-toc.1-1.2.2.4.2.2.1"><a href="#section-2.4.2" class="xref">2.4.2</a>.  <a href="#name-shadowattribute-attributes" class="xref">ShadowAttribute Attributes</a></p>
 </li>
-                  <li class="compact ulBare ulEmpty toc" id="section-toc.1-1.2.2.5.2.3">
-                    <p id="section-toc.1-1.2.2.5.2.3.1"><a href="#section-2.5.3" class="xref">2.5.3</a>.  <a href="#name-org-2" class="xref">Org</a></p>
+                  <li class="compact toc ulBare ulEmpty" id="section-toc.1-1.2.2.4.2.3">
+                    <p id="section-toc.1-1.2.2.4.2.3.1"><a href="#section-2.4.3" class="xref">2.4.3</a>.  <a href="#name-shadowattribute-objects" class="xref">ShadowAttribute Objects</a></p>
 </li>
                 </ul>
 </li>
-              <li class="compact ulBare ulEmpty toc" id="section-toc.1-1.2.2.6">
-                <p id="section-toc.1-1.2.2.6.1"><a href="#section-2.6" class="xref">2.6</a>.  <a href="#name-object" class="xref">Object</a></p>
-<ul class="compact ulBare ulEmpty toc">
-<li class="compact ulBare ulEmpty toc" id="section-toc.1-1.2.2.6.2.1">
-                    <p id="section-toc.1-1.2.2.6.2.1.1"><a href="#section-2.6.1" class="xref">2.6.1</a>.  <a href="#name-sample-object" class="xref">Sample Object</a></p>
+              <li class="compact toc ulBare ulEmpty" id="section-toc.1-1.2.2.5">
+                <p id="section-toc.1-1.2.2.5.1"><a href="#section-2.5" class="xref">2.5</a>.  <a href="#name-object" class="xref">Object</a></p>
+<ul class="compact toc ulBare ulEmpty">
+<li class="compact toc ulBare ulEmpty" id="section-toc.1-1.2.2.5.2.1">
+                    <p id="section-toc.1-1.2.2.5.2.1.1"><a href="#section-2.5.1" class="xref">2.5.1</a>.  <a href="#name-sample-object" class="xref">Sample Object</a></p>
 </li>
-                  <li class="compact ulBare ulEmpty toc" id="section-toc.1-1.2.2.6.2.2">
-                    <p id="section-toc.1-1.2.2.6.2.2.1"><a href="#section-2.6.2" class="xref">2.6.2</a>.  <a href="#name-object-attributes" class="xref">Object Attributes</a></p>
+                  <li class="compact toc ulBare ulEmpty" id="section-toc.1-1.2.2.5.2.2">
+                    <p id="section-toc.1-1.2.2.5.2.2.1"><a href="#section-2.5.2" class="xref">2.5.2</a>.  <a href="#name-object-attributes" class="xref">Object Attributes</a></p>
 </li>
                 </ul>
 </li>
-              <li class="compact ulBare ulEmpty toc" id="section-toc.1-1.2.2.7">
-                <p id="section-toc.1-1.2.2.7.1"><a href="#section-2.7" class="xref">2.7</a>.  <a href="#name-object-references" class="xref">Object References</a></p>
-<ul class="compact ulBare ulEmpty toc">
-<li class="compact ulBare ulEmpty toc" id="section-toc.1-1.2.2.7.2.1">
-                    <p id="section-toc.1-1.2.2.7.2.1.1"><a href="#section-2.7.1" class="xref">2.7.1</a>.  <a href="#name-sample-objectreference-obje" class="xref">Sample ObjectReference object</a></p>
+              <li class="compact toc ulBare ulEmpty" id="section-toc.1-1.2.2.6">
+                <p id="section-toc.1-1.2.2.6.1"><a href="#section-2.6" class="xref">2.6</a>.  <a href="#name-object-references" class="xref">Object References</a></p>
+<ul class="compact toc ulBare ulEmpty">
+<li class="compact toc ulBare ulEmpty" id="section-toc.1-1.2.2.6.2.1">
+                    <p id="section-toc.1-1.2.2.6.2.1.1"><a href="#section-2.6.1" class="xref">2.6.1</a>.  <a href="#name-sample-objectreference-obje" class="xref">Sample ObjectReference object</a></p>
 </li>
-                  <li class="compact ulBare ulEmpty toc" id="section-toc.1-1.2.2.7.2.2">
-                    <p id="section-toc.1-1.2.2.7.2.2.1"><a href="#section-2.7.2" class="xref">2.7.2</a>.  <a href="#name-objectreference-attributes" class="xref">ObjectReference Attributes</a></p>
+                  <li class="compact toc ulBare ulEmpty" id="section-toc.1-1.2.2.6.2.2">
+                    <p id="section-toc.1-1.2.2.6.2.2.1"><a href="#section-2.6.2" class="xref">2.6.2</a>.  <a href="#name-objectreference-attributes" class="xref">ObjectReference Attributes</a></p>
 </li>
                 </ul>
 </li>
-              <li class="compact ulBare ulEmpty toc" id="section-toc.1-1.2.2.8">
-                <p id="section-toc.1-1.2.2.8.1"><a href="#section-2.8" class="xref">2.8</a>.  <a href="#name-eventreport" class="xref">EventReport</a></p>
-<ul class="compact ulBare ulEmpty toc">
-<li class="compact ulBare ulEmpty toc" id="section-toc.1-1.2.2.8.2.1">
-                    <p id="section-toc.1-1.2.2.8.2.1.1"><a href="#section-2.8.1" class="xref">2.8.1</a>.  <a href="#name-id-6" class="xref">id</a></p>
+              <li class="compact toc ulBare ulEmpty" id="section-toc.1-1.2.2.7">
+                <p id="section-toc.1-1.2.2.7.1"><a href="#section-2.7" class="xref">2.7</a>.  <a href="#name-eventreport" class="xref">EventReport</a></p>
+<ul class="compact toc ulBare ulEmpty">
+<li class="compact toc ulBare ulEmpty" id="section-toc.1-1.2.2.7.2.1">
+                    <p id="section-toc.1-1.2.2.7.2.1.1"><a href="#section-2.7.1" class="xref">2.7.1</a>.  <a href="#name-id-6" class="xref">id</a></p>
 </li>
-                  <li class="compact ulBare ulEmpty toc" id="section-toc.1-1.2.2.8.2.2">
-                    <p id="section-toc.1-1.2.2.8.2.2.1"><a href="#section-2.8.2" class="xref">2.8.2</a>.  <a href="#name-uuid-6" class="xref">UUID</a></p>
+                  <li class="compact toc ulBare ulEmpty" id="section-toc.1-1.2.2.7.2.2">
+                    <p id="section-toc.1-1.2.2.7.2.2.1"><a href="#section-2.7.2" class="xref">2.7.2</a>.  <a href="#name-uuid-6" class="xref">UUID</a></p>
 </li>
-                  <li class="compact ulBare ulEmpty toc" id="section-toc.1-1.2.2.8.2.3">
-                    <p id="section-toc.1-1.2.2.8.2.3.1"><a href="#section-2.8.3" class="xref">2.8.3</a>.  <a href="#name-event_id-5" class="xref">event_id</a></p>
+                  <li class="compact toc ulBare ulEmpty" id="section-toc.1-1.2.2.7.2.3">
+                    <p id="section-toc.1-1.2.2.7.2.3.1"><a href="#section-2.7.3" class="xref">2.7.3</a>.  <a href="#name-event_id-5" class="xref">event_id</a></p>
 </li>
-                  <li class="compact ulBare ulEmpty toc" id="section-toc.1-1.2.2.8.2.4">
-                    <p id="section-toc.1-1.2.2.8.2.4.1"><a href="#section-2.8.4" class="xref">2.8.4</a>.  <a href="#name-name-2" class="xref">name</a></p>
+                  <li class="compact toc ulBare ulEmpty" id="section-toc.1-1.2.2.7.2.4">
+                    <p id="section-toc.1-1.2.2.7.2.4.1"><a href="#section-2.7.4" class="xref">2.7.4</a>.  <a href="#name-name-2" class="xref">name</a></p>
 </li>
-                  <li class="compact ulBare ulEmpty toc" id="section-toc.1-1.2.2.8.2.5">
-                    <p id="section-toc.1-1.2.2.8.2.5.1"><a href="#section-2.8.5" class="xref">2.8.5</a>.  <a href="#name-content" class="xref">content</a></p>
+                  <li class="compact toc ulBare ulEmpty" id="section-toc.1-1.2.2.7.2.5">
+                    <p id="section-toc.1-1.2.2.7.2.5.1"><a href="#section-2.7.5" class="xref">2.7.5</a>.  <a href="#name-content" class="xref">content</a></p>
 </li>
-                  <li class="compact ulBare ulEmpty toc" id="section-toc.1-1.2.2.8.2.6">
-                    <p id="section-toc.1-1.2.2.8.2.6.1"><a href="#section-2.8.6" class="xref">2.8.6</a>.  <a href="#name-distribution-4" class="xref">distribution</a></p>
+                  <li class="compact toc ulBare ulEmpty" id="section-toc.1-1.2.2.7.2.6">
+                    <p id="section-toc.1-1.2.2.7.2.6.1"><a href="#section-2.7.6" class="xref">2.7.6</a>.  <a href="#name-distribution-4" class="xref">distribution</a></p>
 </li>
-                  <li class="compact ulBare ulEmpty toc" id="section-toc.1-1.2.2.8.2.7">
-                    <p id="section-toc.1-1.2.2.8.2.7.1"><a href="#section-2.8.7" class="xref">2.8.7</a>.  <a href="#name-sharing_group_id-4" class="xref">sharing_group_id</a></p>
+                  <li class="compact toc ulBare ulEmpty" id="section-toc.1-1.2.2.7.2.7">
+                    <p id="section-toc.1-1.2.2.7.2.7.1"><a href="#section-2.7.7" class="xref">2.7.7</a>.  <a href="#name-sharing_group_id-4" class="xref">sharing_group_id</a></p>
 </li>
-                  <li class="compact ulBare ulEmpty toc" id="section-toc.1-1.2.2.8.2.8">
-                    <p id="section-toc.1-1.2.2.8.2.8.1"><a href="#section-2.8.8" class="xref">2.8.8</a>.  <a href="#name-timestamp-6" class="xref">timestamp</a></p>
+                  <li class="compact toc ulBare ulEmpty" id="section-toc.1-1.2.2.7.2.8">
+                    <p id="section-toc.1-1.2.2.7.2.8.1"><a href="#section-2.7.8" class="xref">2.7.8</a>.  <a href="#name-timestamp-6" class="xref">timestamp</a></p>
 </li>
-                  <li class="compact ulBare ulEmpty toc" id="section-toc.1-1.2.2.8.2.9">
-                    <p id="section-toc.1-1.2.2.8.2.9.1"><a href="#section-2.8.9" class="xref">2.8.9</a>.  <a href="#name-deleted-5" class="xref">deleted</a></p>
+                  <li class="compact toc ulBare ulEmpty" id="section-toc.1-1.2.2.7.2.9">
+                    <p id="section-toc.1-1.2.2.7.2.9.1"><a href="#section-2.7.9" class="xref">2.7.9</a>.  <a href="#name-deleted-5" class="xref">deleted</a></p>
 </li>
                 </ul>
 </li>
-              <li class="compact ulBare ulEmpty toc" id="section-toc.1-1.2.2.9">
-                <p id="section-toc.1-1.2.2.9.1"><a href="#section-2.9" class="xref">2.9</a>.  <a href="#name-tag" class="xref">Tag</a></p>
-<ul class="compact ulBare ulEmpty toc">
-<li class="compact ulBare ulEmpty toc" id="section-toc.1-1.2.2.9.2.1">
-                    <p id="section-toc.1-1.2.2.9.2.1.1"><a href="#section-2.9.1" class="xref">2.9.1</a>.  <a href="#name-sample-tag" class="xref">Sample Tag</a></p>
+              <li class="compact toc ulBare ulEmpty" id="section-toc.1-1.2.2.8">
+                <p id="section-toc.1-1.2.2.8.1"><a href="#section-2.8" class="xref">2.8</a>.  <a href="#name-tag" class="xref">Tag</a></p>
+<ul class="compact toc ulBare ulEmpty">
+<li class="compact toc ulBare ulEmpty" id="section-toc.1-1.2.2.8.2.1">
+                    <p id="section-toc.1-1.2.2.8.2.1.1"><a href="#section-2.8.1" class="xref">2.8.1</a>.  <a href="#name-sample-tag" class="xref">Sample Tag</a></p>
 </li>
                 </ul>
 </li>
-              <li class="compact ulBare ulEmpty toc" id="section-toc.1-1.2.2.10">
-                <p id="section-toc.1-1.2.2.10.1"><a href="#section-2.10" class="xref">2.10</a>. <a href="#name-sighting" class="xref">Sighting</a></p>
-<ul class="compact ulBare ulEmpty toc">
-<li class="compact ulBare ulEmpty toc" id="section-toc.1-1.2.2.10.2.1">
-                    <p id="section-toc.1-1.2.2.10.2.1.1"><a href="#section-2.10.1" class="xref">2.10.1</a>.  <a href="#name-sample-sighting" class="xref">Sample Sighting</a></p>
+              <li class="compact toc ulBare ulEmpty" id="section-toc.1-1.2.2.9">
+                <p id="section-toc.1-1.2.2.9.1"><a href="#section-2.9" class="xref">2.9</a>.  <a href="#name-sighting" class="xref">Sighting</a></p>
+<ul class="compact toc ulBare ulEmpty">
+<li class="compact toc ulBare ulEmpty" id="section-toc.1-1.2.2.9.2.1">
+                    <p id="section-toc.1-1.2.2.9.2.1.1"><a href="#section-2.9.1" class="xref">2.9.1</a>.  <a href="#name-sample-sighting" class="xref">Sample Sighting</a></p>
 </li>
                 </ul>
 </li>
-              <li class="compact ulBare ulEmpty toc" id="section-toc.1-1.2.2.11">
-                <p id="section-toc.1-1.2.2.11.1"><a href="#section-2.11" class="xref">2.11</a>. <a href="#name-galaxy" class="xref">Galaxy</a></p>
-<ul class="compact ulBare ulEmpty toc">
-<li class="compact ulBare ulEmpty toc" id="section-toc.1-1.2.2.11.2.1">
-                    <p id="section-toc.1-1.2.2.11.2.1.1"><a href="#section-2.11.1" class="xref">2.11.1</a>.  <a href="#name-sample-galaxy" class="xref">Sample Galaxy</a></p>
+              <li class="compact toc ulBare ulEmpty" id="section-toc.1-1.2.2.10">
+                <p id="section-toc.1-1.2.2.10.1"><a href="#section-2.10" class="xref">2.10</a>. <a href="#name-galaxy" class="xref">Galaxy</a></p>
+<ul class="compact toc ulBare ulEmpty">
+<li class="compact toc ulBare ulEmpty" id="section-toc.1-1.2.2.10.2.1">
+                    <p id="section-toc.1-1.2.2.10.2.1.1"><a href="#section-2.10.1" class="xref">2.10.1</a>.  <a href="#name-sample-galaxy" class="xref">Sample Galaxy</a></p>
 </li>
                 </ul>
 </li>
             </ul>
 </li>
-          <li class="ulBare toc compact ulEmpty" id="section-toc.1-1.3">
+          <li class="compact toc ulBare ulEmpty" id="section-toc.1-1.3">
             <p id="section-toc.1-1.3.1"><a href="#section-3" class="xref">3</a>.  <a href="#name-json-schema" class="xref">JSON Schema</a></p>
 </li>
-          <li class="ulBare toc compact ulEmpty" id="section-toc.1-1.4">
+          <li class="compact toc ulBare ulEmpty" id="section-toc.1-1.4">
             <p id="section-toc.1-1.4.1"><a href="#section-4" class="xref">4</a>.  <a href="#name-manifest" class="xref">Manifest</a></p>
-<ul class="compact ulBare ulEmpty toc">
-<li class="compact ulBare ulEmpty toc" id="section-toc.1-1.4.2.1">
+<ul class="compact toc ulBare ulEmpty">
+<li class="compact toc ulBare ulEmpty" id="section-toc.1-1.4.2.1">
                 <p id="section-toc.1-1.4.2.1.1"><a href="#section-4.1" class="xref">4.1</a>.  <a href="#name-format-2" class="xref">Format</a></p>
-<ul class="compact ulBare ulEmpty toc">
-<li class="compact ulBare ulEmpty toc" id="section-toc.1-1.4.2.1.2.1">
+<ul class="compact toc ulBare ulEmpty">
+<li class="compact toc ulBare ulEmpty" id="section-toc.1-1.4.2.1.2.1">
                     <p id="section-toc.1-1.4.2.1.2.1.1"><a href="#section-4.1.1" class="xref">4.1.1</a>.  <a href="#name-sample-manifest" class="xref">Sample Manifest</a></p>
 </li>
                 </ul>
 </li>
             </ul>
 </li>
-          <li class="ulBare toc compact ulEmpty" id="section-toc.1-1.5">
+          <li class="compact toc ulBare ulEmpty" id="section-toc.1-1.5">
             <p id="section-toc.1-1.5.1"><a href="#section-5" class="xref">5</a>.  <a href="#name-implementation" class="xref">Implementation</a></p>
 </li>
-          <li class="ulBare toc compact ulEmpty" id="section-toc.1-1.6">
+          <li class="compact toc ulBare ulEmpty" id="section-toc.1-1.6">
             <p id="section-toc.1-1.6.1"><a href="#section-6" class="xref">6</a>.  <a href="#name-security-considerations" class="xref">Security Considerations</a></p>
 </li>
-          <li class="ulBare toc compact ulEmpty" id="section-toc.1-1.7">
+          <li class="compact toc ulBare ulEmpty" id="section-toc.1-1.7">
             <p id="section-toc.1-1.7.1"><a href="#section-7" class="xref">7</a>.  <a href="#name-acknowledgements" class="xref">Acknowledgements</a></p>
 </li>
-          <li class="ulBare toc compact ulEmpty" id="section-toc.1-1.8">
+          <li class="compact toc ulBare ulEmpty" id="section-toc.1-1.8">
             <p id="section-toc.1-1.8.1"><a href="#section-8" class="xref">8</a>.  <a href="#name-references" class="xref">References</a></p>
 </li>
-          <li class="ulBare toc compact ulEmpty" id="section-toc.1-1.9">
+          <li class="compact toc ulBare ulEmpty" id="section-toc.1-1.9">
             <p id="section-toc.1-1.9.1"><a href="#section-9" class="xref">9</a>.  <a href="#name-normative-references" class="xref">Normative References</a></p>
 </li>
-          <li class="ulBare toc compact ulEmpty" id="section-toc.1-1.10">
+          <li class="compact toc ulBare ulEmpty" id="section-toc.1-1.10">
             <p id="section-toc.1-1.10.1"><a href="#section-10" class="xref">10</a>. <a href="#name-informative-references" class="xref">Informative References</a></p>
 </li>
-          <li class="ulBare toc compact ulEmpty" id="section-toc.1-1.11">
+          <li class="compact toc ulBare ulEmpty" id="section-toc.1-1.11">
             <p id="section-toc.1-1.11.1"><a href="#appendix-A" class="xref"></a><a href="#name-authors-addresses" class="xref">Authors' Addresses</a></p>
 </li>
         </ul>
@@ -1549,8 +1546,8 @@ of the event. info <span class="bcp14">SHOULD</span> NOT be bigger than 256 char
             <h5 id="name-threat_level_id">
 <a href="#section-2.2.1.5" class="section-number selfRef">2.2.1.5. </a><a href="#name-threat_level_id" class="section-name selfRef">threat_level_id</a>
             </h5>
-<p id="section-2.2.1.5-1">threat<em>level</em>id represents the threat level.<a href="#section-2.2.1.5-1" class="pilcrow">¶</a></p>
-<span class="break"></span><dl class="dlParallel" id="section-2.2.1.5-2">
+<p id="section-2.2.1.5-1">threat_level_id represents the threat level.<a href="#section-2.2.1.5-1" class="pilcrow">¶</a></p>
+<span class="break"></span><dl class="dlCompact dlParallel" id="section-2.2.1.5-2">
               <dt id="section-2.2.1.5-2.1">4:</dt>
               <dd style="margin-left: 1.5em" id="section-2.2.1.5-2.2">Undefined<a href="#section-2.2.1.5-2.2" class="pilcrow">¶</a>
 </dd>
@@ -1569,7 +1566,7 @@ of the event. info <span class="bcp14">SHOULD</span> NOT be bigger than 256 char
             <dd class="break"></dd>
 </dl>
 <p id="section-2.2.1.5-3">If a higher granularity is required, a MISP taxonomy applied as a Tag <span class="bcp14">SHOULD</span> be preferred.<a href="#section-2.2.1.5-3" class="pilcrow">¶</a></p>
-<p id="section-2.2.1.5-4">threat<em>level</em>id is represented as a JSON string. threat<em>level</em>id <span class="bcp14">SHALL</span> be present.<a href="#section-2.2.1.5-4" class="pilcrow">¶</a></p>
+<p id="section-2.2.1.5-4">threat_level_id is represented as a JSON string. threat_level_id <span class="bcp14">SHALL</span> be present.<a href="#section-2.2.1.5-4" class="pilcrow">¶</a></p>
 </section>
 </div>
 <div id="analysis">
@@ -1578,7 +1575,7 @@ of the event. info <span class="bcp14">SHOULD</span> NOT be bigger than 256 char
 <a href="#section-2.2.1.6" class="section-number selfRef">2.2.1.6. </a><a href="#name-analysis" class="section-name selfRef">analysis</a>
             </h5>
 <p id="section-2.2.1.6-1">analysis represents the analysis level.<a href="#section-2.2.1.6-1" class="pilcrow">¶</a></p>
-<span class="break"></span><dl class="dlParallel" id="section-2.2.1.6-2">
+<span class="break"></span><dl class="dlCompact dlParallel" id="section-2.2.1.6-2">
               <dt id="section-2.2.1.6-2.1">0:</dt>
               <dd style="margin-left: 1.5em" id="section-2.2.1.6-2.2">Initial<a href="#section-2.2.1.6-2.2" class="pilcrow">¶</a>
 </dd>
@@ -1619,8 +1616,8 @@ of the event. info <span class="bcp14">SHOULD</span> NOT be bigger than 256 char
             <h5 id="name-publish_timestamp">
 <a href="#section-2.2.1.9" class="section-number selfRef">2.2.1.9. </a><a href="#name-publish_timestamp" class="section-name selfRef">publish_timestamp</a>
             </h5>
-<p id="section-2.2.1.9-1">publish<em>timestamp represents a reference time when the event was published on the instance. published</em>timestamp is expressed in seconds (decimal) since 1st of January 1970 (Unix timestamp). At each publication of an event, publish<em>timestamp <span class="bcp14">MUST</span> be updated. The time zone <span class="bcp14">MUST</span> be UTC. If the published</em>timestamp is present and the published flag is set to false, the publish<em>timestamp represents the previous publication timestamp. If the event was never published, the published</em>timestamp <span class="bcp14">MUST</span> be set to 0.<a href="#section-2.2.1.9-1" class="pilcrow">¶</a></p>
-<p id="section-2.2.1.9-2">publish<em>timestamp is represented as a JSON string. publish</em>timestamp <span class="bcp14">MUST</span> be present.<a href="#section-2.2.1.9-2" class="pilcrow">¶</a></p>
+<p id="section-2.2.1.9-1">publish_timestamp represents a reference time when the event was published on the instance. published_timestamp is expressed in seconds (decimal) since 1st of January 1970 (Unix timestamp). At each publication of an event, publish_timestamp <span class="bcp14">MUST</span> be updated. The time zone <span class="bcp14">MUST</span> be UTC. If the published_timestamp is present and the published flag is set to false, the publish_timestamp represents the previous publication timestamp. If the event was never published, the published_timestamp <span class="bcp14">MUST</span> be set to 0.<a href="#section-2.2.1.9-1" class="pilcrow">¶</a></p>
+<p id="section-2.2.1.9-2">publish_timestamp is represented as a JSON string. publish_timestamp <span class="bcp14">MUST</span> be present.<a href="#section-2.2.1.9-2" class="pilcrow">¶</a></p>
 </section>
 </div>
 <div id="org-id">
@@ -1631,7 +1628,7 @@ of the event. info <span class="bcp14">SHOULD</span> NOT be bigger than 256 char
 <p id="section-2.2.1.10-1">org_id represents a human-readable identifier referencing an Org object of the organisation which generated the event. A human-readable identifier <span class="bcp14">MUST</span> be
 represented as an unsigned integer.<a href="#section-2.2.1.10-1" class="pilcrow">¶</a></p>
 <p id="section-2.2.1.10-2">The org_id <span class="bcp14">MUST</span> be updated when the event is generated by a new instance.<a href="#section-2.2.1.10-2" class="pilcrow">¶</a></p>
-<p id="section-2.2.1.10-3">org<em>id is represented as a JSON string. org</em>id <span class="bcp14">MUST</span> be present.<a href="#section-2.2.1.10-3" class="pilcrow">¶</a></p>
+<p id="section-2.2.1.10-3">org_id is represented as a JSON string. org_id <span class="bcp14">MUST</span> be present.<a href="#section-2.2.1.10-3" class="pilcrow">¶</a></p>
 </section>
 </div>
 <div id="orgc-id">
@@ -1641,7 +1638,7 @@ represented as an unsigned integer.<a href="#section-2.2.1.10-1" class="pilcrow"
             </h5>
 <p id="section-2.2.1.11-1">orgc_id represents a human-readable identifier referencing an Orgc object of the organisation which created the event.<a href="#section-2.2.1.11-1" class="pilcrow">¶</a></p>
 <p id="section-2.2.1.11-2">The orgc_id and Org object <span class="bcp14">MUST</span> be preserved for any updates or transfer of the same event.<a href="#section-2.2.1.11-2" class="pilcrow">¶</a></p>
-<p id="section-2.2.1.11-3">orgc<em>id is represented as a JSON string. orgc</em>id <span class="bcp14">MUST</span> be present.<a href="#section-2.2.1.11-3" class="pilcrow">¶</a></p>
+<p id="section-2.2.1.11-3">orgc_id is represented as a JSON string. orgc_id <span class="bcp14">MUST</span> be present.<a href="#section-2.2.1.11-3" class="pilcrow">¶</a></p>
 </section>
 </div>
 <div id="attribute-count">
@@ -1649,8 +1646,8 @@ represented as an unsigned integer.<a href="#section-2.2.1.10-1" class="pilcrow"
             <h5 id="name-attribute_count">
 <a href="#section-2.2.1.12" class="section-number selfRef">2.2.1.12. </a><a href="#name-attribute_count" class="section-name selfRef">attribute_count</a>
             </h5>
-<p id="section-2.2.1.12-1">attribute<em>count represents the number of attributes in the event. attribute</em>count is expressed in decimal.<a href="#section-2.2.1.12-1" class="pilcrow">¶</a></p>
-<p id="section-2.2.1.12-2">attribute<em>count is represented as a JSON string. attribute</em>count <span class="bcp14">SHALL</span> be present.<a href="#section-2.2.1.12-2" class="pilcrow">¶</a></p>
+<p id="section-2.2.1.12-1">attribute_count represents the number of attributes in the event. attribute_count is expressed in decimal.<a href="#section-2.2.1.12-1" class="pilcrow">¶</a></p>
+<p id="section-2.2.1.12-2">attribute_count is represented as a JSON string. attribute_count <span class="bcp14">SHALL</span> be present.<a href="#section-2.2.1.12-2" class="pilcrow">¶</a></p>
 </section>
 </div>
 <div id="distribution">
@@ -1660,7 +1657,7 @@ represented as an unsigned integer.<a href="#section-2.2.1.10-1" class="pilcrow"
             </h5>
 <p id="section-2.2.1.13-1">distribution represents the basic distribution rules of the event. The system must adhere to the distribution setting for access control and for dissemination of the event.<a href="#section-2.2.1.13-1" class="pilcrow">¶</a></p>
 <p id="section-2.2.1.13-2">distribution is represented by a JSON string. distribution <span class="bcp14">MUST</span> be present and be one of the following options:<a href="#section-2.2.1.13-2" class="pilcrow">¶</a></p>
-<span class="break"></span><dl class="dlParallel" id="section-2.2.1.13-3">
+<span class="break"></span><dl class="dlCompact dlParallel" id="section-2.2.1.13-3">
               <dt id="section-2.2.1.13-3.1">0</dt>
               <dd style="margin-left: 1.5em" id="section-2.2.1.13-3.2">Your Organisation Only<a href="#section-2.2.1.13-3.2" class="pilcrow">¶</a>
 </dd>
@@ -1704,72 +1701,72 @@ represented as an unsigned integer.<a href="#section-2.2.1.10-1" class="pilcrow"
 </div>
 </section>
 </div>
-</section>
-</div>
-<div id="objects">
-<section id="section-2.3">
-        <h3 id="name-objects">
-<a href="#section-2.3" class="section-number selfRef">2.3. </a><a href="#name-objects" class="section-name selfRef">Objects</a>
-        </h3>
-<div id="org">
-<section id="section-2.3.1">
-          <h4 id="name-org">
-<a href="#section-2.3.1" class="section-number selfRef">2.3.1. </a><a href="#name-org" class="section-name selfRef">Org</a>
+<div id="event-objects">
+<section id="section-2.2.2">
+          <h4 id="name-event-objects">
+<a href="#section-2.2.2" class="section-number selfRef">2.2.2. </a><a href="#name-event-objects" class="section-name selfRef">Event Objects</a>
           </h4>
-<p id="section-2.3.1-1">An Org object is composed of an uuid, name and id.<a href="#section-2.3.1-1" class="pilcrow">¶</a></p>
-<p id="section-2.3.1-2">The uuid represents the Universally Unique IDentifier (UUID) <span>[<a href="#RFC4122" class="xref">RFC4122</a>]</span> of the organisation.
-The organisation UUID is globally assigned to an organisation and <span class="bcp14">SHALL</span> be kept overtime.<a href="#section-2.3.1-2" class="pilcrow">¶</a></p>
-<p id="section-2.3.1-3">The name is a readable description of the organisation and <span class="bcp14">SHOULD</span> be present.
-The id is a human-readable identifier generated by the instance and used as reference in the event.
-A human-readable identifier <span class="bcp14">MUST</span> be represented as an unsigned integer.<a href="#section-2.3.1-3" class="pilcrow">¶</a></p>
-<p id="section-2.3.1-4">uuid, name and id are represented as a JSON string. uuid, name and id <span class="bcp14">MUST</span> be present.<a href="#section-2.3.1-4" class="pilcrow">¶</a></p>
-<div id="sample-org-object">
-<section id="section-2.3.1.1">
-            <h5 id="name-sample-org-object">
-<a href="#section-2.3.1.1" class="section-number selfRef">2.3.1.1. </a><a href="#name-sample-org-object" class="section-name selfRef">Sample Org Object</a>
+<div id="org">
+<section id="section-2.2.2.1">
+            <h5 id="name-org">
+<a href="#section-2.2.2.1" class="section-number selfRef">2.2.2.1. </a><a href="#name-org" class="section-name selfRef">Org</a>
             </h5>
-<div class="artwork art-text alignLeft" id="section-2.3.1.1-1">
+<p id="section-2.2.2.1-1">An Org object is composed of an uuid, name and id.<a href="#section-2.2.2.1-1" class="pilcrow">¶</a></p>
+<p id="section-2.2.2.1-2">The uuid represents the Universally Unique IDentifier (UUID) <span>[<a href="#RFC4122" class="xref">RFC4122</a>]</span> of the organisation.
+The organisation UUID is globally assigned to an organisation and <span class="bcp14">SHALL</span> be kept overtime.<a href="#section-2.2.2.1-2" class="pilcrow">¶</a></p>
+<p id="section-2.2.2.1-3">The name is a readable description of the organisation and <span class="bcp14">SHOULD</span> be present.
+The id is a human-readable identifier generated by the instance and used as reference in the event.
+A human-readable identifier <span class="bcp14">MUST</span> be represented as an unsigned integer.<a href="#section-2.2.2.1-3" class="pilcrow">¶</a></p>
+<p id="section-2.2.2.1-4">uuid, name and id are represented as a JSON string. uuid, name and id <span class="bcp14">MUST</span> be present.<a href="#section-2.2.2.1-4" class="pilcrow">¶</a></p>
+<div id="sample-org-object">
+<section id="section-2.2.2.1.1">
+              <h6 id="name-sample-org-object">
+<a href="#section-2.2.2.1.1" class="section-number selfRef">2.2.2.1.1. </a><a href="#name-sample-org-object" class="section-name selfRef">Sample Org Object</a>
+              </h6>
+<div class="alignLeft art-text artwork" id="section-2.2.2.1.1-1">
 <pre>"Org": {
         "id": "2",
         "name": "CIRCL",
         "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"
        }
-</pre><a href="#section-2.3.1.1-1" class="pilcrow">¶</a>
+</pre><a href="#section-2.2.2.1.1-1" class="pilcrow">¶</a>
 </div>
 </section>
 </div>
 </section>
 </div>
 <div id="orgc">
-<section id="section-2.3.2">
-          <h4 id="name-orgc">
-<a href="#section-2.3.2" class="section-number selfRef">2.3.2. </a><a href="#name-orgc" class="section-name selfRef">Orgc</a>
-          </h4>
-<p id="section-2.3.2-1">An Orgc object is composed of an uuid, name and id.<a href="#section-2.3.2-1" class="pilcrow">¶</a></p>
-<p id="section-2.3.2-2">The uuid <span class="bcp14">MUST</span> be preserved for any updates or transfer of the same event. UUID version 4 is <span class="bcp14">RECOMMENDED</span> when assigning it to a new event.
-The organisation UUID is globally assigned to an organisation and <span class="bcp14">SHALL</span> be kept overtime.<a href="#section-2.3.2-2" class="pilcrow">¶</a></p>
-<p id="section-2.3.2-3">The name is a readable description of the organisation and <span class="bcp14">SHOULD</span> be present.
+<section id="section-2.2.2.2">
+            <h5 id="name-orgc">
+<a href="#section-2.2.2.2" class="section-number selfRef">2.2.2.2. </a><a href="#name-orgc" class="section-name selfRef">Orgc</a>
+            </h5>
+<p id="section-2.2.2.2-1">An Orgc object is composed of an uuid, name and id.<a href="#section-2.2.2.2-1" class="pilcrow">¶</a></p>
+<p id="section-2.2.2.2-2">The uuid <span class="bcp14">MUST</span> be preserved for any updates or transfer of the same event. UUID version 4 is <span class="bcp14">RECOMMENDED</span> when assigning it to a new event.
+The organisation UUID is globally assigned to an organisation and <span class="bcp14">SHALL</span> be kept overtime.<a href="#section-2.2.2.2-2" class="pilcrow">¶</a></p>
+<p id="section-2.2.2.2-3">The name is a readable description of the organisation and <span class="bcp14">SHOULD</span> be present.
 The id is a human-readable identifier generated by the instance and used as reference in the event.
-A human-readable identifier <span class="bcp14">MUST</span> be represented as an unsigned integer.<a href="#section-2.3.2-3" class="pilcrow">¶</a></p>
-<p id="section-2.3.2-4">uuid, name and id are represented as a JSON string. uuid, name and id <span class="bcp14">MUST</span> be present.<a href="#section-2.3.2-4" class="pilcrow">¶</a></p>
+A human-readable identifier <span class="bcp14">MUST</span> be represented as an unsigned integer.<a href="#section-2.2.2.2-3" class="pilcrow">¶</a></p>
+<p id="section-2.2.2.2-4">uuid, name and id are represented as a JSON string. uuid, name and id <span class="bcp14">MUST</span> be present.<a href="#section-2.2.2.2-4" class="pilcrow">¶</a></p>
+</section>
+</div>
 </section>
 </div>
 </section>
 </div>
 <div id="attribute">
-<section id="section-2.4">
+<section id="section-2.3">
         <h3 id="name-attribute">
-<a href="#section-2.4" class="section-number selfRef">2.4. </a><a href="#name-attribute" class="section-name selfRef">Attribute</a>
+<a href="#section-2.3" class="section-number selfRef">2.3. </a><a href="#name-attribute" class="section-name selfRef">Attribute</a>
         </h3>
-<p id="section-2.4-1">Attributes are used to describe the indicators and contextual data of an event. The main information contained in an attribute is made up of a category-type-value triplet,
-where the category and type give meaning and context to the value. Through the various category-type combinations a wide range of information can be conveyed.<a href="#section-2.4-1" class="pilcrow">¶</a></p>
-<p id="section-2.4-2">A MISP document <span class="bcp14">MUST</span> at least includes category-type-value triplet described in section "Attribute Attributes".<a href="#section-2.4-2" class="pilcrow">¶</a></p>
+<p id="section-2.3-1">Attributes are used to describe the indicators and contextual data of an event. The main information contained in an attribute is made up of a category-type-value triplet,
+where the category and type give meaning and context to the value. Through the various category-type combinations a wide range of information can be conveyed.<a href="#section-2.3-1" class="pilcrow">¶</a></p>
+<p id="section-2.3-2">A MISP document <span class="bcp14">MUST</span> at least includes category-type-value triplet described in section "Attribute Attributes".<a href="#section-2.3-2" class="pilcrow">¶</a></p>
 <div id="sample-attribute-object">
-<section id="section-2.4.1">
+<section id="section-2.3.1">
           <h4 id="name-sample-attribute-object">
-<a href="#section-2.4.1" class="section-number selfRef">2.4.1. </a><a href="#name-sample-attribute-object" class="section-name selfRef">Sample Attribute Object</a>
+<a href="#section-2.3.1" class="section-number selfRef">2.3.1. </a><a href="#name-sample-attribute-object" class="section-name selfRef">Sample Attribute Object</a>
           </h4>
-<div class="artwork art-text alignLeft" id="section-2.4.1-1">
+<div class="alignLeft art-text artwork" id="section-2.3.1-1">
 <pre>"Attribute": {
               "id": "346056",
               "type": "comment",
@@ -1789,43 +1786,342 @@ where the category and type give meaning and context to the value. Through the v
               "first_seen": "2019-06-02T22:14:28.711954+00:00",
               "last_seen": null
              }
-</pre><a href="#section-2.4.1-1" class="pilcrow">¶</a>
+</pre><a href="#section-2.3.1-1" class="pilcrow">¶</a>
 </div>
 </section>
 </div>
 <div id="attribute-attributes">
-<section id="section-2.4.2">
+<section id="section-2.3.2">
           <h4 id="name-attribute-attributes">
-<a href="#section-2.4.2" class="section-number selfRef">2.4.2. </a><a href="#name-attribute-attributes" class="section-name selfRef">Attribute Attributes</a>
+<a href="#section-2.3.2" class="section-number selfRef">2.3.2. </a><a href="#name-attribute-attributes" class="section-name selfRef">Attribute Attributes</a>
           </h4>
 <div id="uuid-1">
-<section id="section-2.4.2.1">
+<section id="section-2.3.2.1">
             <h5 id="name-uuid-2">
-<a href="#section-2.4.2.1" class="section-number selfRef">2.4.2.1. </a><a href="#name-uuid-2" class="section-name selfRef">uuid</a>
+<a href="#section-2.3.2.1" class="section-number selfRef">2.3.2.1. </a><a href="#name-uuid-2" class="section-name selfRef">uuid</a>
+            </h5>
+<p id="section-2.3.2.1-1">uuid represents the Universally Unique IDentifier (UUID) <span>[<a href="#RFC4122" class="xref">RFC4122</a>]</span> of the event. The uuid <span class="bcp14">MUST</span> be preserved
+for any updates or transfer of the same event. UUID version 4 is <span class="bcp14">RECOMMENDED</span> when assigning it to a new event.<a href="#section-2.3.2.1-1" class="pilcrow">¶</a></p>
+<p id="section-2.3.2.1-2">uuid is represented as a JSON string. uuid <span class="bcp14">MUST</span> be present.<a href="#section-2.3.2.1-2" class="pilcrow">¶</a></p>
+</section>
+</div>
+<div id="id-1">
+<section id="section-2.3.2.2">
+            <h5 id="name-id-2">
+<a href="#section-2.3.2.2" class="section-number selfRef">2.3.2.2. </a><a href="#name-id-2" class="section-name selfRef">id</a>
+            </h5>
+<p id="section-2.3.2.2-1">id represents the human-readable identifier associated to the event for a specific MISP instance. A human-readable identifier <span class="bcp14">MUST</span> be
+represented as an unsigned integer.<a href="#section-2.3.2.2-1" class="pilcrow">¶</a></p>
+<p id="section-2.3.2.2-2">id is represented as a JSON string. id <span class="bcp14">SHALL</span> be present.<a href="#section-2.3.2.2-2" class="pilcrow">¶</a></p>
+</section>
+</div>
+<div id="type">
+<section id="section-2.3.2.3">
+            <h5 id="name-type">
+<a href="#section-2.3.2.3" class="section-number selfRef">2.3.2.3. </a><a href="#name-type" class="section-name selfRef">type</a>
+            </h5>
+<p id="section-2.3.2.3-1">type represents the means through which an attribute tries to describe the intent of the attribute creator, using a list of pre-defined attribute types.<a href="#section-2.3.2.3-1" class="pilcrow">¶</a></p>
+<p id="section-2.3.2.3-2">type is represented as a JSON string. type <span class="bcp14">MUST</span> be present and it <span class="bcp14">MUST</span> be a valid selection for the chosen category. The list of valid category-type combinations is as follows:<a href="#section-2.3.2.3-2" class="pilcrow">¶</a></p>
+<span class="break"></span><dl class="dlCompact dlParallel" id="section-2.3.2.3-3">
+              <dt id="section-2.3.2.3-3.1">Antivirus detection</dt>
+              <dd style="margin-left: 1.5em" id="section-2.3.2.3-3.2">link, comment, text, hex, attachment, other, anonymised<a href="#section-2.3.2.3-3.2" class="pilcrow">¶</a>
+</dd>
+              <dd class="break"></dd>
+<dt id="section-2.3.2.3-3.3">Artifacts dropped</dt>
+              <dd style="margin-left: 1.5em" id="section-2.3.2.3-3.4">md5, sha1, sha224, sha256, sha384, sha512, sha512/224, sha512/256, sha3-224, sha3-256, sha3-384, sha3-512, ssdeep, imphash, telfhash, impfuzzy, authentihash, vhash, cdhash, filename, filename|md5, filename|sha1, filename|sha224, filename|sha256, filename|sha384, filename|sha512, filename|sha512/224, filename|sha512/256, filename|sha3-224, filename|sha3-256, filename|sha3-384, filename|sha3-512, filename|authentihash, filename|vhash, filename|ssdeep, filename|tlsh, filename|imphash, filename|impfuzzy, filename|pehash, regkey, regkey|value, pattern-in-file, pattern-in-memory, filename-pattern, pdb, stix2-pattern, yara, sigma, attachment, malware-sample, named pipe, mutex, process-state, windows-scheduled-task, windows-service-name, windows-service-displayname, comment, text, hex, x509-fingerprint-sha1, x509-fingerprint-md5, x509-fingerprint-sha256, other, cookie, gene, kusto-query, mime-type, anonymised, pgp-public-key, pgp-private-key<a href="#section-2.3.2.3-3.4" class="pilcrow">¶</a>
+</dd>
+              <dd class="break"></dd>
+<dt id="section-2.3.2.3-3.5">Attribution</dt>
+              <dd style="margin-left: 1.5em" id="section-2.3.2.3-3.6">threat-actor, campaign-name, campaign-id, whois-registrant-phone, whois-registrant-email, whois-registrant-name, whois-registrant-org, whois-registrar, whois-creation-date, comment, text, x509-fingerprint-sha1, x509-fingerprint-md5, x509-fingerprint-sha256, other, dns-soa-email, anonymised, email<a href="#section-2.3.2.3-3.6" class="pilcrow">¶</a>
+</dd>
+              <dd class="break"></dd>
+<dt id="section-2.3.2.3-3.7">External analysis</dt>
+              <dd style="margin-left: 1.5em" id="section-2.3.2.3-3.8">md5, sha1, sha256, sha3-224, sha3-256, sha3-384, sha3-512, filename, filename|md5, filename|sha1, filename|sha256, filename|sha3-224, filename|sha3-256, filename|sha3-384, filename|sha3-512, ip-src, ip-dst, ip-dst|port, ip-src|port, mac-address, mac-eui-64, hostname, domain, domain|ip, url, user-agent, regkey, regkey|value, AS, snort, bro, zeek, pattern-in-file, pattern-in-traffic, pattern-in-memory, filename-pattern, vulnerability, cpe, weakness, attachment, malware-sample, link, comment, text, x509-fingerprint-sha1, x509-fingerprint-md5, x509-fingerprint-sha256, ja3-fingerprint-md5, jarm-fingerprint, hassh-md5, hasshserver-md5, github-repository, other, cortex, anonymised, community-id<a href="#section-2.3.2.3-3.8" class="pilcrow">¶</a>
+</dd>
+              <dd class="break"></dd>
+<dt id="section-2.3.2.3-3.9">Financial fraud</dt>
+              <dd style="margin-left: 1.5em" id="section-2.3.2.3-3.10">btc, dash, xmr, iban, bic, bank-account-nr, aba-rtn, bin, cc-number, prtn, phone-number, comment, text, other, hex, anonymised<a href="#section-2.3.2.3-3.10" class="pilcrow">¶</a>
+</dd>
+              <dd class="break"></dd>
+<dt id="section-2.3.2.3-3.11">Internal reference</dt>
+              <dd style="margin-left: 1.5em" id="section-2.3.2.3-3.12">text, link, comment, other, hex, anonymised, git-commit-id<a href="#section-2.3.2.3-3.12" class="pilcrow">¶</a>
+</dd>
+              <dd class="break"></dd>
+<dt id="section-2.3.2.3-3.13">Network activity</dt>
+              <dd style="margin-left: 1.5em" id="section-2.3.2.3-3.14">ip-src, ip-dst, ip-dst|port, ip-src|port, port, hostname, domain, domain|ip, mac-address, mac-eui-64, email, email-dst, email-src, eppn, url, uri, user-agent, http-method, AS, snort, pattern-in-file, filename-pattern, stix2-pattern, pattern-in-traffic, attachment, comment, text, x509-fingerprint-md5, x509-fingerprint-sha1, x509-fingerprint-sha256, ja3-fingerprint-md5, jarm-fingerprint, hassh-md5, hasshserver-md5, other, hex, cookie, hostname|port, bro, zeek, anonymised, community-id, email-subject, favicon-mmh3, dkim, dkim-signature, ssh-fingerprint<a href="#section-2.3.2.3-3.14" class="pilcrow">¶</a>
+</dd>
+              <dd class="break"></dd>
+<dt id="section-2.3.2.3-3.15">Other</dt>
+              <dd style="margin-left: 1.5em" id="section-2.3.2.3-3.16">comment, text, other, size-in-bytes, counter, datetime, cpe, port, float, hex, phone-number, boolean, anonymised, pgp-public-key, pgp-private-key<a href="#section-2.3.2.3-3.16" class="pilcrow">¶</a>
+</dd>
+              <dd class="break"></dd>
+<dt id="section-2.3.2.3-3.17">Payload delivery</dt>
+              <dd style="margin-left: 1.5em" id="section-2.3.2.3-3.18">md5, sha1, sha224, sha256, sha384, sha512, sha512/224, sha512/256, sha3-224, sha3-256, sha3-384, sha3-512, ssdeep, imphash, telfhash, impfuzzy, authentihash, vhash, pehash, tlsh, cdhash, filename, filename|md5, filename|sha1, filename|sha224, filename|sha256, filename|sha384, filename|sha512, filename|sha512/224, filename|sha512/256, filename|sha3-224, filename|sha3-256, filename|sha3-384, filename|sha3-512, filename|authentihash, filename|vhash, filename|ssdeep, filename|tlsh, filename|imphash, filename|impfuzzy, filename|pehash, mac-address, mac-eui-64, ip-src, ip-dst, ip-dst|port, ip-src|port, hostname, domain, email, email-src, email-dst, email-subject, email-attachment, email-body, url, user-agent, AS, pattern-in-file, pattern-in-traffic, filename-pattern, stix2-pattern, yara, sigma, mime-type, attachment, malware-sample, link, malware-type, comment, text, hex, vulnerability, cpe, weakness, x509-fingerprint-sha1, x509-fingerprint-md5, x509-fingerprint-sha256, ja3-fingerprint-md5, jarm-fingerprint, hassh-md5, hasshserver-md5, other, hostname|port, email-dst-display-name, email-src-display-name, email-header, email-reply-to, email-x-mailer, email-mime-boundary, email-thread-index, email-message-id, mobile-application-id, chrome-extension-id, whois-registrant-email, anonymised<a href="#section-2.3.2.3-3.18" class="pilcrow">¶</a>
+</dd>
+              <dd class="break"></dd>
+<dt id="section-2.3.2.3-3.19">Payload installation</dt>
+              <dd style="margin-left: 1.5em" id="section-2.3.2.3-3.20">md5, sha1, sha224, sha256, sha384, sha512, sha512/224, sha512/256, sha3-224, sha3-256, sha3-384, sha3-512, ssdeep, imphash, telfhash, impfuzzy, authentihash, vhash, pehash, tlsh, cdhash, filename, filename|md5, filename|sha1, filename|sha224, filename|sha256, filename|sha384, filename|sha512, filename|sha512/224, filename|sha512/256, filename|sha3-224, filename|sha3-256, filename|sha3-384, filename|sha3-512, filename|authentihash, filename|vhash, filename|ssdeep, filename|tlsh, filename|imphash, filename|impfuzzy, filename|pehash, pattern-in-file, pattern-in-traffic, pattern-in-memory, filename-pattern, stix2-pattern, yara, sigma, vulnerability, cpe, weakness, attachment, malware-sample, malware-type, comment, text, hex, x509-fingerprint-sha1, x509-fingerprint-md5, x509-fingerprint-sha256, mobile-application-id, chrome-extension-id, other, mime-type, anonymised<a href="#section-2.3.2.3-3.20" class="pilcrow">¶</a>
+</dd>
+              <dd class="break"></dd>
+<dt id="section-2.3.2.3-3.21">Payload type</dt>
+              <dd style="margin-left: 1.5em" id="section-2.3.2.3-3.22">comment, text, other, anonymised<a href="#section-2.3.2.3-3.22" class="pilcrow">¶</a>
+</dd>
+              <dd class="break"></dd>
+<dt id="section-2.3.2.3-3.23">Persistence mechanism</dt>
+              <dd style="margin-left: 1.5em" id="section-2.3.2.3-3.24">filename, regkey, regkey|value, comment, text, other, hex, anonymised<a href="#section-2.3.2.3-3.24" class="pilcrow">¶</a>
+</dd>
+              <dd class="break"></dd>
+<dt id="section-2.3.2.3-3.25">Person</dt>
+              <dd style="margin-left: 1.5em" id="section-2.3.2.3-3.26">first-name, middle-name, last-name, full-name, date-of-birth, place-of-birth, gender, passport-number, passport-country, passport-expiration, redress-number, nationality, visa-number, issue-date-of-the-visa, primary-residence, country-of-residence, special-service-request, frequent-flyer-number, travel-details, payment-details, place-port-of-original-embarkation, place-port-of-clearance, place-port-of-onward-foreign-destination, passenger-name-record-locator-number, comment, text, other, phone-number, identity-card-number, anonymised, email, pgp-public-key, pgp-private-key<a href="#section-2.3.2.3-3.26" class="pilcrow">¶</a>
+</dd>
+              <dd class="break"></dd>
+<dt id="section-2.3.2.3-3.27">Social network</dt>
+              <dd style="margin-left: 1.5em" id="section-2.3.2.3-3.28">github-username, github-repository, github-organisation, jabber-id, twitter-id, email, email-src, email-dst, eppn, comment, text, other, whois-registrant-email, anonymised, pgp-public-key, pgp-private-key<a href="#section-2.3.2.3-3.28" class="pilcrow">¶</a>
+</dd>
+              <dd class="break"></dd>
+<dt id="section-2.3.2.3-3.29">Support Tool</dt>
+              <dd style="margin-left: 1.5em" id="section-2.3.2.3-3.30">link, text, attachment, comment, other, hex, anonymised<a href="#section-2.3.2.3-3.30" class="pilcrow">¶</a>
+</dd>
+              <dd class="break"></dd>
+<dt id="section-2.3.2.3-3.31">Targeting data</dt>
+              <dd style="margin-left: 1.5em" id="section-2.3.2.3-3.32">target-user, target-email, target-machine, target-org, target-location, target-external, comment, anonymised<a href="#section-2.3.2.3-3.32" class="pilcrow">¶</a>
+</dd>
+            <dd class="break"></dd>
+</dl>
+<p id="section-2.3.2.3-4">Attributes are based on the usage within their different communities. Attributes can be extended on a regular basis and this reference document is updated accordingly.<a href="#section-2.3.2.3-4" class="pilcrow">¶</a></p>
+</section>
+</div>
+<div id="category">
+<section id="section-2.3.2.4">
+            <h5 id="name-category">
+<a href="#section-2.3.2.4" class="section-number selfRef">2.3.2.4. </a><a href="#name-category" class="section-name selfRef">category</a>
+            </h5>
+<p id="section-2.3.2.4-1">category represents the intent of what the attribute is describing as selected by the attribute creator, using a list of pre-defined attribute categories.<a href="#section-2.3.2.4-1" class="pilcrow">¶</a></p>
+<p id="section-2.3.2.4-2">category is represented as a JSON string. category <span class="bcp14">MUST</span> be present and it <span class="bcp14">MUST</span> be a valid selection for the chosen type. The list of valid category-type combinations is mentioned above.<a href="#section-2.3.2.4-2" class="pilcrow">¶</a></p>
+</section>
+</div>
+<div id="to-ids">
+<section id="section-2.3.2.5">
+            <h5 id="name-to_ids">
+<a href="#section-2.3.2.5" class="section-number selfRef">2.3.2.5. </a><a href="#name-to_ids" class="section-name selfRef">to_ids</a>
+            </h5>
+<p id="section-2.3.2.5-1">to_ids represents whether the attribute is meant to be actionable. Actionable defined attributes that can be used in automated processes as a pattern for detection in Local or Network Intrusion Detection System, log analysis tools or even filtering mechanisms.<a href="#section-2.3.2.5-1" class="pilcrow">¶</a></p>
+<p id="section-2.3.2.5-2">to_ids is represented as a JSON boolean. to_ids <span class="bcp14">MUST</span> be present.<a href="#section-2.3.2.5-2" class="pilcrow">¶</a></p>
+</section>
+</div>
+<div id="event-id">
+<section id="section-2.3.2.6">
+            <h5 id="name-event_id">
+<a href="#section-2.3.2.6" class="section-number selfRef">2.3.2.6. </a><a href="#name-event_id" class="section-name selfRef">event_id</a>
+            </h5>
+<p id="section-2.3.2.6-1">event_id represents a human-readable identifier referencing the Event object that the attribute belongs to. A human-readable identifier <span class="bcp14">MUST</span> be
+represented as an unsigned integer.<a href="#section-2.3.2.6-1" class="pilcrow">¶</a></p>
+<p id="section-2.3.2.6-2">The event_id <span class="bcp14">SHOULD</span> be updated when the event is imported to reflect the newly created event's id on the instance.<a href="#section-2.3.2.6-2" class="pilcrow">¶</a></p>
+<p id="section-2.3.2.6-3">event_id is represented as a JSON string. event_id <span class="bcp14">MUST</span> be present.<a href="#section-2.3.2.6-3" class="pilcrow">¶</a></p>
+</section>
+</div>
+<div id="distribution-1">
+<section id="section-2.3.2.7">
+            <h5 id="name-distribution-2">
+<a href="#section-2.3.2.7" class="section-number selfRef">2.3.2.7. </a><a href="#name-distribution-2" class="section-name selfRef">distribution</a>
+            </h5>
+<p id="section-2.3.2.7-1">distribution represents the basic distribution rules of the attribute. The system must adhere to the distribution setting for access control and for dissemination of the attribute.<a href="#section-2.3.2.7-1" class="pilcrow">¶</a></p>
+<p id="section-2.3.2.7-2">distribution is represented by a JSON string. distribution <span class="bcp14">MUST</span> be present and be one of the following options:<a href="#section-2.3.2.7-2" class="pilcrow">¶</a></p>
+<span class="break"></span><dl class="dlCompact dlParallel" id="section-2.3.2.7-3">
+              <dt id="section-2.3.2.7-3.1">0</dt>
+              <dd style="margin-left: 1.5em" id="section-2.3.2.7-3.2">Your Organisation Only<a href="#section-2.3.2.7-3.2" class="pilcrow">¶</a>
+</dd>
+              <dd class="break"></dd>
+<dt id="section-2.3.2.7-3.3">1</dt>
+              <dd style="margin-left: 1.5em" id="section-2.3.2.7-3.4">This Community Only<a href="#section-2.3.2.7-3.4" class="pilcrow">¶</a>
+</dd>
+              <dd class="break"></dd>
+<dt id="section-2.3.2.7-3.5">2</dt>
+              <dd style="margin-left: 1.5em" id="section-2.3.2.7-3.6">Connected Communities<a href="#section-2.3.2.7-3.6" class="pilcrow">¶</a>
+</dd>
+              <dd class="break"></dd>
+<dt id="section-2.3.2.7-3.7">3</dt>
+              <dd style="margin-left: 1.5em" id="section-2.3.2.7-3.8">All Communities<a href="#section-2.3.2.7-3.8" class="pilcrow">¶</a>
+</dd>
+              <dd class="break"></dd>
+<dt id="section-2.3.2.7-3.9">4</dt>
+              <dd style="margin-left: 1.5em" id="section-2.3.2.7-3.10">Sharing Group<a href="#section-2.3.2.7-3.10" class="pilcrow">¶</a>
+</dd>
+              <dd class="break"></dd>
+<dt id="section-2.3.2.7-3.11">5</dt>
+              <dd style="margin-left: 1.5em" id="section-2.3.2.7-3.12">Inherit Event<a href="#section-2.3.2.7-3.12" class="pilcrow">¶</a>
+</dd>
+            <dd class="break"></dd>
+</dl>
+</section>
+</div>
+<div id="timestamp-1">
+<section id="section-2.3.2.8">
+            <h5 id="name-timestamp-2">
+<a href="#section-2.3.2.8" class="section-number selfRef">2.3.2.8. </a><a href="#name-timestamp-2" class="section-name selfRef">timestamp</a>
+            </h5>
+<p id="section-2.3.2.8-1">timestamp represents a reference time when the attribute was created or last modified. timestamp is expressed in seconds (decimal) since 1st of January 1970 (Unix timestamp). The time zone <span class="bcp14">MUST</span> be UTC.<a href="#section-2.3.2.8-1" class="pilcrow">¶</a></p>
+<p id="section-2.3.2.8-2">timestamp is represented as a JSON string. timestamp <span class="bcp14">MUST</span> be present.<a href="#section-2.3.2.8-2" class="pilcrow">¶</a></p>
+</section>
+</div>
+<div id="comment">
+<section id="section-2.3.2.9">
+            <h5 id="name-comment">
+<a href="#section-2.3.2.9" class="section-number selfRef">2.3.2.9. </a><a href="#name-comment" class="section-name selfRef">comment</a>
+            </h5>
+<p id="section-2.3.2.9-1">comment is a contextual comment field.<a href="#section-2.3.2.9-1" class="pilcrow">¶</a></p>
+<p id="section-2.3.2.9-2">comment is represented by a JSON string. comment <span class="bcp14">MAY</span> be present.<a href="#section-2.3.2.9-2" class="pilcrow">¶</a></p>
+</section>
+</div>
+<div id="sharing-group-id-1">
+<section id="section-2.3.2.10">
+            <h5 id="name-sharing_group_id-2">
+<a href="#section-2.3.2.10" class="section-number selfRef">2.3.2.10. </a><a href="#name-sharing_group_id-2" class="section-name selfRef">sharing_group_id</a>
+            </h5>
+<p id="section-2.3.2.10-1">sharing_group_id represents a human-readable identifier referencing a Sharing Group object that defines the distribution of the attribute, if distribution level "4" is set. A human-readable identifier <span class="bcp14">MUST</span> be represented as an unsigned integer.<a href="#section-2.3.2.10-1" class="pilcrow">¶</a></p>
+<p id="section-2.3.2.10-2">sharing_group_id is represented by a JSON string and <span class="bcp14">SHOULD</span> be present. If a distribution level other than "4" is chosen the sharing_group_id <span class="bcp14">MUST</span> be set to "0".<a href="#section-2.3.2.10-2" class="pilcrow">¶</a></p>
+</section>
+</div>
+<div id="deleted">
+<section id="section-2.3.2.11">
+            <h5 id="name-deleted">
+<a href="#section-2.3.2.11" class="section-number selfRef">2.3.2.11. </a><a href="#name-deleted" class="section-name selfRef">deleted</a>
+            </h5>
+<p id="section-2.3.2.11-1">deleted represents a setting that allows attributes to be revoked. Revoked attributes are not actionable and exist merely to inform other instances of a revocation.<a href="#section-2.3.2.11-1" class="pilcrow">¶</a></p>
+<p id="section-2.3.2.11-2">deleted is represented by a JSON boolean. deleted <span class="bcp14">MUST</span> be present.<a href="#section-2.3.2.11-2" class="pilcrow">¶</a></p>
+</section>
+</div>
+<div id="data">
+<section id="section-2.3.2.12">
+            <h5 id="name-data">
+<a href="#section-2.3.2.12" class="section-number selfRef">2.3.2.12. </a><a href="#name-data" class="section-name selfRef">data</a>
+            </h5>
+<p id="section-2.3.2.12-1">data contains the base64 encoded contents of an attachment or a malware sample. For malware samples,
+the sample <span class="bcp14">MUST</span> be encrypted using a password protected zip archive, with the password being "infected".<a href="#section-2.3.2.12-1" class="pilcrow">¶</a></p>
+<p id="section-2.3.2.12-2">data is represented by a JSON string in base64 encoding. data <span class="bcp14">MUST</span> be set for attributes of type malware-sample and attachment.<a href="#section-2.3.2.12-2" class="pilcrow">¶</a></p>
+</section>
+</div>
+<div id="relatedattribute">
+<section id="section-2.3.2.13">
+            <h5 id="name-relatedattribute">
+<a href="#section-2.3.2.13" class="section-number selfRef">2.3.2.13. </a><a href="#name-relatedattribute" class="section-name selfRef">RelatedAttribute</a>
+            </h5>
+<p id="section-2.3.2.13-1">RelatedAttribute is an array of attributes correlating with the current attribute. Each element in the array represents an JSON object which contains an Attribute dictionnary with the external attributes who correlate. Each Attribute <span class="bcp14">MUST</span> include the id, org_id, info and a value. Only the correlations found on the local instance are shown in RelatedAttribute.<a href="#section-2.3.2.13-1" class="pilcrow">¶</a></p>
+<p id="section-2.3.2.13-2">RelatedAttribute <span class="bcp14">MAY</span> be present.<a href="#section-2.3.2.13-2" class="pilcrow">¶</a></p>
+</section>
+</div>
+<div id="shadowattribute">
+<section id="section-2.3.2.14">
+            <h5 id="name-shadowattribute">
+<a href="#section-2.3.2.14" class="section-number selfRef">2.3.2.14. </a><a href="#name-shadowattribute" class="section-name selfRef">ShadowAttribute</a>
+            </h5>
+<p id="section-2.3.2.14-1">ShadowAttribute is an array of shadow attributes that serve as proposals by third parties to alter the containing attribute. The structure of a ShadowAttribute is similar to that of an Attribute,
+which can be accepted or discarded by the event creator. If accepted, the original attribute containing the shadow attribute is removed and the shadow attribute is converted into an attribute.<a href="#section-2.3.2.14-1" class="pilcrow">¶</a></p>
+<p id="section-2.3.2.14-2">Each shadow attribute that references an attribute <span class="bcp14">MUST</span> contain the containing attribute's ID in the old_id field and the event's ID in the event_id field.<a href="#section-2.3.2.14-2" class="pilcrow">¶</a></p>
+</section>
+</div>
+<div id="value">
+<section id="section-2.3.2.15">
+            <h5 id="name-value">
+<a href="#section-2.3.2.15" class="section-number selfRef">2.3.2.15. </a><a href="#name-value" class="section-name selfRef">value</a>
+            </h5>
+<p id="section-2.3.2.15-1">value represents the payload of an attribute. The format of the value is dependent on the type of the attribute.<a href="#section-2.3.2.15-1" class="pilcrow">¶</a></p>
+<p id="section-2.3.2.15-2">value is represented by a JSON string. value <span class="bcp14">MUST</span> be present.<a href="#section-2.3.2.15-2" class="pilcrow">¶</a></p>
+</section>
+</div>
+<div id="first-seen">
+<section id="section-2.3.2.16">
+            <h5 id="name-first_seen">
+<a href="#section-2.3.2.16" class="section-number selfRef">2.3.2.16. </a><a href="#name-first_seen" class="section-name selfRef">first_seen</a>
+            </h5>
+<p id="section-2.3.2.16-1">first_seen represents a reference time when the attribute was first seen. first_seen is expressed as an ISO 8601 datetime up to the micro-second with time zone support.<a href="#section-2.3.2.16-1" class="pilcrow">¶</a></p>
+<p id="section-2.3.2.16-2">first_seen is represented as a JSON string. first_seen <span class="bcp14">MAY</span> be present.<a href="#section-2.3.2.16-2" class="pilcrow">¶</a></p>
+</section>
+</div>
+<div id="last-seen">
+<section id="section-2.3.2.17">
+            <h5 id="name-last_seen">
+<a href="#section-2.3.2.17" class="section-number selfRef">2.3.2.17. </a><a href="#name-last_seen" class="section-name selfRef">last_seen</a>
+            </h5>
+<p id="section-2.3.2.17-1">last_seen represents a reference time when the attribute was last seen. last_seen is expressed as an ISO 8601 datetime up to the micro-second with time zone support.<a href="#section-2.3.2.17-1" class="pilcrow">¶</a></p>
+<p id="section-2.3.2.17-2">last_seen is represented as a JSON string. last_seen <span class="bcp14">MAY</span> be present.<a href="#section-2.3.2.17-2" class="pilcrow">¶</a></p>
+</section>
+</div>
+</section>
+</div>
+</section>
+</div>
+<div id="shadowattribute-1">
+<section id="section-2.4">
+        <h3 id="name-shadowattribute-2">
+<a href="#section-2.4" class="section-number selfRef">2.4. </a><a href="#name-shadowattribute-2" class="section-name selfRef">ShadowAttribute</a>
+        </h3>
+<p id="section-2.4-1">ShadowAttributes are 3rd party created attributes that either propose to add new information to an event or modify existing information. They are not meant to be actionable until the event creator accepts them - at which point they will be converted into attributes or modify an existing attribute.<a href="#section-2.4-1" class="pilcrow">¶</a></p>
+<p id="section-2.4-2">They are similar in structure to Attributes but additionally carry a reference to the creator of the ShadowAttribute as well as a revocation flag.<a href="#section-2.4-2" class="pilcrow">¶</a></p>
+<div id="sample-attribute-object-1">
+<section id="section-2.4.1">
+          <h4 id="name-sample-attribute-object-2">
+<a href="#section-2.4.1" class="section-number selfRef">2.4.1. </a><a href="#name-sample-attribute-object-2" class="section-name selfRef">Sample Attribute Object</a>
+          </h4>
+<div class="alignLeft art-text artwork" id="section-2.4.1-1">
+<pre>"ShadowAttribute":  {
+                       "id": "8",
+                       "type": "ip-src",
+                       "category": "Network activity",
+                       "to_ids": false,
+                       "uuid": "57d475f1-da78-4569-89de-1458c0a83869",
+                       "event_uuid": "57d475e6-41c4-41ca-b450-145ec0a83869",
+                       "event_id": "9",
+                       "old_id": "319",
+                       "comment": "",
+                       "org_id": "1",
+                       "proposal_to_delete": false,
+                       "value": "5.5.5.5",
+                       "deleted": false,
+                       "Org": {
+                           "id": "1",
+                           "name": "MISP",
+                           "uuid": "568cce5a-0c80-412b-8fdf-1ffac0a83869"
+                       },
+                       "first_seen": "2019-06-02T22:14:28.711954+00:00",
+                       "last_seen": null
+                   }
+</pre><a href="#section-2.4.1-1" class="pilcrow">¶</a>
+</div>
+</section>
+</div>
+<div id="shadowattribute-attributes">
+<section id="section-2.4.2">
+          <h4 id="name-shadowattribute-attributes">
+<a href="#section-2.4.2" class="section-number selfRef">2.4.2. </a><a href="#name-shadowattribute-attributes" class="section-name selfRef">ShadowAttribute Attributes</a>
+          </h4>
+<div id="uuid-2">
+<section id="section-2.4.2.1">
+            <h5 id="name-uuid-3">
+<a href="#section-2.4.2.1" class="section-number selfRef">2.4.2.1. </a><a href="#name-uuid-3" class="section-name selfRef">uuid</a>
             </h5>
 <p id="section-2.4.2.1-1">uuid represents the Universally Unique IDentifier (UUID) <span>[<a href="#RFC4122" class="xref">RFC4122</a>]</span> of the event. The uuid <span class="bcp14">MUST</span> be preserved
 for any updates or transfer of the same event. UUID version 4 is <span class="bcp14">RECOMMENDED</span> when assigning it to a new event.<a href="#section-2.4.2.1-1" class="pilcrow">¶</a></p>
 <p id="section-2.4.2.1-2">uuid is represented as a JSON string. uuid <span class="bcp14">MUST</span> be present.<a href="#section-2.4.2.1-2" class="pilcrow">¶</a></p>
 </section>
 </div>
-<div id="id-1">
+<div id="id-2">
 <section id="section-2.4.2.2">
-            <h5 id="name-id-2">
-<a href="#section-2.4.2.2" class="section-number selfRef">2.4.2.2. </a><a href="#name-id-2" class="section-name selfRef">id</a>
+            <h5 id="name-id-3">
+<a href="#section-2.4.2.2" class="section-number selfRef">2.4.2.2. </a><a href="#name-id-3" class="section-name selfRef">id</a>
             </h5>
-<p id="section-2.4.2.2-1">id represents the human-readable identifier associated to the event for a specific MISP instance. A human-readable identifier <span class="bcp14">MUST</span> be
-represented as an unsigned integer.<a href="#section-2.4.2.2-1" class="pilcrow">¶</a></p>
-<p id="section-2.4.2.2-2">id is represented as a JSON string. id <span class="bcp14">SHALL</span> be present.<a href="#section-2.4.2.2-2" class="pilcrow">¶</a></p>
+<p id="section-2.4.2.2-1">id represents the human-readable identifier associated to the event for a specific MISP instance. human-readable identifier <span class="bcp14">MUST</span> be represented as an unsigned integer.
+id is represented as a JSON string. id <span class="bcp14">SHALL</span> be present.<a href="#section-2.4.2.2-1" class="pilcrow">¶</a></p>
 </section>
 </div>
-<div id="type">
+<div id="type-1">
 <section id="section-2.4.2.3">
-            <h5 id="name-type">
-<a href="#section-2.4.2.3" class="section-number selfRef">2.4.2.3. </a><a href="#name-type" class="section-name selfRef">type</a>
+            <h5 id="name-type-2">
+<a href="#section-2.4.2.3" class="section-number selfRef">2.4.2.3. </a><a href="#name-type-2" class="section-name selfRef">type</a>
             </h5>
 <p id="section-2.4.2.3-1">type represents the means through which an attribute tries to describe the intent of the attribute creator, using a list of pre-defined attribute types.<a href="#section-2.4.2.3-1" class="pilcrow">¶</a></p>
 <p id="section-2.4.2.3-2">type is represented as a JSON string. type <span class="bcp14">MUST</span> be present and it <span class="bcp14">MUST</span> be a valid selection for the chosen category. The list of valid category-type combinations is as follows:<a href="#section-2.4.2.3-2" class="pilcrow">¶</a></p>
-<span class="break"></span><dl class="dlParallel" id="section-2.4.2.3-3">
+<span class="break"></span><dl class="dlCompact dlParallel" id="section-2.4.2.3-3">
               <dt id="section-2.4.2.3-3.1">Antivirus detection</dt>
               <dd style="margin-left: 1.5em" id="section-2.4.2.3-3.2">link, comment, text, hex, attachment, other, anonymised<a href="#section-2.4.2.3-3.2" class="pilcrow">¶</a>
 </dd>
@@ -1894,454 +2190,162 @@ represented as an unsigned integer.<a href="#section-2.4.2.2-1" class="pilcrow">
 <p id="section-2.4.2.3-4">Attributes are based on the usage within their different communities. Attributes can be extended on a regular basis and this reference document is updated accordingly.<a href="#section-2.4.2.3-4" class="pilcrow">¶</a></p>
 </section>
 </div>
-<div id="category">
+<div id="category-1">
 <section id="section-2.4.2.4">
-            <h5 id="name-category">
-<a href="#section-2.4.2.4" class="section-number selfRef">2.4.2.4. </a><a href="#name-category" class="section-name selfRef">category</a>
+            <h5 id="name-category-2">
+<a href="#section-2.4.2.4" class="section-number selfRef">2.4.2.4. </a><a href="#name-category-2" class="section-name selfRef">category</a>
             </h5>
 <p id="section-2.4.2.4-1">category represents the intent of what the attribute is describing as selected by the attribute creator, using a list of pre-defined attribute categories.<a href="#section-2.4.2.4-1" class="pilcrow">¶</a></p>
 <p id="section-2.4.2.4-2">category is represented as a JSON string. category <span class="bcp14">MUST</span> be present and it <span class="bcp14">MUST</span> be a valid selection for the chosen type. The list of valid category-type combinations is mentioned above.<a href="#section-2.4.2.4-2" class="pilcrow">¶</a></p>
 </section>
 </div>
-<div id="to-ids">
+<div id="to-ids-1">
 <section id="section-2.4.2.5">
-            <h5 id="name-to_ids">
-<a href="#section-2.4.2.5" class="section-number selfRef">2.4.2.5. </a><a href="#name-to_ids" class="section-name selfRef">to_ids</a>
+            <h5 id="name-to_ids-2">
+<a href="#section-2.4.2.5" class="section-number selfRef">2.4.2.5. </a><a href="#name-to_ids-2" class="section-name selfRef">to_ids</a>
             </h5>
-<p id="section-2.4.2.5-1">to_ids represents whether the attribute is meant to be actionable. Actionable defined attributes that can be used in automated processes as a pattern for detection in Local or Network Intrusion Detection System, log analysis tools or even filtering mechanisms.<a href="#section-2.4.2.5-1" class="pilcrow">¶</a></p>
+<p id="section-2.4.2.5-1">to_ids represents whether the Attribute to be created if the ShadowAttribute is accepted is meant to be actionable. Actionable defined attributes that can be used in automated processes as a pattern for detection in Local or Network Intrusion Detection System, log analysis tools or even filtering mechanisms.<a href="#section-2.4.2.5-1" class="pilcrow">¶</a></p>
 <p id="section-2.4.2.5-2">to_ids is represented as a JSON boolean. to_ids <span class="bcp14">MUST</span> be present.<a href="#section-2.4.2.5-2" class="pilcrow">¶</a></p>
 </section>
 </div>
-<div id="event-id">
+<div id="event-id-1">
 <section id="section-2.4.2.6">
-            <h5 id="name-event_id">
-<a href="#section-2.4.2.6" class="section-number selfRef">2.4.2.6. </a><a href="#name-event_id" class="section-name selfRef">event_id</a>
+            <h5 id="name-event_id-2">
+<a href="#section-2.4.2.6" class="section-number selfRef">2.4.2.6. </a><a href="#name-event_id-2" class="section-name selfRef">event_id</a>
             </h5>
-<p id="section-2.4.2.6-1">event_id represents a human-readable identifier referencing the Event object that the attribute belongs to. A human-readable identifier <span class="bcp14">MUST</span> be
-represented as an unsigned integer.<a href="#section-2.4.2.6-1" class="pilcrow">¶</a></p>
+<p id="section-2.4.2.6-1">event_id represents a human-readable identifier referencing the Event object that the ShadowAttribute belongs to.<a href="#section-2.4.2.6-1" class="pilcrow">¶</a></p>
 <p id="section-2.4.2.6-2">The event_id <span class="bcp14">SHOULD</span> be updated when the event is imported to reflect the newly created event's id on the instance.<a href="#section-2.4.2.6-2" class="pilcrow">¶</a></p>
 <p id="section-2.4.2.6-3">event_id is represented as a JSON string. event_id <span class="bcp14">MUST</span> be present.<a href="#section-2.4.2.6-3" class="pilcrow">¶</a></p>
 </section>
 </div>
-<div id="distribution-1">
+<div id="old-id">
 <section id="section-2.4.2.7">
-            <h5 id="name-distribution-2">
-<a href="#section-2.4.2.7" class="section-number selfRef">2.4.2.7. </a><a href="#name-distribution-2" class="section-name selfRef">distribution</a>
+            <h5 id="name-old_id">
+<a href="#section-2.4.2.7" class="section-number selfRef">2.4.2.7. </a><a href="#name-old_id" class="section-name selfRef">old_id</a>
             </h5>
-<p id="section-2.4.2.7-1">distribution represents the basic distribution rules of the attribute. The system must adhere to the distribution setting for access control and for dissemination of the attribute.<a href="#section-2.4.2.7-1" class="pilcrow">¶</a></p>
-<p id="section-2.4.2.7-2">distribution is represented by a JSON string. distribution <span class="bcp14">MUST</span> be present and be one of the following options:<a href="#section-2.4.2.7-2" class="pilcrow">¶</a></p>
-<span class="break"></span><dl class="dlParallel" id="section-2.4.2.7-3">
-              <dt id="section-2.4.2.7-3.1">0</dt>
-              <dd style="margin-left: 1.5em" id="section-2.4.2.7-3.2">Your Organisation Only<a href="#section-2.4.2.7-3.2" class="pilcrow">¶</a>
-</dd>
-              <dd class="break"></dd>
-<dt id="section-2.4.2.7-3.3">1</dt>
-              <dd style="margin-left: 1.5em" id="section-2.4.2.7-3.4">This Community Only<a href="#section-2.4.2.7-3.4" class="pilcrow">¶</a>
-</dd>
-              <dd class="break"></dd>
-<dt id="section-2.4.2.7-3.5">2</dt>
-              <dd style="margin-left: 1.5em" id="section-2.4.2.7-3.6">Connected Communities<a href="#section-2.4.2.7-3.6" class="pilcrow">¶</a>
-</dd>
-              <dd class="break"></dd>
-<dt id="section-2.4.2.7-3.7">3</dt>
-              <dd style="margin-left: 1.5em" id="section-2.4.2.7-3.8">All Communities<a href="#section-2.4.2.7-3.8" class="pilcrow">¶</a>
-</dd>
-              <dd class="break"></dd>
-<dt id="section-2.4.2.7-3.9">4</dt>
-              <dd style="margin-left: 1.5em" id="section-2.4.2.7-3.10">Sharing Group<a href="#section-2.4.2.7-3.10" class="pilcrow">¶</a>
-</dd>
-              <dd class="break"></dd>
-<dt id="section-2.4.2.7-3.11">5</dt>
-              <dd style="margin-left: 1.5em" id="section-2.4.2.7-3.12">Inherit Event<a href="#section-2.4.2.7-3.12" class="pilcrow">¶</a>
-</dd>
-            <dd class="break"></dd>
-</dl>
+<p id="section-2.4.2.7-1">old_id represents a human-readable identifier referencing the Attribute object that the ShadowAttribute belongs to. A ShadowAttribute can this way target an existing Attribute, implying that it is a proposal to modify an existing Attribute, or alternatively it can be a proposal to create a new Attribute for the containing Event.<a href="#section-2.4.2.7-1" class="pilcrow">¶</a></p>
+<p id="section-2.4.2.7-2">The old_id <span class="bcp14">SHOULD</span> be updated when the event is imported to reflect the newly created Attribute's id on the instance. Alternatively, if the ShadowAttribute proposes the creation of a new Attribute, it should be set to 0.<a href="#section-2.4.2.7-2" class="pilcrow">¶</a></p>
+<p id="section-2.4.2.7-3">old_id is represented as a JSON string. old_id <span class="bcp14">MUST</span> be present.<a href="#section-2.4.2.7-3" class="pilcrow">¶</a></p>
 </section>
 </div>
-<div id="timestamp-1">
+<div id="timestamp-2">
 <section id="section-2.4.2.8">
-            <h5 id="name-timestamp-2">
-<a href="#section-2.4.2.8" class="section-number selfRef">2.4.2.8. </a><a href="#name-timestamp-2" class="section-name selfRef">timestamp</a>
+            <h5 id="name-timestamp-3">
+<a href="#section-2.4.2.8" class="section-number selfRef">2.4.2.8. </a><a href="#name-timestamp-3" class="section-name selfRef">timestamp</a>
             </h5>
 <p id="section-2.4.2.8-1">timestamp represents a reference time when the attribute was created or last modified. timestamp is expressed in seconds (decimal) since 1st of January 1970 (Unix timestamp). The time zone <span class="bcp14">MUST</span> be UTC.<a href="#section-2.4.2.8-1" class="pilcrow">¶</a></p>
 <p id="section-2.4.2.8-2">timestamp is represented as a JSON string. timestamp <span class="bcp14">MUST</span> be present.<a href="#section-2.4.2.8-2" class="pilcrow">¶</a></p>
 </section>
 </div>
-<div id="comment">
+<div id="comment-1">
 <section id="section-2.4.2.9">
-            <h5 id="name-comment">
-<a href="#section-2.4.2.9" class="section-number selfRef">2.4.2.9. </a><a href="#name-comment" class="section-name selfRef">comment</a>
+            <h5 id="name-comment-2">
+<a href="#section-2.4.2.9" class="section-number selfRef">2.4.2.9. </a><a href="#name-comment-2" class="section-name selfRef">comment</a>
             </h5>
 <p id="section-2.4.2.9-1">comment is a contextual comment field.<a href="#section-2.4.2.9-1" class="pilcrow">¶</a></p>
 <p id="section-2.4.2.9-2">comment is represented by a JSON string. comment <span class="bcp14">MAY</span> be present.<a href="#section-2.4.2.9-2" class="pilcrow">¶</a></p>
 </section>
 </div>
-<div id="sharing-group-id-1">
-<section id="section-2.4.2.10">
-            <h5 id="name-sharing_group_id-2">
-<a href="#section-2.4.2.10" class="section-number selfRef">2.4.2.10. </a><a href="#name-sharing_group_id-2" class="section-name selfRef">sharing_group_id</a>
-            </h5>
-<p id="section-2.4.2.10-1">sharing_group_id represents a human-readable identifier referencing a Sharing Group object that defines the distribution of the attribute, if distribution level "4" is set. A human-readable identifier <span class="bcp14">MUST</span> be represented as an unsigned integer.<a href="#section-2.4.2.10-1" class="pilcrow">¶</a></p>
-<p id="section-2.4.2.10-2">sharing_group_id is represented by a JSON string and <span class="bcp14">SHOULD</span> be present. If a distribution level other than "4" is chosen the sharing_group_id <span class="bcp14">MUST</span> be set to "0".<a href="#section-2.4.2.10-2" class="pilcrow">¶</a></p>
-</section>
-</div>
-<div id="deleted">
-<section id="section-2.4.2.11">
-            <h5 id="name-deleted">
-<a href="#section-2.4.2.11" class="section-number selfRef">2.4.2.11. </a><a href="#name-deleted" class="section-name selfRef">deleted</a>
-            </h5>
-<p id="section-2.4.2.11-1">deleted represents a setting that allows attributes to be revoked. Revoked attributes are not actionable and exist merely to inform other instances of a revocation.<a href="#section-2.4.2.11-1" class="pilcrow">¶</a></p>
-<p id="section-2.4.2.11-2">deleted is represented by a JSON boolean. deleted <span class="bcp14">MUST</span> be present.<a href="#section-2.4.2.11-2" class="pilcrow">¶</a></p>
-</section>
-</div>
-<div id="data">
-<section id="section-2.4.2.12">
-            <h5 id="name-data">
-<a href="#section-2.4.2.12" class="section-number selfRef">2.4.2.12. </a><a href="#name-data" class="section-name selfRef">data</a>
-            </h5>
-<p id="section-2.4.2.12-1">data contains the base64 encoded contents of an attachment or a malware sample. For malware samples,
-the sample <span class="bcp14">MUST</span> be encrypted using a password protected zip archive, with the password being "infected".<a href="#section-2.4.2.12-1" class="pilcrow">¶</a></p>
-<p id="section-2.4.2.12-2">data is represented by a JSON string in base64 encoding. data <span class="bcp14">MUST</span> be set for attributes of type malware-sample and attachment.<a href="#section-2.4.2.12-2" class="pilcrow">¶</a></p>
-</section>
-</div>
-<div id="relatedattribute">
-<section id="section-2.4.2.13">
-            <h5 id="name-relatedattribute">
-<a href="#section-2.4.2.13" class="section-number selfRef">2.4.2.13. </a><a href="#name-relatedattribute" class="section-name selfRef">RelatedAttribute</a>
-            </h5>
-<p id="section-2.4.2.13-1">RelatedAttribute is an array of attributes correlating with the current attribute. Each element in the array represents an JSON object which contains an Attribute dictionnary with the external attributes who correlate. Each Attribute <span class="bcp14">MUST</span> include the id, org_id, info and a value. Only the correlations found on the local instance are shown in RelatedAttribute.<a href="#section-2.4.2.13-1" class="pilcrow">¶</a></p>
-<p id="section-2.4.2.13-2">RelatedAttribute <span class="bcp14">MAY</span> be present.<a href="#section-2.4.2.13-2" class="pilcrow">¶</a></p>
-</section>
-</div>
-<div id="shadowattribute">
-<section id="section-2.4.2.14">
-            <h5 id="name-shadowattribute">
-<a href="#section-2.4.2.14" class="section-number selfRef">2.4.2.14. </a><a href="#name-shadowattribute" class="section-name selfRef">ShadowAttribute</a>
-            </h5>
-<p id="section-2.4.2.14-1">ShadowAttribute is an array of shadow attributes that serve as proposals by third parties to alter the containing attribute. The structure of a ShadowAttribute is similar to that of an Attribute,
-which can be accepted or discarded by the event creator. If accepted, the original attribute containing the shadow attribute is removed and the shadow attribute is converted into an attribute.<a href="#section-2.4.2.14-1" class="pilcrow">¶</a></p>
-<p id="section-2.4.2.14-2">Each shadow attribute that references an attribute <span class="bcp14">MUST</span> contain the containing attribute's ID in the old<em>id field and the event's ID in the event</em>id field.<a href="#section-2.4.2.14-2" class="pilcrow">¶</a></p>
-</section>
-</div>
-<div id="value">
-<section id="section-2.4.2.15">
-            <h5 id="name-value">
-<a href="#section-2.4.2.15" class="section-number selfRef">2.4.2.15. </a><a href="#name-value" class="section-name selfRef">value</a>
-            </h5>
-<p id="section-2.4.2.15-1">value represents the payload of an attribute. The format of the value is dependent on the type of the attribute.<a href="#section-2.4.2.15-1" class="pilcrow">¶</a></p>
-<p id="section-2.4.2.15-2">value is represented by a JSON string. value <span class="bcp14">MUST</span> be present.<a href="#section-2.4.2.15-2" class="pilcrow">¶</a></p>
-</section>
-</div>
-<div id="first-seen">
-<section id="section-2.4.2.16">
-            <h5 id="name-first_seen">
-<a href="#section-2.4.2.16" class="section-number selfRef">2.4.2.16. </a><a href="#name-first_seen" class="section-name selfRef">first_seen</a>
-            </h5>
-<p id="section-2.4.2.16-1">first<em>seen represents a reference time when the attribute was first seen. first</em>seen is expressed as an ISO 8601 datetime up to the micro-second with time zone support.<a href="#section-2.4.2.16-1" class="pilcrow">¶</a></p>
-<p id="section-2.4.2.16-2">first<em>seen is represented as a JSON string. first</em>seen <span class="bcp14">MAY</span> be present.<a href="#section-2.4.2.16-2" class="pilcrow">¶</a></p>
-</section>
-</div>
-<div id="last-seen">
-<section id="section-2.4.2.17">
-            <h5 id="name-last_seen">
-<a href="#section-2.4.2.17" class="section-number selfRef">2.4.2.17. </a><a href="#name-last_seen" class="section-name selfRef">last_seen</a>
-            </h5>
-<p id="section-2.4.2.17-1">last<em>seen represents a reference time when the attribute was last seen. last</em>seen is expressed as an ISO 8601 datetime up to the micro-second with time zone support.<a href="#section-2.4.2.17-1" class="pilcrow">¶</a></p>
-<p id="section-2.4.2.17-2">last<em>seen is represented as a JSON string. last</em>seen <span class="bcp14">MAY</span> be present.<a href="#section-2.4.2.17-2" class="pilcrow">¶</a></p>
-</section>
-</div>
-</section>
-</div>
-</section>
-</div>
-<div id="shadowattribute-1">
-<section id="section-2.5">
-        <h3 id="name-shadowattribute-2">
-<a href="#section-2.5" class="section-number selfRef">2.5. </a><a href="#name-shadowattribute-2" class="section-name selfRef">ShadowAttribute</a>
-        </h3>
-<p id="section-2.5-1">ShadowAttributes are 3rd party created attributes that either propose to add new information to an event or modify existing information. They are not meant to be actionable until the event creator accepts them - at which point they will be converted into attributes or modify an existing attribute.<a href="#section-2.5-1" class="pilcrow">¶</a></p>
-<p id="section-2.5-2">They are similar in structure to Attributes but additionally carry a reference to the creator of the ShadowAttribute as well as a revocation flag.<a href="#section-2.5-2" class="pilcrow">¶</a></p>
-<div id="sample-attribute-object-1">
-<section id="section-2.5.1">
-          <h4 id="name-sample-attribute-object-2">
-<a href="#section-2.5.1" class="section-number selfRef">2.5.1. </a><a href="#name-sample-attribute-object-2" class="section-name selfRef">Sample Attribute Object</a>
-          </h4>
-<div class="artwork art-text alignLeft" id="section-2.5.1-1">
-<pre>"ShadowAttribute":  {
-                       "id": "8",
-                       "type": "ip-src",
-                       "category": "Network activity",
-                       "to_ids": false,
-                       "uuid": "57d475f1-da78-4569-89de-1458c0a83869",
-                       "event_uuid": "57d475e6-41c4-41ca-b450-145ec0a83869",
-                       "event_id": "9",
-                       "old_id": "319",
-                       "comment": "",
-                       "org_id": "1",
-                       "proposal_to_delete": false,
-                       "value": "5.5.5.5",
-                       "deleted": false,
-                       "Org": {
-                           "id": "1",
-                           "name": "MISP",
-                           "uuid": "568cce5a-0c80-412b-8fdf-1ffac0a83869"
-                       },
-                       "first_seen": "2019-06-02T22:14:28.711954+00:00",
-                       "last_seen": null
-                   }
-</pre><a href="#section-2.5.1-1" class="pilcrow">¶</a>
-</div>
-</section>
-</div>
-<div id="shadowattribute-attributes">
-<section id="section-2.5.2">
-          <h4 id="name-shadowattribute-attributes">
-<a href="#section-2.5.2" class="section-number selfRef">2.5.2. </a><a href="#name-shadowattribute-attributes" class="section-name selfRef">ShadowAttribute Attributes</a>
-          </h4>
-<div id="uuid-2">
-<section id="section-2.5.2.1">
-            <h5 id="name-uuid-3">
-<a href="#section-2.5.2.1" class="section-number selfRef">2.5.2.1. </a><a href="#name-uuid-3" class="section-name selfRef">uuid</a>
-            </h5>
-<p id="section-2.5.2.1-1">uuid represents the Universally Unique IDentifier (UUID) <span>[<a href="#RFC4122" class="xref">RFC4122</a>]</span> of the event. The uuid <span class="bcp14">MUST</span> be preserved
-for any updates or transfer of the same event. UUID version 4 is <span class="bcp14">RECOMMENDED</span> when assigning it to a new event.<a href="#section-2.5.2.1-1" class="pilcrow">¶</a></p>
-<p id="section-2.5.2.1-2">uuid is represented as a JSON string. uuid <span class="bcp14">MUST</span> be present.<a href="#section-2.5.2.1-2" class="pilcrow">¶</a></p>
-</section>
-</div>
-<div id="id-2">
-<section id="section-2.5.2.2">
-            <h5 id="name-id-3">
-<a href="#section-2.5.2.2" class="section-number selfRef">2.5.2.2. </a><a href="#name-id-3" class="section-name selfRef">id</a>
-            </h5>
-<p id="section-2.5.2.2-1">id represents the human-readable identifier associated to the event for a specific MISP instance. human-readable identifier <span class="bcp14">MUST</span> be represented as an unsigned integer.
-id is represented as a JSON string. id <span class="bcp14">SHALL</span> be present.<a href="#section-2.5.2.2-1" class="pilcrow">¶</a></p>
-</section>
-</div>
-<div id="type-1">
-<section id="section-2.5.2.3">
-            <h5 id="name-type-2">
-<a href="#section-2.5.2.3" class="section-number selfRef">2.5.2.3. </a><a href="#name-type-2" class="section-name selfRef">type</a>
-            </h5>
-<p id="section-2.5.2.3-1">type represents the means through which an attribute tries to describe the intent of the attribute creator, using a list of pre-defined attribute types.<a href="#section-2.5.2.3-1" class="pilcrow">¶</a></p>
-<p id="section-2.5.2.3-2">type is represented as a JSON string. type <span class="bcp14">MUST</span> be present and it <span class="bcp14">MUST</span> be a valid selection for the chosen category. The list of valid category-type combinations is as follows:<a href="#section-2.5.2.3-2" class="pilcrow">¶</a></p>
-<span class="break"></span><dl class="dlParallel" id="section-2.5.2.3-3">
-              <dt id="section-2.5.2.3-3.1">Antivirus detection</dt>
-              <dd style="margin-left: 1.5em" id="section-2.5.2.3-3.2">link, comment, text, hex, attachment, other, anonymised<a href="#section-2.5.2.3-3.2" class="pilcrow">¶</a>
-</dd>
-              <dd class="break"></dd>
-<dt id="section-2.5.2.3-3.3">Artifacts dropped</dt>
-              <dd style="margin-left: 1.5em" id="section-2.5.2.3-3.4">md5, sha1, sha224, sha256, sha384, sha512, sha512/224, sha512/256, sha3-224, sha3-256, sha3-384, sha3-512, ssdeep, imphash, telfhash, impfuzzy, authentihash, vhash, cdhash, filename, filename|md5, filename|sha1, filename|sha224, filename|sha256, filename|sha384, filename|sha512, filename|sha512/224, filename|sha512/256, filename|sha3-224, filename|sha3-256, filename|sha3-384, filename|sha3-512, filename|authentihash, filename|vhash, filename|ssdeep, filename|tlsh, filename|imphash, filename|impfuzzy, filename|pehash, regkey, regkey|value, pattern-in-file, pattern-in-memory, filename-pattern, pdb, stix2-pattern, yara, sigma, attachment, malware-sample, named pipe, mutex, process-state, windows-scheduled-task, windows-service-name, windows-service-displayname, comment, text, hex, x509-fingerprint-sha1, x509-fingerprint-md5, x509-fingerprint-sha256, other, cookie, gene, kusto-query, mime-type, anonymised, pgp-public-key, pgp-private-key<a href="#section-2.5.2.3-3.4" class="pilcrow">¶</a>
-</dd>
-              <dd class="break"></dd>
-<dt id="section-2.5.2.3-3.5">Attribution</dt>
-              <dd style="margin-left: 1.5em" id="section-2.5.2.3-3.6">threat-actor, campaign-name, campaign-id, whois-registrant-phone, whois-registrant-email, whois-registrant-name, whois-registrant-org, whois-registrar, whois-creation-date, comment, text, x509-fingerprint-sha1, x509-fingerprint-md5, x509-fingerprint-sha256, other, dns-soa-email, anonymised, email<a href="#section-2.5.2.3-3.6" class="pilcrow">¶</a>
-</dd>
-              <dd class="break"></dd>
-<dt id="section-2.5.2.3-3.7">External analysis</dt>
-              <dd style="margin-left: 1.5em" id="section-2.5.2.3-3.8">md5, sha1, sha256, sha3-224, sha3-256, sha3-384, sha3-512, filename, filename|md5, filename|sha1, filename|sha256, filename|sha3-224, filename|sha3-256, filename|sha3-384, filename|sha3-512, ip-src, ip-dst, ip-dst|port, ip-src|port, mac-address, mac-eui-64, hostname, domain, domain|ip, url, user-agent, regkey, regkey|value, AS, snort, bro, zeek, pattern-in-file, pattern-in-traffic, pattern-in-memory, filename-pattern, vulnerability, cpe, weakness, attachment, malware-sample, link, comment, text, x509-fingerprint-sha1, x509-fingerprint-md5, x509-fingerprint-sha256, ja3-fingerprint-md5, jarm-fingerprint, hassh-md5, hasshserver-md5, github-repository, other, cortex, anonymised, community-id<a href="#section-2.5.2.3-3.8" class="pilcrow">¶</a>
-</dd>
-              <dd class="break"></dd>
-<dt id="section-2.5.2.3-3.9">Financial fraud</dt>
-              <dd style="margin-left: 1.5em" id="section-2.5.2.3-3.10">btc, dash, xmr, iban, bic, bank-account-nr, aba-rtn, bin, cc-number, prtn, phone-number, comment, text, other, hex, anonymised<a href="#section-2.5.2.3-3.10" class="pilcrow">¶</a>
-</dd>
-              <dd class="break"></dd>
-<dt id="section-2.5.2.3-3.11">Internal reference</dt>
-              <dd style="margin-left: 1.5em" id="section-2.5.2.3-3.12">text, link, comment, other, hex, anonymised, git-commit-id<a href="#section-2.5.2.3-3.12" class="pilcrow">¶</a>
-</dd>
-              <dd class="break"></dd>
-<dt id="section-2.5.2.3-3.13">Network activity</dt>
-              <dd style="margin-left: 1.5em" id="section-2.5.2.3-3.14">ip-src, ip-dst, ip-dst|port, ip-src|port, port, hostname, domain, domain|ip, mac-address, mac-eui-64, email, email-dst, email-src, eppn, url, uri, user-agent, http-method, AS, snort, pattern-in-file, filename-pattern, stix2-pattern, pattern-in-traffic, attachment, comment, text, x509-fingerprint-md5, x509-fingerprint-sha1, x509-fingerprint-sha256, ja3-fingerprint-md5, jarm-fingerprint, hassh-md5, hasshserver-md5, other, hex, cookie, hostname|port, bro, zeek, anonymised, community-id, email-subject, favicon-mmh3, dkim, dkim-signature, ssh-fingerprint<a href="#section-2.5.2.3-3.14" class="pilcrow">¶</a>
-</dd>
-              <dd class="break"></dd>
-<dt id="section-2.5.2.3-3.15">Other</dt>
-              <dd style="margin-left: 1.5em" id="section-2.5.2.3-3.16">comment, text, other, size-in-bytes, counter, datetime, cpe, port, float, hex, phone-number, boolean, anonymised, pgp-public-key, pgp-private-key<a href="#section-2.5.2.3-3.16" class="pilcrow">¶</a>
-</dd>
-              <dd class="break"></dd>
-<dt id="section-2.5.2.3-3.17">Payload delivery</dt>
-              <dd style="margin-left: 1.5em" id="section-2.5.2.3-3.18">md5, sha1, sha224, sha256, sha384, sha512, sha512/224, sha512/256, sha3-224, sha3-256, sha3-384, sha3-512, ssdeep, imphash, telfhash, impfuzzy, authentihash, vhash, pehash, tlsh, cdhash, filename, filename|md5, filename|sha1, filename|sha224, filename|sha256, filename|sha384, filename|sha512, filename|sha512/224, filename|sha512/256, filename|sha3-224, filename|sha3-256, filename|sha3-384, filename|sha3-512, filename|authentihash, filename|vhash, filename|ssdeep, filename|tlsh, filename|imphash, filename|impfuzzy, filename|pehash, mac-address, mac-eui-64, ip-src, ip-dst, ip-dst|port, ip-src|port, hostname, domain, email, email-src, email-dst, email-subject, email-attachment, email-body, url, user-agent, AS, pattern-in-file, pattern-in-traffic, filename-pattern, stix2-pattern, yara, sigma, mime-type, attachment, malware-sample, link, malware-type, comment, text, hex, vulnerability, cpe, weakness, x509-fingerprint-sha1, x509-fingerprint-md5, x509-fingerprint-sha256, ja3-fingerprint-md5, jarm-fingerprint, hassh-md5, hasshserver-md5, other, hostname|port, email-dst-display-name, email-src-display-name, email-header, email-reply-to, email-x-mailer, email-mime-boundary, email-thread-index, email-message-id, mobile-application-id, chrome-extension-id, whois-registrant-email, anonymised<a href="#section-2.5.2.3-3.18" class="pilcrow">¶</a>
-</dd>
-              <dd class="break"></dd>
-<dt id="section-2.5.2.3-3.19">Payload installation</dt>
-              <dd style="margin-left: 1.5em" id="section-2.5.2.3-3.20">md5, sha1, sha224, sha256, sha384, sha512, sha512/224, sha512/256, sha3-224, sha3-256, sha3-384, sha3-512, ssdeep, imphash, telfhash, impfuzzy, authentihash, vhash, pehash, tlsh, cdhash, filename, filename|md5, filename|sha1, filename|sha224, filename|sha256, filename|sha384, filename|sha512, filename|sha512/224, filename|sha512/256, filename|sha3-224, filename|sha3-256, filename|sha3-384, filename|sha3-512, filename|authentihash, filename|vhash, filename|ssdeep, filename|tlsh, filename|imphash, filename|impfuzzy, filename|pehash, pattern-in-file, pattern-in-traffic, pattern-in-memory, filename-pattern, stix2-pattern, yara, sigma, vulnerability, cpe, weakness, attachment, malware-sample, malware-type, comment, text, hex, x509-fingerprint-sha1, x509-fingerprint-md5, x509-fingerprint-sha256, mobile-application-id, chrome-extension-id, other, mime-type, anonymised<a href="#section-2.5.2.3-3.20" class="pilcrow">¶</a>
-</dd>
-              <dd class="break"></dd>
-<dt id="section-2.5.2.3-3.21">Payload type</dt>
-              <dd style="margin-left: 1.5em" id="section-2.5.2.3-3.22">comment, text, other, anonymised<a href="#section-2.5.2.3-3.22" class="pilcrow">¶</a>
-</dd>
-              <dd class="break"></dd>
-<dt id="section-2.5.2.3-3.23">Persistence mechanism</dt>
-              <dd style="margin-left: 1.5em" id="section-2.5.2.3-3.24">filename, regkey, regkey|value, comment, text, other, hex, anonymised<a href="#section-2.5.2.3-3.24" class="pilcrow">¶</a>
-</dd>
-              <dd class="break"></dd>
-<dt id="section-2.5.2.3-3.25">Person</dt>
-              <dd style="margin-left: 1.5em" id="section-2.5.2.3-3.26">first-name, middle-name, last-name, full-name, date-of-birth, place-of-birth, gender, passport-number, passport-country, passport-expiration, redress-number, nationality, visa-number, issue-date-of-the-visa, primary-residence, country-of-residence, special-service-request, frequent-flyer-number, travel-details, payment-details, place-port-of-original-embarkation, place-port-of-clearance, place-port-of-onward-foreign-destination, passenger-name-record-locator-number, comment, text, other, phone-number, identity-card-number, anonymised, email, pgp-public-key, pgp-private-key<a href="#section-2.5.2.3-3.26" class="pilcrow">¶</a>
-</dd>
-              <dd class="break"></dd>
-<dt id="section-2.5.2.3-3.27">Social network</dt>
-              <dd style="margin-left: 1.5em" id="section-2.5.2.3-3.28">github-username, github-repository, github-organisation, jabber-id, twitter-id, email, email-src, email-dst, eppn, comment, text, other, whois-registrant-email, anonymised, pgp-public-key, pgp-private-key<a href="#section-2.5.2.3-3.28" class="pilcrow">¶</a>
-</dd>
-              <dd class="break"></dd>
-<dt id="section-2.5.2.3-3.29">Support Tool</dt>
-              <dd style="margin-left: 1.5em" id="section-2.5.2.3-3.30">link, text, attachment, comment, other, hex, anonymised<a href="#section-2.5.2.3-3.30" class="pilcrow">¶</a>
-</dd>
-              <dd class="break"></dd>
-<dt id="section-2.5.2.3-3.31">Targeting data</dt>
-              <dd style="margin-left: 1.5em" id="section-2.5.2.3-3.32">target-user, target-email, target-machine, target-org, target-location, target-external, comment, anonymised<a href="#section-2.5.2.3-3.32" class="pilcrow">¶</a>
-</dd>
-            <dd class="break"></dd>
-</dl>
-<p id="section-2.5.2.3-4">Attributes are based on the usage within their different communities. Attributes can be extended on a regular basis and this reference document is updated accordingly.<a href="#section-2.5.2.3-4" class="pilcrow">¶</a></p>
-</section>
-</div>
-<div id="category-1">
-<section id="section-2.5.2.4">
-            <h5 id="name-category-2">
-<a href="#section-2.5.2.4" class="section-number selfRef">2.5.2.4. </a><a href="#name-category-2" class="section-name selfRef">category</a>
-            </h5>
-<p id="section-2.5.2.4-1">category represents the intent of what the attribute is describing as selected by the attribute creator, using a list of pre-defined attribute categories.<a href="#section-2.5.2.4-1" class="pilcrow">¶</a></p>
-<p id="section-2.5.2.4-2">category is represented as a JSON string. category <span class="bcp14">MUST</span> be present and it <span class="bcp14">MUST</span> be a valid selection for the chosen type. The list of valid category-type combinations is mentioned above.<a href="#section-2.5.2.4-2" class="pilcrow">¶</a></p>
-</section>
-</div>
-<div id="to-ids-1">
-<section id="section-2.5.2.5">
-            <h5 id="name-to_ids-2">
-<a href="#section-2.5.2.5" class="section-number selfRef">2.5.2.5. </a><a href="#name-to_ids-2" class="section-name selfRef">to_ids</a>
-            </h5>
-<p id="section-2.5.2.5-1">to_ids represents whether the Attribute to be created if the ShadowAttribute is accepted is meant to be actionable. Actionable defined attributes that can be used in automated processes as a pattern for detection in Local or Network Intrusion Detection System, log analysis tools or even filtering mechanisms.<a href="#section-2.5.2.5-1" class="pilcrow">¶</a></p>
-<p id="section-2.5.2.5-2">to_ids is represented as a JSON boolean. to_ids <span class="bcp14">MUST</span> be present.<a href="#section-2.5.2.5-2" class="pilcrow">¶</a></p>
-</section>
-</div>
-<div id="event-id-1">
-<section id="section-2.5.2.6">
-            <h5 id="name-event_id-2">
-<a href="#section-2.5.2.6" class="section-number selfRef">2.5.2.6. </a><a href="#name-event_id-2" class="section-name selfRef">event_id</a>
-            </h5>
-<p id="section-2.5.2.6-1">event_id represents a human-readable identifier referencing the Event object that the ShadowAttribute belongs to.<a href="#section-2.5.2.6-1" class="pilcrow">¶</a></p>
-<p id="section-2.5.2.6-2">The event_id <span class="bcp14">SHOULD</span> be updated when the event is imported to reflect the newly created event's id on the instance.<a href="#section-2.5.2.6-2" class="pilcrow">¶</a></p>
-<p id="section-2.5.2.6-3">event_id is represented as a JSON string. event_id <span class="bcp14">MUST</span> be present.<a href="#section-2.5.2.6-3" class="pilcrow">¶</a></p>
-</section>
-</div>
-<div id="old-id">
-<section id="section-2.5.2.7">
-            <h5 id="name-old_id">
-<a href="#section-2.5.2.7" class="section-number selfRef">2.5.2.7. </a><a href="#name-old_id" class="section-name selfRef">old_id</a>
-            </h5>
-<p id="section-2.5.2.7-1">old_id represents a human-readable identifier referencing the Attribute object that the ShadowAttribute belongs to. A ShadowAttribute can this way target an existing Attribute, implying that it is a proposal to modify an existing Attribute, or alternatively it can be a proposal to create a new Attribute for the containing Event.<a href="#section-2.5.2.7-1" class="pilcrow">¶</a></p>
-<p id="section-2.5.2.7-2">The old_id <span class="bcp14">SHOULD</span> be updated when the event is imported to reflect the newly created Attribute's id on the instance. Alternatively, if the ShadowAttribute proposes the creation of a new Attribute, it should be set to 0.<a href="#section-2.5.2.7-2" class="pilcrow">¶</a></p>
-<p id="section-2.5.2.7-3">old_id is represented as a JSON string. old_id <span class="bcp14">MUST</span> be present.<a href="#section-2.5.2.7-3" class="pilcrow">¶</a></p>
-</section>
-</div>
-<div id="timestamp-2">
-<section id="section-2.5.2.8">
-            <h5 id="name-timestamp-3">
-<a href="#section-2.5.2.8" class="section-number selfRef">2.5.2.8. </a><a href="#name-timestamp-3" class="section-name selfRef">timestamp</a>
-            </h5>
-<p id="section-2.5.2.8-1">timestamp represents a reference time when the attribute was created or last modified. timestamp is expressed in seconds (decimal) since 1st of January 1970 (Unix timestamp). The time zone <span class="bcp14">MUST</span> be UTC.<a href="#section-2.5.2.8-1" class="pilcrow">¶</a></p>
-<p id="section-2.5.2.8-2">timestamp is represented as a JSON string. timestamp <span class="bcp14">MUST</span> be present.<a href="#section-2.5.2.8-2" class="pilcrow">¶</a></p>
-</section>
-</div>
-<div id="comment-1">
-<section id="section-2.5.2.9">
-            <h5 id="name-comment-2">
-<a href="#section-2.5.2.9" class="section-number selfRef">2.5.2.9. </a><a href="#name-comment-2" class="section-name selfRef">comment</a>
-            </h5>
-<p id="section-2.5.2.9-1">comment is a contextual comment field.<a href="#section-2.5.2.9-1" class="pilcrow">¶</a></p>
-<p id="section-2.5.2.9-2">comment is represented by a JSON string. comment <span class="bcp14">MAY</span> be present.<a href="#section-2.5.2.9-2" class="pilcrow">¶</a></p>
-</section>
-</div>
 <div id="org-id-1">
-<section id="section-2.5.2.10">
+<section id="section-2.4.2.10">
             <h5 id="name-org_id-2">
-<a href="#section-2.5.2.10" class="section-number selfRef">2.5.2.10. </a><a href="#name-org_id-2" class="section-name selfRef">org_id</a>
+<a href="#section-2.4.2.10" class="section-number selfRef">2.4.2.10. </a><a href="#name-org_id-2" class="section-name selfRef">org_id</a>
             </h5>
-<p id="section-2.5.2.10-1">org_id represents a human-readable identifier referencing the proposal creator's Organisation object. A human-readable identifier <span class="bcp14">MUST</span> be represented as an unsigned integer.<a href="#section-2.5.2.10-1" class="pilcrow">¶</a></p>
-<p id="section-2.5.2.10-2">Whilst attributes can only be created by the event creator organisation, shadow attributes can be created by third parties. org_id tracks the creator organisation.<a href="#section-2.5.2.10-2" class="pilcrow">¶</a></p>
-<p id="section-2.5.2.10-3">org_id is represented by a JSON string and <span class="bcp14">MUST</span> be present.<a href="#section-2.5.2.10-3" class="pilcrow">¶</a></p>
+<p id="section-2.4.2.10-1">org_id represents a human-readable identifier referencing the proposal creator's Organisation object. A human-readable identifier <span class="bcp14">MUST</span> be represented as an unsigned integer.<a href="#section-2.4.2.10-1" class="pilcrow">¶</a></p>
+<p id="section-2.4.2.10-2">Whilst attributes can only be created by the event creator organisation, shadow attributes can be created by third parties. org_id tracks the creator organisation.<a href="#section-2.4.2.10-2" class="pilcrow">¶</a></p>
+<p id="section-2.4.2.10-3">org_id is represented by a JSON string and <span class="bcp14">MUST</span> be present.<a href="#section-2.4.2.10-3" class="pilcrow">¶</a></p>
 </section>
 </div>
 <div id="proposal-to-delete">
-<section id="section-2.5.2.11">
+<section id="section-2.4.2.11">
             <h5 id="name-proposal_to_delete">
-<a href="#section-2.5.2.11" class="section-number selfRef">2.5.2.11. </a><a href="#name-proposal_to_delete" class="section-name selfRef">proposal_to_delete</a>
+<a href="#section-2.4.2.11" class="section-number selfRef">2.4.2.11. </a><a href="#name-proposal_to_delete" class="section-name selfRef">proposal_to_delete</a>
             </h5>
-<p id="section-2.5.2.11-1">proposal_to_delete is a boolean flag that sets whether the shadow attribute proposes to alter an attribute, or whether it proposes to remove it completely.<a href="#section-2.5.2.11-1" class="pilcrow">¶</a></p>
-<p id="section-2.5.2.11-2">Accepting a shadow attribute with this flag set will remove the target attribute.<a href="#section-2.5.2.11-2" class="pilcrow">¶</a></p>
-<p id="section-2.5.2.11-3">proposal_to_delete is a JSON boolean and it <span class="bcp14">MUST</span> be present. If proposal_to_delete is set to true, old_id <span class="bcp14">MUST NOT</span> be 0.<a href="#section-2.5.2.11-3" class="pilcrow">¶</a></p>
+<p id="section-2.4.2.11-1">proposal_to_delete is a boolean flag that sets whether the shadow attribute proposes to alter an attribute, or whether it proposes to remove it completely.<a href="#section-2.4.2.11-1" class="pilcrow">¶</a></p>
+<p id="section-2.4.2.11-2">Accepting a shadow attribute with this flag set will remove the target attribute.<a href="#section-2.4.2.11-2" class="pilcrow">¶</a></p>
+<p id="section-2.4.2.11-3">proposal_to_delete is a JSON boolean and it <span class="bcp14">MUST</span> be present. If proposal_to_delete is set to true, old_id <span class="bcp14">MUST NOT</span> be 0.<a href="#section-2.4.2.11-3" class="pilcrow">¶</a></p>
 </section>
 </div>
 <div id="deleted-1">
-<section id="section-2.5.2.12">
+<section id="section-2.4.2.12">
             <h5 id="name-deleted-2">
-<a href="#section-2.5.2.12" class="section-number selfRef">2.5.2.12. </a><a href="#name-deleted-2" class="section-name selfRef">deleted</a>
+<a href="#section-2.4.2.12" class="section-number selfRef">2.4.2.12. </a><a href="#name-deleted-2" class="section-name selfRef">deleted</a>
             </h5>
-<p id="section-2.5.2.12-1">deleted represents a setting that allows shadow attributes to be revoked. Revoked shadow attributes only serve to inform other instances that the shadow attribute is no longer active.<a href="#section-2.5.2.12-1" class="pilcrow">¶</a></p>
-<p id="section-2.5.2.12-2">deleted is represented by a JSON boolean. deleted <span class="bcp14">SHOULD</span> be present.<a href="#section-2.5.2.12-2" class="pilcrow">¶</a></p>
+<p id="section-2.4.2.12-1">deleted represents a setting that allows shadow attributes to be revoked. Revoked shadow attributes only serve to inform other instances that the shadow attribute is no longer active.<a href="#section-2.4.2.12-1" class="pilcrow">¶</a></p>
+<p id="section-2.4.2.12-2">deleted is represented by a JSON boolean. deleted <span class="bcp14">SHOULD</span> be present.<a href="#section-2.4.2.12-2" class="pilcrow">¶</a></p>
 </section>
 </div>
 <div id="data-1">
-<section id="section-2.5.2.13">
+<section id="section-2.4.2.13">
             <h5 id="name-data-2">
-<a href="#section-2.5.2.13" class="section-number selfRef">2.5.2.13. </a><a href="#name-data-2" class="section-name selfRef">data</a>
+<a href="#section-2.4.2.13" class="section-number selfRef">2.4.2.13. </a><a href="#name-data-2" class="section-name selfRef">data</a>
             </h5>
-<p id="section-2.5.2.13-1">data contains the base64 encoded contents of an attachment or a malware sample. For malware samples,
-the sample <span class="bcp14">MUST</span> be encrypted using a password protected zip archive, with the password being "infected".<a href="#section-2.5.2.13-1" class="pilcrow">¶</a></p>
-<p id="section-2.5.2.13-2">data is represented by a JSON string in base64 encoding. data <span class="bcp14">MUST</span> be set for shadow attributes of type malware-sample and attachment.<a href="#section-2.5.2.13-2" class="pilcrow">¶</a></p>
+<p id="section-2.4.2.13-1">data contains the base64 encoded contents of an attachment or a malware sample. For malware samples,
+the sample <span class="bcp14">MUST</span> be encrypted using a password protected zip archive, with the password being "infected".<a href="#section-2.4.2.13-1" class="pilcrow">¶</a></p>
+<p id="section-2.4.2.13-2">data is represented by a JSON string in base64 encoding. data <span class="bcp14">MUST</span> be set for shadow attributes of type malware-sample and attachment.<a href="#section-2.4.2.13-2" class="pilcrow">¶</a></p>
 </section>
 </div>
 <div id="first-seen-1">
-<section id="section-2.5.2.14">
+<section id="section-2.4.2.14">
             <h5 id="name-first_seen-2">
-<a href="#section-2.5.2.14" class="section-number selfRef">2.5.2.14. </a><a href="#name-first_seen-2" class="section-name selfRef">first_seen</a>
+<a href="#section-2.4.2.14" class="section-number selfRef">2.4.2.14. </a><a href="#name-first_seen-2" class="section-name selfRef">first_seen</a>
             </h5>
-<p id="section-2.5.2.14-1">first<em>seen represents a reference time when the attribute was first seen. first</em>seen as an ISO 8601 datetime up to the micro-second with time zone support.<a href="#section-2.5.2.14-1" class="pilcrow">¶</a></p>
-<p id="section-2.5.2.14-2">first<em>seen is represented as a JSON string. first</em>seen <span class="bcp14">MAY</span> be present.<a href="#section-2.5.2.14-2" class="pilcrow">¶</a></p>
+<p id="section-2.4.2.14-1">first_seen represents a reference time when the attribute was first seen. first_seen as an ISO 8601 datetime up to the micro-second with time zone support.<a href="#section-2.4.2.14-1" class="pilcrow">¶</a></p>
+<p id="section-2.4.2.14-2">first_seen is represented as a JSON string. first_seen <span class="bcp14">MAY</span> be present.<a href="#section-2.4.2.14-2" class="pilcrow">¶</a></p>
 </section>
 </div>
 <div id="last-seen-1">
-<section id="section-2.5.2.15">
+<section id="section-2.4.2.15">
             <h5 id="name-last_seen-2">
-<a href="#section-2.5.2.15" class="section-number selfRef">2.5.2.15. </a><a href="#name-last_seen-2" class="section-name selfRef">last_seen</a>
+<a href="#section-2.4.2.15" class="section-number selfRef">2.4.2.15. </a><a href="#name-last_seen-2" class="section-name selfRef">last_seen</a>
             </h5>
-<p id="section-2.5.2.15-1">last<em>seen represents a reference time when the attribute was last seen. last</em>seen as an ISO 8601 datetime up to the micro-second with time zone support.<a href="#section-2.5.2.15-1" class="pilcrow">¶</a></p>
-<p id="section-2.5.2.15-2">last<em>seen is represented as a JSON string. last</em>seen <span class="bcp14">MAY</span> be present.<a href="#section-2.5.2.15-2" class="pilcrow">¶</a></p>
+<p id="section-2.4.2.15-1">last_seen represents a reference time when the attribute was last seen. last_seen as an ISO 8601 datetime up to the micro-second with time zone support.<a href="#section-2.4.2.15-1" class="pilcrow">¶</a></p>
+<p id="section-2.4.2.15-2">last_seen is represented as a JSON string. last_seen <span class="bcp14">MAY</span> be present.<a href="#section-2.4.2.15-2" class="pilcrow">¶</a></p>
+</section>
+</div>
+<div id="value-1">
+<section id="section-2.4.2.16">
+            <h5 id="name-value-2">
+<a href="#section-2.4.2.16" class="section-number selfRef">2.4.2.16. </a><a href="#name-value-2" class="section-name selfRef">value</a>
+            </h5>
+<p id="section-2.4.2.16-1">value represents the payload of an attribute. The format of the value is dependent on the type of the attribute.<a href="#section-2.4.2.16-1" class="pilcrow">¶</a></p>
+<p id="section-2.4.2.16-2">value is represented by a JSON string. value <span class="bcp14">MUST</span> be present.<a href="#section-2.4.2.16-2" class="pilcrow">¶</a></p>
 </section>
 </div>
 </section>
 </div>
-<div id="org-1">
-<section id="section-2.5.3">
-          <h4 id="name-org-2">
-<a href="#section-2.5.3" class="section-number selfRef">2.5.3. </a><a href="#name-org-2" class="section-name selfRef">Org</a>
+<div id="shadowattribute-objects">
+<section id="section-2.4.3">
+          <h4 id="name-shadowattribute-objects">
+<a href="#section-2.4.3" class="section-number selfRef">2.4.3. </a><a href="#name-shadowattribute-objects" class="section-name selfRef">ShadowAttribute Objects</a>
           </h4>
-<p id="section-2.5.3-1">An Org object is composed of an uuid, name and id.<a href="#section-2.5.3-1" class="pilcrow">¶</a></p>
-<p id="section-2.5.3-2">The uuid represents the Universally Unique IDentifier (UUID) <span>[<a href="#RFC4122" class="xref">RFC4122</a>]</span> of the organization.
-The organization UUID is globally assigned to an organization and <span class="bcp14">SHALL</span> be kept overtime.<a href="#section-2.5.3-2" class="pilcrow">¶</a></p>
-<p id="section-2.5.3-3">The name is a readable description of the organization and <span class="bcp14">SHOULD</span> be present.
-The id is a human-readable identifier generated by the instance and used as reference in the event.
-A human-readable identifier <span class="bcp14">MUST</span> be represented as an unsigned integer.<a href="#section-2.5.3-3" class="pilcrow">¶</a></p>
-<p id="section-2.5.3-4">uuid, name and id are represented as a JSON string. uuid, name and id <span class="bcp14">MUST</span> be present.<a href="#section-2.5.3-4" class="pilcrow">¶</a></p>
-<div id="sample-org-object-1">
-<section id="section-2.5.3.1">
-            <h5 id="name-sample-org-object-2">
-<a href="#section-2.5.3.1" class="section-number selfRef">2.5.3.1. </a><a href="#name-sample-org-object-2" class="section-name selfRef">Sample Org Object</a>
+<div id="org-1">
+<section id="section-2.4.3.1">
+            <h5 id="name-org-2">
+<a href="#section-2.4.3.1" class="section-number selfRef">2.4.3.1. </a><a href="#name-org-2" class="section-name selfRef">Org</a>
             </h5>
-<div class="artwork art-text alignLeft" id="section-2.5.3.1-1">
+<p id="section-2.4.3.1-1">An Org object is composed of an uuid, name and id.<a href="#section-2.4.3.1-1" class="pilcrow">¶</a></p>
+<p id="section-2.4.3.1-2">The uuid represents the Universally Unique IDentifier (UUID) <span>[<a href="#RFC4122" class="xref">RFC4122</a>]</span> of the organization.
+The organization UUID is globally assigned to an organization and <span class="bcp14">SHALL</span> be kept overtime.<a href="#section-2.4.3.1-2" class="pilcrow">¶</a></p>
+<p id="section-2.4.3.1-3">The name is a readable description of the organization and <span class="bcp14">SHOULD</span> be present.
+The id is a human-readable identifier generated by the instance and used as reference in the event.
+A human-readable identifier <span class="bcp14">MUST</span> be represented as an unsigned integer.<a href="#section-2.4.3.1-3" class="pilcrow">¶</a></p>
+<p id="section-2.4.3.1-4">uuid, name and id are represented as a JSON string. uuid, name and id <span class="bcp14">MUST</span> be present.<a href="#section-2.4.3.1-4" class="pilcrow">¶</a></p>
+<div id="sample-org-object-1">
+<section id="section-2.4.3.1.1">
+              <h6 id="name-sample-org-object-2">
+<a href="#section-2.4.3.1.1" class="section-number selfRef">2.4.3.1.1. </a><a href="#name-sample-org-object-2" class="section-name selfRef">Sample Org Object</a>
+              </h6>
+<div class="alignLeft art-text artwork" id="section-2.4.3.1.1-1">
 <pre>"Org": {
         "id": "2",
         "name": "CIRCL",
         "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"
        }
-</pre><a href="#section-2.5.3.1-1" class="pilcrow">¶</a>
+</pre><a href="#section-2.4.3.1.1-1" class="pilcrow">¶</a>
 </div>
 </section>
 </div>
-<div id="value-1">
-<section id="section-2.5.3.2">
-            <h5 id="name-value-2">
-<a href="#section-2.5.3.2" class="section-number selfRef">2.5.3.2. </a><a href="#name-value-2" class="section-name selfRef">value</a>
-            </h5>
-<p id="section-2.5.3.2-1">value represents the payload of an attribute. The format of the value is dependent on the type of the attribute.<a href="#section-2.5.3.2-1" class="pilcrow">¶</a></p>
-<p id="section-2.5.3.2-2">value is represented by a JSON string. value <span class="bcp14">MUST</span> be present.<a href="#section-2.5.3.2-2" class="pilcrow">¶</a></p>
 </section>
 </div>
 </section>
@@ -2349,21 +2353,21 @@ A human-readable identifier <span class="bcp14">MUST</span> be represented as an
 </section>
 </div>
 <div id="object">
-<section id="section-2.6">
+<section id="section-2.5">
         <h3 id="name-object">
-<a href="#section-2.6" class="section-number selfRef">2.6. </a><a href="#name-object" class="section-name selfRef">Object</a>
+<a href="#section-2.5" class="section-number selfRef">2.5. </a><a href="#name-object" class="section-name selfRef">Object</a>
         </h3>
-<p id="section-2.6-1">Objects serve as a contextual bond between a list of attributes within an event. Their main purpose is to describe more complex structures than can be described by a single attribute
-Each object is created using an Object Template and carries the meta-data of the template used for its creation within. Objects belong to a meta-category and are defined by a name.<a href="#section-2.6-1" class="pilcrow">¶</a></p>
-<p id="section-2.6-2">The schema used is described by the template<em>uuid and template</em>version fields.<a href="#section-2.6-2" class="pilcrow">¶</a></p>
-<p id="section-2.6-3">A MISP document containing an Object <span class="bcp14">MUST</span> contain a name, a meta-category, a description, a template<em>uuid and a template</em>version as described in the "Object Attributes" section.<a href="#section-2.6-3" class="pilcrow">¶</a></p>
+<p id="section-2.5-1">Objects serve as a contextual bond between a list of attributes within an event. Their main purpose is to describe more complex structures than can be described by a single attribute
+Each object is created using an Object Template and carries the meta-data of the template used for its creation within. Objects belong to a meta-category and are defined by a name.<a href="#section-2.5-1" class="pilcrow">¶</a></p>
+<p id="section-2.5-2">The schema used is described by the template_uuid and template_version fields.<a href="#section-2.5-2" class="pilcrow">¶</a></p>
+<p id="section-2.5-3">A MISP document containing an Object <span class="bcp14">MUST</span> contain a name, a meta-category, a description, a template_uuid and a template_version as described in the "Object Attributes" section.<a href="#section-2.5-3" class="pilcrow">¶</a></p>
 <div id="sample-object">
-<section id="section-2.6.1">
+<section id="section-2.5.1">
           <h4 id="name-sample-object">
-<a href="#section-2.6.1" class="section-number selfRef">2.6.1. </a><a href="#name-sample-object" class="section-name selfRef">Sample Object</a>
+<a href="#section-2.5.1" class="section-number selfRef">2.5.1. </a><a href="#name-sample-object" class="section-name selfRef">Sample Object</a>
           </h4>
 <div id="fig-sample-object">
-<div class="artwork art-text alignLeft" id="section-2.6.1-1">
+<div class="alignLeft art-text artwork" id="section-2.5.1-1">
 <pre>"Object": {
    "id": "588",
    "name": "file",
@@ -2404,184 +2408,185 @@ Each object is created using an Object Template and carries the meta-data of the
      "last_seen": null
    ]
 }
-</pre><a href="#section-2.6.1-1" class="pilcrow">¶</a>
+</pre><a href="#section-2.5.1-1" class="pilcrow">¶</a>
 </div>
 </div>
 </section>
 </div>
 <div id="object-attributes">
-<section id="section-2.6.2">
+<section id="section-2.5.2">
           <h4 id="name-object-attributes">
-<a href="#section-2.6.2" class="section-number selfRef">2.6.2. </a><a href="#name-object-attributes" class="section-name selfRef">Object Attributes</a>
+<a href="#section-2.5.2" class="section-number selfRef">2.5.2. </a><a href="#name-object-attributes" class="section-name selfRef">Object Attributes</a>
           </h4>
 <div id="uuid-3">
-<section id="section-2.6.2.1">
+<section id="section-2.5.2.1">
             <h5 id="name-uuid-4">
-<a href="#section-2.6.2.1" class="section-number selfRef">2.6.2.1. </a><a href="#name-uuid-4" class="section-name selfRef">uuid</a>
+<a href="#section-2.5.2.1" class="section-number selfRef">2.5.2.1. </a><a href="#name-uuid-4" class="section-name selfRef">uuid</a>
             </h5>
-<p id="section-2.6.2.1-1">uuid represents the Universally Unique IDentifier (UUID) <span>[<a href="#RFC4122" class="xref">RFC4122</a>]</span> of the object. The uuid <span class="bcp14">MUST</span> be preserved
-for any updates or transfer of the same object. UUID version 4 is <span class="bcp14">RECOMMENDED</span> when assigning it to a new object.<a href="#section-2.6.2.1-1" class="pilcrow">¶</a></p>
+<p id="section-2.5.2.1-1">uuid represents the Universally Unique IDentifier (UUID) <span>[<a href="#RFC4122" class="xref">RFC4122</a>]</span> of the object. The uuid <span class="bcp14">MUST</span> be preserved
+for any updates or transfer of the same object. UUID version 4 is <span class="bcp14">RECOMMENDED</span> when assigning it to a new object.<a href="#section-2.5.2.1-1" class="pilcrow">¶</a></p>
 </section>
 </div>
 <div id="id-3">
-<section id="section-2.6.2.2">
+<section id="section-2.5.2.2">
             <h5 id="name-id-4">
-<a href="#section-2.6.2.2" class="section-number selfRef">2.6.2.2. </a><a href="#name-id-4" class="section-name selfRef">id</a>
+<a href="#section-2.5.2.2" class="section-number selfRef">2.5.2.2. </a><a href="#name-id-4" class="section-name selfRef">id</a>
             </h5>
-<p id="section-2.6.2.2-1">id represents the human-readable identifier associated to the object for a specific MISP instance. A human-readable identifier <span class="bcp14">MUST</span> be
-represented as an unsigned integer.<a href="#section-2.6.2.2-1" class="pilcrow">¶</a></p>
-<p id="section-2.6.2.2-2">id is represented as a JSON string. id <span class="bcp14">SHALL</span> be present.<a href="#section-2.6.2.2-2" class="pilcrow">¶</a></p>
+<p id="section-2.5.2.2-1">id represents the human-readable identifier associated to the object for a specific MISP instance. A human-readable identifier <span class="bcp14">MUST</span> be
+represented as an unsigned integer.<a href="#section-2.5.2.2-1" class="pilcrow">¶</a></p>
+<p id="section-2.5.2.2-2">id is represented as a JSON string. id <span class="bcp14">SHALL</span> be present.<a href="#section-2.5.2.2-2" class="pilcrow">¶</a></p>
 </section>
 </div>
 <div id="name">
-<section id="section-2.6.2.3">
+<section id="section-2.5.2.3">
             <h5 id="name-name">
-<a href="#section-2.6.2.3" class="section-number selfRef">2.6.2.3. </a><a href="#name-name" class="section-name selfRef">name</a>
+<a href="#section-2.5.2.3" class="section-number selfRef">2.5.2.3. </a><a href="#name-name" class="section-name selfRef">name</a>
             </h5>
-<p id="section-2.6.2.3-1">name represents the human-readable name of the object describing the intent of the object package.<a href="#section-2.6.2.3-1" class="pilcrow">¶</a></p>
-<p id="section-2.6.2.3-2">name is represented as a JSON string. name <span class="bcp14">MUST</span> be present<a href="#section-2.6.2.3-2" class="pilcrow">¶</a></p>
+<p id="section-2.5.2.3-1">name represents the human-readable name of the object describing the intent of the object package.<a href="#section-2.5.2.3-1" class="pilcrow">¶</a></p>
+<p id="section-2.5.2.3-2">name is represented as a JSON string. name <span class="bcp14">MUST</span> be present.<a href="#section-2.5.2.3-2" class="pilcrow">¶</a></p>
 </section>
 </div>
 <div id="meta-category">
-<section id="section-2.6.2.4">
+<section id="section-2.5.2.4">
             <h5 id="name-meta-category">
-<a href="#section-2.6.2.4" class="section-number selfRef">2.6.2.4. </a><a href="#name-meta-category" class="section-name selfRef">meta-category</a>
+<a href="#section-2.5.2.4" class="section-number selfRef">2.5.2.4. </a><a href="#name-meta-category" class="section-name selfRef">meta-category</a>
             </h5>
-<p id="section-2.6.2.4-1">meta-category represents the sub-category of objects that the given object belongs to. meta-categories are not
-tied to a fixed list of options but can be created on the fly.<a href="#section-2.6.2.4-1" class="pilcrow">¶</a></p>
-<p id="section-2.6.2.4-2">meta-category is represented as a JSON string. meta-category <span class="bcp14">MUST</span> be present<a href="#section-2.6.2.4-2" class="pilcrow">¶</a></p>
+<p id="section-2.5.2.4-1">meta-category represents the sub-category of objects that the given object belongs to. meta-categories are not
+tied to a fixed list of options but can be created on the fly.<a href="#section-2.5.2.4-1" class="pilcrow">¶</a></p>
+<p id="section-2.5.2.4-2">meta-category is represented as a JSON string. meta-category <span class="bcp14">MUST</span> be present.<a href="#section-2.5.2.4-2" class="pilcrow">¶</a></p>
 </section>
 </div>
 <div id="description">
-<section id="section-2.6.2.5">
+<section id="section-2.5.2.5">
             <h5 id="name-description">
-<a href="#section-2.6.2.5" class="section-number selfRef">2.6.2.5. </a><a href="#name-description" class="section-name selfRef">description</a>
+<a href="#section-2.5.2.5" class="section-number selfRef">2.5.2.5. </a><a href="#name-description" class="section-name selfRef">description</a>
             </h5>
-<p id="section-2.6.2.5-1">description is a human-readable description of the given object type, as derived from the template used for creation.<a href="#section-2.6.2.5-1" class="pilcrow">¶</a></p>
-<p id="section-2.6.2.5-2">description is represented as a JSON string. id <span class="bcp14">SHALL</span> be present.<a href="#section-2.6.2.5-2" class="pilcrow">¶</a></p>
+<p id="section-2.5.2.5-1">description is a human-readable description of the given object type, as derived from the template used for creation.<a href="#section-2.5.2.5-1" class="pilcrow">¶</a></p>
+<p id="section-2.5.2.5-2">description is represented as a JSON string. description <span class="bcp14">SHALL</span> be present.<a href="#section-2.5.2.5-2" class="pilcrow">¶</a></p>
 </section>
 </div>
 <div id="template-uuid">
-<section id="section-2.6.2.6">
+<section id="section-2.5.2.6">
             <h5 id="name-template_uuid">
-<a href="#section-2.6.2.6" class="section-number selfRef">2.6.2.6. </a><a href="#name-template_uuid" class="section-name selfRef">template_uuid</a>
+<a href="#section-2.5.2.6" class="section-number selfRef">2.5.2.6. </a><a href="#name-template_uuid" class="section-name selfRef">template_uuid</a>
             </h5>
-<p id="section-2.6.2.6-1">uuid represents the Universally Unique IDentifier (UUID) <span>[<a href="#RFC4122" class="xref">RFC4122</a>]</span> of the template used to create the object. The uuid <span class="bcp14">MUST</span> be preserved
-to preserve the object's association with the correct template used for creation. UUID version 4 is <span class="bcp14">RECOMMENDED</span> when assigning it to a new object.<a href="#section-2.6.2.6-1" class="pilcrow">¶</a></p>
+<p id="section-2.5.2.6-1">template_uuid represents the Universally Unique IDentifier (UUID) <span>[<a href="#RFC4122" class="xref">RFC4122</a>]</span> of the template used to create the object. The uuid <span class="bcp14">MUST</span> be preserved
+to preserve the object's association with the correct template used for creation. UUID version 4 is <span class="bcp14">RECOMMENDED</span> when assigning it to a new object.<a href="#section-2.5.2.6-1" class="pilcrow">¶</a></p>
+<p id="section-2.5.2.6-2">template_uuid is represented as a JSON string. template_uuid <span class="bcp14">MUST</span> be present.<a href="#section-2.5.2.6-2" class="pilcrow">¶</a></p>
 </section>
 </div>
 <div id="template-version">
-<section id="section-2.6.2.7">
+<section id="section-2.5.2.7">
             <h5 id="name-template_version">
-<a href="#section-2.6.2.7" class="section-number selfRef">2.6.2.7. </a><a href="#name-template_version" class="section-name selfRef">template_version</a>
+<a href="#section-2.5.2.7" class="section-number selfRef">2.5.2.7. </a><a href="#name-template_version" class="section-name selfRef">template_version</a>
             </h5>
-<p id="section-2.6.2.7-1">template<em>version represents a numeric incrementing version of the template used to create the object. It is used to associate the object to the
-correct version of the template and together with the template</em>uuid forms an association to the correct template type and version.<a href="#section-2.6.2.7-1" class="pilcrow">¶</a></p>
-<p id="section-2.6.2.7-2">version is represented as a JSON string. version <span class="bcp14">MUST</span> be present.<a href="#section-2.6.2.7-2" class="pilcrow">¶</a></p>
+<p id="section-2.5.2.7-1">template_version represents a numeric incrementing version of the template used to create the object. It is used to associate the object to the
+correct version of the template and together with the template_uuid forms an association to the correct template type and version.<a href="#section-2.5.2.7-1" class="pilcrow">¶</a></p>
+<p id="section-2.5.2.7-2">template_version is represented as a JSON string. template_version <span class="bcp14">MUST</span> be present.<a href="#section-2.5.2.7-2" class="pilcrow">¶</a></p>
 </section>
 </div>
 <div id="event-id-2">
-<section id="section-2.6.2.8">
+<section id="section-2.5.2.8">
             <h5 id="name-event_id-3">
-<a href="#section-2.6.2.8" class="section-number selfRef">2.6.2.8. </a><a href="#name-event_id-3" class="section-name selfRef">event_id</a>
+<a href="#section-2.5.2.8" class="section-number selfRef">2.5.2.8. </a><a href="#name-event_id-3" class="section-name selfRef">event_id</a>
             </h5>
-<p id="section-2.6.2.8-1">event_id represents the human-readable identifier of the event that the object belongs to on a specific MISP instance. A human-readable identifier <span class="bcp14">MUST</span> be
-represented as an unsigned integer.<a href="#section-2.6.2.8-1" class="pilcrow">¶</a></p>
-<p id="section-2.6.2.8-2">event<em>id is represented as a JSON string. event</em>id <span class="bcp14">SHALL</span> be present.<a href="#section-2.6.2.8-2" class="pilcrow">¶</a></p>
+<p id="section-2.5.2.8-1">event_id represents the human-readable identifier of the event that the object belongs to on a specific MISP instance. A human-readable identifier <span class="bcp14">MUST</span> be
+represented as an unsigned integer.<a href="#section-2.5.2.8-1" class="pilcrow">¶</a></p>
+<p id="section-2.5.2.8-2">event_id is represented as a JSON string. event_id <span class="bcp14">SHALL</span> be present.<a href="#section-2.5.2.8-2" class="pilcrow">¶</a></p>
 </section>
 </div>
 <div id="timestamp-3">
-<section id="section-2.6.2.9">
+<section id="section-2.5.2.9">
             <h5 id="name-timestamp-4">
-<a href="#section-2.6.2.9" class="section-number selfRef">2.6.2.9. </a><a href="#name-timestamp-4" class="section-name selfRef">timestamp</a>
+<a href="#section-2.5.2.9" class="section-number selfRef">2.5.2.9. </a><a href="#name-timestamp-4" class="section-name selfRef">timestamp</a>
             </h5>
-<p id="section-2.6.2.9-1">timestamp represents a reference time when the object was created or last modified. timestamp is expressed in seconds (decimal) since 1st of January 1970 (Unix timestamp). The time zone <span class="bcp14">MUST</span> be UTC.<a href="#section-2.6.2.9-1" class="pilcrow">¶</a></p>
-<p id="section-2.6.2.9-2">timestamp is represented as a JSON string. timestamp <span class="bcp14">MUST</span> be present.<a href="#section-2.6.2.9-2" class="pilcrow">¶</a></p>
+<p id="section-2.5.2.9-1">timestamp represents a reference time when the object was created or last modified. timestamp is expressed in seconds (decimal) since 1st of January 1970 (Unix timestamp). The time zone <span class="bcp14">MUST</span> be UTC.<a href="#section-2.5.2.9-1" class="pilcrow">¶</a></p>
+<p id="section-2.5.2.9-2">timestamp is represented as a JSON string. timestamp <span class="bcp14">MUST</span> be present.<a href="#section-2.5.2.9-2" class="pilcrow">¶</a></p>
 </section>
 </div>
 <div id="distribution-2">
-<section id="section-2.6.2.10">
+<section id="section-2.5.2.10">
             <h5 id="name-distribution-3">
-<a href="#section-2.6.2.10" class="section-number selfRef">2.6.2.10. </a><a href="#name-distribution-3" class="section-name selfRef">distribution</a>
+<a href="#section-2.5.2.10" class="section-number selfRef">2.5.2.10. </a><a href="#name-distribution-3" class="section-name selfRef">distribution</a>
             </h5>
-<p id="section-2.6.2.10-1">distribution represents the basic distribution rules of the object. The system must adhere to the distribution setting for access control and for dissemination of the object.<a href="#section-2.6.2.10-1" class="pilcrow">¶</a></p>
-<p id="section-2.6.2.10-2">distribution is represented by a JSON string. distribution <span class="bcp14">MUST</span> be present and be one of the following options:<a href="#section-2.6.2.10-2" class="pilcrow">¶</a></p>
-<span class="break"></span><dl class="dlParallel" id="section-2.6.2.10-3">
-              <dt id="section-2.6.2.10-3.1">0</dt>
-              <dd style="margin-left: 1.5em" id="section-2.6.2.10-3.2">Your Organisation Only<a href="#section-2.6.2.10-3.2" class="pilcrow">¶</a>
+<p id="section-2.5.2.10-1">distribution represents the basic distribution rules of the object. The system must adhere to the distribution setting for access control and for dissemination of the object.<a href="#section-2.5.2.10-1" class="pilcrow">¶</a></p>
+<p id="section-2.5.2.10-2">distribution is represented by a JSON string. distribution <span class="bcp14">MUST</span> be present and be one of the following options:<a href="#section-2.5.2.10-2" class="pilcrow">¶</a></p>
+<span class="break"></span><dl class="dlCompact dlParallel" id="section-2.5.2.10-3">
+              <dt id="section-2.5.2.10-3.1">0</dt>
+              <dd style="margin-left: 1.5em" id="section-2.5.2.10-3.2">Your Organisation Only<a href="#section-2.5.2.10-3.2" class="pilcrow">¶</a>
 </dd>
               <dd class="break"></dd>
-<dt id="section-2.6.2.10-3.3">1</dt>
-              <dd style="margin-left: 1.5em" id="section-2.6.2.10-3.4">This Community Only<a href="#section-2.6.2.10-3.4" class="pilcrow">¶</a>
+<dt id="section-2.5.2.10-3.3">1</dt>
+              <dd style="margin-left: 1.5em" id="section-2.5.2.10-3.4">This Community Only<a href="#section-2.5.2.10-3.4" class="pilcrow">¶</a>
 </dd>
               <dd class="break"></dd>
-<dt id="section-2.6.2.10-3.5">2</dt>
-              <dd style="margin-left: 1.5em" id="section-2.6.2.10-3.6">Connected Communities<a href="#section-2.6.2.10-3.6" class="pilcrow">¶</a>
+<dt id="section-2.5.2.10-3.5">2</dt>
+              <dd style="margin-left: 1.5em" id="section-2.5.2.10-3.6">Connected Communities<a href="#section-2.5.2.10-3.6" class="pilcrow">¶</a>
 </dd>
               <dd class="break"></dd>
-<dt id="section-2.6.2.10-3.7">3</dt>
-              <dd style="margin-left: 1.5em" id="section-2.6.2.10-3.8">All Communities<a href="#section-2.6.2.10-3.8" class="pilcrow">¶</a>
+<dt id="section-2.5.2.10-3.7">3</dt>
+              <dd style="margin-left: 1.5em" id="section-2.5.2.10-3.8">All Communities<a href="#section-2.5.2.10-3.8" class="pilcrow">¶</a>
 </dd>
               <dd class="break"></dd>
-<dt id="section-2.6.2.10-3.9">4</dt>
-              <dd style="margin-left: 1.5em" id="section-2.6.2.10-3.10">Sharing Group<a href="#section-2.6.2.10-3.10" class="pilcrow">¶</a>
+<dt id="section-2.5.2.10-3.9">4</dt>
+              <dd style="margin-left: 1.5em" id="section-2.5.2.10-3.10">Sharing Group<a href="#section-2.5.2.10-3.10" class="pilcrow">¶</a>
 </dd>
             <dd class="break"></dd>
 </dl>
 </section>
 </div>
 <div id="sharing-group-id-2">
-<section id="section-2.6.2.11">
+<section id="section-2.5.2.11">
             <h5 id="name-sharing_group_id-3">
-<a href="#section-2.6.2.11" class="section-number selfRef">2.6.2.11. </a><a href="#name-sharing_group_id-3" class="section-name selfRef">sharing_group_id</a>
+<a href="#section-2.5.2.11" class="section-number selfRef">2.5.2.11. </a><a href="#name-sharing_group_id-3" class="section-name selfRef">sharing_group_id</a>
             </h5>
-<p id="section-2.6.2.11-1">sharing_group_id represents a human-readable identifier referencing a Sharing Group object that defines the distribution of the object, if distribution level "4" is set. A human-readable identifier <span class="bcp14">MUST</span> be represented as an unsigned integer.<a href="#section-2.6.2.11-1" class="pilcrow">¶</a></p>
-<p id="section-2.6.2.11-2">sharing_group_id is represented by a JSON string and <span class="bcp14">SHOULD</span> be present. If a distribution level other than "4" is chosen the sharing_group_id <span class="bcp14">MUST</span> be set to "0".<a href="#section-2.6.2.11-2" class="pilcrow">¶</a></p>
+<p id="section-2.5.2.11-1">sharing_group_id represents a human-readable identifier referencing a Sharing Group object that defines the distribution of the object, if distribution level "4" is set. A human-readable identifier <span class="bcp14">MUST</span> be represented as an unsigned integer.<a href="#section-2.5.2.11-1" class="pilcrow">¶</a></p>
+<p id="section-2.5.2.11-2">sharing_group_id is represented by a JSON string and <span class="bcp14">SHOULD</span> be present. If a distribution level other than "4" is chosen the sharing_group_id <span class="bcp14">MUST</span> be set to "0".<a href="#section-2.5.2.11-2" class="pilcrow">¶</a></p>
 </section>
 </div>
 <div id="comment-2">
-<section id="section-2.6.2.12">
+<section id="section-2.5.2.12">
             <h5 id="name-comment-3">
-<a href="#section-2.6.2.12" class="section-number selfRef">2.6.2.12. </a><a href="#name-comment-3" class="section-name selfRef">comment</a>
+<a href="#section-2.5.2.12" class="section-number selfRef">2.5.2.12. </a><a href="#name-comment-3" class="section-name selfRef">comment</a>
             </h5>
-<p id="section-2.6.2.12-1">comment is a contextual comment field.<a href="#section-2.6.2.12-1" class="pilcrow">¶</a></p>
-<p id="section-2.6.2.12-2">comment is represented by a JSON string. comment <span class="bcp14">MAY</span> be present.<a href="#section-2.6.2.12-2" class="pilcrow">¶</a></p>
+<p id="section-2.5.2.12-1">comment is a contextual comment field.<a href="#section-2.5.2.12-1" class="pilcrow">¶</a></p>
+<p id="section-2.5.2.12-2">comment is represented by a JSON string. comment <span class="bcp14">MAY</span> be present.<a href="#section-2.5.2.12-2" class="pilcrow">¶</a></p>
 </section>
 </div>
 <div id="deleted-2">
-<section id="section-2.6.2.13">
+<section id="section-2.5.2.13">
             <h5 id="name-deleted-3">
-<a href="#section-2.6.2.13" class="section-number selfRef">2.6.2.13. </a><a href="#name-deleted-3" class="section-name selfRef">deleted</a>
+<a href="#section-2.5.2.13" class="section-number selfRef">2.5.2.13. </a><a href="#name-deleted-3" class="section-name selfRef">deleted</a>
             </h5>
-<p id="section-2.6.2.13-1">deleted represents a setting that allows attributes to be revoked. Revoked attributes are not actionable and exist merely to inform other instances of a revocation.<a href="#section-2.6.2.13-1" class="pilcrow">¶</a></p>
-<p id="section-2.6.2.13-2">deleted is represented by a JSON boolean. deleted <span class="bcp14">MUST</span> be present.<a href="#section-2.6.2.13-2" class="pilcrow">¶</a></p>
+<p id="section-2.5.2.13-1">deleted represents a setting that allows objects to be revoked. Revoked objects are not actionable and exist merely to inform other instances of a revocation.<a href="#section-2.5.2.13-1" class="pilcrow">¶</a></p>
+<p id="section-2.5.2.13-2">deleted is represented by a JSON boolean. deleted <span class="bcp14">MUST</span> be present.<a href="#section-2.5.2.13-2" class="pilcrow">¶</a></p>
 </section>
 </div>
 <div id="attribute-1">
-<section id="section-2.6.2.14">
+<section id="section-2.5.2.14">
             <h5 id="name-attribute-2">
-<a href="#section-2.6.2.14" class="section-number selfRef">2.6.2.14. </a><a href="#name-attribute-2" class="section-name selfRef">Attribute</a>
+<a href="#section-2.5.2.14" class="section-number selfRef">2.5.2.14. </a><a href="#name-attribute-2" class="section-name selfRef">Attribute</a>
             </h5>
-<p id="section-2.6.2.14-1">Attribute is an array of attributes that describe the object with data.<a href="#section-2.6.2.14-1" class="pilcrow">¶</a></p>
-<p id="section-2.6.2.14-2">Each attribute in an object <span class="bcp14">MUST</span> contain the parent event's ID in the event<em>id field and the parent object's ID in the object</em>id field.<a href="#section-2.6.2.14-2" class="pilcrow">¶</a></p>
+<p id="section-2.5.2.14-1">Attribute is an array of attributes that describe the object with data.<a href="#section-2.5.2.14-1" class="pilcrow">¶</a></p>
+<p id="section-2.5.2.14-2">Each attribute in an object <span class="bcp14">MUST</span> contain the parent event's ID in the event_id field and the parent object's ID in the object_id field.<a href="#section-2.5.2.14-2" class="pilcrow">¶</a></p>
 </section>
 </div>
 <div id="first-seen-2">
-<section id="section-2.6.2.15">
+<section id="section-2.5.2.15">
             <h5 id="name-first_seen-3">
-<a href="#section-2.6.2.15" class="section-number selfRef">2.6.2.15. </a><a href="#name-first_seen-3" class="section-name selfRef">first_seen</a>
+<a href="#section-2.5.2.15" class="section-number selfRef">2.5.2.15. </a><a href="#name-first_seen-3" class="section-name selfRef">first_seen</a>
             </h5>
-<p id="section-2.6.2.15-1">first<em>seen represents a reference time when the object was first seen. first</em>seen as an ISO 8601 datetime up to the micro-second with time zone support.<a href="#section-2.6.2.15-1" class="pilcrow">¶</a></p>
-<p id="section-2.6.2.15-2">first<em>seen is represented as a JSON string. first</em>seen <span class="bcp14">MAY</span> be present.<a href="#section-2.6.2.15-2" class="pilcrow">¶</a></p>
+<p id="section-2.5.2.15-1">first_seen represents a reference time when the object was first seen. first_seen as an ISO 8601 datetime up to the micro-second with time zone support.<a href="#section-2.5.2.15-1" class="pilcrow">¶</a></p>
+<p id="section-2.5.2.15-2">first_seen is represented as a JSON string. first_seen <span class="bcp14">MAY</span> be present.<a href="#section-2.5.2.15-2" class="pilcrow">¶</a></p>
 </section>
 </div>
 <div id="last-seen-2">
-<section id="section-2.6.2.16">
+<section id="section-2.5.2.16">
             <h5 id="name-last_seen-3">
-<a href="#section-2.6.2.16" class="section-number selfRef">2.6.2.16. </a><a href="#name-last_seen-3" class="section-name selfRef">last_seen</a>
+<a href="#section-2.5.2.16" class="section-number selfRef">2.5.2.16. </a><a href="#name-last_seen-3" class="section-name selfRef">last_seen</a>
             </h5>
-<p id="section-2.6.2.16-1">last<em>seen represents a reference time when the object was last seen. last</em>seen as an ISO 8601 datetime up to the micro-second with time zone support.<a href="#section-2.6.2.16-1" class="pilcrow">¶</a></p>
-<p id="section-2.6.2.16-2">last<em>seen is represented as a JSON string. last</em>seen <span class="bcp14">MAY</span> be present.<a href="#section-2.6.2.16-2" class="pilcrow">¶</a></p>
+<p id="section-2.5.2.16-1">last_seen represents a reference time when the object was last seen. last_seen as an ISO 8601 datetime up to the micro-second with time zone support.<a href="#section-2.5.2.16-1" class="pilcrow">¶</a></p>
+<p id="section-2.5.2.16-2">last_seen is represented as a JSON string. last_seen <span class="bcp14">MAY</span> be present.<a href="#section-2.5.2.16-2" class="pilcrow">¶</a></p>
 </section>
 </div>
 </section>
@@ -2589,19 +2594,19 @@ represented as an unsigned integer.<a href="#section-2.6.2.8-1" class="pilcrow">
 </section>
 </div>
 <div id="object-references">
-<section id="section-2.7">
+<section id="section-2.6">
         <h3 id="name-object-references">
-<a href="#section-2.7" class="section-number selfRef">2.7. </a><a href="#name-object-references" class="section-name selfRef">Object References</a>
+<a href="#section-2.6" class="section-number selfRef">2.6. </a><a href="#name-object-references" class="section-name selfRef">Object References</a>
         </h3>
-<p id="section-2.7-1">Object References serve as a logical link between an Object and another referenced Object or Attribute. The relationship is categorised by an enumerated value from a fixed vocabulary.<a href="#section-2.7-1" class="pilcrow">¶</a></p>
-<p id="section-2.7-2">The relationship_type is recommended to be taken from the MISP object relationship list [<span>[<a href="#MISP-R" class="xref">MISP-R</a>]</span>] is <span class="bcp14">RECOMMENDED</span> to ensure a coherent naming of the tags<a href="#section-2.7-2" class="pilcrow">¶</a></p>
-<p id="section-2.7-3">All Object References <span class="bcp14">MUST</span> contain an object_uuid, a referenced_uuid and a relationship type.<a href="#section-2.7-3" class="pilcrow">¶</a></p>
+<p id="section-2.6-1">Object References serve as a logical link between an Object and another referenced Object or Attribute. The relationship is categorised by an enumerated value from a fixed vocabulary.<a href="#section-2.6-1" class="pilcrow">¶</a></p>
+<p id="section-2.6-2">The relationship_type is recommended to be taken from the MISP object relationship list [<span>[<a href="#MISP-R" class="xref">MISP-R</a>]</span>] is <span class="bcp14">RECOMMENDED</span> to ensure a coherent naming of the tags<a href="#section-2.6-2" class="pilcrow">¶</a></p>
+<p id="section-2.6-3">All Object References <span class="bcp14">MUST</span> contain an object_uuid, a referenced_uuid and a relationship type.<a href="#section-2.6-3" class="pilcrow">¶</a></p>
 <div id="sample-objectreference-object">
-<section id="section-2.7.1">
+<section id="section-2.6.1">
           <h4 id="name-sample-objectreference-obje">
-<a href="#section-2.7.1" class="section-number selfRef">2.7.1. </a><a href="#name-sample-objectreference-obje" class="section-name selfRef">Sample ObjectReference object</a>
+<a href="#section-2.6.1" class="section-number selfRef">2.6.1. </a><a href="#name-sample-objectreference-obje" class="section-name selfRef">Sample ObjectReference object</a>
           </h4>
-<div class="artwork art-text alignLeft" id="section-2.7.1-1">
+<div class="alignLeft art-text artwork" id="section-2.6.1-1">
 <pre>"ObjectReference": {
                     "id": "195",
                     "uuid": "59c21a2c-c0ac-4083-93b3-363da07724d1",
@@ -2616,123 +2621,123 @@ represented as an unsigned integer.<a href="#section-2.6.2.8-1" class="pilcrow">
                     "object_uuid": "59c1134d-8a40-4c14-ad94-0f7ba07724d1",
                     "referenced_uuid": "59c1133c-9adc-4d06-a34b-0f7ca07724d1",
                    }
-</pre><a href="#section-2.7.1-1" class="pilcrow">¶</a>
+</pre><a href="#section-2.6.1-1" class="pilcrow">¶</a>
 </div>
 </section>
 </div>
 <div id="objectreference-attributes">
-<section id="section-2.7.2">
+<section id="section-2.6.2">
           <h4 id="name-objectreference-attributes">
-<a href="#section-2.7.2" class="section-number selfRef">2.7.2. </a><a href="#name-objectreference-attributes" class="section-name selfRef">ObjectReference Attributes</a>
+<a href="#section-2.6.2" class="section-number selfRef">2.6.2. </a><a href="#name-objectreference-attributes" class="section-name selfRef">ObjectReference Attributes</a>
           </h4>
 <div id="uuid-4">
-<section id="section-2.7.2.1">
+<section id="section-2.6.2.1">
             <h5 id="name-uuid-5">
-<a href="#section-2.7.2.1" class="section-number selfRef">2.7.2.1. </a><a href="#name-uuid-5" class="section-name selfRef">uuid</a>
+<a href="#section-2.6.2.1" class="section-number selfRef">2.6.2.1. </a><a href="#name-uuid-5" class="section-name selfRef">uuid</a>
             </h5>
-<p id="section-2.7.2.1-1">uuid represents the Universally Unique IDentifier (UUID) <span>[<a href="#RFC4122" class="xref">RFC4122</a>]</span> of the object reference. The uuid <span class="bcp14">MUST</span> be preserved
-for any updates or transfer of the same object reference. UUID version 4 is <span class="bcp14">RECOMMENDED</span> when assigning it to a new object reference.<a href="#section-2.7.2.1-1" class="pilcrow">¶</a></p>
+<p id="section-2.6.2.1-1">uuid represents the Universally Unique IDentifier (UUID) <span>[<a href="#RFC4122" class="xref">RFC4122</a>]</span> of the object reference. The uuid <span class="bcp14">MUST</span> be preserved
+for any updates or transfer of the same object reference. UUID version 4 is <span class="bcp14">RECOMMENDED</span> when assigning it to a new object reference.<a href="#section-2.6.2.1-1" class="pilcrow">¶</a></p>
 </section>
 </div>
 <div id="id-4">
-<section id="section-2.7.2.2">
+<section id="section-2.6.2.2">
             <h5 id="name-id-5">
-<a href="#section-2.7.2.2" class="section-number selfRef">2.7.2.2. </a><a href="#name-id-5" class="section-name selfRef">id</a>
+<a href="#section-2.6.2.2" class="section-number selfRef">2.6.2.2. </a><a href="#name-id-5" class="section-name selfRef">id</a>
             </h5>
-<p id="section-2.7.2.2-1">id represents the human-readable identifier associated to the object reference for a specific MISP instance.<a href="#section-2.7.2.2-1" class="pilcrow">¶</a></p>
-<p id="section-2.7.2.2-2">id is represented as a JSON string. id <span class="bcp14">SHALL</span> be present.<a href="#section-2.7.2.2-2" class="pilcrow">¶</a></p>
+<p id="section-2.6.2.2-1">id represents the human-readable identifier associated to the object reference for a specific MISP instance.<a href="#section-2.6.2.2-1" class="pilcrow">¶</a></p>
+<p id="section-2.6.2.2-2">id is represented as a JSON string. id <span class="bcp14">SHALL</span> be present.<a href="#section-2.6.2.2-2" class="pilcrow">¶</a></p>
 </section>
 </div>
 <div id="timestamp-4">
-<section id="section-2.7.2.3">
+<section id="section-2.6.2.3">
             <h5 id="name-timestamp-5">
-<a href="#section-2.7.2.3" class="section-number selfRef">2.7.2.3. </a><a href="#name-timestamp-5" class="section-name selfRef">timestamp</a>
+<a href="#section-2.6.2.3" class="section-number selfRef">2.6.2.3. </a><a href="#name-timestamp-5" class="section-name selfRef">timestamp</a>
             </h5>
-<p id="section-2.7.2.3-1">timestamp represents a reference time when the object was created or last modified. timestamp is expressed in seconds (decimal) since 1st of January 1970 (Unix timestamp). The time zone <span class="bcp14">MUST</span> be UTC.<a href="#section-2.7.2.3-1" class="pilcrow">¶</a></p>
-<p id="section-2.7.2.3-2">timestamp is represented as a JSON string. timestamp <span class="bcp14">MUST</span> be present.<a href="#section-2.7.2.3-2" class="pilcrow">¶</a></p>
+<p id="section-2.6.2.3-1">timestamp represents a reference time when the object was created or last modified. timestamp is expressed in seconds (decimal) since 1st of January 1970 (Unix timestamp). The time zone <span class="bcp14">MUST</span> be UTC.<a href="#section-2.6.2.3-1" class="pilcrow">¶</a></p>
+<p id="section-2.6.2.3-2">timestamp is represented as a JSON string. timestamp <span class="bcp14">MUST</span> be present.<a href="#section-2.6.2.3-2" class="pilcrow">¶</a></p>
 </section>
 </div>
 <div id="object-id">
-<section id="section-2.7.2.4">
+<section id="section-2.6.2.4">
             <h5 id="name-object_id">
-<a href="#section-2.7.2.4" class="section-number selfRef">2.7.2.4. </a><a href="#name-object_id" class="section-name selfRef">object_id</a>
+<a href="#section-2.6.2.4" class="section-number selfRef">2.6.2.4. </a><a href="#name-object_id" class="section-name selfRef">object_id</a>
             </h5>
-<p id="section-2.7.2.4-1">object_id represents the human-readable identifier of the object that the object reference belongs to on a specific MISP instance. A human-readable identifier <span class="bcp14">MUST</span> be
-represented as an unsigned integer.<a href="#section-2.7.2.4-1" class="pilcrow">¶</a></p>
-<p id="section-2.7.2.4-2">event<em>id is represented as a JSON string. event</em>id <span class="bcp14">SHALL</span> be present.<a href="#section-2.7.2.4-2" class="pilcrow">¶</a></p>
+<p id="section-2.6.2.4-1">object_id represents the human-readable identifier of the object that the object reference belongs to on a specific MISP instance. A human-readable identifier <span class="bcp14">MUST</span> be
+represented as an unsigned integer.<a href="#section-2.6.2.4-1" class="pilcrow">¶</a></p>
+<p id="section-2.6.2.4-2">object_id is represented as a JSON string. object_id <span class="bcp14">SHALL</span> be present.<a href="#section-2.6.2.4-2" class="pilcrow">¶</a></p>
 </section>
 </div>
 <div id="event-id-3">
-<section id="section-2.7.2.5">
+<section id="section-2.6.2.5">
             <h5 id="name-event_id-4">
-<a href="#section-2.7.2.5" class="section-number selfRef">2.7.2.5. </a><a href="#name-event_id-4" class="section-name selfRef">event_id</a>
+<a href="#section-2.6.2.5" class="section-number selfRef">2.6.2.5. </a><a href="#name-event_id-4" class="section-name selfRef">event_id</a>
             </h5>
-<p id="section-2.7.2.5-1">event_id represents the human-readable identifier of the event that the object reference belongs to on a specific MISP instance. A human-readable identifier <span class="bcp14">MUST</span> be
-represented as an unsigned integer.<a href="#section-2.7.2.5-1" class="pilcrow">¶</a></p>
-<p id="section-2.7.2.5-2">event<em>id is represented as a JSON string. event</em>id <span class="bcp14">SHALL</span> be present.<a href="#section-2.7.2.5-2" class="pilcrow">¶</a></p>
+<p id="section-2.6.2.5-1">event_id represents the human-readable identifier of the event that the object reference belongs to on a specific MISP instance. A human-readable identifier <span class="bcp14">MUST</span> be
+represented as an unsigned integer.<a href="#section-2.6.2.5-1" class="pilcrow">¶</a></p>
+<p id="section-2.6.2.5-2">event_id is represented as a JSON string. event_id <span class="bcp14">SHALL</span> be present.<a href="#section-2.6.2.5-2" class="pilcrow">¶</a></p>
 </section>
 </div>
 <div id="referenced-id">
-<section id="section-2.7.2.6">
+<section id="section-2.6.2.6">
             <h5 id="name-referenced_id">
-<a href="#section-2.7.2.6" class="section-number selfRef">2.7.2.6. </a><a href="#name-referenced_id" class="section-name selfRef">referenced_id</a>
+<a href="#section-2.6.2.6" class="section-number selfRef">2.6.2.6. </a><a href="#name-referenced_id" class="section-name selfRef">referenced_id</a>
             </h5>
-<p id="section-2.7.2.6-1">referenced_id represents the human-readable identifier of the object or attribute that the parent object  of the object reference points to on a specific MISP instance.<a href="#section-2.7.2.6-1" class="pilcrow">¶</a></p>
-<p id="section-2.7.2.6-2">referenced<em>id is represented as a JSON string. referenced</em>id <span class="bcp14">MAY</span> be present.<a href="#section-2.7.2.6-2" class="pilcrow">¶</a></p>
+<p id="section-2.6.2.6-1">referenced_id represents the human-readable identifier of the object or attribute that the parent object  of the object reference points to on a specific MISP instance.<a href="#section-2.6.2.6-1" class="pilcrow">¶</a></p>
+<p id="section-2.6.2.6-2">referenced_id is represented as a JSON string. referenced_id <span class="bcp14">MAY</span> be present.<a href="#section-2.6.2.6-2" class="pilcrow">¶</a></p>
 </section>
 </div>
 <div id="referenced-type">
-<section id="section-2.7.2.7">
+<section id="section-2.6.2.7">
             <h5 id="name-referenced_type">
-<a href="#section-2.7.2.7" class="section-number selfRef">2.7.2.7. </a><a href="#name-referenced_type" class="section-name selfRef">referenced_type</a>
+<a href="#section-2.6.2.7" class="section-number selfRef">2.6.2.7. </a><a href="#name-referenced_type" class="section-name selfRef">referenced_type</a>
             </h5>
-<p id="section-2.7.2.7-1">referenced_type represents the numeric value describing what the object reference points to, "0" representing an attribute and "1" representing an object<a href="#section-2.7.2.7-1" class="pilcrow">¶</a></p>
-<p id="section-2.7.2.7-2">referenced<em>type is represented as a JSON string. referenced</em>type <span class="bcp14">MAY</span> be present.<a href="#section-2.7.2.7-2" class="pilcrow">¶</a></p>
+<p id="section-2.6.2.7-1">referenced_type represents the numeric value describing what the object reference points to, "0" representing an attribute and "1" representing an object<a href="#section-2.6.2.7-1" class="pilcrow">¶</a></p>
+<p id="section-2.6.2.7-2">referenced_type is represented as a JSON string. referenced_type <span class="bcp14">MAY</span> be present.<a href="#section-2.6.2.7-2" class="pilcrow">¶</a></p>
 </section>
 </div>
 <div id="relationship-type">
-<section id="section-2.7.2.8">
+<section id="section-2.6.2.8">
             <h5 id="name-relationship_type">
-<a href="#section-2.7.2.8" class="section-number selfRef">2.7.2.8. </a><a href="#name-relationship_type" class="section-name selfRef">relationship_type</a>
+<a href="#section-2.6.2.8" class="section-number selfRef">2.6.2.8. </a><a href="#name-relationship_type" class="section-name selfRef">relationship_type</a>
             </h5>
-<p id="section-2.7.2.8-1">relationship<em>type represents the human-readable context of the relationship between an object and another object or attribute as described by the object</em>reference.<a href="#section-2.7.2.8-1" class="pilcrow">¶</a></p>
-<p id="section-2.7.2.8-2">referenced<em>type is represented as a JSON string. relationship</em>type <span class="bcp14">MUST</span> be present.<a href="#section-2.7.2.8-2" class="pilcrow">¶</a></p>
+<p id="section-2.6.2.8-1">relationship_type represents the human-readable context of the relationship between an object and another object or attribute as described by the object_reference.<a href="#section-2.6.2.8-1" class="pilcrow">¶</a></p>
+<p id="section-2.6.2.8-2">relationship_type is represented as a JSON string. relationship_type <span class="bcp14">MUST</span> be present.<a href="#section-2.6.2.8-2" class="pilcrow">¶</a></p>
 </section>
 </div>
 <div id="comment-3">
-<section id="section-2.7.2.9">
+<section id="section-2.6.2.9">
             <h5 id="name-comment-4">
-<a href="#section-2.7.2.9" class="section-number selfRef">2.7.2.9. </a><a href="#name-comment-4" class="section-name selfRef">comment</a>
+<a href="#section-2.6.2.9" class="section-number selfRef">2.6.2.9. </a><a href="#name-comment-4" class="section-name selfRef">comment</a>
             </h5>
-<p id="section-2.7.2.9-1">comment is a contextual comment field.<a href="#section-2.7.2.9-1" class="pilcrow">¶</a></p>
-<p id="section-2.7.2.9-2">comment is represented by a JSON string. comment <span class="bcp14">MAY</span> be present.<a href="#section-2.7.2.9-2" class="pilcrow">¶</a></p>
+<p id="section-2.6.2.9-1">comment is a contextual comment field.<a href="#section-2.6.2.9-1" class="pilcrow">¶</a></p>
+<p id="section-2.6.2.9-2">comment is represented by a JSON string. comment <span class="bcp14">MAY</span> be present.<a href="#section-2.6.2.9-2" class="pilcrow">¶</a></p>
 </section>
 </div>
 <div id="deleted-3">
-<section id="section-2.7.2.10">
+<section id="section-2.6.2.10">
             <h5 id="name-deleted-4">
-<a href="#section-2.7.2.10" class="section-number selfRef">2.7.2.10. </a><a href="#name-deleted-4" class="section-name selfRef">deleted</a>
+<a href="#section-2.6.2.10" class="section-number selfRef">2.6.2.10. </a><a href="#name-deleted-4" class="section-name selfRef">deleted</a>
             </h5>
-<p id="section-2.7.2.10-1">deleted represents a setting that allows object references to be revoked. Revoked object references are not actionable and exist merely to inform other instances of a revocation.<a href="#section-2.7.2.10-1" class="pilcrow">¶</a></p>
-<p id="section-2.7.2.10-2">deleted is represented by a JSON boolean. deleted <span class="bcp14">MUST</span> be present.<a href="#section-2.7.2.10-2" class="pilcrow">¶</a></p>
+<p id="section-2.6.2.10-1">deleted represents a setting that allows object references to be revoked. Revoked object references are not actionable and exist merely to inform other instances of a revocation.<a href="#section-2.6.2.10-1" class="pilcrow">¶</a></p>
+<p id="section-2.6.2.10-2">deleted is represented by a JSON boolean. deleted <span class="bcp14">MUST</span> be present.<a href="#section-2.6.2.10-2" class="pilcrow">¶</a></p>
 </section>
 </div>
 <div id="object-uuid">
-<section id="section-2.7.2.11">
+<section id="section-2.6.2.11">
             <h5 id="name-object_uuid">
-<a href="#section-2.7.2.11" class="section-number selfRef">2.7.2.11. </a><a href="#name-object_uuid" class="section-name selfRef">object_uuid</a>
+<a href="#section-2.6.2.11" class="section-number selfRef">2.6.2.11. </a><a href="#name-object_uuid" class="section-name selfRef">object_uuid</a>
             </h5>
-<p id="section-2.7.2.11-1">object_uuid represents the Universally Unique IDentifier (UUID) <span>[<a href="#RFC4122" class="xref">RFC4122</a>]</span> of the object that the given object reference belongs to. The object_uuid <span class="bcp14">MUST</span> be preserved
-to preserve the object reference's association with the object.<a href="#section-2.7.2.11-1" class="pilcrow">¶</a></p>
+<p id="section-2.6.2.11-1">object_uuid represents the Universally Unique IDentifier (UUID) <span>[<a href="#RFC4122" class="xref">RFC4122</a>]</span> of the object that the given object reference belongs to. The object_uuid <span class="bcp14">MUST</span> be preserved
+to preserve the object reference's association with the object.<a href="#section-2.6.2.11-1" class="pilcrow">¶</a></p>
 </section>
 </div>
 <div id="referenced-uuid">
-<section id="section-2.7.2.12">
+<section id="section-2.6.2.12">
             <h5 id="name-referenced_uuid">
-<a href="#section-2.7.2.12" class="section-number selfRef">2.7.2.12. </a><a href="#name-referenced_uuid" class="section-name selfRef">referenced_uuid</a>
+<a href="#section-2.6.2.12" class="section-number selfRef">2.6.2.12. </a><a href="#name-referenced_uuid" class="section-name selfRef">referenced_uuid</a>
             </h5>
-<p id="section-2.7.2.12-1">referenced_uuid represents the Universally Unique IDentifier (UUID) <span>[<a href="#RFC4122" class="xref">RFC4122</a>]</span> of the object or attribute that is being referenced by the object reference. The referenced_uuid <span class="bcp14">MUST</span> be preserved
-to preserve the object reference's association with the object or attribute.<a href="#section-2.7.2.12-1" class="pilcrow">¶</a></p>
+<p id="section-2.6.2.12-1">referenced_uuid represents the Universally Unique IDentifier (UUID) <span>[<a href="#RFC4122" class="xref">RFC4122</a>]</span> of the object or attribute that is being referenced by the object reference. The referenced_uuid <span class="bcp14">MUST</span> be preserved
+to preserve the object reference's association with the object or attribute.<a href="#section-2.6.2.12-1" class="pilcrow">¶</a></p>
 </section>
 </div>
 </section>
@@ -2740,158 +2745,158 @@ to preserve the object reference's association with the object or attribute.<a h
 </section>
 </div>
 <div id="eventreport">
-<section id="section-2.8">
+<section id="section-2.7">
         <h3 id="name-eventreport">
-<a href="#section-2.8" class="section-number selfRef">2.8. </a><a href="#name-eventreport" class="section-name selfRef">EventReport</a>
+<a href="#section-2.7" class="section-number selfRef">2.7. </a><a href="#name-eventreport" class="section-name selfRef">EventReport</a>
         </h3>
-<p id="section-2.8-1">EventReport are used to complement an event with one or more report in Markdown format. The EventReport contains unstructured information which can be linked to Attributes, Objects, Tags or Galaxy with
-an extension to the Markdown marking language.<a href="#section-2.8-1" class="pilcrow">¶</a></p>
+<p id="section-2.7-1">EventReport are used to complement an event with one or more report in Markdown format. The EventReport contains unstructured information which can be linked to Attributes, Objects, Tags or Galaxy with
+an extension to the Markdown marking language.<a href="#section-2.7-1" class="pilcrow">¶</a></p>
 <div id="id-5">
-<section id="section-2.8.1">
+<section id="section-2.7.1">
           <h4 id="name-id-6">
-<a href="#section-2.8.1" class="section-number selfRef">2.8.1. </a><a href="#name-id-6" class="section-name selfRef">id</a>
+<a href="#section-2.7.1" class="section-number selfRef">2.7.1. </a><a href="#name-id-6" class="section-name selfRef">id</a>
           </h4>
-<p id="section-2.8.1-1">id represents the human-readable identifier associated to the EventReport for a specific MISP instance. A human-readable identifier <span class="bcp14">MUST</span> be
-represented as an unsigned integer.<a href="#section-2.8.1-1" class="pilcrow">¶</a></p>
-<p id="section-2.8.1-2">id is represented as a JSON string. id <span class="bcp14">SHALL</span> be present.<a href="#section-2.8.1-2" class="pilcrow">¶</a></p>
+<p id="section-2.7.1-1">id represents the human-readable identifier associated to the EventReport for a specific MISP instance. A human-readable identifier <span class="bcp14">MUST</span> be
+represented as an unsigned integer.<a href="#section-2.7.1-1" class="pilcrow">¶</a></p>
+<p id="section-2.7.1-2">id is represented as a JSON string. id <span class="bcp14">SHALL</span> be present.<a href="#section-2.7.1-2" class="pilcrow">¶</a></p>
 </section>
 </div>
 <div id="uuid-5">
-<section id="section-2.8.2">
+<section id="section-2.7.2">
           <h4 id="name-uuid-6">
-<a href="#section-2.8.2" class="section-number selfRef">2.8.2. </a><a href="#name-uuid-6" class="section-name selfRef">UUID</a>
+<a href="#section-2.7.2" class="section-number selfRef">2.7.2. </a><a href="#name-uuid-6" class="section-name selfRef">UUID</a>
           </h4>
-<p id="section-2.8.2-1">uuid represents the Universally Unique IDentifier (UUID) <span>[<a href="#RFC4122" class="xref">RFC4122</a>]</span> of the EventReport. The uuid <span class="bcp14">MUST</span> be preserved for any updates or transfer of the same EventReport. UUID version 4 is <span class="bcp14">RECOMMENDED</span> when assigning it to a new EventReport.<a href="#section-2.8.2-1" class="pilcrow">¶</a></p>
-<p id="section-2.8.2-2">uuid is represented as a JSON string. uuid <span class="bcp14">MUST</span> be present.<a href="#section-2.8.2-2" class="pilcrow">¶</a></p>
+<p id="section-2.7.2-1">uuid represents the Universally Unique IDentifier (UUID) <span>[<a href="#RFC4122" class="xref">RFC4122</a>]</span> of the EventReport. The uuid <span class="bcp14">MUST</span> be preserved for any updates or transfer of the same EventReport. UUID version 4 is <span class="bcp14">RECOMMENDED</span> when assigning it to a new EventReport.<a href="#section-2.7.2-1" class="pilcrow">¶</a></p>
+<p id="section-2.7.2-2">uuid is represented as a JSON string. uuid <span class="bcp14">MUST</span> be present.<a href="#section-2.7.2-2" class="pilcrow">¶</a></p>
 </section>
 </div>
 <div id="event-id-4">
-<section id="section-2.8.3">
+<section id="section-2.7.3">
           <h4 id="name-event_id-5">
-<a href="#section-2.8.3" class="section-number selfRef">2.8.3. </a><a href="#name-event_id-5" class="section-name selfRef">event_id</a>
+<a href="#section-2.7.3" class="section-number selfRef">2.7.3. </a><a href="#name-event_id-5" class="section-name selfRef">event_id</a>
           </h4>
-<p id="section-2.8.3-1">event_id represents the human-readable identifier associating the EventReport to an event on a specific MISP instance. A human-readable identifier <span class="bcp14">MUST</span> be
-represented as an unsigned integer.<a href="#section-2.8.3-1" class="pilcrow">¶</a></p>
-<p id="section-2.8.3-2">event_id is represented as a JSON string. event_id  <span class="bcp14">MUST</span> be present.<a href="#section-2.8.3-2" class="pilcrow">¶</a></p>
+<p id="section-2.7.3-1">event_id represents the human-readable identifier associating the EventReport to an event on a specific MISP instance. A human-readable identifier <span class="bcp14">MUST</span> be
+represented as an unsigned integer.<a href="#section-2.7.3-1" class="pilcrow">¶</a></p>
+<p id="section-2.7.3-2">event_id is represented as a JSON string. event_id  <span class="bcp14">MUST</span> be present.<a href="#section-2.7.3-2" class="pilcrow">¶</a></p>
 </section>
 </div>
 <div id="name-1">
-<section id="section-2.8.4">
+<section id="section-2.7.4">
           <h4 id="name-name-2">
-<a href="#section-2.8.4" class="section-number selfRef">2.8.4. </a><a href="#name-name-2" class="section-name selfRef">name</a>
+<a href="#section-2.7.4" class="section-number selfRef">2.7.4. </a><a href="#name-name-2" class="section-name selfRef">name</a>
           </h4>
-<p id="section-2.8.4-1">name represents the information field of the EventReport. name is a free-text value to provide a human-readable summary
-of the report. name <span class="bcp14">SHOULD</span> NOT be bigger than 256 characters and <span class="bcp14">SHOULD</span> NOT include new-lines.<a href="#section-2.8.4-1" class="pilcrow">¶</a></p>
-<p id="section-2.8.4-2">name is represented as a JSON string. name <span class="bcp14">MUST</span> be present.<a href="#section-2.8.4-2" class="pilcrow">¶</a></p>
+<p id="section-2.7.4-1">name represents the information field of the EventReport. name is a free-text value to provide a human-readable summary
+of the report. name <span class="bcp14">SHOULD</span> NOT be bigger than 256 characters and <span class="bcp14">SHOULD</span> NOT include new-lines.<a href="#section-2.7.4-1" class="pilcrow">¶</a></p>
+<p id="section-2.7.4-2">name is represented as a JSON string. name <span class="bcp14">MUST</span> be present.<a href="#section-2.7.4-2" class="pilcrow">¶</a></p>
 </section>
 </div>
 <div id="content">
-<section id="section-2.8.5">
+<section id="section-2.7.5">
           <h4 id="name-content">
-<a href="#section-2.8.5" class="section-number selfRef">2.8.5. </a><a href="#name-content" class="section-name selfRef">content</a>
+<a href="#section-2.7.5" class="section-number selfRef">2.7.5. </a><a href="#name-content" class="section-name selfRef">content</a>
           </h4>
-<p id="section-2.8.5-1">content includes the raw EventReport in Markdown format with or without the specific MISP Markdown markup extension.<a href="#section-2.8.5-1" class="pilcrow">¶</a></p>
-<p id="section-2.8.5-2">The markdown extension for MISP is composed with a symbol as prefix then between square bracket the scope (attribute, object, tag or galaxymatrix) followed by the UUID in parenthesis.<a href="#section-2.8.5-2" class="pilcrow">¶</a></p>
-<p id="section-2.8.5-3">content is represented as a JSON string. content <span class="bcp14">MUST</span> be present.<a href="#section-2.8.5-3" class="pilcrow">¶</a></p>
+<p id="section-2.7.5-1">content includes the raw EventReport in Markdown format with or without the specific MISP Markdown markup extension.<a href="#section-2.7.5-1" class="pilcrow">¶</a></p>
+<p id="section-2.7.5-2">The markdown extension for MISP is composed with a symbol as prefix then between square bracket the scope (attribute, object, tag or galaxymatrix) followed by the UUID in parenthesis.<a href="#section-2.7.5-2" class="pilcrow">¶</a></p>
+<p id="section-2.7.5-3">content is represented as a JSON string. content <span class="bcp14">MUST</span> be present.<a href="#section-2.7.5-3" class="pilcrow">¶</a></p>
 </section>
 </div>
 <div id="distribution-3">
-<section id="section-2.8.6">
+<section id="section-2.7.6">
           <h4 id="name-distribution-4">
-<a href="#section-2.8.6" class="section-number selfRef">2.8.6. </a><a href="#name-distribution-4" class="section-name selfRef">distribution</a>
+<a href="#section-2.7.6" class="section-number selfRef">2.7.6. </a><a href="#name-distribution-4" class="section-name selfRef">distribution</a>
           </h4>
-<p id="section-2.8.6-1">distribution represents the basic distribution rules of the EventReport. The system must adhere to the distribution setting for access control and for dissemination of the EventReport.<a href="#section-2.8.6-1" class="pilcrow">¶</a></p>
-<p id="section-2.8.6-2">distribution is represented by a JSON string. distribution <span class="bcp14">MUST</span> be present and be one of the following options:<a href="#section-2.8.6-2" class="pilcrow">¶</a></p>
-<span class="break"></span><dl class="dlParallel" id="section-2.8.6-3">
-            <dt id="section-2.8.6-3.1">0</dt>
-            <dd style="margin-left: 1.5em" id="section-2.8.6-3.2">Your Organisation Only<a href="#section-2.8.6-3.2" class="pilcrow">¶</a>
+<p id="section-2.7.6-1">distribution represents the basic distribution rules of the EventReport. The system must adhere to the distribution setting for access control and for dissemination of the EventReport.<a href="#section-2.7.6-1" class="pilcrow">¶</a></p>
+<p id="section-2.7.6-2">distribution is represented by a JSON string. distribution <span class="bcp14">MUST</span> be present and be one of the following options:<a href="#section-2.7.6-2" class="pilcrow">¶</a></p>
+<span class="break"></span><dl class="dlCompact dlParallel" id="section-2.7.6-3">
+            <dt id="section-2.7.6-3.1">0</dt>
+            <dd style="margin-left: 1.5em" id="section-2.7.6-3.2">Your Organisation Only<a href="#section-2.7.6-3.2" class="pilcrow">¶</a>
 </dd>
             <dd class="break"></dd>
-<dt id="section-2.8.6-3.3">1</dt>
-            <dd style="margin-left: 1.5em" id="section-2.8.6-3.4">This Community Only<a href="#section-2.8.6-3.4" class="pilcrow">¶</a>
+<dt id="section-2.7.6-3.3">1</dt>
+            <dd style="margin-left: 1.5em" id="section-2.7.6-3.4">This Community Only<a href="#section-2.7.6-3.4" class="pilcrow">¶</a>
 </dd>
             <dd class="break"></dd>
-<dt id="section-2.8.6-3.5">2</dt>
-            <dd style="margin-left: 1.5em" id="section-2.8.6-3.6">Connected Communities<a href="#section-2.8.6-3.6" class="pilcrow">¶</a>
+<dt id="section-2.7.6-3.5">2</dt>
+            <dd style="margin-left: 1.5em" id="section-2.7.6-3.6">Connected Communities<a href="#section-2.7.6-3.6" class="pilcrow">¶</a>
 </dd>
             <dd class="break"></dd>
-<dt id="section-2.8.6-3.7">3</dt>
-            <dd style="margin-left: 1.5em" id="section-2.8.6-3.8">All Communities<a href="#section-2.8.6-3.8" class="pilcrow">¶</a>
+<dt id="section-2.7.6-3.7">3</dt>
+            <dd style="margin-left: 1.5em" id="section-2.7.6-3.8">All Communities<a href="#section-2.7.6-3.8" class="pilcrow">¶</a>
 </dd>
             <dd class="break"></dd>
-<dt id="section-2.8.6-3.9">4</dt>
-            <dd style="margin-left: 1.5em" id="section-2.8.6-3.10">Sharing Group<a href="#section-2.8.6-3.10" class="pilcrow">¶</a>
+<dt id="section-2.7.6-3.9">4</dt>
+            <dd style="margin-left: 1.5em" id="section-2.7.6-3.10">Sharing Group<a href="#section-2.7.6-3.10" class="pilcrow">¶</a>
 </dd>
             <dd class="break"></dd>
-<dt id="section-2.8.6-3.11">5</dt>
-            <dd style="margin-left: 1.5em" id="section-2.8.6-3.12">Inherit Event<a href="#section-2.8.6-3.12" class="pilcrow">¶</a>
+<dt id="section-2.7.6-3.11">5</dt>
+            <dd style="margin-left: 1.5em" id="section-2.7.6-3.12">Inherit Event<a href="#section-2.7.6-3.12" class="pilcrow">¶</a>
 </dd>
           <dd class="break"></dd>
 </dl>
 </section>
 </div>
 <div id="sharing-group-id-3">
-<section id="section-2.8.7">
+<section id="section-2.7.7">
           <h4 id="name-sharing_group_id-4">
-<a href="#section-2.8.7" class="section-number selfRef">2.8.7. </a><a href="#name-sharing_group_id-4" class="section-name selfRef">sharing_group_id</a>
+<a href="#section-2.7.7" class="section-number selfRef">2.7.7. </a><a href="#name-sharing_group_id-4" class="section-name selfRef">sharing_group_id</a>
           </h4>
-<p id="section-2.8.7-1">sharing_group_id represents the local id to the MISP local instance of the Sharing Group associated for the distribution.<a href="#section-2.8.7-1" class="pilcrow">¶</a></p>
-<p id="section-2.8.7-2">sharing_group_id is represented by a JSON string. sharing_group_id <span class="bcp14">MUST</span> be present and set to "0" if not used.<a href="#section-2.8.7-2" class="pilcrow">¶</a></p>
+<p id="section-2.7.7-1">sharing_group_id represents the local id to the MISP local instance of the Sharing Group associated for the distribution.<a href="#section-2.7.7-1" class="pilcrow">¶</a></p>
+<p id="section-2.7.7-2">sharing_group_id is represented by a JSON string. sharing_group_id <span class="bcp14">MUST</span> be present and set to "0" if not used.<a href="#section-2.7.7-2" class="pilcrow">¶</a></p>
 </section>
 </div>
 <div id="timestamp-5">
-<section id="section-2.8.8">
+<section id="section-2.7.8">
           <h4 id="name-timestamp-6">
-<a href="#section-2.8.8" class="section-number selfRef">2.8.8. </a><a href="#name-timestamp-6" class="section-name selfRef">timestamp</a>
+<a href="#section-2.7.8" class="section-number selfRef">2.7.8. </a><a href="#name-timestamp-6" class="section-name selfRef">timestamp</a>
           </h4>
-<p id="section-2.8.8-1">timestamp represents a reference time when the EventReport was created or last modified. timestamp is expressed in seconds (decimal) since 1st of January 1970 (Unix timestamp). The time zone <span class="bcp14">MUST</span> be UTC.<a href="#section-2.8.8-1" class="pilcrow">¶</a></p>
-<p id="section-2.8.8-2">timestamp is represented as a JSON string. timestamp <span class="bcp14">MUST</span> be present.<a href="#section-2.8.8-2" class="pilcrow">¶</a></p>
+<p id="section-2.7.8-1">timestamp represents a reference time when the EventReport was created or last modified. timestamp is expressed in seconds (decimal) since 1st of January 1970 (Unix timestamp). The time zone <span class="bcp14">MUST</span> be UTC.<a href="#section-2.7.8-1" class="pilcrow">¶</a></p>
+<p id="section-2.7.8-2">timestamp is represented as a JSON string. timestamp <span class="bcp14">MUST</span> be present.<a href="#section-2.7.8-2" class="pilcrow">¶</a></p>
 </section>
 </div>
 <div id="deleted-4">
-<section id="section-2.8.9">
+<section id="section-2.7.9">
           <h4 id="name-deleted-5">
-<a href="#section-2.8.9" class="section-number selfRef">2.8.9. </a><a href="#name-deleted-5" class="section-name selfRef">deleted</a>
+<a href="#section-2.7.9" class="section-number selfRef">2.7.9. </a><a href="#name-deleted-5" class="section-name selfRef">deleted</a>
           </h4>
-<p id="section-2.8.9-1">deleted represents a setting that allows EventReport to be revoked. Revoked EventReport are not actionable and exist merely to inform other instances of a revocation.<a href="#section-2.8.9-1" class="pilcrow">¶</a></p>
-<p id="section-2.8.9-2">deleted is represented by a JSON boolean. deleted <span class="bcp14">MUST</span> be present.<a href="#section-2.8.9-2" class="pilcrow">¶</a></p>
+<p id="section-2.7.9-1">deleted represents a setting that allows EventReport to be revoked. Revoked EventReport are not actionable and exist merely to inform other instances of a revocation.<a href="#section-2.7.9-1" class="pilcrow">¶</a></p>
+<p id="section-2.7.9-2">deleted is represented by a JSON boolean. deleted <span class="bcp14">MUST</span> be present.<a href="#section-2.7.9-2" class="pilcrow">¶</a></p>
 </section>
 </div>
 </section>
 </div>
 <div id="tag">
-<section id="section-2.9">
+<section id="section-2.8">
         <h3 id="name-tag">
-<a href="#section-2.9" class="section-number selfRef">2.9. </a><a href="#name-tag" class="section-name selfRef">Tag</a>
+<a href="#section-2.8" class="section-number selfRef">2.8. </a><a href="#name-tag" class="section-name selfRef">Tag</a>
         </h3>
-<p id="section-2.9-1">A tag is a simple method to classify an event with a simple string. The tag name can be freely chosen. The tag name can be also chosen from a fixed machine-tag vocabulary called MISP taxonomies[<span>[<a href="#MISP-T" class="xref">MISP-T</a>]</span>]. When an event is distributed outside an organisation, the use of MISP taxonomies[<span>[<a href="#MISP-T" class="xref">MISP-T</a>]</span>] is <span class="bcp14">RECOMMENDED</span> to ensure a coherent naming of the tags. A tag is represented as a JSON array where each element describes each tag associated. A tag array <span class="bcp14">SHALL</span> be at event level or attribute level. A tag element is described with a name, id, colour and exportable flag.<a href="#section-2.9-1" class="pilcrow">¶</a></p>
-<p id="section-2.9-2">exportable represents a setting if the tag is kept local or exportable to other MISP instances. exportable is represented by a JSON boolean. id is a human-readable identifier that references the tag on the local instance. colour represents an RGB value of the tag.<a href="#section-2.9-2" class="pilcrow">¶</a></p>
-<p id="section-2.9-3">name <span class="bcp14">MUST</span> be present. colour, id and exportable <span class="bcp14">SHALL</span> be present.<a href="#section-2.9-3" class="pilcrow">¶</a></p>
+<p id="section-2.8-1">A tag is a simple method to classify an event with a simple string. The tag name can be freely chosen. The tag name can be also chosen from a fixed machine-tag vocabulary called MISP taxonomies[<span>[<a href="#MISP-T" class="xref">MISP-T</a>]</span>]. When an event is distributed outside an organisation, the use of MISP taxonomies[<span>[<a href="#MISP-T" class="xref">MISP-T</a>]</span>] is <span class="bcp14">RECOMMENDED</span> to ensure a coherent naming of the tags. A tag is represented as a JSON array where each element describes each tag associated. A tag array <span class="bcp14">SHALL</span> be at event level or attribute level. A tag element is described with a name, id, colour and exportable flag.<a href="#section-2.8-1" class="pilcrow">¶</a></p>
+<p id="section-2.8-2">exportable represents a setting if the tag is kept local or exportable to other MISP instances. exportable is represented by a JSON boolean. id is a human-readable identifier that references the tag on the local instance. colour represents an RGB value of the tag.<a href="#section-2.8-2" class="pilcrow">¶</a></p>
+<p id="section-2.8-3">name <span class="bcp14">MUST</span> be present. colour, id and exportable <span class="bcp14">SHALL</span> be present.<a href="#section-2.8-3" class="pilcrow">¶</a></p>
 <div id="sample-tag">
-<section id="section-2.9.1">
+<section id="section-2.8.1">
           <h4 id="name-sample-tag">
-<a href="#section-2.9.1" class="section-number selfRef">2.9.1. </a><a href="#name-sample-tag" class="section-name selfRef">Sample Tag</a>
+<a href="#section-2.8.1" class="section-number selfRef">2.8.1. </a><a href="#name-sample-tag" class="section-name selfRef">Sample Tag</a>
           </h4>
-<div class="artwork art-text alignLeft" id="section-2.9.1-1">
+<div class="alignLeft art-text artwork" id="section-2.8.1-1">
 <pre>"Tag": [{
         "exportable": true,
         "colour": "#ffffff",
         "name": "tlp:white",
         "id": "2" }]
-</pre><a href="#section-2.9.1-1" class="pilcrow">¶</a>
+</pre><a href="#section-2.8.1-1" class="pilcrow">¶</a>
 </div>
 </section>
 </div>
 </section>
 </div>
 <div id="sighting">
-<section id="section-2.10">
+<section id="section-2.9">
         <h3 id="name-sighting">
-<a href="#section-2.10" class="section-number selfRef">2.10. </a><a href="#name-sighting" class="section-name selfRef">Sighting</a>
+<a href="#section-2.9" class="section-number selfRef">2.9. </a><a href="#name-sighting" class="section-name selfRef">Sighting</a>
         </h3>
-<p id="section-2.10-1">A sighting is an ascertainment which describes whether an attribute has been seen under a given set of conditions. The sighting can include the organisation who sighted the attribute or can
-be anonymised. Sighting is composed of a JSON array in which each element describes one singular instance of a sighting. A sighting element is a JSON object composed of the following values:<a href="#section-2.10-1" class="pilcrow">¶</a></p>
-<p id="section-2.10-2">type <span class="bcp14">MUST</span> be present. type describes the type of a sighting. MISP allows 3 default types:<a href="#section-2.10-2" class="pilcrow">¶</a></p>
+<p id="section-2.9-1">A sighting is an ascertainment which describes whether an attribute has been seen under a given set of conditions. The sighting can include the organisation who sighted the attribute or can
+be anonymised. Sighting is composed of a JSON array in which each element describes one singular instance of a sighting. A sighting element is a JSON object composed of the following values:<a href="#section-2.9-1" class="pilcrow">¶</a></p>
+<p id="section-2.9-2">type <span class="bcp14">MUST</span> be present. type describes the type of a sighting. MISP allows 3 default types:<a href="#section-2.9-2" class="pilcrow">¶</a></p>
 <table class="center" id="table-1">
           <caption><a href="#table-1" class="selfRef">Table 1</a></caption>
 <thead>
@@ -2915,22 +2920,22 @@ be anonymised. Sighting is composed of a JSON array in which each element descri
             </tr>
           </tbody>
         </table>
-<p id="section-2.10-4">uuid <span class="bcp14">MUST</span> be present. uuid references the uuid of the sighted attribute.<a href="#section-2.10-4" class="pilcrow">¶</a></p>
-<p id="section-2.10-5">date<em>sighting <span class="bcp14">MUST</span> be present. date</em>sighting is expressed in seconds (decimal) elapsed since 1st of January 1970 (Unix timestamp). date_sighting represents when the referenced attribute, designated by its uuid, is sighted.<a href="#section-2.10-5" class="pilcrow">¶</a></p>
-<p id="section-2.10-6">source <span class="bcp14">MAY</span> be present. source is represented as a JSON string and represents the human-readable version of the sighting source, which can be a given piece of software (e.g. SIEM), device or a specific analytical process.<a href="#section-2.10-6" class="pilcrow">¶</a></p>
-<p id="section-2.10-7">id, event<em>id and attribute</em>id <span class="bcp14">MAY</span> be present.<a href="#section-2.10-7" class="pilcrow">¶</a></p>
-<p id="section-2.10-8">id represents the human-readable identifier of the sighting reference which belongs to a specific MISP instance.
-event<em>id represents the human-readable identifier of the event referenced by the sighting and belongs to a specific MISP instance.
-attribute</em>id represents the human-readable identifier of the attribute referenced by the sighting and belongs to a specific MISP instance.<a href="#section-2.10-8" class="pilcrow">¶</a></p>
-<p id="section-2.10-9">org<em>id <span class="bcp14">MAY</span> be present along the JSON object describing the organisation. If the org</em>id is not present, the sighting is considered as anonymised.<a href="#section-2.10-9" class="pilcrow">¶</a></p>
-<p id="section-2.10-10">org_id represents the human-readable identifier of the organisation which did the sighting and belongs to a specific MISP instance.<a href="#section-2.10-10" class="pilcrow">¶</a></p>
-<p id="section-2.10-11">A human-readable identifier <span class="bcp14">MUST</span> be represented as an unsigned integer.<a href="#section-2.10-11" class="pilcrow">¶</a></p>
+<p id="section-2.9-4">uuid <span class="bcp14">MUST</span> be present. uuid references the uuid of the sighted attribute.<a href="#section-2.9-4" class="pilcrow">¶</a></p>
+<p id="section-2.9-5">date_sighting <span class="bcp14">MUST</span> be present. date_sighting is expressed in seconds (decimal) elapsed since 1st of January 1970 (Unix timestamp). date_sighting represents when the referenced attribute, designated by its uuid, is sighted.<a href="#section-2.9-5" class="pilcrow">¶</a></p>
+<p id="section-2.9-6">source <span class="bcp14">MAY</span> be present. source is represented as a JSON string and represents the human-readable version of the sighting source, which can be a given piece of software (e.g. SIEM), device or a specific analytical process.<a href="#section-2.9-6" class="pilcrow">¶</a></p>
+<p id="section-2.9-7">id, event_id and attribute_id are represented as a JSON string and <span class="bcp14">MAY</span> be present.<a href="#section-2.9-7" class="pilcrow">¶</a></p>
+<p id="section-2.9-8">id represents the human-readable identifier of the sighting reference which belongs to a specific MISP instance.
+event_id represents the human-readable identifier of the event referenced by the sighting and belongs to a specific MISP instance.
+attribute_id represents the human-readable identifier of the attribute referenced by the sighting and belongs to a specific MISP instance.<a href="#section-2.9-8" class="pilcrow">¶</a></p>
+<p id="section-2.9-9">org_id <span class="bcp14">MAY</span> be present along the JSON object describing the organisation. If the org_id is not present, the sighting is considered as anonymised.<a href="#section-2.9-9" class="pilcrow">¶</a></p>
+<p id="section-2.9-10">org_id represents the human-readable identifier of the organisation which did the sighting and belongs to a specific MISP instance.<a href="#section-2.9-10" class="pilcrow">¶</a></p>
+<p id="section-2.9-11">A human-readable identifier <span class="bcp14">MUST</span> be considered as an unsigned integer.<a href="#section-2.9-11" class="pilcrow">¶</a></p>
 <div id="sample-sighting">
-<section id="section-2.10.1">
+<section id="section-2.9.1">
           <h4 id="name-sample-sighting">
-<a href="#section-2.10.1" class="section-number selfRef">2.10.1. </a><a href="#name-sample-sighting" class="section-name selfRef">Sample Sighting</a>
+<a href="#section-2.9.1" class="section-number selfRef">2.9.1. </a><a href="#name-sample-sighting" class="section-name selfRef">Sample Sighting</a>
           </h4>
-<div class="artwork art-text alignLeft" id="section-2.10.1-1">
+<div class="alignLeft art-text artwork" id="section-2.9.1-1">
 <pre>"Sighting": [
                    {
                                 "id": "13599",
@@ -2963,24 +2968,24 @@ attribute</em>id represents the human-readable identifier of the attribute refer
                                 }
                         }
                 ]
-</pre><a href="#section-2.10.1-1" class="pilcrow">¶</a>
+</pre><a href="#section-2.9.1-1" class="pilcrow">¶</a>
 </div>
 </section>
 </div>
 </section>
 </div>
 <div id="galaxy">
-<section id="section-2.11">
+<section id="section-2.10">
         <h3 id="name-galaxy">
-<a href="#section-2.11" class="section-number selfRef">2.11. </a><a href="#name-galaxy" class="section-name selfRef">Galaxy</a>
+<a href="#section-2.10" class="section-number selfRef">2.10. </a><a href="#name-galaxy" class="section-name selfRef">Galaxy</a>
         </h3>
-<p id="section-2.11-1">A galaxy is a simple method to express a large object called cluster that can be attached to MISP events. A cluster can be composed of one or more elements. Elements are expressed as key-values.<a href="#section-2.11-1" class="pilcrow">¶</a></p>
+<p id="section-2.10-1">A galaxy is a simple method to express a large object called cluster that can be attached to MISP events. A cluster can be composed of one or more elements. Elements are expressed as key-values.<a href="#section-2.10-1" class="pilcrow">¶</a></p>
 <div id="sample-galaxy">
-<section id="section-2.11.1">
+<section id="section-2.10.1">
           <h4 id="name-sample-galaxy">
-<a href="#section-2.11.1" class="section-number selfRef">2.11.1. </a><a href="#name-sample-galaxy" class="section-name selfRef">Sample Galaxy</a>
+<a href="#section-2.10.1" class="section-number selfRef">2.10.1. </a><a href="#name-sample-galaxy" class="section-name selfRef">Sample Galaxy</a>
           </h4>
-<div class="artwork art-text alignLeft" id="section-2.11.1-1">
+<div class="alignLeft art-text artwork" id="section-2.10.1-1">
 <pre>"Galaxy": [ {
            "id": "18",
            "uuid": "698774c7-8022-42c4-917f-8d6e4f06ada3",
@@ -3025,7 +3030,7 @@ attribute</em>id represents the human-readable identifier of the attribute refer
                 ]
             }
         ]
-</pre><a href="#section-2.11.1-1" class="pilcrow">¶</a>
+</pre><a href="#section-2.10.1-1" class="pilcrow">¶</a>
 </div>
 </section>
 </div>
@@ -3041,7 +3046,7 @@ attribute</em>id represents the human-readable identifier of the attribute refer
 <p id="section-3-1">The JSON Schema <span>[<a href="#JSON-SCHEMA" class="xref">JSON-SCHEMA</a>]</span> below defines the structure of the MISP core format
 as literally described before. The JSON Schema is used to validate MISP events at creation time
 or parsing.<a href="#section-3-1" class="pilcrow">¶</a></p>
-<div class="artwork art-text alignLeft" id="section-3-2">
+<div class="alignLeft art-text artwork" id="section-3-2">
 <pre>{
   "$schema": "http://json-schema.org/draft-04/schema#",
   "title": "Validator for misp events",
@@ -3738,25 +3743,25 @@ Each MISP event is a file located in the same directory with the event uuid as f
 <p id="section-4.1-2">The manifest format is a JSON object composed of a dictionary where the field is the uuid of the event.<a href="#section-4.1-2" class="pilcrow">¶</a></p>
 <p id="section-4.1-3">Each uuid is composed of a JSON object with the following fields which came from the original event referenced
 by the same uuid:<a href="#section-4.1-3" class="pilcrow">¶</a></p>
-<ul class="normal">
-<li class="normal" id="section-4.1-4.1">info (<span class="bcp14">MUST</span>)<a href="#section-4.1-4.1" class="pilcrow">¶</a>
+<ul class="compact">
+<li class="compact" id="section-4.1-4.1">info (<span class="bcp14">MUST</span>)<a href="#section-4.1-4.1" class="pilcrow">¶</a>
 </li>
-          <li class="normal" id="section-4.1-4.2">Orgc object (<span class="bcp14">MUST</span>)<a href="#section-4.1-4.2" class="pilcrow">¶</a>
+          <li class="compact" id="section-4.1-4.2">Orgc object (<span class="bcp14">MUST</span>)<a href="#section-4.1-4.2" class="pilcrow">¶</a>
 </li>
-          <li class="normal" id="section-4.1-4.3">analysis (<span class="bcp14">SHALL</span>)<a href="#section-4.1-4.3" class="pilcrow">¶</a>
+          <li class="compact" id="section-4.1-4.3">analysis (<span class="bcp14">SHALL</span>)<a href="#section-4.1-4.3" class="pilcrow">¶</a>
 </li>
-          <li class="normal" id="section-4.1-4.4">timestamp (<span class="bcp14">MUST</span>)<a href="#section-4.1-4.4" class="pilcrow">¶</a>
+          <li class="compact" id="section-4.1-4.4">timestamp (<span class="bcp14">MUST</span>)<a href="#section-4.1-4.4" class="pilcrow">¶</a>
 </li>
-          <li class="normal" id="section-4.1-4.5">date (<span class="bcp14">MUST</span>)<a href="#section-4.1-4.5" class="pilcrow">¶</a>
+          <li class="compact" id="section-4.1-4.5">date (<span class="bcp14">MUST</span>)<a href="#section-4.1-4.5" class="pilcrow">¶</a>
 </li>
-          <li class="normal" id="section-4.1-4.6">threat<em>level</em>id (<span class="bcp14">SHALL</span>)<a href="#section-4.1-4.6" class="pilcrow">¶</a>
+          <li class="compact" id="section-4.1-4.6">threat_level_id (<span class="bcp14">SHALL</span>)<a href="#section-4.1-4.6" class="pilcrow">¶</a>
 </li>
         </ul>
 <p id="section-4.1-5">In addition to the fields originating from the event, the following fields can be added:<a href="#section-4.1-5" class="pilcrow">¶</a></p>
-<ul class="normal">
-<li class="normal" id="section-4.1-6.1">integrity:sha256 represents the SHA256 value in hexadecimal representation of the associated MISP event file to ensure integrity of the file. (<span class="bcp14">SHOULD</span>)<a href="#section-4.1-6.1" class="pilcrow">¶</a>
+<ul class="compact">
+<li class="compact" id="section-4.1-6.1">integrity:sha256 represents the SHA256 value in hexadecimal representation of the associated MISP event file to ensure integrity of the file. (<span class="bcp14">SHOULD</span>)<a href="#section-4.1-6.1" class="pilcrow">¶</a>
 </li>
-          <li class="normal" id="section-4.1-6.2">integrity:pgp represents a detached PGP signature <span>[<a href="#RFC4880" class="xref">RFC4880</a>]</span> of the associated MISP event file to ensure integrity of the file. (<span class="bcp14">SHOULD</span>)<a href="#section-4.1-6.2" class="pilcrow">¶</a>
+          <li class="compact" id="section-4.1-6.2">integrity:pgp represents a detached PGP signature <span>[<a href="#RFC4880" class="xref">RFC4880</a>]</span> of the associated MISP event file to ensure integrity of the file. (<span class="bcp14">SHOULD</span>)<a href="#section-4.1-6.2" class="pilcrow">¶</a>
 </li>
         </ul>
 <p id="section-4.1-7">If a detached PGP signature is used for each MISP event, a detached PGP signature is a <span class="bcp14">MUST</span> to ensure integrity of the manifest file.
@@ -3766,7 +3771,7 @@ A detached PGP signature for a manifest file is a manifest.json.asc file contain
           <h4 id="name-sample-manifest">
 <a href="#section-4.1.1" class="section-number selfRef">4.1.1. </a><a href="#name-sample-manifest" class="section-name selfRef">Sample Manifest</a>
           </h4>
-<div class="artwork art-text alignLeft" id="section-4.1.1-1">
+<div class="alignLeft art-text artwork" id="section-4.1.1-1">
 <pre>{
   "57c6ac4c-c60c-4f79-a38f-b666950d210f": {
     "info": "Malspam 2016-08-31 (.wsf in .zip) - campaign: Photo",
@@ -3896,19 +3901,19 @@ for the review of the JSON Schema.<a href="#section-7-1" class="pilcrow">¶</a><
 <dl class="references">
 <dt id="JSON-SCHEMA">[JSON-SCHEMA]</dt>
       <dd>
-<span class="refAuthor">Wright, A.</span>, <span class="refTitle">"JSON Schema: A Media Type for Describing JSON Documents"</span>, <span class="refContent"></span>, <time datetime="2016" class="refDate">2016</time>, <span>&lt;<a href="https://tools.ietf.org/html/draft-wright-json-schema">https://tools.ietf.org/html/draft-wright-json-schema</a>&gt;</span>. </dd>
+<span class="refAuthor">Wright, A.</span>, <span class="refTitle">"JSON Schema: A Media Type for Describing JSON Documents"</span>, <time datetime="2016" class="refDate">2016</time>, <span>&lt;<a href="https://tools.ietf.org/html/draft-wright-json-schema">https://tools.ietf.org/html/draft-wright-json-schema</a>&gt;</span>. </dd>
 <dd class="break"></dd>
 <dt id="MISP-P">[MISP-P]</dt>
       <dd>
-<span class="refAuthor">Community, M.</span>, <span class="refTitle">"MISP Project - Open Source Threat Intelligence Platform and Open Standards For Threat Information Sharing"</span>, <span class="refContent"></span>, <span>&lt;<a href="https://github.com/MISP">https://github.com/MISP</a>&gt;</span>. </dd>
+<span class="refAuthor">Community, M.</span>, <span class="refTitle">"MISP Project - Open Source Threat Intelligence Platform and Open Standards For Threat Information Sharing"</span>, <span>&lt;<a href="https://github.com/MISP">https://github.com/MISP</a>&gt;</span>. </dd>
 <dd class="break"></dd>
 <dt id="MISP-R">[MISP-R]</dt>
       <dd>
-<span class="refAuthor">Community, M.</span>, <span class="refTitle">"MISP Object Relationship Types - common vocabulary of relationships"</span>, <span class="refContent"></span>, <span>&lt;<a href="https://github.com/MISP/misp-objects/tree/master/relationships">https://github.com/MISP/misp-objects/tree/master/relationships</a>&gt;</span>. </dd>
+<span class="refAuthor">Community, M.</span>, <span class="refTitle">"MISP Object Relationship Types - common vocabulary of relationships"</span>, <span>&lt;<a href="https://github.com/MISP/misp-objects/tree/master/relationships">https://github.com/MISP/misp-objects/tree/master/relationships</a>&gt;</span>. </dd>
 <dd class="break"></dd>
 <dt id="MISP-T">[MISP-T]</dt>
     <dd>
-<span class="refAuthor">Community, M.</span>, <span class="refTitle">"MISP Taxonomies - shared and common vocabularies of tags"</span>, <span class="refContent"></span>, <span>&lt;<a href="https://github.com/MISP/misp-taxonomies">https://github.com/MISP/misp-taxonomies</a>&gt;</span>. </dd>
+<span class="refAuthor">Community, M.</span>, <span class="refTitle">"MISP Taxonomies - shared and common vocabularies of tags"</span>, <span>&lt;<a href="https://github.com/MISP/misp-taxonomies">https://github.com/MISP/misp-taxonomies</a>&gt;</span>. </dd>
 <dd class="break"></dd>
 </dl>
 </section>
diff --git a/rfc/misp-standard-core.txt b/rfc/misp-standard-core.txt
index b2a6c8c..53c0af3 100644
--- a/rfc/misp-standard-core.txt
+++ b/rfc/misp-standard-core.txt
@@ -5,7 +5,7 @@
 Network Working Group                                        A. Dulaunoy
 Internet-Draft                                                 A. Iklody
 Intended status: Informational                                     CIRCL
-Expires: 1 May 2022                                      28 October 2021
+Expires: 19 August 2022                                 15 February 2022
 
 
                             MISP core format
@@ -37,11 +37,11 @@ Status of This Memo
    time.  It is inappropriate to use Internet-Drafts as reference
    material or to cite them other than as "work in progress."
 
-   This Internet-Draft will expire on 1 May 2022.
+   This Internet-Draft will expire on 19 August 2022.
 
 Copyright Notice
 
-   Copyright (c) 2021 IETF Trust and the persons identified as the
+   Copyright (c) 2022 IETF Trust and the persons identified as the
    document authors.  All rights reserved.
 
    This document is subject to BCP 78 and the IETF Trust's Legal
@@ -53,9 +53,9 @@ Copyright Notice
 
 
 
-Dulaunoy & Iklody          Expires 1 May 2022                   [Page 1]
+Dulaunoy & Iklody        Expires 19 August 2022                 [Page 1]
 
-Internet-Draft              MISP core format                October 2021
+Internet-Draft              MISP core format               February 2022
 
 
 Table of Contents
@@ -66,57 +66,55 @@ Table of Contents
      2.1.  Overview  . . . . . . . . . . . . . . . . . . . . . . . .   3
      2.2.  Event . . . . . . . . . . . . . . . . . . . . . . . . . .   3
        2.2.1.  Event Attributes  . . . . . . . . . . . . . . . . . .   3
-     2.3.  Objects . . . . . . . . . . . . . . . . . . . . . . . . .   7
-       2.3.1.  Org . . . . . . . . . . . . . . . . . . . . . . . . .   7
-       2.3.2.  Orgc  . . . . . . . . . . . . . . . . . . . . . . . .   8
-     2.4.  Attribute . . . . . . . . . . . . . . . . . . . . . . . .   8
-       2.4.1.  Sample Attribute Object . . . . . . . . . . . . . . .   8
-       2.4.2.  Attribute Attributes  . . . . . . . . . . . . . . . .   9
-     2.5.  ShadowAttribute . . . . . . . . . . . . . . . . . . . . .  15
-       2.5.1.  Sample Attribute Object . . . . . . . . . . . . . . .  16
-       2.5.2.  ShadowAttribute Attributes  . . . . . . . . . . . . .  16
-       2.5.3.  Org . . . . . . . . . . . . . . . . . . . . . . . . .  22
-     2.6.  Object  . . . . . . . . . . . . . . . . . . . . . . . . .  23
-       2.6.1.  Sample Object . . . . . . . . . . . . . . . . . . . .  23
-       2.6.2.  Object Attributes . . . . . . . . . . . . . . . . . .  24
-     2.7.  Object References . . . . . . . . . . . . . . . . . . . .  28
-       2.7.1.  Sample ObjectReference object . . . . . . . . . . . .  28
-       2.7.2.  ObjectReference Attributes  . . . . . . . . . . . . .  28
-     2.8.  EventReport . . . . . . . . . . . . . . . . . . . . . . .  30
-       2.8.1.  id  . . . . . . . . . . . . . . . . . . . . . . . . .  30
-       2.8.2.  UUID  . . . . . . . . . . . . . . . . . . . . . . . .  31
-       2.8.3.  event_id  . . . . . . . . . . . . . . . . . . . . . .  31
-       2.8.4.  name  . . . . . . . . . . . . . . . . . . . . . . . .  31
-       2.8.5.  content . . . . . . . . . . . . . . . . . . . . . . .  31
-       2.8.6.  distribution  . . . . . . . . . . . . . . . . . . . .  31
-       2.8.7.  sharing_group_id  . . . . . . . . . . . . . . . . . .  32
-       2.8.8.  timestamp . . . . . . . . . . . . . . . . . . . . . .  32
-       2.8.9.  deleted . . . . . . . . . . . . . . . . . . . . . . .  32
-     2.9.  Tag . . . . . . . . . . . . . . . . . . . . . . . . . . .  32
-       2.9.1.  Sample Tag  . . . . . . . . . . . . . . . . . . . . .  33
-     2.10. Sighting  . . . . . . . . . . . . . . . . . . . . . . . .  33
-       2.10.1.  Sample Sighting  . . . . . . . . . . . . . . . . . .  34
-     2.11. Galaxy  . . . . . . . . . . . . . . . . . . . . . . . . .  35
-       2.11.1.  Sample Galaxy  . . . . . . . . . . . . . . . . . . .  35
-   3.  JSON Schema . . . . . . . . . . . . . . . . . . . . . . . . .  37
-   4.  Manifest  . . . . . . . . . . . . . . . . . . . . . . . . . .  51
-     4.1.  Format  . . . . . . . . . . . . . . . . . . . . . . . . .  51
-       4.1.1.  Sample Manifest . . . . . . . . . . . . . . . . . . .  52
-   5.  Implementation  . . . . . . . . . . . . . . . . . . . . . . .  53
-   6.  Security Considerations . . . . . . . . . . . . . . . . . . .  53
-   7.  Acknowledgements  . . . . . . . . . . . . . . . . . . . . . .  53
-   8.  References  . . . . . . . . . . . . . . . . . . . . . . . . .  53
+       2.2.2.  Event Objects . . . . . . . . . . . . . . . . . . . .   7
+     2.3.  Attribute . . . . . . . . . . . . . . . . . . . . . . . .   8
+       2.3.1.  Sample Attribute Object . . . . . . . . . . . . . . .   8
+       2.3.2.  Attribute Attributes  . . . . . . . . . . . . . . . .   8
+     2.4.  ShadowAttribute . . . . . . . . . . . . . . . . . . . . .  14
+       2.4.1.  Sample Attribute Object . . . . . . . . . . . . . . .  15
+       2.4.2.  ShadowAttribute Attributes  . . . . . . . . . . . . .  15
+       2.4.3.  ShadowAttribute Objects . . . . . . . . . . . . . . .  21
+     2.5.  Object  . . . . . . . . . . . . . . . . . . . . . . . . .  22
+       2.5.1.  Sample Object . . . . . . . . . . . . . . . . . . . .  22
+       2.5.2.  Object Attributes . . . . . . . . . . . . . . . . . .  23
+     2.6.  Object References . . . . . . . . . . . . . . . . . . . .  27
+       2.6.1.  Sample ObjectReference object . . . . . . . . . . . .  27
+       2.6.2.  ObjectReference Attributes  . . . . . . . . . . . . .  27
+     2.7.  EventReport . . . . . . . . . . . . . . . . . . . . . . .  29
+       2.7.1.  id  . . . . . . . . . . . . . . . . . . . . . . . . .  29
+       2.7.2.  UUID  . . . . . . . . . . . . . . . . . . . . . . . .  30
+       2.7.3.  event_id  . . . . . . . . . . . . . . . . . . . . . .  30
+       2.7.4.  name  . . . . . . . . . . . . . . . . . . . . . . . .  30
+       2.7.5.  content . . . . . . . . . . . . . . . . . . . . . . .  30
+       2.7.6.  distribution  . . . . . . . . . . . . . . . . . . . .  30
+       2.7.7.  sharing_group_id  . . . . . . . . . . . . . . . . . .  31
+       2.7.8.  timestamp . . . . . . . . . . . . . . . . . . . . . .  31
+       2.7.9.  deleted . . . . . . . . . . . . . . . . . . . . . . .  31
+     2.8.  Tag . . . . . . . . . . . . . . . . . . . . . . . . . . .  31
+       2.8.1.  Sample Tag  . . . . . . . . . . . . . . . . . . . . .  32
+     2.9.  Sighting  . . . . . . . . . . . . . . . . . . . . . . . .  32
+       2.9.1.  Sample Sighting . . . . . . . . . . . . . . . . . . .  33
+     2.10. Galaxy  . . . . . . . . . . . . . . . . . . . . . . . . .  34
+       2.10.1.  Sample Galaxy  . . . . . . . . . . . . . . . . . . .  34
+   3.  JSON Schema . . . . . . . . . . . . . . . . . . . . . . . . .  36
+   4.  Manifest  . . . . . . . . . . . . . . . . . . . . . . . . . .  50
+     4.1.  Format  . . . . . . . . . . . . . . . . . . . . . . . . .  50
+       4.1.1.  Sample Manifest . . . . . . . . . . . . . . . . . . .  51
+   5.  Implementation  . . . . . . . . . . . . . . . . . . . . . . .  52
+   6.  Security Considerations . . . . . . . . . . . . . . . . . . .  52
+   7.  Acknowledgements  . . . . . . . . . . . . . . . . . . . . . .  52
+   8.  References  . . . . . . . . . . . . . . . . . . . . . . . . .  52
+   9.  Normative References  . . . . . . . . . . . . . . . . . . . .  52
+   10. Informative References  . . . . . . . . . . . . . . . . . . .  53
 
 
 
-Dulaunoy & Iklody          Expires 1 May 2022                   [Page 2]
+Dulaunoy & Iklody        Expires 19 August 2022                 [Page 2]
 
-Internet-Draft              MISP core format                October 2021
+Internet-Draft              MISP core format               February 2022
 
 
-   9.  Normative References  . . . . . . . . . . . . . . . . . . . .  53
-   10. Informative References  . . . . . . . . . . . . . . . . . . .  54
-   Authors' Addresses  . . . . . . . . . . . . . . . . . . . . . . .  54
+   Authors' Addresses  . . . . . . . . . . . . . . . . . . . . . . .  53
 
 1.  Introduction
 
@@ -158,18 +156,6 @@ Internet-Draft              MISP core format                October 2021
 
 2.2.1.  Event Attributes
 
-
-
-
-
-
-
-
-Dulaunoy & Iklody          Expires 1 May 2022                   [Page 3]
-
-Internet-Draft              MISP core format                October 2021
-
-
 2.2.1.1.  uuid
 
    uuid represents the Universally Unique IDentifier (UUID) [RFC4122] of
@@ -177,6 +163,13 @@ Internet-Draft              MISP core format                October 2021
    the same event.  UUID version 4 is RECOMMENDED when assigning it to a
    new event.
 
+
+
+Dulaunoy & Iklody        Expires 19 August 2022                 [Page 3]
+
+Internet-Draft              MISP core format               February 2022
+
+
    uuid is represented as a JSON string. uuid MUST be present.
 
 2.2.1.2.  id
@@ -210,22 +203,10 @@ Internet-Draft              MISP core format                October 2021
    threat_level_id represents the threat level.
 
    4:  Undefined
-
    3:  Low
-
    2:  Medium
-
    1:  High
 
-
-
-
-
-Dulaunoy & Iklody          Expires 1 May 2022                   [Page 4]
-
-Internet-Draft              MISP core format                October 2021
-
-
    If a higher granularity is required, a MISP taxonomy applied as a Tag
    SHOULD be preferred.
 
@@ -238,8 +219,14 @@ Internet-Draft              MISP core format                October 2021
 
    0:  Initial
 
-   1:  Ongoing
 
+
+Dulaunoy & Iklody        Expires 19 August 2022                 [Page 4]
+
+Internet-Draft              MISP core format               February 2022
+
+
+   1:  Ongoing
    2:  Complete
 
    If a higher granularity is required, a MISP taxonomy applied as a Tag
@@ -275,13 +262,6 @@ Internet-Draft              MISP core format                October 2021
    previous publication timestamp.  If the event was never published,
    the published_timestamp MUST be set to 0.
 
-
-
-Dulaunoy & Iklody          Expires 1 May 2022                   [Page 5]
-
-Internet-Draft              MISP core format                October 2021
-
-
    publish_timestamp is represented as a JSON string. publish_timestamp
    MUST be present.
 
@@ -294,6 +274,14 @@ Internet-Draft              MISP core format                October 2021
    The org_id MUST be updated when the event is generated by a new
    instance.
 
+
+
+
+Dulaunoy & Iklody        Expires 19 August 2022                 [Page 5]
+
+Internet-Draft              MISP core format               February 2022
+
+
    org_id is represented as a JSON string. org_id MUST be present.
 
 2.2.1.11.  orgc_id
@@ -324,20 +312,9 @@ Internet-Draft              MISP core format                October 2021
    present and be one of the following options:
 
    0  Your Organisation Only
-
    1  This Community Only
-
    2  Connected Communities
-
    3  All Communities
-
-
-
-Dulaunoy & Iklody          Expires 1 May 2022                   [Page 6]
-
-Internet-Draft              MISP core format                October 2021
-
-
    4  Sharing Group
 
 2.2.1.14.  sharing_group_id
@@ -351,6 +328,16 @@ Internet-Draft              MISP core format                October 2021
    present.  If a distribution level other than "4" is chosen the
    sharing_group_id MUST be set to "0".
 
+
+
+
+
+
+Dulaunoy & Iklody        Expires 19 August 2022                 [Page 6]
+
+Internet-Draft              MISP core format               February 2022
+
+
 2.2.1.15.  extends_uuid
 
    extends_uuid represents which event is extended by this event.  The
@@ -360,9 +347,9 @@ Internet-Draft              MISP core format                October 2021
    extends_uuid is represented as a JSON string. extends_uuid SHOULD be
    present.
 
-2.3.  Objects
+2.2.2.  Event Objects
 
-2.3.1.  Org
+2.2.2.1.  Org
 
    An Org object is composed of an uuid, name and id.
 
@@ -378,7 +365,7 @@ Internet-Draft              MISP core format                October 2021
    uuid, name and id are represented as a JSON string. uuid, name and id
    MUST be present.
 
-2.3.1.1.  Sample Org Object
+2.2.2.1.1.  Sample Org Object
 
    "Org": {
            "id": "2",
@@ -386,15 +373,7 @@ Internet-Draft              MISP core format                October 2021
            "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"
           }
 
-
-
-
-Dulaunoy & Iklody          Expires 1 May 2022                   [Page 7]
-
-Internet-Draft              MISP core format                October 2021
-
-
-2.3.2.  Orgc
+2.2.2.2.  Orgc
 
    An Orgc object is composed of an uuid, name and id.
 
@@ -408,10 +387,17 @@ Internet-Draft              MISP core format                October 2021
    instance and used as reference in the event.  A human-readable
    identifier MUST be represented as an unsigned integer.
 
+
+
+Dulaunoy & Iklody        Expires 19 August 2022                 [Page 7]
+
+Internet-Draft              MISP core format               February 2022
+
+
    uuid, name and id are represented as a JSON string. uuid, name and id
    MUST be present.
 
-2.4.  Attribute
+2.3.  Attribute
 
    Attributes are used to describe the indicators and contextual data of
    an event.  The main information contained in an attribute is made up
@@ -422,33 +408,7 @@ Internet-Draft              MISP core format                October 2021
    A MISP document MUST at least includes category-type-value triplet
    described in section "Attribute Attributes".
 
-2.4.1.  Sample Attribute Object
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-Dulaunoy & Iklody          Expires 1 May 2022                   [Page 8]
-
-Internet-Draft              MISP core format                October 2021
-
+2.3.1.  Sample Attribute Object
 
    "Attribute": {
                  "id": "346056",
@@ -470,9 +430,9 @@ Internet-Draft              MISP core format                October 2021
                  "last_seen": null
                 }
 
-2.4.2.  Attribute Attributes
+2.3.2.  Attribute Attributes
 
-2.4.2.1.  uuid
+2.3.2.1.  uuid
 
    uuid represents the Universally Unique IDentifier (UUID) [RFC4122] of
    the event.  The uuid MUST be preserved for any updates or transfer of
@@ -481,7 +441,16 @@ Internet-Draft              MISP core format                October 2021
 
    uuid is represented as a JSON string. uuid MUST be present.
 
-2.4.2.2.  id
+
+
+
+
+Dulaunoy & Iklody        Expires 19 August 2022                 [Page 8]
+
+Internet-Draft              MISP core format               February 2022
+
+
+2.3.2.2.  id
 
    id represents the human-readable identifier associated to the event
    for a specific MISP instance.  A human-readable identifier MUST be
@@ -489,7 +458,7 @@ Internet-Draft              MISP core format                October 2021
 
    id is represented as a JSON string. id SHALL be present.
 
-2.4.2.3.  type
+2.3.2.3.  type
 
    type represents the means through which an attribute tries to
    describe the intent of the attribute creator, using a list of pre-
@@ -499,16 +468,8 @@ Internet-Draft              MISP core format                October 2021
    MUST be a valid selection for the chosen category.  The list of valid
    category-type combinations is as follows:
 
-
-
-Dulaunoy & Iklody          Expires 1 May 2022                   [Page 9]
-
-Internet-Draft              MISP core format                October 2021
-
-
    Antivirus detection  link, comment, text, hex, attachment, other,
       anonymised
-
    Artifacts dropped  md5, sha1, sha224, sha256, sha384, sha512,
       sha512/224, sha512/256, sha3-224, sha3-256, sha3-384, sha3-512,
       ssdeep, imphash, telfhash, impfuzzy, authentihash, vhash, cdhash,
@@ -526,42 +487,37 @@ Internet-Draft              MISP core format                October 2021
       fingerprint-md5, x509-fingerprint-sha256, other, cookie, gene,
       kusto-query, mime-type, anonymised, pgp-public-key, pgp-private-
       key
-
    Attribution  threat-actor, campaign-name, campaign-id, whois-
       registrant-phone, whois-registrant-email, whois-registrant-name,
       whois-registrant-org, whois-registrar, whois-creation-date,
       comment, text, x509-fingerprint-sha1, x509-fingerprint-md5, x509-
       fingerprint-sha256, other, dns-soa-email, anonymised, email
-
    External analysis  md5, sha1, sha256, sha3-224, sha3-256, sha3-384,
       sha3-512, filename, filename|md5, filename|sha1, filename|sha256,
       filename|sha3-224, filename|sha3-256, filename|sha3-384,
       filename|sha3-512, ip-src, ip-dst, ip-dst|port, ip-src|port, mac-
       address, mac-eui-64, hostname, domain, domain|ip, url, user-agent,
       regkey, regkey|value, AS, snort, bro, zeek, pattern-in-file,
+
+
+
+Dulaunoy & Iklody        Expires 19 August 2022                 [Page 9]
+
+Internet-Draft              MISP core format               February 2022
+
+
       pattern-in-traffic, pattern-in-memory, filename-pattern,
       vulnerability, cpe, weakness, attachment, malware-sample, link,
       comment, text, x509-fingerprint-sha1, x509-fingerprint-md5, x509-
       fingerprint-sha256, ja3-fingerprint-md5, jarm-fingerprint, hassh-
       md5, hasshserver-md5, github-repository, other, cortex,
       anonymised, community-id
-
    Financial fraud  btc, dash, xmr, iban, bic, bank-account-nr, aba-rtn,
       bin, cc-number, prtn, phone-number, comment, text, other, hex,
       anonymised
-
    Internal reference  text, link, comment, other, hex, anonymised, git-
       commit-id
-
    Network activity  ip-src, ip-dst, ip-dst|port, ip-src|port, port,
-
-
-
-Dulaunoy & Iklody          Expires 1 May 2022                  [Page 10]
-
-Internet-Draft              MISP core format                October 2021
-
-
       hostname, domain, domain|ip, mac-address, mac-eui-64, email,
       email-dst, email-src, eppn, url, uri, user-agent, http-method, AS,
       snort, pattern-in-file, filename-pattern, stix2-pattern, pattern-
@@ -570,11 +526,9 @@ Internet-Draft              MISP core format                October 2021
       jarm-fingerprint, hassh-md5, hasshserver-md5, other, hex, cookie,
       hostname|port, bro, zeek, anonymised, community-id, email-subject,
       favicon-mmh3, dkim, dkim-signature, ssh-fingerprint
-
    Other  comment, text, other, size-in-bytes, counter, datetime, cpe,
       port, float, hex, phone-number, boolean, anonymised, pgp-public-
       key, pgp-private-key
-
    Payload delivery  md5, sha1, sha224, sha256, sha384, sha512,
       sha512/224, sha512/256, sha3-224, sha3-256, sha3-384, sha3-512,
       ssdeep, imphash, telfhash, impfuzzy, authentihash, vhash, pehash,
@@ -597,8 +551,17 @@ Internet-Draft              MISP core format                October 2021
       email-header, email-reply-to, email-x-mailer, email-mime-boundary,
       email-thread-index, email-message-id, mobile-application-id,
       chrome-extension-id, whois-registrant-email, anonymised
-
    Payload installation  md5, sha1, sha224, sha256, sha384, sha512,
+
+
+
+
+
+Dulaunoy & Iklody        Expires 19 August 2022                [Page 10]
+
+Internet-Draft              MISP core format               February 2022
+
+
       sha512/224, sha512/256, sha3-224, sha3-256, sha3-384, sha3-512,
       ssdeep, imphash, telfhash, impfuzzy, authentihash, vhash, pehash,
       tlsh, cdhash, filename, filename|md5, filename|sha1,
@@ -610,23 +573,12 @@ Internet-Draft              MISP core format                October 2021
       filename|impfuzzy, filename|pehash, pattern-in-file, pattern-in-
       traffic, pattern-in-memory, filename-pattern, stix2-pattern, yara,
       sigma, vulnerability, cpe, weakness, attachment, malware-sample,
-
-
-
-Dulaunoy & Iklody          Expires 1 May 2022                  [Page 11]
-
-Internet-Draft              MISP core format                October 2021
-
-
       malware-type, comment, text, hex, x509-fingerprint-sha1, x509-
       fingerprint-md5, x509-fingerprint-sha256, mobile-application-id,
       chrome-extension-id, other, mime-type, anonymised
-
    Payload type  comment, text, other, anonymised
-
    Persistence mechanism  filename, regkey, regkey|value, comment, text,
       other, hex, anonymised
-
    Person  first-name, middle-name, last-name, full-name, date-of-birth,
       place-of-birth, gender, passport-number, passport-country,
       passport-expiration, redress-number, nationality, visa-number,
@@ -637,14 +589,11 @@ Internet-Draft              MISP core format                October 2021
       name-record-locator-number, comment, text, other, phone-number,
       identity-card-number, anonymised, email, pgp-public-key, pgp-
       private-key
-
    Social network  github-username, github-repository, github-
       organisation, jabber-id, twitter-id, email, email-src, email-dst,
       eppn, comment, text, other, whois-registrant-email, anonymised,
       pgp-public-key, pgp-private-key
-
    Support Tool  link, text, attachment, comment, other, hex, anonymised
-
    Targeting data  target-user, target-email, target-machine, target-
       org, target-location, target-external, comment, anonymised
 
@@ -652,7 +601,7 @@ Internet-Draft              MISP core format                October 2021
    Attributes can be extended on a regular basis and this reference
    document is updated accordingly.
 
-2.4.2.4.  category
+2.3.2.4.  category
 
    category represents the intent of what the attribute is describing as
    selected by the attribute creator, using a list of pre-defined
@@ -664,17 +613,12 @@ Internet-Draft              MISP core format                October 2021
 
 
 
-
-
-
-
-
-Dulaunoy & Iklody          Expires 1 May 2022                  [Page 12]
+Dulaunoy & Iklody        Expires 19 August 2022                [Page 11]
 
-Internet-Draft              MISP core format                October 2021
+Internet-Draft              MISP core format               February 2022
 
 
-2.4.2.5.  to_ids
+2.3.2.5.  to_ids
 
    to_ids represents whether the attribute is meant to be actionable.
    Actionable defined attributes that can be used in automated processes
@@ -683,7 +627,7 @@ Internet-Draft              MISP core format                October 2021
 
    to_ids is represented as a JSON boolean. to_ids MUST be present.
 
-2.4.2.6.  event_id
+2.3.2.6.  event_id
 
    event_id represents a human-readable identifier referencing the Event
    object that the attribute belongs to.  A human-readable identifier
@@ -694,7 +638,7 @@ Internet-Draft              MISP core format                October 2021
 
    event_id is represented as a JSON string. event_id MUST be present.
 
-2.4.2.7.  distribution
+2.3.2.7.  distribution
 
    distribution represents the basic distribution rules of the
    attribute.  The system must adhere to the distribution setting for
@@ -704,18 +648,13 @@ Internet-Draft              MISP core format                October 2021
    present and be one of the following options:
 
    0  Your Organisation Only
-
    1  This Community Only
-
    2  Connected Communities
-
    3  All Communities
-
    4  Sharing Group
-
    5  Inherit Event
 
-2.4.2.8.  timestamp
+2.3.2.8.  timestamp
 
    timestamp represents a reference time when the attribute was created
    or last modified. timestamp is expressed in seconds (decimal) since
@@ -723,20 +662,21 @@ Internet-Draft              MISP core format                October 2021
 
    timestamp is represented as a JSON string. timestamp MUST be present.
 
-
-
-Dulaunoy & Iklody          Expires 1 May 2022                  [Page 13]
-
-Internet-Draft              MISP core format                October 2021
-
-
-2.4.2.9.  comment
+2.3.2.9.  comment
 
    comment is a contextual comment field.
 
+
+
+
+Dulaunoy & Iklody        Expires 19 August 2022                [Page 12]
+
+Internet-Draft              MISP core format               February 2022
+
+
    comment is represented by a JSON string. comment MAY be present.
 
-2.4.2.10.  sharing_group_id
+2.3.2.10.  sharing_group_id
 
    sharing_group_id represents a human-readable identifier referencing a
    Sharing Group object that defines the distribution of the attribute,
@@ -747,7 +687,7 @@ Internet-Draft              MISP core format                October 2021
    present.  If a distribution level other than "4" is chosen the
    sharing_group_id MUST be set to "0".
 
-2.4.2.11.  deleted
+2.3.2.11.  deleted
 
    deleted represents a setting that allows attributes to be revoked.
    Revoked attributes are not actionable and exist merely to inform
@@ -755,7 +695,7 @@ Internet-Draft              MISP core format                October 2021
 
    deleted is represented by a JSON boolean. deleted MUST be present.
 
-2.4.2.12.  data
+2.3.2.12.  data
 
    data contains the base64 encoded contents of an attachment or a
    malware sample.  For malware samples, the sample MUST be encrypted
@@ -765,7 +705,7 @@ Internet-Draft              MISP core format                October 2021
    data is represented by a JSON string in base64 encoding. data MUST be
    set for attributes of type malware-sample and attachment.
 
-2.4.2.13.  RelatedAttribute
+2.3.2.13.  RelatedAttribute
 
    RelatedAttribute is an array of attributes correlating with the
    current attribute.  Each element in the array represents an JSON
@@ -781,12 +721,16 @@ Internet-Draft              MISP core format                October 2021
 
 
 
-Dulaunoy & Iklody          Expires 1 May 2022                  [Page 14]
+
+
+
+
+Dulaunoy & Iklody        Expires 19 August 2022                [Page 13]
 
-Internet-Draft              MISP core format                October 2021
+Internet-Draft              MISP core format               February 2022
 
 
-2.4.2.14.  ShadowAttribute
+2.3.2.14.  ShadowAttribute
 
    ShadowAttribute is an array of shadow attributes that serve as
    proposals by third parties to alter the containing attribute.  The
@@ -799,14 +743,14 @@ Internet-Draft              MISP core format                October 2021
    containing attribute's ID in the old_id field and the event's ID in
    the event_id field.
 
-2.4.2.15.  value
+2.3.2.15.  value
 
    value represents the payload of an attribute.  The format of the
    value is dependent on the type of the attribute.
 
    value is represented by a JSON string. value MUST be present.
 
-2.4.2.16.  first_seen
+2.3.2.16.  first_seen
 
    first_seen represents a reference time when the attribute was first
    seen. first_seen is expressed as an ISO 8601 datetime up to the
@@ -815,7 +759,7 @@ Internet-Draft              MISP core format                October 2021
    first_seen is represented as a JSON string. first_seen MAY be
    present.
 
-2.4.2.17.  last_seen
+2.3.2.17.  last_seen
 
    last_seen represents a reference time when the attribute was last
    seen. last_seen is expressed as an ISO 8601 datetime up to the micro-
@@ -823,7 +767,7 @@ Internet-Draft              MISP core format                October 2021
 
    last_seen is represented as a JSON string. last_seen MAY be present.
 
-2.5.  ShadowAttribute
+2.4.  ShadowAttribute
 
    ShadowAttributes are 3rd party created attributes that either propose
    to add new information to an event or modify existing information.
@@ -837,12 +781,12 @@ Internet-Draft              MISP core format                October 2021
 
 
 
-Dulaunoy & Iklody          Expires 1 May 2022                  [Page 15]
+Dulaunoy & Iklody        Expires 19 August 2022                [Page 14]
 
-Internet-Draft              MISP core format                October 2021
+Internet-Draft              MISP core format               February 2022
 
 
-2.5.1.  Sample Attribute Object
+2.4.1.  Sample Attribute Object
 
 "ShadowAttribute":  {
                        "id": "8",
@@ -867,9 +811,9 @@ Internet-Draft              MISP core format                October 2021
                        "last_seen": null
                    }
 
-2.5.2.  ShadowAttribute Attributes
+2.4.2.  ShadowAttribute Attributes
 
-2.5.2.1.  uuid
+2.4.2.1.  uuid
 
    uuid represents the Universally Unique IDentifier (UUID) [RFC4122] of
    the event.  The uuid MUST be preserved for any updates or transfer of
@@ -878,14 +822,14 @@ Internet-Draft              MISP core format                October 2021
 
    uuid is represented as a JSON string. uuid MUST be present.
 
-2.5.2.2.  id
+2.4.2.2.  id
 
    id represents the human-readable identifier associated to the event
    for a specific MISP instance. human-readable identifier MUST be
    represented as an unsigned integer. id is represented as a JSON
    string. id SHALL be present.
 
-2.5.2.3.  type
+2.4.2.3.  type
 
    type represents the means through which an attribute tries to
    describe the intent of the attribute creator, using a list of pre-
@@ -893,9 +837,9 @@ Internet-Draft              MISP core format                October 2021
 
 
 
-Dulaunoy & Iklody          Expires 1 May 2022                  [Page 16]
+Dulaunoy & Iklody        Expires 19 August 2022                [Page 15]
 
-Internet-Draft              MISP core format                October 2021
+Internet-Draft              MISP core format               February 2022
 
 
    type is represented as a JSON string. type MUST be present and it
@@ -904,7 +848,6 @@ Internet-Draft              MISP core format                October 2021
 
    Antivirus detection  link, comment, text, hex, attachment, other,
       anonymised
-
    Artifacts dropped  md5, sha1, sha224, sha256, sha384, sha512,
       sha512/224, sha512/256, sha3-224, sha3-256, sha3-384, sha3-512,
       ssdeep, imphash, telfhash, impfuzzy, authentihash, vhash, cdhash,
@@ -922,13 +865,11 @@ Internet-Draft              MISP core format                October 2021
       fingerprint-md5, x509-fingerprint-sha256, other, cookie, gene,
       kusto-query, mime-type, anonymised, pgp-public-key, pgp-private-
       key
-
    Attribution  threat-actor, campaign-name, campaign-id, whois-
       registrant-phone, whois-registrant-email, whois-registrant-name,
       whois-registrant-org, whois-registrar, whois-creation-date,
       comment, text, x509-fingerprint-sha1, x509-fingerprint-md5, x509-
       fingerprint-sha256, other, dns-soa-email, anonymised, email
-
    External analysis  md5, sha1, sha256, sha3-224, sha3-256, sha3-384,
       sha3-512, filename, filename|md5, filename|sha1, filename|sha256,
       filename|sha3-224, filename|sha3-256, filename|sha3-384,
@@ -941,23 +882,22 @@ Internet-Draft              MISP core format                October 2021
       fingerprint-sha256, ja3-fingerprint-md5, jarm-fingerprint, hassh-
       md5, hasshserver-md5, github-repository, other, cortex,
       anonymised, community-id
-
    Financial fraud  btc, dash, xmr, iban, bic, bank-account-nr, aba-rtn,
       bin, cc-number, prtn, phone-number, comment, text, other, hex,
       anonymised
-
-
-
-
-Dulaunoy & Iklody          Expires 1 May 2022                  [Page 17]
-
-Internet-Draft              MISP core format                October 2021
-
-
    Internal reference  text, link, comment, other, hex, anonymised, git-
       commit-id
-
    Network activity  ip-src, ip-dst, ip-dst|port, ip-src|port, port,
+
+
+
+
+
+Dulaunoy & Iklody        Expires 19 August 2022                [Page 16]
+
+Internet-Draft              MISP core format               February 2022
+
+
       hostname, domain, domain|ip, mac-address, mac-eui-64, email,
       email-dst, email-src, eppn, url, uri, user-agent, http-method, AS,
       snort, pattern-in-file, filename-pattern, stix2-pattern, pattern-
@@ -966,11 +906,9 @@ Internet-Draft              MISP core format                October 2021
       jarm-fingerprint, hassh-md5, hasshserver-md5, other, hex, cookie,
       hostname|port, bro, zeek, anonymised, community-id, email-subject,
       favicon-mmh3, dkim, dkim-signature, ssh-fingerprint
-
    Other  comment, text, other, size-in-bytes, counter, datetime, cpe,
       port, float, hex, phone-number, boolean, anonymised, pgp-public-
       key, pgp-private-key
-
    Payload delivery  md5, sha1, sha224, sha256, sha384, sha512,
       sha512/224, sha512/256, sha3-224, sha3-256, sha3-384, sha3-512,
       ssdeep, imphash, telfhash, impfuzzy, authentihash, vhash, pehash,
@@ -993,7 +931,6 @@ Internet-Draft              MISP core format                October 2021
       email-header, email-reply-to, email-x-mailer, email-mime-boundary,
       email-thread-index, email-message-id, mobile-application-id,
       chrome-extension-id, whois-registrant-email, anonymised
-
    Payload installation  md5, sha1, sha224, sha256, sha384, sha512,
       sha512/224, sha512/256, sha3-224, sha3-256, sha3-384, sha3-512,
       ssdeep, imphash, telfhash, impfuzzy, authentihash, vhash, pehash,
@@ -1002,14 +939,6 @@ Internet-Draft              MISP core format                October 2021
       filename|sha512, filename|sha512/224, filename|sha512/256,
       filename|sha3-224, filename|sha3-256, filename|sha3-384,
       filename|sha3-512, filename|authentihash, filename|vhash,
-
-
-
-Dulaunoy & Iklody          Expires 1 May 2022                  [Page 18]
-
-Internet-Draft              MISP core format                October 2021
-
-
       filename|ssdeep, filename|tlsh, filename|imphash,
       filename|impfuzzy, filename|pehash, pattern-in-file, pattern-in-
       traffic, pattern-in-memory, filename-pattern, stix2-pattern, yara,
@@ -1018,11 +947,16 @@ Internet-Draft              MISP core format                October 2021
       fingerprint-md5, x509-fingerprint-sha256, mobile-application-id,
       chrome-extension-id, other, mime-type, anonymised
 
-   Payload type  comment, text, other, anonymised
 
+
+Dulaunoy & Iklody        Expires 19 August 2022                [Page 17]
+
+Internet-Draft              MISP core format               February 2022
+
+
+   Payload type  comment, text, other, anonymised
    Persistence mechanism  filename, regkey, regkey|value, comment, text,
       other, hex, anonymised
-
    Person  first-name, middle-name, last-name, full-name, date-of-birth,
       place-of-birth, gender, passport-number, passport-country,
       passport-expiration, redress-number, nationality, visa-number,
@@ -1033,14 +967,11 @@ Internet-Draft              MISP core format                October 2021
       name-record-locator-number, comment, text, other, phone-number,
       identity-card-number, anonymised, email, pgp-public-key, pgp-
       private-key
-
    Social network  github-username, github-repository, github-
       organisation, jabber-id, twitter-id, email, email-src, email-dst,
       eppn, comment, text, other, whois-registrant-email, anonymised,
       pgp-public-key, pgp-private-key
-
    Support Tool  link, text, attachment, comment, other, hex, anonymised
-
    Targeting data  target-user, target-email, target-machine, target-
       org, target-location, target-external, comment, anonymised
 
@@ -1048,7 +979,7 @@ Internet-Draft              MISP core format                October 2021
    Attributes can be extended on a regular basis and this reference
    document is updated accordingly.
 
-2.5.2.4.  category
+2.4.2.4.  category
 
    category represents the intent of what the attribute is describing as
    selected by the attribute creator, using a list of pre-defined
@@ -1058,15 +989,7 @@ Internet-Draft              MISP core format                October 2021
    and it MUST be a valid selection for the chosen type.  The list of
    valid category-type combinations is mentioned above.
 
-
-
-
-Dulaunoy & Iklody          Expires 1 May 2022                  [Page 19]
-
-Internet-Draft              MISP core format                October 2021
-
-
-2.5.2.5.  to_ids
+2.4.2.5.  to_ids
 
    to_ids represents whether the Attribute to be created if the
    ShadowAttribute is accepted is meant to be actionable.  Actionable
@@ -1076,7 +999,18 @@ Internet-Draft              MISP core format                October 2021
 
    to_ids is represented as a JSON boolean. to_ids MUST be present.
 
-2.5.2.6.  event_id
+
+
+
+
+
+
+Dulaunoy & Iklody        Expires 19 August 2022                [Page 18]
+
+Internet-Draft              MISP core format               February 2022
+
+
+2.4.2.6.  event_id
 
    event_id represents a human-readable identifier referencing the Event
    object that the ShadowAttribute belongs to.
@@ -1086,7 +1020,7 @@ Internet-Draft              MISP core format                October 2021
 
    event_id is represented as a JSON string. event_id MUST be present.
 
-2.5.2.7.  old_id
+2.4.2.7.  old_id
 
    old_id represents a human-readable identifier referencing the
    Attribute object that the ShadowAttribute belongs to.  A
@@ -1102,7 +1036,7 @@ Internet-Draft              MISP core format                October 2021
 
    old_id is represented as a JSON string. old_id MUST be present.
 
-2.5.2.8.  timestamp
+2.4.2.8.  timestamp
 
    timestamp represents a reference time when the attribute was created
    or last modified. timestamp is expressed in seconds (decimal) since
@@ -1110,33 +1044,35 @@ Internet-Draft              MISP core format                October 2021
 
    timestamp is represented as a JSON string. timestamp MUST be present.
 
-2.5.2.9.  comment
+2.4.2.9.  comment
 
    comment is a contextual comment field.
 
-
-
-
-Dulaunoy & Iklody          Expires 1 May 2022                  [Page 20]
-
-Internet-Draft              MISP core format                October 2021
-
-
    comment is represented by a JSON string. comment MAY be present.
 
-2.5.2.10.  org_id
+2.4.2.10.  org_id
 
    org_id represents a human-readable identifier referencing the
    proposal creator's Organisation object.  A human-readable identifier
    MUST be represented as an unsigned integer.
 
+
+
+
+
+
+Dulaunoy & Iklody        Expires 19 August 2022                [Page 19]
+
+Internet-Draft              MISP core format               February 2022
+
+
    Whilst attributes can only be created by the event creator
    organisation, shadow attributes can be created by third parties.
    org_id tracks the creator organisation.
 
    org_id is represented by a JSON string and MUST be present.
 
-2.5.2.11.  proposal_to_delete
+2.4.2.11.  proposal_to_delete
 
    proposal_to_delete is a boolean flag that sets whether the shadow
    attribute proposes to alter an attribute, or whether it proposes to
@@ -1148,7 +1084,7 @@ Internet-Draft              MISP core format                October 2021
    proposal_to_delete is a JSON boolean and it MUST be present.  If
    proposal_to_delete is set to true, old_id MUST NOT be 0.
 
-2.5.2.12.  deleted
+2.4.2.12.  deleted
 
    deleted represents a setting that allows shadow attributes to be
    revoked.  Revoked shadow attributes only serve to inform other
@@ -1156,7 +1092,7 @@ Internet-Draft              MISP core format                October 2021
 
    deleted is represented by a JSON boolean. deleted SHOULD be present.
 
-2.5.2.13.  data
+2.4.2.13.  data
 
    data contains the base64 encoded contents of an attachment or a
    malware sample.  For malware samples, the sample MUST be encrypted
@@ -1166,19 +1102,7 @@ Internet-Draft              MISP core format                October 2021
    data is represented by a JSON string in base64 encoding. data MUST be
    set for shadow attributes of type malware-sample and attachment.
 
-
-
-
-
-
-
-
-Dulaunoy & Iklody          Expires 1 May 2022                  [Page 21]
-
-Internet-Draft              MISP core format                October 2021
-
-
-2.5.2.14.  first_seen
+2.4.2.14.  first_seen
 
    first_seen represents a reference time when the attribute was first
    seen. first_seen as an ISO 8601 datetime up to the micro-second with
@@ -1187,7 +1111,18 @@ Internet-Draft              MISP core format                October 2021
    first_seen is represented as a JSON string. first_seen MAY be
    present.
 
-2.5.2.15.  last_seen
+
+
+
+
+
+
+Dulaunoy & Iklody        Expires 19 August 2022                [Page 20]
+
+Internet-Draft              MISP core format               February 2022
+
+
+2.4.2.15.  last_seen
 
    last_seen represents a reference time when the attribute was last
    seen. last_seen as an ISO 8601 datetime up to the micro-second with
@@ -1195,7 +1130,16 @@ Internet-Draft              MISP core format                October 2021
 
    last_seen is represented as a JSON string. last_seen MAY be present.
 
-2.5.3.  Org
+2.4.2.16.  value
+
+   value represents the payload of an attribute.  The format of the
+   value is dependent on the type of the attribute.
+
+   value is represented by a JSON string. value MUST be present.
+
+2.4.3.  ShadowAttribute Objects
+
+2.4.3.1.  Org
 
    An Org object is composed of an uuid, name and id.
 
@@ -1211,7 +1155,7 @@ Internet-Draft              MISP core format                October 2021
    uuid, name and id are represented as a JSON string. uuid, name and id
    MUST be present.
 
-2.5.3.1.  Sample Org Object
+2.4.3.1.1.  Sample Org Object
 
    "Org": {
            "id": "2",
@@ -1219,22 +1163,22 @@ Internet-Draft              MISP core format                October 2021
            "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"
           }
 
-2.5.3.2.  value
-
-   value represents the payload of an attribute.  The format of the
-   value is dependent on the type of the attribute.
-
-   value is represented by a JSON string. value MUST be present.
 
 
 
 
-Dulaunoy & Iklody          Expires 1 May 2022                  [Page 22]
+
+
+
+
+
+
+Dulaunoy & Iklody        Expires 19 August 2022                [Page 21]
 
-Internet-Draft              MISP core format                October 2021
+Internet-Draft              MISP core format               February 2022
 
 
-2.6.  Object
+2.5.  Object
 
    Objects serve as a contextual bond between a list of attributes
    within an event.  Their main purpose is to describe more complex
@@ -1250,7 +1194,7 @@ Internet-Draft              MISP core format                October 2021
    category, a description, a template_uuid and a template_version as
    described in the "Object Attributes" section.
 
-2.6.1.  Sample Object
+2.5.1.  Sample Object
 
 
 
@@ -1285,9 +1229,9 @@ Internet-Draft              MISP core format                October 2021
 
 
 
-Dulaunoy & Iklody          Expires 1 May 2022                  [Page 23]
+Dulaunoy & Iklody        Expires 19 August 2022                [Page 22]
 
-Internet-Draft              MISP core format                October 2021
+Internet-Draft              MISP core format               February 2022
 
 
 "Object": {
@@ -1331,7 +1275,7 @@ Internet-Draft              MISP core format                October 2021
    ]
 }
 
-2.6.2.  Object Attributes
+2.5.2.  Object Attributes
 
 
 
@@ -1341,19 +1285,19 @@ Internet-Draft              MISP core format                October 2021
 
 
 
-Dulaunoy & Iklody          Expires 1 May 2022                  [Page 24]
+Dulaunoy & Iklody        Expires 19 August 2022                [Page 23]
 
-Internet-Draft              MISP core format                October 2021
+Internet-Draft              MISP core format               February 2022
 
 
-2.6.2.1.  uuid
+2.5.2.1.  uuid
 
    uuid represents the Universally Unique IDentifier (UUID) [RFC4122] of
    the object.  The uuid MUST be preserved for any updates or transfer
    of the same object.  UUID version 4 is RECOMMENDED when assigning it
    to a new object.
 
-2.6.2.2.  id
+2.5.2.2.  id
 
    id represents the human-readable identifier associated to the object
    for a specific MISP instance.  A human-readable identifier MUST be
@@ -1361,48 +1305,51 @@ Internet-Draft              MISP core format                October 2021
 
    id is represented as a JSON string. id SHALL be present.
 
-2.6.2.3.  name
+2.5.2.3.  name
 
    name represents the human-readable name of the object describing the
    intent of the object package.
 
-   name is represented as a JSON string. name MUST be present
+   name is represented as a JSON string. name MUST be present.
 
-2.6.2.4.  meta-category
+2.5.2.4.  meta-category
 
    meta-category represents the sub-category of objects that the given
    object belongs to. meta-categories are not tied to a fixed list of
    options but can be created on the fly.
 
    meta-category is represented as a JSON string. meta-category MUST be
-   present
+   present.
 
-2.6.2.5.  description
+2.5.2.5.  description
 
    description is a human-readable description of the given object type,
    as derived from the template used for creation.
 
-   description is represented as a JSON string. id SHALL be present.
+   description is represented as a JSON string. description SHALL be
+   present.
 
-2.6.2.6.  template_uuid
+2.5.2.6.  template_uuid
 
-   uuid represents the Universally Unique IDentifier (UUID) [RFC4122] of
-   the template used to create the object.  The uuid MUST be preserved
-   to preserve the object's association with the correct template used
-   for creation.  UUID version 4 is RECOMMENDED when assigning it to a
-   new object.
+   template_uuid represents the Universally Unique IDentifier (UUID)
+   [RFC4122] of the template used to create the object.  The uuid MUST
+   be preserved to preserve the object's association with the correct
+   template used for creation.  UUID version 4 is RECOMMENDED when
+   assigning it to a new object.
 
 
 
 
 
-
-Dulaunoy & Iklody          Expires 1 May 2022                  [Page 25]
+Dulaunoy & Iklody        Expires 19 August 2022                [Page 24]
 
-Internet-Draft              MISP core format                October 2021
+Internet-Draft              MISP core format               February 2022
 
 
-2.6.2.7.  template_version
+   template_uuid is represented as a JSON string. template_uuid MUST be
+   present.
+
+2.5.2.7.  template_version
 
    template_version represents a numeric incrementing version of the
    template used to create the object.  It is used to associate the
@@ -1410,9 +1357,10 @@ Internet-Draft              MISP core format                October 2021
    template_uuid forms an association to the correct template type and
    version.
 
-   version is represented as a JSON string. version MUST be present.
+   template_version is represented as a JSON string. template_version
+   MUST be present.
 
-2.6.2.8.  event_id
+2.5.2.8.  event_id
 
    event_id represents the human-readable identifier of the event that
    the object belongs to on a specific MISP instance.  A human-readable
@@ -1420,7 +1368,7 @@ Internet-Draft              MISP core format                October 2021
 
    event_id is represented as a JSON string. event_id SHALL be present.
 
-2.6.2.9.  timestamp
+2.5.2.9.  timestamp
 
    timestamp represents a reference time when the object was created or
    last modified. timestamp is expressed in seconds (decimal) since 1st
@@ -1428,7 +1376,7 @@ Internet-Draft              MISP core format                October 2021
 
    timestamp is represented as a JSON string. timestamp MUST be present.
 
-2.6.2.10.  distribution
+2.5.2.10.  distribution
 
    distribution represents the basic distribution rules of the object.
    The system must adhere to the distribution setting for access control
@@ -1438,13 +1386,9 @@ Internet-Draft              MISP core format                October 2021
    present and be one of the following options:
 
    0  Your Organisation Only
-
    1  This Community Only
-
    2  Connected Communities
-
    3  All Communities
-
    4  Sharing Group
 
 
@@ -1453,12 +1397,12 @@ Internet-Draft              MISP core format                October 2021
 
 
 
-Dulaunoy & Iklody          Expires 1 May 2022                  [Page 26]
+Dulaunoy & Iklody        Expires 19 August 2022                [Page 25]
 
-Internet-Draft              MISP core format                October 2021
+Internet-Draft              MISP core format               February 2022
 
 
-2.6.2.11.  sharing_group_id
+2.5.2.11.  sharing_group_id
 
    sharing_group_id represents a human-readable identifier referencing a
    Sharing Group object that defines the distribution of the object, if
@@ -1469,21 +1413,21 @@ Internet-Draft              MISP core format                October 2021
    present.  If a distribution level other than "4" is chosen the
    sharing_group_id MUST be set to "0".
 
-2.6.2.12.  comment
+2.5.2.12.  comment
 
    comment is a contextual comment field.
 
    comment is represented by a JSON string. comment MAY be present.
 
-2.6.2.13.  deleted
+2.5.2.13.  deleted
 
-   deleted represents a setting that allows attributes to be revoked.
-   Revoked attributes are not actionable and exist merely to inform
-   other instances of a revocation.
+   deleted represents a setting that allows objects to be revoked.
+   Revoked objects are not actionable and exist merely to inform other
+   instances of a revocation.
 
    deleted is represented by a JSON boolean. deleted MUST be present.
 
-2.6.2.14.  Attribute
+2.5.2.14.  Attribute
 
    Attribute is an array of attributes that describe the object with
    data.
@@ -1491,7 +1435,7 @@ Internet-Draft              MISP core format                October 2021
    Each attribute in an object MUST contain the parent event's ID in the
    event_id field and the parent object's ID in the object_id field.
 
-2.6.2.15.  first_seen
+2.5.2.15.  first_seen
 
    first_seen represents a reference time when the object was first
    seen. first_seen as an ISO 8601 datetime up to the micro-second with
@@ -1500,7 +1444,7 @@ Internet-Draft              MISP core format                October 2021
    first_seen is represented as a JSON string. first_seen MAY be
    present.
 
-2.6.2.16.  last_seen
+2.5.2.16.  last_seen
 
    last_seen represents a reference time when the object was last seen.
    last_seen as an ISO 8601 datetime up to the micro-second with time
@@ -1509,14 +1453,14 @@ Internet-Draft              MISP core format                October 2021
 
 
 
-Dulaunoy & Iklody          Expires 1 May 2022                  [Page 27]
+Dulaunoy & Iklody        Expires 19 August 2022                [Page 26]
 
-Internet-Draft              MISP core format                October 2021
+Internet-Draft              MISP core format               February 2022
 
 
    last_seen is represented as a JSON string. last_seen MAY be present.
 
-2.7.  Object References
+2.6.  Object References
 
    Object References serve as a logical link between an Object and
    another referenced Object or Attribute.  The relationship is
@@ -1529,7 +1473,7 @@ Internet-Draft              MISP core format                October 2021
    All Object References MUST contain an object_uuid, a referenced_uuid
    and a relationship type.
 
-2.7.1.  Sample ObjectReference object
+2.6.1.  Sample ObjectReference object
 
 "ObjectReference": {
                     "id": "195",
@@ -1546,16 +1490,16 @@ Internet-Draft              MISP core format                October 2021
                     "referenced_uuid": "59c1133c-9adc-4d06-a34b-0f7ca07724d1",
                    }
 
-2.7.2.  ObjectReference Attributes
+2.6.2.  ObjectReference Attributes
 
-2.7.2.1.  uuid
+2.6.2.1.  uuid
 
    uuid represents the Universally Unique IDentifier (UUID) [RFC4122] of
    the object reference.  The uuid MUST be preserved for any updates or
    transfer of the same object reference.  UUID version 4 is RECOMMENDED
    when assigning it to a new object reference.
 
-2.7.2.2.  id
+2.6.2.2.  id
 
    id represents the human-readable identifier associated to the object
    reference for a specific MISP instance.
@@ -1565,12 +1509,12 @@ Internet-Draft              MISP core format                October 2021
 
 
 
-Dulaunoy & Iklody          Expires 1 May 2022                  [Page 28]
+Dulaunoy & Iklody        Expires 19 August 2022                [Page 27]
 
-Internet-Draft              MISP core format                October 2021
+Internet-Draft              MISP core format               February 2022
 
 
-2.7.2.3.  timestamp
+2.6.2.3.  timestamp
 
    timestamp represents a reference time when the object was created or
    last modified. timestamp is expressed in seconds (decimal) since 1st
@@ -1578,15 +1522,16 @@ Internet-Draft              MISP core format                October 2021
 
    timestamp is represented as a JSON string. timestamp MUST be present.
 
-2.7.2.4.  object_id
+2.6.2.4.  object_id
 
    object_id represents the human-readable identifier of the object that
    the object reference belongs to on a specific MISP instance.  A
    human-readable identifier MUST be represented as an unsigned integer.
 
-   event_id is represented as a JSON string. event_id SHALL be present.
+   object_id is represented as a JSON string. object_id SHALL be
+   present.
 
-2.7.2.5.  event_id
+2.6.2.5.  event_id
 
    event_id represents the human-readable identifier of the event that
    the object reference belongs to on a specific MISP instance.  A
@@ -1594,7 +1539,7 @@ Internet-Draft              MISP core format                October 2021
 
    event_id is represented as a JSON string. event_id SHALL be present.
 
-2.7.2.6.  referenced_id
+2.6.2.6.  referenced_id
 
    referenced_id represents the human-readable identifier of the object
    or attribute that the parent object of the object reference points to
@@ -1603,7 +1548,7 @@ Internet-Draft              MISP core format                October 2021
    referenced_id is represented as a JSON string. referenced_id MAY be
    present.
 
-2.7.2.7.  referenced_type
+2.6.2.7.  referenced_type
 
    referenced_type represents the numeric value describing what the
    object reference points to, "0" representing an attribute and "1"
@@ -1612,7 +1557,7 @@ Internet-Draft              MISP core format                October 2021
    referenced_type is represented as a JSON string. referenced_type MAY
    be present.
 
-2.7.2.8.  relationship_type
+2.6.2.8.  relationship_type
 
    relationship_type represents the human-readable context of the
    relationship between an object and another object or attribute as
@@ -1620,22 +1565,21 @@ Internet-Draft              MISP core format                October 2021
 
 
 
-
-Dulaunoy & Iklody          Expires 1 May 2022                  [Page 29]
+Dulaunoy & Iklody        Expires 19 August 2022                [Page 28]
 
-Internet-Draft              MISP core format                October 2021
+Internet-Draft              MISP core format               February 2022
 
 
-   referenced_type is represented as a JSON string. relationship_type
+   relationship_type is represented as a JSON string. relationship_type
    MUST be present.
 
-2.7.2.9.  comment
+2.6.2.9.  comment
 
    comment is a contextual comment field.
 
    comment is represented by a JSON string. comment MAY be present.
 
-2.7.2.10.  deleted
+2.6.2.10.  deleted
 
    deleted represents a setting that allows object references to be
    revoked.  Revoked object references are not actionable and exist
@@ -1643,28 +1587,28 @@ Internet-Draft              MISP core format                October 2021
 
    deleted is represented by a JSON boolean. deleted MUST be present.
 
-2.7.2.11.  object_uuid
+2.6.2.11.  object_uuid
 
    object_uuid represents the Universally Unique IDentifier (UUID)
    [RFC4122] of the object that the given object reference belongs to.
    The object_uuid MUST be preserved to preserve the object reference's
    association with the object.
 
-2.7.2.12.  referenced_uuid
+2.6.2.12.  referenced_uuid
 
    referenced_uuid represents the Universally Unique IDentifier (UUID)
    [RFC4122] of the object or attribute that is being referenced by the
    object reference.  The referenced_uuid MUST be preserved to preserve
    the object reference's association with the object or attribute.
 
-2.8.  EventReport
+2.7.  EventReport
 
    EventReport are used to complement an event with one or more report
    in Markdown format.  The EventReport contains unstructured
    information which can be linked to Attributes, Objects, Tags or
    Galaxy with an extension to the Markdown marking language.
 
-2.8.1.  id
+2.7.1.  id
 
    id represents the human-readable identifier associated to the
    EventReport for a specific MISP instance.  A human-readable
@@ -1677,12 +1621,12 @@ Internet-Draft              MISP core format                October 2021
 
 
 
-Dulaunoy & Iklody          Expires 1 May 2022                  [Page 30]
+Dulaunoy & Iklody        Expires 19 August 2022                [Page 29]
 
-Internet-Draft              MISP core format                October 2021
+Internet-Draft              MISP core format               February 2022
 
 
-2.8.2.  UUID
+2.7.2.  UUID
 
    uuid represents the Universally Unique IDentifier (UUID) [RFC4122] of
    the EventReport.  The uuid MUST be preserved for any updates or
@@ -1691,7 +1635,7 @@ Internet-Draft              MISP core format                October 2021
 
    uuid is represented as a JSON string. uuid MUST be present.
 
-2.8.3.  event_id
+2.7.3.  event_id
 
    event_id represents the human-readable identifier associating the
    EventReport to an event on a specific MISP instance.  A human-
@@ -1699,7 +1643,7 @@ Internet-Draft              MISP core format                October 2021
 
    event_id is represented as a JSON string. event_id MUST be present.
 
-2.8.4.  name
+2.7.4.  name
 
    name represents the information field of the EventReport. name is a
    free-text value to provide a human-readable summary of the report.
@@ -1708,7 +1652,7 @@ Internet-Draft              MISP core format                October 2021
 
    name is represented as a JSON string. name MUST be present.
 
-2.8.5.  content
+2.7.5.  content
 
    content includes the raw EventReport in Markdown format with or
    without the specific MISP Markdown markup extension.
@@ -1719,7 +1663,7 @@ Internet-Draft              MISP core format                October 2021
 
    content is represented as a JSON string. content MUST be present.
 
-2.8.6.  distribution
+2.7.6.  distribution
 
    distribution represents the basic distribution rules of the
    EventReport.  The system must adhere to the distribution setting for
@@ -1729,26 +1673,21 @@ Internet-Draft              MISP core format                October 2021
    present and be one of the following options:
 
    0  Your Organisation Only
-
-
-
-
-Dulaunoy & Iklody          Expires 1 May 2022                  [Page 31]
-
-Internet-Draft              MISP core format                October 2021
-
-
    1  This Community Only
 
+
+
+Dulaunoy & Iklody        Expires 19 August 2022                [Page 30]
+
+Internet-Draft              MISP core format               February 2022
+
+
    2  Connected Communities
-
    3  All Communities
-
    4  Sharing Group
-
    5  Inherit Event
 
-2.8.7.  sharing_group_id
+2.7.7.  sharing_group_id
 
    sharing_group_id represents the local id to the MISP local instance
    of the Sharing Group associated for the distribution.
@@ -1756,7 +1695,7 @@ Internet-Draft              MISP core format                October 2021
    sharing_group_id is represented by a JSON string. sharing_group_id
    MUST be present and set to "0" if not used.
 
-2.8.8.  timestamp
+2.7.8.  timestamp
 
    timestamp represents a reference time when the EventReport was
    created or last modified. timestamp is expressed in seconds (decimal)
@@ -1765,7 +1704,7 @@ Internet-Draft              MISP core format                October 2021
 
    timestamp is represented as a JSON string. timestamp MUST be present.
 
-2.8.9.  deleted
+2.7.9.  deleted
 
    deleted represents a setting that allows EventReport to be revoked.
    Revoked EventReport are not actionable and exist merely to inform
@@ -1773,7 +1712,7 @@ Internet-Draft              MISP core format                October 2021
 
    deleted is represented by a JSON boolean. deleted MUST be present.
 
-2.9.  Tag
+2.8.  Tag
 
    A tag is a simple method to classify an event with a simple string.
    The tag name can be freely chosen.  The tag name can be also chosen
@@ -1785,15 +1724,6 @@ Internet-Draft              MISP core format                October 2021
    or attribute level.  A tag element is described with a name, id,
    colour and exportable flag.
 
-
-
-
-
-Dulaunoy & Iklody          Expires 1 May 2022                  [Page 32]
-
-Internet-Draft              MISP core format                October 2021
-
-
    exportable represents a setting if the tag is kept local or
    exportable to other MISP instances. exportable is represented by a
    JSON boolean. id is a human-readable identifier that references the
@@ -1801,7 +1731,14 @@ Internet-Draft              MISP core format                October 2021
 
    name MUST be present. colour, id and exportable SHALL be present.
 
-2.9.1.  Sample Tag
+
+
+Dulaunoy & Iklody        Expires 19 August 2022                [Page 31]
+
+Internet-Draft              MISP core format               February 2022
+
+
+2.8.1.  Sample Tag
 
    "Tag": [{
            "exportable": true,
@@ -1809,7 +1746,7 @@ Internet-Draft              MISP core format                October 2021
            "name": "tlp:white",
            "id": "2" }]
 
-2.10.  Sighting
+2.9.  Sighting
 
    A sighting is an ascertainment which describes whether an attribute
    has been seen under a given set of conditions.  The sighting can
@@ -1843,19 +1780,22 @@ Internet-Draft              MISP core format                October 2021
    date_sighting represents when the referenced attribute, designated by
    its uuid, is sighted.
 
-
-
-Dulaunoy & Iklody          Expires 1 May 2022                  [Page 33]
-
-Internet-Draft              MISP core format                October 2021
-
-
    source MAY be present. source is represented as a JSON string and
    represents the human-readable version of the sighting source, which
    can be a given piece of software (e.g.  SIEM), device or a specific
    analytical process.
 
-   id, event_id and attribute_id MAY be present.
+
+
+
+
+Dulaunoy & Iklody        Expires 19 August 2022                [Page 32]
+
+Internet-Draft              MISP core format               February 2022
+
+
+   id, event_id and attribute_id are represented as a JSON string and
+   MAY be present.
 
    id represents the human-readable identifier of the sighting reference
    which belongs to a specific MISP instance. event_id represents the
@@ -1871,10 +1811,10 @@ Internet-Draft              MISP core format                October 2021
    org_id represents the human-readable identifier of the organisation
    which did the sighting and belongs to a specific MISP instance.
 
-   A human-readable identifier MUST be represented as an unsigned
+   A human-readable identifier MUST be considered as an unsigned
    integer.
 
-2.10.1.  Sample Sighting
+2.9.1.  Sample Sighting
 
 
 
@@ -1901,9 +1841,13 @@ Internet-Draft              MISP core format                October 2021
 
 
 
-Dulaunoy & Iklody          Expires 1 May 2022                  [Page 34]
+
+
+
+
+Dulaunoy & Iklody        Expires 19 August 2022                [Page 33]
 
-Internet-Draft              MISP core format                October 2021
+Internet-Draft              MISP core format               February 2022
 
 
 "Sighting": [
@@ -1939,13 +1883,13 @@ Internet-Draft              MISP core format                October 2021
                         }
                 ]
 
-2.11.  Galaxy
+2.10.  Galaxy
 
    A galaxy is a simple method to express a large object called cluster
    that can be attached to MISP events.  A cluster can be composed of
    one or more elements.  Elements are expressed as key-values.
 
-2.11.1.  Sample Galaxy
+2.10.1.  Sample Galaxy
 
 
 
@@ -1957,9 +1901,9 @@ Internet-Draft              MISP core format                October 2021
 
 
 
-Dulaunoy & Iklody          Expires 1 May 2022                  [Page 35]
+Dulaunoy & Iklody        Expires 19 August 2022                [Page 34]
 
-Internet-Draft              MISP core format                October 2021
+Internet-Draft              MISP core format               February 2022
 
 
 "Galaxy": [ {
@@ -2013,9 +1957,9 @@ Internet-Draft              MISP core format                October 2021
 
 
 
-Dulaunoy & Iklody          Expires 1 May 2022                  [Page 36]
+Dulaunoy & Iklody        Expires 19 August 2022                [Page 35]
 
-Internet-Draft              MISP core format                October 2021
+Internet-Draft              MISP core format               February 2022
 
 
 3.  JSON Schema
@@ -2069,9 +2013,9 @@ Internet-Draft              MISP core format                October 2021
 
 
 
-Dulaunoy & Iklody          Expires 1 May 2022                  [Page 37]
+Dulaunoy & Iklody        Expires 19 August 2022                [Page 36]
 
-Internet-Draft              MISP core format                October 2021
+Internet-Draft              MISP core format               February 2022
 
 
        "type": "object",
@@ -2125,9 +2069,9 @@ Internet-Draft              MISP core format                October 2021
 
 
 
-Dulaunoy & Iklody          Expires 1 May 2022                  [Page 38]
+Dulaunoy & Iklody        Expires 19 August 2022                [Page 37]
 
-Internet-Draft              MISP core format                October 2021
+Internet-Draft              MISP core format               February 2022
 
 
            "items": {
@@ -2181,9 +2125,9 @@ Internet-Draft              MISP core format                October 2021
 
 
 
-Dulaunoy & Iklody          Expires 1 May 2022                  [Page 39]
+Dulaunoy & Iklody        Expires 19 August 2022                [Page 38]
 
-Internet-Draft              MISP core format                October 2021
+Internet-Draft              MISP core format               February 2022
 
 
            "type": "string"
@@ -2237,9 +2181,9 @@ Internet-Draft              MISP core format                October 2021
 
 
 
-Dulaunoy & Iklody          Expires 1 May 2022                  [Page 40]
+Dulaunoy & Iklody        Expires 19 August 2022                [Page 39]
 
-Internet-Draft              MISP core format                October 2021
+Internet-Draft              MISP core format               February 2022
 
 
            "type": "string"
@@ -2293,9 +2237,9 @@ Internet-Draft              MISP core format                October 2021
 
 
 
-Dulaunoy & Iklody          Expires 1 May 2022                  [Page 41]
+Dulaunoy & Iklody        Expires 19 August 2022                [Page 40]
 
-Internet-Draft              MISP core format                October 2021
+Internet-Draft              MISP core format               February 2022
 
 
        "properties": {
@@ -2349,9 +2293,9 @@ Internet-Draft              MISP core format                October 2021
 
 
 
-Dulaunoy & Iklody          Expires 1 May 2022                  [Page 42]
+Dulaunoy & Iklody        Expires 19 August 2022                [Page 41]
 
-Internet-Draft              MISP core format                October 2021
+Internet-Draft              MISP core format               February 2022
 
 
        "properties": {
@@ -2405,9 +2349,9 @@ Internet-Draft              MISP core format                October 2021
 
 
 
-Dulaunoy & Iklody          Expires 1 May 2022                  [Page 43]
+Dulaunoy & Iklody        Expires 19 August 2022                [Page 42]
 
-Internet-Draft              MISP core format                October 2021
+Internet-Draft              MISP core format               February 2022
 
 
        "properties": {
@@ -2461,9 +2405,9 @@ Internet-Draft              MISP core format                October 2021
 
 
 
-Dulaunoy & Iklody          Expires 1 May 2022                  [Page 44]
+Dulaunoy & Iklody        Expires 19 August 2022                [Page 43]
 
-Internet-Draft              MISP core format                October 2021
+Internet-Draft              MISP core format               February 2022
 
 
          },
@@ -2517,9 +2461,9 @@ Internet-Draft              MISP core format                October 2021
 
 
 
-Dulaunoy & Iklody          Expires 1 May 2022                  [Page 45]
+Dulaunoy & Iklody        Expires 19 August 2022                [Page 44]
 
-Internet-Draft              MISP core format                October 2021
+Internet-Draft              MISP core format               February 2022
 
 
          },
@@ -2573,9 +2517,9 @@ Internet-Draft              MISP core format                October 2021
 
 
 
-Dulaunoy & Iklody          Expires 1 May 2022                  [Page 46]
+Dulaunoy & Iklody        Expires 19 August 2022                [Page 45]
 
-Internet-Draft              MISP core format                October 2021
+Internet-Draft              MISP core format               February 2022
 
 
            "type": "string"
@@ -2629,9 +2573,9 @@ Internet-Draft              MISP core format                October 2021
 
 
 
-Dulaunoy & Iklody          Expires 1 May 2022                  [Page 47]
+Dulaunoy & Iklody        Expires 19 August 2022                [Page 46]
 
-Internet-Draft              MISP core format                October 2021
+Internet-Draft              MISP core format               February 2022
 
 
            "uniqueItems": true,
@@ -2685,9 +2629,9 @@ Internet-Draft              MISP core format                October 2021
 
 
 
-Dulaunoy & Iklody          Expires 1 May 2022                  [Page 48]
+Dulaunoy & Iklody        Expires 19 August 2022                [Page 47]
 
-Internet-Draft              MISP core format                October 2021
+Internet-Draft              MISP core format               February 2022
 
 
            "type": "boolean"
@@ -2741,9 +2685,9 @@ Internet-Draft              MISP core format                October 2021
 
 
 
-Dulaunoy & Iklody          Expires 1 May 2022                  [Page 49]
+Dulaunoy & Iklody        Expires 19 August 2022                [Page 48]
 
-Internet-Draft              MISP core format                October 2021
+Internet-Draft              MISP core format               February 2022
 
 
        "type": "object",
@@ -2797,9 +2741,9 @@ Internet-Draft              MISP core format                October 2021
 
 
 
-Dulaunoy & Iklody          Expires 1 May 2022                  [Page 50]
+Dulaunoy & Iklody        Expires 19 August 2022                [Page 49]
 
-Internet-Draft              MISP core format                October 2021
+Internet-Draft              MISP core format               February 2022
 
 
      "Event": {
@@ -2832,15 +2776,10 @@ Internet-Draft              MISP core format                October 2021
    which came from the original event referenced by the same uuid:
 
    *  info (MUST)
-
    *  Orgc object (MUST)
-
    *  analysis (SHALL)
-
    *  timestamp (MUST)
-
    *  date (MUST)
-
    *  threat_level_id (SHALL)
 
    In addition to the fields originating from the event, the following
@@ -2849,19 +2788,20 @@ Internet-Draft              MISP core format                October 2021
    *  integrity:sha256 represents the SHA256 value in hexadecimal
       representation of the associated MISP event file to ensure
       integrity of the file.  (SHOULD)
-
-
-
-
-Dulaunoy & Iklody          Expires 1 May 2022                  [Page 51]
-
-Internet-Draft              MISP core format                October 2021
-
-
    *  integrity:pgp represents a detached PGP signature [RFC4880] of the
       associated MISP event file to ensure integrity of the file.
       (SHOULD)
 
+
+
+
+
+
+Dulaunoy & Iklody        Expires 19 August 2022                [Page 50]
+
+Internet-Draft              MISP core format               February 2022
+
+
    If a detached PGP signature is used for each MISP event, a detached
    PGP signature is a MUST to ensure integrity of the manifest file.  A
    detached PGP signature for a manifest file is a manifest.json.asc
@@ -2906,18 +2846,18 @@ Internet-Draft              MISP core format                October 2021
       },
       {
         "colour": "#3d7a00",
-
-
-
-Dulaunoy & Iklody          Expires 1 May 2022                  [Page 52]
-
-Internet-Draft              MISP core format                October 2021
-
-
         "name": "circl:incident-classification=\"malware\""
       },
       {
         "colour": "#2c4f00",
+
+
+
+Dulaunoy & Iklody        Expires 19 August 2022                [Page 51]
+
+Internet-Draft              MISP core format               February 2022
+
+
         "name": "malware_classification:malware-category=\"Ransomware\""
       }
     ],
@@ -2965,9 +2905,13 @@ Internet-Draft              MISP core format                October 2021
 
 
 
-Dulaunoy & Iklody          Expires 1 May 2022                  [Page 53]
+
+
+
+
+Dulaunoy & Iklody        Expires 19 August 2022                [Page 52]
 
-Internet-Draft              MISP core format                October 2021
+Internet-Draft              MISP core format               February 2022
 
 
    [RFC4122]  Leach, P., Mealling, M., and R. Salz, "A Universally
@@ -3021,9 +2965,9 @@ Authors' Addresses
 
 
 
-Dulaunoy & Iklody          Expires 1 May 2022                  [Page 54]
+Dulaunoy & Iklody        Expires 19 August 2022                [Page 53]
 
-Internet-Draft              MISP core format                October 2021
+Internet-Draft              MISP core format               February 2022
 
 
    Andras Iklody
@@ -3077,4 +3021,4 @@ Internet-Draft              MISP core format                October 2021
 
 
 
-Dulaunoy & Iklody          Expires 1 May 2022                  [Page 55]
+Dulaunoy & Iklody        Expires 19 August 2022                [Page 54]
diff --git a/rfc/misp-standard-object-template-format.html b/rfc/misp-standard-object-template-format.html
index 1da2cfe..b50876f 100644
--- a/rfc/misp-standard-object-template-format.html
+++ b/rfc/misp-standard-object-template-format.html
@@ -10,29 +10,28 @@
 <meta content="
        This document describes the MISP object template format which describes a simple JSON format to represent the various templates used to construct MISP objects. A public directory of common vocabularies MISP object templates   is available and relies on the MISP object reference format. 
     " name="description">
-<meta content="xml2rfc 3.9.1" name="generator">
+<meta content="xml2rfc 3.12.1" name="generator">
 <meta content="draft-00" name="ietf.draft">
 <!-- Generator version information:
-  xml2rfc 3.9.1
-    Python 3.6.9
+  xml2rfc 3.12.1
+    Python 3.8.10
     appdirs 1.4.4
-    ConfigArgParse 1.5.2
-    google-i18n-address 2.3.5
-    html5lib 1.0.1
-    intervaltree 2.1.0
-    Jinja2 2.11.2
+    ConfigArgParse 1.5.3
+    google-i18n-address 2.5.0
+    html5lib 1.1
+    intervaltree 3.1.0
+    Jinja2 2.11.3
     kitchen 1.2.6
-    lxml 4.6.3
+    lxml 4.7.1
     pycairo 1.16.2
-    pycountry 18.12.8
-    pyflakes 2.1.1
+    pycountry 22.1.10
+    pyflakes 2.4.0
     PyYAML 5.4.1
-    requests 2.25.1
-    setuptools 57.1.0
+    requests 2.24.0
+    setuptools 45.2.0
     six 1.15.0
-    WeasyPrint 48
 -->
-<link href="misp-standard-object-template-format.xml" rel="alternate" type="application/rfc+xml">
+<link href="raw.md.xml" rel="alternate" type="application/rfc+xml">
 <link href="#copyright" rel="license">
 <style type="text/css">/*
 
@@ -386,6 +385,12 @@ hr {
   float: left;
   margin-bottom: 0;
 }
+/* Fix PDF info block run off issue */
+@media print {
+  #identifiers dd {
+    float: none;
+  }
+}
 #identifiers .authors .author {
   display: inline-block;
   margin-right: 1.5em;
@@ -1080,7 +1085,7 @@ tr:nth-child(2n+1) > td {
 }
 /* Change the approach to avoiding breaks inside artwork etc. */
 figure, pre, table, .artwork, .sourcecode  {
-  break-before: avoid-page;
+  break-before: auto;
   break-after: auto;
 }
 /* Avoid breaks between <dt> and <dd> */
@@ -1181,11 +1186,11 @@ li > p:last-of-type {
 <thead><tr>
 <td class="left">Internet-Draft</td>
 <td class="center">MISP object template format</td>
-<td class="right">November 2021</td>
+<td class="right">February 2022</td>
 </tr></thead>
 <tfoot><tr>
 <td class="left">Dulaunoy &amp; Iklody</td>
-<td class="center">Expires 25 May 2022</td>
+<td class="center">Expires 19 August 2022</td>
 <td class="right">[Page]</td>
 </tr></tfoot>
 </table>
@@ -1198,12 +1203,12 @@ li > p:last-of-type {
 <dd class="internet-draft">draft-00</dd>
 <dt class="label-published">Published:</dt>
 <dd class="published">
-<time datetime="2021-11-21" class="published">21 November 2021</time>
+<time datetime="2022-02-15" class="published">15 February 2022</time>
     </dd>
 <dt class="label-intended-status">Intended Status:</dt>
 <dd class="intended-status">Informational</dd>
 <dt class="label-expires">Expires:</dt>
-<dd class="expires"><time datetime="2022-05-25">25 May 2022</time></dd>
+<dd class="expires"><time datetime="2022-08-19">19 August 2022</time></dd>
 <dt class="label-authors">Authors:</dt>
 <dd class="authors">
 <div class="author">
@@ -1241,7 +1246,7 @@ li > p:last-of-type {
         time. It is inappropriate to use Internet-Drafts as reference
         material or to cite them other than as "work in progress."<a href="#section-boilerplate.1-3" class="pilcrow">¶</a></p>
 <p id="section-boilerplate.1-4">
-        This Internet-Draft will expire on 25 May 2022.<a href="#section-boilerplate.1-4" class="pilcrow">¶</a></p>
+        This Internet-Draft will expire on 19 August 2022.<a href="#section-boilerplate.1-4" class="pilcrow">¶</a></p>
 </section>
 </div>
 <div id="copyright">
@@ -1250,7 +1255,7 @@ li > p:last-of-type {
 <a href="#name-copyright-notice" class="section-name selfRef">Copyright Notice</a>
         </h2>
 <p id="section-boilerplate.2-1">
-            Copyright (c) 2021 IETF Trust and the persons identified as the
+            Copyright (c) 2022 IETF Trust and the persons identified as the
             document authors. All rights reserved.<a href="#section-boilerplate.2-1" class="pilcrow">¶</a></p>
 <p id="section-boilerplate.2-2">
             This document is subject to BCP 78 and the IETF Trust's Legal
@@ -1266,55 +1271,55 @@ li > p:last-of-type {
         <a href="#" onclick="scroll(0,0)" class="toplink">▲</a><h2 id="name-table-of-contents">
 <a href="#name-table-of-contents" class="section-name selfRef">Table of Contents</a>
         </h2>
-<nav class="toc"><ul class="ulBare toc compact ulEmpty">
-<li class="ulBare toc compact ulEmpty" id="section-toc.1-1.1">
+<nav class="toc"><ul class="compact toc ulBare ulEmpty">
+<li class="compact toc ulBare ulEmpty" id="section-toc.1-1.1">
             <p id="section-toc.1-1.1.1" class="keepWithNext"><a href="#section-1" class="xref">1</a>.  <a href="#name-introduction" class="xref">Introduction</a></p>
-<ul class="toc compact ulBare ulEmpty">
-<li class="toc compact ulBare ulEmpty" id="section-toc.1-1.1.2.1">
+<ul class="compact toc ulBare ulEmpty">
+<li class="compact toc ulBare ulEmpty" id="section-toc.1-1.1.2.1">
                 <p id="section-toc.1-1.1.2.1.1" class="keepWithNext"><a href="#section-1.1" class="xref">1.1</a>.  <a href="#name-conventions-and-terminology" class="xref">Conventions and Terminology</a></p>
 </li>
             </ul>
 </li>
-          <li class="ulBare toc compact ulEmpty" id="section-toc.1-1.2">
+          <li class="compact toc ulBare ulEmpty" id="section-toc.1-1.2">
             <p id="section-toc.1-1.2.1"><a href="#section-2" class="xref">2</a>.  <a href="#name-format" class="xref">Format</a></p>
-<ul class="toc compact ulBare ulEmpty">
-<li class="toc compact ulBare ulEmpty" id="section-toc.1-1.2.2.1">
+<ul class="compact toc ulBare ulEmpty">
+<li class="compact toc ulBare ulEmpty" id="section-toc.1-1.2.2.1">
                 <p id="section-toc.1-1.2.2.1.1"><a href="#section-2.1" class="xref">2.1</a>.  <a href="#name-overview" class="xref">Overview</a></p>
-<ul class="toc ulBare compact ulEmpty">
-<li class="toc ulBare compact ulEmpty" id="section-toc.1-1.2.2.1.2.1">
+<ul class="compact toc ulBare ulEmpty">
+<li class="compact toc ulBare ulEmpty" id="section-toc.1-1.2.2.1.2.1">
                     <p id="section-toc.1-1.2.2.1.2.1.1" class="keepWithNext"><a href="#section-2.1.1" class="xref">2.1.1</a>.  <a href="#name-object-template" class="xref">Object Template</a></p>
 </li>
-                  <li class="toc ulBare compact ulEmpty" id="section-toc.1-1.2.2.1.2.2">
+                  <li class="compact toc ulBare ulEmpty" id="section-toc.1-1.2.2.1.2.2">
                     <p id="section-toc.1-1.2.2.1.2.2.1"><a href="#section-2.1.2" class="xref">2.1.2</a>.  <a href="#name-attributes" class="xref">attributes</a></p>
 </li>
-                  <li class="toc ulBare compact ulEmpty" id="section-toc.1-1.2.2.1.2.3">
+                  <li class="compact toc ulBare ulEmpty" id="section-toc.1-1.2.2.1.2.3">
                     <p id="section-toc.1-1.2.2.1.2.3.1"><a href="#section-2.1.3" class="xref">2.1.3</a>.  <a href="#name-sample-object-template-obje" class="xref">Sample Object Template object</a></p>
 </li>
-                  <li class="toc ulBare compact ulEmpty" id="section-toc.1-1.2.2.1.2.4">
+                  <li class="compact toc ulBare ulEmpty" id="section-toc.1-1.2.2.1.2.4">
                     <p id="section-toc.1-1.2.2.1.2.4.1"><a href="#section-2.1.4" class="xref">2.1.4</a>.  <a href="#name-object-relationships" class="xref">Object Relationships</a></p>
 </li>
                 </ul>
 </li>
             </ul>
 </li>
-          <li class="ulBare toc compact ulEmpty" id="section-toc.1-1.3">
+          <li class="compact toc ulBare ulEmpty" id="section-toc.1-1.3">
             <p id="section-toc.1-1.3.1"><a href="#section-3" class="xref">3</a>.  <a href="#name-directory" class="xref">Directory</a></p>
-<ul class="toc compact ulBare ulEmpty">
-<li class="toc compact ulBare ulEmpty" id="section-toc.1-1.3.2.1">
+<ul class="compact toc ulBare ulEmpty">
+<li class="compact toc ulBare ulEmpty" id="section-toc.1-1.3.2.1">
                 <p id="section-toc.1-1.3.2.1.1"><a href="#section-3.1" class="xref">3.1</a>.  <a href="#name-existing-and-public-misp-ob" class="xref">Existing and public MISP object templates</a></p>
 </li>
             </ul>
 </li>
-          <li class="ulBare toc compact ulEmpty" id="section-toc.1-1.4">
+          <li class="compact toc ulBare ulEmpty" id="section-toc.1-1.4">
             <p id="section-toc.1-1.4.1"><a href="#section-4" class="xref">4</a>.  <a href="#name-acknowledgements" class="xref">Acknowledgements</a></p>
 </li>
-          <li class="ulBare toc compact ulEmpty" id="section-toc.1-1.5">
+          <li class="compact toc ulBare ulEmpty" id="section-toc.1-1.5">
             <p id="section-toc.1-1.5.1"><a href="#section-5" class="xref">5</a>.  <a href="#name-normative-references" class="xref">Normative References</a></p>
 </li>
-          <li class="ulBare toc compact ulEmpty" id="section-toc.1-1.6">
+          <li class="compact toc ulBare ulEmpty" id="section-toc.1-1.6">
             <p id="section-toc.1-1.6.1"><a href="#section-6" class="xref">6</a>.  <a href="#name-informative-references" class="xref">Informative References</a></p>
 </li>
-          <li class="ulBare toc compact ulEmpty" id="section-toc.1-1.7">
+          <li class="compact toc ulBare ulEmpty" id="section-toc.1-1.7">
             <p id="section-toc.1-1.7.1"><a href="#appendix-A" class="xref"></a><a href="#name-authors-addresses" class="xref">Authors' Addresses</a></p>
 </li>
         </ul>
@@ -1512,7 +1517,7 @@ document are to be interpreted as described in RFC 2119 <span>[<a href="#RFC2119
             <h5 id="name-credit-card-object-template">
 <a href="#section-2.1.3.1" class="section-number selfRef">2.1.3.1. </a><a href="#name-credit-card-object-template" class="section-name selfRef">credit-card object template</a>
             </h5>
-<div class="artwork art-text alignLeft" id="section-2.1.3.1-1">
+<div class="alignLeft art-text artwork" id="section-2.1.3.1-1">
 <pre>{
   "requiredOneOf": [
     "cc-number"
@@ -1569,7 +1574,7 @@ document are to be interpreted as described in RFC 2119 <span>[<a href="#RFC2119
             <h5 id="name-credential-object-template">
 <a href="#section-2.1.3.2" class="section-number selfRef">2.1.3.2. </a><a href="#name-credential-object-template" class="section-name selfRef">credential object template</a>
             </h5>
-<div class="artwork art-text alignLeft" id="section-2.1.3.2-1">
+<div class="alignLeft art-text artwork" id="section-2.1.3.2-1">
 <pre>{
   "requiredOneOf": [
     "password"
@@ -1699,769 +1704,841 @@ document are to be interpreted as described in RFC 2119 <span>[<a href="#RFC2119
         <h3 id="name-existing-and-public-misp-ob">
 <a href="#section-3.1" class="section-number selfRef">3.1. </a><a href="#name-existing-and-public-misp-ob" class="section-name selfRef">Existing and public MISP object templates</a>
         </h3>
-<ul class="normal">
-<li class="normal" id="section-3.1-1.1">
+<ul class="compact">
+<li class="compact" id="section-3.1-1.1">
             <a href="https://github.com/MISP/misp-objects/blob/main/objects/ail-leak/definition.json">objects/ail-leak</a> - An information leak as defined by the AIL Analysis Information Leak framework.<a href="#section-3.1-1.1" class="pilcrow">¶</a>
 </li>
-          <li class="normal" id="section-3.1-1.2">
+          <li class="compact" id="section-3.1-1.2">
             <a href="https://github.com/MISP/misp-objects/blob/main/objects/ais-info/definition.json">objects/ais-info</a> - Automated Indicator Sharing (AIS) Information Source Markings.<a href="#section-3.1-1.2" class="pilcrow">¶</a>
 </li>
-          <li class="normal" id="section-3.1-1.3">
+          <li class="compact" id="section-3.1-1.3">
             <a href="https://github.com/MISP/misp-objects/blob/main/objects/android-app/definition.json">objects/android-app</a> - Indicators related to an Android app.<a href="#section-3.1-1.3" class="pilcrow">¶</a>
 </li>
-          <li class="normal" id="section-3.1-1.4">
+          <li class="compact" id="section-3.1-1.4">
             <a href="https://github.com/MISP/misp-objects/blob/main/objects/android-permission/definition.json">objects/android-permission</a> - A set of android permissions - one or more permission(s) which can be linked to other objects (e.g. malware, app).<a href="#section-3.1-1.4" class="pilcrow">¶</a>
 </li>
-          <li class="normal" id="section-3.1-1.5">
+          <li class="compact" id="section-3.1-1.5">
             <a href="https://github.com/MISP/misp-objects/blob/main/objects/annotation/definition.json">objects/annotation</a> - An annotation object allowing analysts to add annotations, comments, executive summary to a MISP event, objects or attributes.<a href="#section-3.1-1.5" class="pilcrow">¶</a>
 </li>
-          <li class="normal" id="section-3.1-1.6">
+          <li class="compact" id="section-3.1-1.6">
             <a href="https://github.com/MISP/misp-objects/blob/main/objects/anonymisation/definition.json">objects/anonymisation</a> - Anonymisation object describing an anonymisation technique used to encode MISP attribute values. Reference: <a href="https://www.caida.org/tools/taxonomy/anonymization.xml">https://www.caida.org/tools/taxonomy/anonymization.xml</a>.<a href="#section-3.1-1.6" class="pilcrow">¶</a>
 </li>
-          <li class="normal" id="section-3.1-1.7">
-            <a href="https://github.com/MISP/misp-objects/blob/main/objects/asn/definition.json">objects/asn</a> - Autonomous system object describing an autonomous system which can include one or more network operators management an entity (e.g. ISP) along with their routing policy, routing prefixes or alike.<a href="#section-3.1-1.7" class="pilcrow">¶</a>
+          <li class="compact" id="section-3.1-1.7">
+            <a href="https://github.com/MISP/misp-objects/blob/main/objects/apivoid-email-verification/definition.json">objects/apivoid-email-verification</a> - Apivoid email verification API result. Reference: <a href="https://www.apivoid.com/api/email-verify/">https://www.apivoid.com/api/email-verify/</a>.<a href="#section-3.1-1.7" class="pilcrow">¶</a>
 </li>
-          <li class="normal" id="section-3.1-1.8">
-            <a href="https://github.com/MISP/misp-objects/blob/main/objects/attack-pattern/definition.json">objects/attack-pattern</a> - Attack pattern describing a common attack pattern enumeration and classification.<a href="#section-3.1-1.8" class="pilcrow">¶</a>
+          <li class="compact" id="section-3.1-1.8">
+            <a href="https://github.com/MISP/misp-objects/blob/main/objects/artifact/definition.json">objects/artifact</a> - The Artifact object permits capturing an array of bytes (8-bits), as a base64-encoded string, or linking to a file-like payload. from STIX 2.1 (6.1).<a href="#section-3.1-1.8" class="pilcrow">¶</a>
 </li>
-          <li class="normal" id="section-3.1-1.9">
-            <a href="https://github.com/MISP/misp-objects/blob/main/objects/authentication-failure-report/definition.json">objects/authentication-failure-report</a> - Authentication Failure Report.<a href="#section-3.1-1.9" class="pilcrow">¶</a>
+          <li class="compact" id="section-3.1-1.9">
+            <a href="https://github.com/MISP/misp-objects/blob/main/objects/asn/definition.json">objects/asn</a> - Autonomous system object describing an autonomous system which can include one or more network operators management an entity (e.g. ISP) along with their routing policy, routing prefixes or alike.<a href="#section-3.1-1.9" class="pilcrow">¶</a>
 </li>
-          <li class="normal" id="section-3.1-1.10">
-            <a href="https://github.com/MISP/misp-objects/blob/main/objects/authenticode-signerinfo/definition.json">objects/authenticode-signerinfo</a> - Authenticode Signer Info.<a href="#section-3.1-1.10" class="pilcrow">¶</a>
+          <li class="compact" id="section-3.1-1.10">
+            <a href="https://github.com/MISP/misp-objects/blob/main/objects/attack-pattern/definition.json">objects/attack-pattern</a> - Attack pattern describing a common attack pattern enumeration and classification.<a href="#section-3.1-1.10" class="pilcrow">¶</a>
 </li>
-          <li class="normal" id="section-3.1-1.11">
-            <a href="https://github.com/MISP/misp-objects/blob/main/objects/av-signature/definition.json">objects/av-signature</a> - Antivirus detection signature.<a href="#section-3.1-1.11" class="pilcrow">¶</a>
+          <li class="compact" id="section-3.1-1.11">
+            <a href="https://github.com/MISP/misp-objects/blob/main/objects/authentication-failure-report/definition.json">objects/authentication-failure-report</a> - Authentication Failure Report.<a href="#section-3.1-1.11" class="pilcrow">¶</a>
 </li>
-          <li class="normal" id="section-3.1-1.12">
-            <a href="https://github.com/MISP/misp-objects/blob/main/objects/bank-account/definition.json">objects/bank-account</a> - An object describing bank account information based on account description from goAML 4.0.<a href="#section-3.1-1.12" class="pilcrow">¶</a>
+          <li class="compact" id="section-3.1-1.12">
+            <a href="https://github.com/MISP/misp-objects/blob/main/objects/authenticode-signerinfo/definition.json">objects/authenticode-signerinfo</a> - Authenticode Signer Info.<a href="#section-3.1-1.12" class="pilcrow">¶</a>
 </li>
-          <li class="normal" id="section-3.1-1.13">
-            <a href="https://github.com/MISP/misp-objects/blob/main/objects/bgp-hijack/definition.json">objects/bgp-hijack</a> - Object encapsulating BGP Hijack description as specified, for example, by bgpstream.com.<a href="#section-3.1-1.13" class="pilcrow">¶</a>
+          <li class="compact" id="section-3.1-1.13">
+            <a href="https://github.com/MISP/misp-objects/blob/main/objects/av-signature/definition.json">objects/av-signature</a> - Antivirus detection signature.<a href="#section-3.1-1.13" class="pilcrow">¶</a>
 </li>
-          <li class="normal" id="section-3.1-1.14">
-            <a href="https://github.com/MISP/misp-objects/blob/main/objects/bgp-ranking/definition.json">objects/bgp-ranking</a> - BGP Ranking object describing the ranking of an ASN for a given day, along with its position, 1 being the most malicious ASN of the day, with the highest ranking. This object is meant to have a relationship with the corresponding ASN object and represents its ranking for a specific date.<a href="#section-3.1-1.14" class="pilcrow">¶</a>
+          <li class="compact" id="section-3.1-1.14">
+            <a href="https://github.com/MISP/misp-objects/blob/main/objects/bank-account/definition.json">objects/bank-account</a> - An object describing bank account information based on account description from goAML 4.0.<a href="#section-3.1-1.14" class="pilcrow">¶</a>
 </li>
-          <li class="normal" id="section-3.1-1.15">
-            <a href="https://github.com/MISP/misp-objects/blob/main/objects/blog/definition.json">objects/blog</a> - Blog post like Medium or WordPress.<a href="#section-3.1-1.15" class="pilcrow">¶</a>
+          <li class="compact" id="section-3.1-1.15">
+            <a href="https://github.com/MISP/misp-objects/blob/main/objects/bgp-hijack/definition.json">objects/bgp-hijack</a> - Object encapsulating BGP Hijack description as specified, for example, by bgpstream.com.<a href="#section-3.1-1.15" class="pilcrow">¶</a>
 </li>
-          <li class="normal" id="section-3.1-1.16">
-            <a href="https://github.com/MISP/misp-objects/blob/main/objects/boleto/definition.json">objects/boleto</a> - A common form of payment used in Brazil.<a href="#section-3.1-1.16" class="pilcrow">¶</a>
+          <li class="compact" id="section-3.1-1.16">
+            <a href="https://github.com/MISP/misp-objects/blob/main/objects/bgp-ranking/definition.json">objects/bgp-ranking</a> - BGP Ranking object describing the ranking of an ASN for a given day, along with its position, 1 being the most malicious ASN of the day, with the highest ranking. This object is meant to have a relationship with the corresponding ASN object and represents its ranking for a specific date.<a href="#section-3.1-1.16" class="pilcrow">¶</a>
 </li>
-          <li class="normal" id="section-3.1-1.17">
-            <a href="https://github.com/MISP/misp-objects/blob/main/objects/btc-transaction/definition.json">objects/btc-transaction</a> - An object to describe a Bitcoin transaction. Best to be used with bitcoin-wallet.<a href="#section-3.1-1.17" class="pilcrow">¶</a>
+          <li class="compact" id="section-3.1-1.17">
+            <a href="https://github.com/MISP/misp-objects/blob/main/objects/blog/definition.json">objects/blog</a> - Blog post like Medium or WordPress.<a href="#section-3.1-1.17" class="pilcrow">¶</a>
 </li>
-          <li class="normal" id="section-3.1-1.18">
-            <a href="https://github.com/MISP/misp-objects/blob/main/objects/btc-wallet/definition.json">objects/btc-wallet</a> - An object to describe a Bitcoin wallet. Best to be used with bitcoin-transactions.<a href="#section-3.1-1.18" class="pilcrow">¶</a>
+          <li class="compact" id="section-3.1-1.18">
+            <a href="https://github.com/MISP/misp-objects/blob/main/objects/boleto/definition.json">objects/boleto</a> - A common form of payment used in Brazil.<a href="#section-3.1-1.18" class="pilcrow">¶</a>
 </li>
-          <li class="normal" id="section-3.1-1.19">
-            <a href="https://github.com/MISP/misp-objects/blob/main/objects/cap-alert/definition.json">objects/cap-alert</a> - Common Alerting Protocol Version (CAP) alert object.<a href="#section-3.1-1.19" class="pilcrow">¶</a>
+          <li class="compact" id="section-3.1-1.19">
+            <a href="https://github.com/MISP/misp-objects/blob/main/objects/btc-transaction/definition.json">objects/btc-transaction</a> - An object to describe a Bitcoin transaction. Best to be used with bitcoin-wallet.<a href="#section-3.1-1.19" class="pilcrow">¶</a>
 </li>
-          <li class="normal" id="section-3.1-1.20">
-            <a href="https://github.com/MISP/misp-objects/blob/main/objects/cap-info/definition.json">objects/cap-info</a> - Common Alerting Protocol Version (CAP) info object.<a href="#section-3.1-1.20" class="pilcrow">¶</a>
+          <li class="compact" id="section-3.1-1.20">
+            <a href="https://github.com/MISP/misp-objects/blob/main/objects/btc-wallet/definition.json">objects/btc-wallet</a> - An object to describe a Bitcoin wallet. Best to be used with bitcoin-transactions.<a href="#section-3.1-1.20" class="pilcrow">¶</a>
 </li>
-          <li class="normal" id="section-3.1-1.21">
-            <a href="https://github.com/MISP/misp-objects/blob/main/objects/cap-resource/definition.json">objects/cap-resource</a> - Common Alerting Protocol Version (CAP) resource object.<a href="#section-3.1-1.21" class="pilcrow">¶</a>
+          <li class="compact" id="section-3.1-1.21">
+            <a href="https://github.com/MISP/misp-objects/blob/main/objects/cap-alert/definition.json">objects/cap-alert</a> - Common Alerting Protocol Version (CAP) alert object.<a href="#section-3.1-1.21" class="pilcrow">¶</a>
 </li>
-          <li class="normal" id="section-3.1-1.22">
-            <a href="https://github.com/MISP/misp-objects/blob/main/objects/coin-address/definition.json">objects/coin-address</a> - An address used in a cryptocurrency.<a href="#section-3.1-1.22" class="pilcrow">¶</a>
+          <li class="compact" id="section-3.1-1.22">
+            <a href="https://github.com/MISP/misp-objects/blob/main/objects/cap-info/definition.json">objects/cap-info</a> - Common Alerting Protocol Version (CAP) info object.<a href="#section-3.1-1.22" class="pilcrow">¶</a>
 </li>
-          <li class="normal" id="section-3.1-1.23">
-            <a href="https://github.com/MISP/misp-objects/blob/main/objects/command/definition.json">objects/command</a> - Command functionalities related to specific commands executed by a program, whether it is malicious or not. Command-line are attached to this object for the related commands.<a href="#section-3.1-1.23" class="pilcrow">¶</a>
+          <li class="compact" id="section-3.1-1.23">
+            <a href="https://github.com/MISP/misp-objects/blob/main/objects/cap-resource/definition.json">objects/cap-resource</a> - Common Alerting Protocol Version (CAP) resource object.<a href="#section-3.1-1.23" class="pilcrow">¶</a>
 </li>
-          <li class="normal" id="section-3.1-1.24">
-            <a href="https://github.com/MISP/misp-objects/blob/main/objects/command-line/definition.json">objects/command-line</a> - Command line and options related to a specific command executed by a program, whether it is malicious or not.<a href="#section-3.1-1.24" class="pilcrow">¶</a>
+          <li class="compact" id="section-3.1-1.24">
+            <a href="https://github.com/MISP/misp-objects/blob/main/objects/coin-address/definition.json">objects/coin-address</a> - An address used in a cryptocurrency.<a href="#section-3.1-1.24" class="pilcrow">¶</a>
 </li>
-          <li class="normal" id="section-3.1-1.25">
-            <a href="https://github.com/MISP/misp-objects/blob/main/objects/cookie/definition.json">objects/cookie</a> - An HTTP cookie (web cookie, browser cookie) is a small piece of data that a server sends to the user's web browser. The browser may store it and send it back with the next request to the same server. Typically, it's used to tell if two requests came from the same browser <span class="unicode">— (U+2014)</span> keeping a user logged-in, for example. It remembers stateful information for the stateless HTTP protocol. (as defined by the Mozilla foundation.<a href="#section-3.1-1.25" class="pilcrow">¶</a>
+          <li class="compact" id="section-3.1-1.25">
+            <a href="https://github.com/MISP/misp-objects/blob/main/objects/command/definition.json">objects/command</a> - Command functionalities related to specific commands executed by a program, whether it is malicious or not. Command-line are attached to this object for the related commands.<a href="#section-3.1-1.25" class="pilcrow">¶</a>
 </li>
-          <li class="normal" id="section-3.1-1.26">
-            <a href="https://github.com/MISP/misp-objects/blob/main/objects/cortex/definition.json">objects/cortex</a> - Cortex object describing a complete cortex analysis. Observables would be attribute with a relationship from this object.<a href="#section-3.1-1.26" class="pilcrow">¶</a>
+          <li class="compact" id="section-3.1-1.26">
+            <a href="https://github.com/MISP/misp-objects/blob/main/objects/command-line/definition.json">objects/command-line</a> - Command line and options related to a specific command executed by a program, whether it is malicious or not.<a href="#section-3.1-1.26" class="pilcrow">¶</a>
 </li>
-          <li class="normal" id="section-3.1-1.27">
-            <a href="https://github.com/MISP/misp-objects/blob/main/objects/cortex-taxonomy/definition.json">objects/cortex-taxonomy</a> - Cortex object describing an Cortex Taxonomy (or mini report).<a href="#section-3.1-1.27" class="pilcrow">¶</a>
+          <li class="compact" id="section-3.1-1.27">
+            <a href="https://github.com/MISP/misp-objects/blob/main/objects/concordia-mtmf-intrusion-set/definition.json">objects/concordia-mtmf-intrusion-set</a> - Intrusion Set - Phase Description.<a href="#section-3.1-1.27" class="pilcrow">¶</a>
 </li>
-          <li class="normal" id="section-3.1-1.28">
-            <a href="https://github.com/MISP/misp-objects/blob/main/objects/course-of-action/definition.json">objects/course-of-action</a> - An object describing a specific measure taken to prevent or respond to an attack.<a href="#section-3.1-1.28" class="pilcrow">¶</a>
+          <li class="compact" id="section-3.1-1.28">
+            <a href="https://github.com/MISP/misp-objects/blob/main/objects/cookie/definition.json">objects/cookie</a> - An HTTP cookie (web cookie, browser cookie) is a small piece of data that a server sends to the user's web browser. The browser may store it and send it back with the next request to the same server. Typically, it's used to tell if two requests came from the same browser <span class="unicode">— (U+2014)</span> keeping a user logged-in, for example. It remembers stateful information for the stateless HTTP protocol. (as defined by the Mozilla foundation.<a href="#section-3.1-1.28" class="pilcrow">¶</a>
 </li>
-          <li class="normal" id="section-3.1-1.29">
-            <a href="https://github.com/MISP/misp-objects/blob/main/objects/covid19-csse-daily-report/definition.json">objects/covid19-csse-daily-report</a> - CSSE COVID-19 Daily report.<a href="#section-3.1-1.29" class="pilcrow">¶</a>
+          <li class="compact" id="section-3.1-1.29">
+            <a href="https://github.com/MISP/misp-objects/blob/main/objects/cortex/definition.json">objects/cortex</a> - Cortex object describing a complete cortex analysis. Observables would be attribute with a relationship from this object.<a href="#section-3.1-1.29" class="pilcrow">¶</a>
 </li>
-          <li class="normal" id="section-3.1-1.30">
-            <a href="https://github.com/MISP/misp-objects/blob/main/objects/covid19-dxy-live-city/definition.json">objects/covid19-dxy-live-city</a> - COVID 19 from dxy.cn - Aggregation by city.<a href="#section-3.1-1.30" class="pilcrow">¶</a>
+          <li class="compact" id="section-3.1-1.30">
+            <a href="https://github.com/MISP/misp-objects/blob/main/objects/cortex-taxonomy/definition.json">objects/cortex-taxonomy</a> - Cortex object describing an Cortex Taxonomy (or mini report).<a href="#section-3.1-1.30" class="pilcrow">¶</a>
 </li>
-          <li class="normal" id="section-3.1-1.31">
-            <a href="https://github.com/MISP/misp-objects/blob/main/objects/covid19-dxy-live-province/definition.json">objects/covid19-dxy-live-province</a> - COVID 19 from dxy.cn - Aggregation by province.<a href="#section-3.1-1.31" class="pilcrow">¶</a>
+          <li class="compact" id="section-3.1-1.31">
+            <a href="https://github.com/MISP/misp-objects/blob/main/objects/course-of-action/definition.json">objects/course-of-action</a> - An object describing a specific measure taken to prevent or respond to an attack.<a href="#section-3.1-1.31" class="pilcrow">¶</a>
 </li>
-          <li class="normal" id="section-3.1-1.32">
-            <a href="https://github.com/MISP/misp-objects/blob/main/objects/cowrie/definition.json">objects/cowrie</a> - Cowrie honeypot object template.<a href="#section-3.1-1.32" class="pilcrow">¶</a>
+          <li class="compact" id="section-3.1-1.32">
+            <a href="https://github.com/MISP/misp-objects/blob/main/objects/covid19-csse-daily-report/definition.json">objects/covid19-csse-daily-report</a> - CSSE COVID-19 Daily report.<a href="#section-3.1-1.32" class="pilcrow">¶</a>
 </li>
-          <li class="normal" id="section-3.1-1.33">
-            <a href="https://github.com/MISP/misp-objects/blob/main/objects/cpe-asset/definition.json">objects/cpe-asset</a> - An asset which can be defined by a CPE. This can be a generic asset. CPE is a structured naming scheme for information technology systems, software, and packages.<a href="#section-3.1-1.33" class="pilcrow">¶</a>
+          <li class="compact" id="section-3.1-1.33">
+            <a href="https://github.com/MISP/misp-objects/blob/main/objects/covid19-dxy-live-city/definition.json">objects/covid19-dxy-live-city</a> - COVID 19 from dxy.cn - Aggregation by city.<a href="#section-3.1-1.33" class="pilcrow">¶</a>
 </li>
-          <li class="normal" id="section-3.1-1.34">
-            <a href="https://github.com/MISP/misp-objects/blob/main/objects/credential/definition.json">objects/credential</a> - Credential describes one or more credential(s) including password(s), api key(s) or decryption key(s).<a href="#section-3.1-1.34" class="pilcrow">¶</a>
+          <li class="compact" id="section-3.1-1.34">
+            <a href="https://github.com/MISP/misp-objects/blob/main/objects/covid19-dxy-live-province/definition.json">objects/covid19-dxy-live-province</a> - COVID 19 from dxy.cn - Aggregation by province.<a href="#section-3.1-1.34" class="pilcrow">¶</a>
 </li>
-          <li class="normal" id="section-3.1-1.35">
-            <a href="https://github.com/MISP/misp-objects/blob/main/objects/credit-card/definition.json">objects/credit-card</a> - A payment card like credit card, debit card or any similar cards which can be used for financial transactions.<a href="#section-3.1-1.35" class="pilcrow">¶</a>
+          <li class="compact" id="section-3.1-1.35">
+            <a href="https://github.com/MISP/misp-objects/blob/main/objects/cowrie/definition.json">objects/cowrie</a> - Cowrie honeypot object template.<a href="#section-3.1-1.35" class="pilcrow">¶</a>
 </li>
-          <li class="normal" id="section-3.1-1.36">
-            <a href="https://github.com/MISP/misp-objects/blob/main/objects/crypto-material/definition.json">objects/crypto-material</a> - Cryptographic materials such as public or/and private keys.<a href="#section-3.1-1.36" class="pilcrow">¶</a>
+          <li class="compact" id="section-3.1-1.36">
+            <a href="https://github.com/MISP/misp-objects/blob/main/objects/cpe-asset/definition.json">objects/cpe-asset</a> - An asset which can be defined by a CPE. This can be a generic asset. CPE is a structured naming scheme for information technology systems, software, and packages.<a href="#section-3.1-1.36" class="pilcrow">¶</a>
 </li>
-          <li class="normal" id="section-3.1-1.37">
-            <a href="https://github.com/MISP/misp-objects/blob/main/objects/cytomic-orion-file/definition.json">objects/cytomic-orion-file</a> - Cytomic Orion File Detection.<a href="#section-3.1-1.37" class="pilcrow">¶</a>
+          <li class="compact" id="section-3.1-1.37">
+            <a href="https://github.com/MISP/misp-objects/blob/main/objects/credential/definition.json">objects/credential</a> - Credential describes one or more credential(s) including password(s), api key(s) or decryption key(s).<a href="#section-3.1-1.37" class="pilcrow">¶</a>
 </li>
-          <li class="normal" id="section-3.1-1.38">
-            <a href="https://github.com/MISP/misp-objects/blob/main/objects/cytomic-orion-machine/definition.json">objects/cytomic-orion-machine</a> - Cytomic Orion File at Machine Detection.<a href="#section-3.1-1.38" class="pilcrow">¶</a>
+          <li class="compact" id="section-3.1-1.38">
+            <a href="https://github.com/MISP/misp-objects/blob/main/objects/credit-card/definition.json">objects/credit-card</a> - A payment card like credit card, debit card or any similar cards which can be used for financial transactions.<a href="#section-3.1-1.38" class="pilcrow">¶</a>
 </li>
-          <li class="normal" id="section-3.1-1.39">
-            <a href="https://github.com/MISP/misp-objects/blob/main/objects/dark-pattern-item/definition.json">objects/dark-pattern-item</a> - An Item whose User Interface implements a dark pattern.<a href="#section-3.1-1.39" class="pilcrow">¶</a>
+          <li class="compact" id="section-3.1-1.39">
+            <a href="https://github.com/MISP/misp-objects/blob/main/objects/crypto-material/definition.json">objects/crypto-material</a> - Cryptographic materials such as public or/and private keys.<a href="#section-3.1-1.39" class="pilcrow">¶</a>
 </li>
-          <li class="normal" id="section-3.1-1.40">
-            <a href="https://github.com/MISP/misp-objects/blob/main/objects/ddos/definition.json">objects/ddos</a> - DDoS object describes a current DDoS activity from a specific or/and to a specific target. Type of DDoS can be attached to the object as a taxonomy.<a href="#section-3.1-1.40" class="pilcrow">¶</a>
+          <li class="compact" id="section-3.1-1.40">
+            <a href="https://github.com/MISP/misp-objects/blob/main/objects/cytomic-orion-file/definition.json">objects/cytomic-orion-file</a> - Cytomic Orion File Detection.<a href="#section-3.1-1.40" class="pilcrow">¶</a>
 </li>
-          <li class="normal" id="section-3.1-1.41">
-            <a href="https://github.com/MISP/misp-objects/blob/main/objects/device/definition.json">objects/device</a> - An object to define a device.<a href="#section-3.1-1.41" class="pilcrow">¶</a>
+          <li class="compact" id="section-3.1-1.41">
+            <a href="https://github.com/MISP/misp-objects/blob/main/objects/cytomic-orion-machine/definition.json">objects/cytomic-orion-machine</a> - Cytomic Orion File at Machine Detection.<a href="#section-3.1-1.41" class="pilcrow">¶</a>
 </li>
-          <li class="normal" id="section-3.1-1.42">
-            <a href="https://github.com/MISP/misp-objects/blob/main/objects/diameter-attack/definition.json">objects/diameter-attack</a> - Attack as seen on diameter authentication against a GSM, UMTS or LTE network.<a href="#section-3.1-1.42" class="pilcrow">¶</a>
+          <li class="compact" id="section-3.1-1.42">
+            <a href="https://github.com/MISP/misp-objects/blob/main/objects/dark-pattern-item/definition.json">objects/dark-pattern-item</a> - An Item whose User Interface implements a dark pattern.<a href="#section-3.1-1.42" class="pilcrow">¶</a>
 </li>
-          <li class="normal" id="section-3.1-1.43">
-            <a href="https://github.com/MISP/misp-objects/blob/main/objects/dns-record/definition.json">objects/dns-record</a> - A set of DNS records observed for a specific domain.<a href="#section-3.1-1.43" class="pilcrow">¶</a>
+          <li class="compact" id="section-3.1-1.43">
+            <a href="https://github.com/MISP/misp-objects/blob/main/objects/ddos/definition.json">objects/ddos</a> - DDoS object describes a current DDoS activity from a specific or/and to a specific target. Type of DDoS can be attached to the object as a taxonomy.<a href="#section-3.1-1.43" class="pilcrow">¶</a>
 </li>
-          <li class="normal" id="section-3.1-1.44">
-            <a href="https://github.com/MISP/misp-objects/blob/main/objects/domain-crawled/definition.json">objects/domain-crawled</a> - A domain crawled over time.<a href="#section-3.1-1.44" class="pilcrow">¶</a>
+          <li class="compact" id="section-3.1-1.44">
+            <a href="https://github.com/MISP/misp-objects/blob/main/objects/device/definition.json">objects/device</a> - An object to define a device.<a href="#section-3.1-1.44" class="pilcrow">¶</a>
 </li>
-          <li class="normal" id="section-3.1-1.45">
-            <a href="https://github.com/MISP/misp-objects/blob/main/objects/domain-ip/definition.json">objects/domain-ip</a> - A domain/hostname and IP address seen as a tuple in a specific time frame.<a href="#section-3.1-1.45" class="pilcrow">¶</a>
+          <li class="compact" id="section-3.1-1.45">
+            <a href="https://github.com/MISP/misp-objects/blob/main/objects/diameter-attack/definition.json">objects/diameter-attack</a> - Attack as seen on the diameter signaling protocol supporting LTE networks.<a href="#section-3.1-1.45" class="pilcrow">¶</a>
 </li>
-          <li class="normal" id="section-3.1-1.46">
-            <a href="https://github.com/MISP/misp-objects/blob/main/objects/elf/definition.json">objects/elf</a> - Object describing a Executable and Linkable Format.<a href="#section-3.1-1.46" class="pilcrow">¶</a>
+          <li class="compact" id="section-3.1-1.46">
+            <a href="https://github.com/MISP/misp-objects/blob/main/objects/dkim/definition.json">objects/dkim</a> - DomainKeys Identified Mail - DKIM.<a href="#section-3.1-1.46" class="pilcrow">¶</a>
 </li>
-          <li class="normal" id="section-3.1-1.47">
-            <a href="https://github.com/MISP/misp-objects/blob/main/objects/elf-section/definition.json">objects/elf-section</a> - Object describing a section of an Executable and Linkable Format.<a href="#section-3.1-1.47" class="pilcrow">¶</a>
+          <li class="compact" id="section-3.1-1.47">
+            <a href="https://github.com/MISP/misp-objects/blob/main/objects/dns-record/definition.json">objects/dns-record</a> - A set of DNS records observed for a specific domain.<a href="#section-3.1-1.47" class="pilcrow">¶</a>
 </li>
-          <li class="normal" id="section-3.1-1.48">
-            <a href="https://github.com/MISP/misp-objects/blob/main/objects/email/definition.json">objects/email</a> - Email object describing an email with meta-information.<a href="#section-3.1-1.48" class="pilcrow">¶</a>
+          <li class="compact" id="section-3.1-1.48">
+            <a href="https://github.com/MISP/misp-objects/blob/main/objects/domain-crawled/definition.json">objects/domain-crawled</a> - A domain crawled over time.<a href="#section-3.1-1.48" class="pilcrow">¶</a>
 </li>
-          <li class="normal" id="section-3.1-1.49">
-            <a href="https://github.com/MISP/misp-objects/blob/main/objects/employee/definition.json">objects/employee</a> - An employee and related data points.<a href="#section-3.1-1.49" class="pilcrow">¶</a>
+          <li class="compact" id="section-3.1-1.49">
+            <a href="https://github.com/MISP/misp-objects/blob/main/objects/domain-ip/definition.json">objects/domain-ip</a> - A domain/hostname and IP address seen as a tuple in a specific time frame.<a href="#section-3.1-1.49" class="pilcrow">¶</a>
 </li>
-          <li class="normal" id="section-3.1-1.50">
-            <a href="https://github.com/MISP/misp-objects/blob/main/objects/exploit-poc/definition.json">objects/exploit-poc</a> - Exploit-poc object describing a proof of concept or exploit of a vulnerability. This object has often a relationship with a vulnerability object.<a href="#section-3.1-1.50" class="pilcrow">¶</a>
+          <li class="compact" id="section-3.1-1.50">
+            <a href="https://github.com/MISP/misp-objects/blob/main/objects/edr-report/definition.json">objects/edr-report</a> - An Object Template to encode an EDR<span class="unicode">  (U+00A0)</span>detection report.<a href="#section-3.1-1.50" class="pilcrow">¶</a>
 </li>
-          <li class="normal" id="section-3.1-1.51">
-            <a href="https://github.com/MISP/misp-objects/blob/main/objects/facebook-account/definition.json">objects/facebook-account</a> - Facebook account.<a href="#section-3.1-1.51" class="pilcrow">¶</a>
+          <li class="compact" id="section-3.1-1.51">
+            <a href="https://github.com/MISP/misp-objects/blob/main/objects/elf/definition.json">objects/elf</a> - Object describing a Executable and Linkable Format.<a href="#section-3.1-1.51" class="pilcrow">¶</a>
 </li>
-          <li class="normal" id="section-3.1-1.52">
-            <a href="https://github.com/MISP/misp-objects/blob/main/objects/facebook-group/definition.json">objects/facebook-group</a> - Public or private facebook group.<a href="#section-3.1-1.52" class="pilcrow">¶</a>
+          <li class="compact" id="section-3.1-1.52">
+            <a href="https://github.com/MISP/misp-objects/blob/main/objects/elf-section/definition.json">objects/elf-section</a> - Object describing a section of an Executable and Linkable Format.<a href="#section-3.1-1.52" class="pilcrow">¶</a>
 </li>
-          <li class="normal" id="section-3.1-1.53">
-            <a href="https://github.com/MISP/misp-objects/blob/main/objects/facebook-page/definition.json">objects/facebook-page</a> - Facebook page.<a href="#section-3.1-1.53" class="pilcrow">¶</a>
+          <li class="compact" id="section-3.1-1.53">
+            <a href="https://github.com/MISP/misp-objects/blob/main/objects/email/definition.json">objects/email</a> - Email object describing an email with meta-information.<a href="#section-3.1-1.53" class="pilcrow">¶</a>
 </li>
-          <li class="normal" id="section-3.1-1.54">
-            <a href="https://github.com/MISP/misp-objects/blob/main/objects/facebook-post/definition.json">objects/facebook-post</a> - Post on a Facebook wall.<a href="#section-3.1-1.54" class="pilcrow">¶</a>
+          <li class="compact" id="section-3.1-1.54">
+            <a href="https://github.com/MISP/misp-objects/blob/main/objects/employee/definition.json">objects/employee</a> - An employee and related data points.<a href="#section-3.1-1.54" class="pilcrow">¶</a>
 </li>
-          <li class="normal" id="section-3.1-1.55">
-            <a href="https://github.com/MISP/misp-objects/blob/main/objects/facial-composite/definition.json">objects/facial-composite</a> - An object which describes a facial composite.<a href="#section-3.1-1.55" class="pilcrow">¶</a>
+          <li class="compact" id="section-3.1-1.55">
+            <a href="https://github.com/MISP/misp-objects/blob/main/objects/exploit-poc/definition.json">objects/exploit-poc</a> - Exploit-poc object describing a proof of concept or exploit of a vulnerability. This object has often a relationship with a vulnerability object.<a href="#section-3.1-1.55" class="pilcrow">¶</a>
 </li>
-          <li class="normal" id="section-3.1-1.56">
-            <a href="https://github.com/MISP/misp-objects/blob/main/objects/fail2ban/definition.json">objects/fail2ban</a> - Fail2ban event.<a href="#section-3.1-1.56" class="pilcrow">¶</a>
+          <li class="compact" id="section-3.1-1.56">
+            <a href="https://github.com/MISP/misp-objects/blob/main/objects/facebook-account/definition.json">objects/facebook-account</a> - Facebook account.<a href="#section-3.1-1.56" class="pilcrow">¶</a>
 </li>
-          <li class="normal" id="section-3.1-1.57">
-            <a href="https://github.com/MISP/misp-objects/blob/main/objects/favicon/definition.json">objects/favicon</a> - A favicon, also known as a shortcut icon, website icon, tab icon, URL icon, or bookmark icon, is a file containing one or more small icons, associated with a particular website or web page. The object template can include the murmur3 hash of the favicon to facilitate correlation.<a href="#section-3.1-1.57" class="pilcrow">¶</a>
+          <li class="compact" id="section-3.1-1.57">
+            <a href="https://github.com/MISP/misp-objects/blob/main/objects/facebook-group/definition.json">objects/facebook-group</a> - Public or private facebook group.<a href="#section-3.1-1.57" class="pilcrow">¶</a>
 </li>
-          <li class="normal" id="section-3.1-1.58">
-            <a href="https://github.com/MISP/misp-objects/blob/main/objects/file/definition.json">objects/file</a> - File object describing a file with meta-information.<a href="#section-3.1-1.58" class="pilcrow">¶</a>
+          <li class="compact" id="section-3.1-1.58">
+            <a href="https://github.com/MISP/misp-objects/blob/main/objects/facebook-page/definition.json">objects/facebook-page</a> - Facebook page.<a href="#section-3.1-1.58" class="pilcrow">¶</a>
 </li>
-          <li class="normal" id="section-3.1-1.59">
-            <a href="https://github.com/MISP/misp-objects/blob/main/objects/forensic-case/definition.json">objects/forensic-case</a> - An object template to describe a digital forensic case.<a href="#section-3.1-1.59" class="pilcrow">¶</a>
+          <li class="compact" id="section-3.1-1.59">
+            <a href="https://github.com/MISP/misp-objects/blob/main/objects/facebook-post/definition.json">objects/facebook-post</a> - Post on a Facebook wall.<a href="#section-3.1-1.59" class="pilcrow">¶</a>
 </li>
-          <li class="normal" id="section-3.1-1.60">
-            <a href="https://github.com/MISP/misp-objects/blob/main/objects/forensic-evidence/definition.json">objects/forensic-evidence</a> - An object template to describe a digital forensic evidence.<a href="#section-3.1-1.60" class="pilcrow">¶</a>
+          <li class="compact" id="section-3.1-1.60">
+            <a href="https://github.com/MISP/misp-objects/blob/main/objects/facial-composite/definition.json">objects/facial-composite</a> - An object which describes a facial composite.<a href="#section-3.1-1.60" class="pilcrow">¶</a>
 </li>
-          <li class="normal" id="section-3.1-1.61">
-            <a href="https://github.com/MISP/misp-objects/blob/main/objects/forged-document/definition.json">objects/forged-document</a> - Object describing a forged document.<a href="#section-3.1-1.61" class="pilcrow">¶</a>
+          <li class="compact" id="section-3.1-1.61">
+            <a href="https://github.com/MISP/misp-objects/blob/main/objects/fail2ban/definition.json">objects/fail2ban</a> - Fail2ban event.<a href="#section-3.1-1.61" class="pilcrow">¶</a>
 </li>
-          <li class="normal" id="section-3.1-1.62">
-            <a href="https://github.com/MISP/misp-objects/blob/main/objects/ftm-Airplane/definition.json">objects/ftm-Airplane</a> - .<a href="#section-3.1-1.62" class="pilcrow">¶</a>
+          <li class="compact" id="section-3.1-1.62">
+            <a href="https://github.com/MISP/misp-objects/blob/main/objects/favicon/definition.json">objects/favicon</a> - A favicon, also known as a shortcut icon, website icon, tab icon, URL icon, or bookmark icon, is a file containing one or more small icons, associated with a particular website or web page. The object template can include the murmur3 hash of the favicon to facilitate correlation.<a href="#section-3.1-1.62" class="pilcrow">¶</a>
 </li>
-          <li class="normal" id="section-3.1-1.63">
-            <a href="https://github.com/MISP/misp-objects/blob/main/objects/ftm-Assessment/definition.json">objects/ftm-Assessment</a> - .<a href="#section-3.1-1.63" class="pilcrow">¶</a>
+          <li class="compact" id="section-3.1-1.63">
+            <a href="https://github.com/MISP/misp-objects/blob/main/objects/file/definition.json">objects/file</a> - File object describing a file with meta-information.<a href="#section-3.1-1.63" class="pilcrow">¶</a>
 </li>
-          <li class="normal" id="section-3.1-1.64">
-            <a href="https://github.com/MISP/misp-objects/blob/main/objects/ftm-Asset/definition.json">objects/ftm-Asset</a> - .<a href="#section-3.1-1.64" class="pilcrow">¶</a>
+          <li class="compact" id="section-3.1-1.64">
+            <a href="https://github.com/MISP/misp-objects/blob/main/objects/forensic-case/definition.json">objects/forensic-case</a> - An object template to describe a digital forensic case.<a href="#section-3.1-1.64" class="pilcrow">¶</a>
 </li>
-          <li class="normal" id="section-3.1-1.65">
-            <a href="https://github.com/MISP/misp-objects/blob/main/objects/ftm-Associate/definition.json">objects/ftm-Associate</a> - Non-family association between two people.<a href="#section-3.1-1.65" class="pilcrow">¶</a>
+          <li class="compact" id="section-3.1-1.65">
+            <a href="https://github.com/MISP/misp-objects/blob/main/objects/forensic-evidence/definition.json">objects/forensic-evidence</a> - An object template to describe a digital forensic evidence.<a href="#section-3.1-1.65" class="pilcrow">¶</a>
 </li>
-          <li class="normal" id="section-3.1-1.66">
-            <a href="https://github.com/MISP/misp-objects/blob/main/objects/ftm-Audio/definition.json">objects/ftm-Audio</a> - .<a href="#section-3.1-1.66" class="pilcrow">¶</a>
+          <li class="compact" id="section-3.1-1.66">
+            <a href="https://github.com/MISP/misp-objects/blob/main/objects/forged-document/definition.json">objects/forged-document</a> - Object describing a forged document.<a href="#section-3.1-1.66" class="pilcrow">¶</a>
 </li>
-          <li class="normal" id="section-3.1-1.67">
-            <a href="https://github.com/MISP/misp-objects/blob/main/objects/ftm-BankAccount/definition.json">objects/ftm-BankAccount</a> - .<a href="#section-3.1-1.67" class="pilcrow">¶</a>
+          <li class="compact" id="section-3.1-1.67">
+            <a href="https://github.com/MISP/misp-objects/blob/main/objects/ftm-Airplane/definition.json">objects/ftm-Airplane</a> - .<a href="#section-3.1-1.67" class="pilcrow">¶</a>
 </li>
-          <li class="normal" id="section-3.1-1.68">
-            <a href="https://github.com/MISP/misp-objects/blob/main/objects/ftm-Call/definition.json">objects/ftm-Call</a> - .<a href="#section-3.1-1.68" class="pilcrow">¶</a>
+          <li class="compact" id="section-3.1-1.68">
+            <a href="https://github.com/MISP/misp-objects/blob/main/objects/ftm-Assessment/definition.json">objects/ftm-Assessment</a> - .<a href="#section-3.1-1.68" class="pilcrow">¶</a>
 </li>
-          <li class="normal" id="section-3.1-1.69">
-            <a href="https://github.com/MISP/misp-objects/blob/main/objects/ftm-Company/definition.json">objects/ftm-Company</a> - .<a href="#section-3.1-1.69" class="pilcrow">¶</a>
+          <li class="compact" id="section-3.1-1.69">
+            <a href="https://github.com/MISP/misp-objects/blob/main/objects/ftm-Asset/definition.json">objects/ftm-Asset</a> - .<a href="#section-3.1-1.69" class="pilcrow">¶</a>
 </li>
-          <li class="normal" id="section-3.1-1.70">
+          <li class="compact" id="section-3.1-1.70">
+            <a href="https://github.com/MISP/misp-objects/blob/main/objects/ftm-Associate/definition.json">objects/ftm-Associate</a> - Non-family association between two people.<a href="#section-3.1-1.70" class="pilcrow">¶</a>
+</li>
+          <li class="compact" id="section-3.1-1.71">
+            <a href="https://github.com/MISP/misp-objects/blob/main/objects/ftm-Audio/definition.json">objects/ftm-Audio</a> - .<a href="#section-3.1-1.71" class="pilcrow">¶</a>
+</li>
+          <li class="compact" id="section-3.1-1.72">
+            <a href="https://github.com/MISP/misp-objects/blob/main/objects/ftm-BankAccount/definition.json">objects/ftm-BankAccount</a> - .<a href="#section-3.1-1.72" class="pilcrow">¶</a>
+</li>
+          <li class="compact" id="section-3.1-1.73">
+            <a href="https://github.com/MISP/misp-objects/blob/main/objects/ftm-Call/definition.json">objects/ftm-Call</a> - .<a href="#section-3.1-1.73" class="pilcrow">¶</a>
+</li>
+          <li class="compact" id="section-3.1-1.74">
+            <a href="https://github.com/MISP/misp-objects/blob/main/objects/ftm-Company/definition.json">objects/ftm-Company</a> - A legal entity representing an association of people, whether natural, legal or a mixture of both, with a specific objective.<a href="#section-3.1-1.74" class="pilcrow">¶</a>
+</li>
+          <li class="compact" id="section-3.1-1.75">
             <a href="https://github.com/MISP/misp-objects/blob/main/objects/ftm-Contract/definition.json">objects/ftm-Contract</a> - An contract or contract lot issued by an authority. Multiple lots may be awarded to different suppliers (see ContractAward).
-.<a href="#section-3.1-1.70" class="pilcrow">¶</a>
+.<a href="#section-3.1-1.75" class="pilcrow">¶</a>
 </li>
-          <li class="normal" id="section-3.1-1.71">
-            <a href="https://github.com/MISP/misp-objects/blob/main/objects/ftm-ContractAward/definition.json">objects/ftm-ContractAward</a> - A contract or contract lot as awarded to a supplier.<a href="#section-3.1-1.71" class="pilcrow">¶</a>
+          <li class="compact" id="section-3.1-1.76">
+            <a href="https://github.com/MISP/misp-objects/blob/main/objects/ftm-ContractAward/definition.json">objects/ftm-ContractAward</a> - A contract or contract lot as awarded to a supplier.<a href="#section-3.1-1.76" class="pilcrow">¶</a>
 </li>
-          <li class="normal" id="section-3.1-1.72">
-            <a href="https://github.com/MISP/misp-objects/blob/main/objects/ftm-CourtCase/definition.json">objects/ftm-CourtCase</a> - .<a href="#section-3.1-1.72" class="pilcrow">¶</a>
+          <li class="compact" id="section-3.1-1.77">
+            <a href="https://github.com/MISP/misp-objects/blob/main/objects/ftm-CourtCase/definition.json">objects/ftm-CourtCase</a> - .<a href="#section-3.1-1.77" class="pilcrow">¶</a>
 </li>
-          <li class="normal" id="section-3.1-1.73">
-            <a href="https://github.com/MISP/misp-objects/blob/main/objects/ftm-CourtCaseParty/definition.json">objects/ftm-CourtCaseParty</a> - .<a href="#section-3.1-1.73" class="pilcrow">¶</a>
+          <li class="compact" id="section-3.1-1.78">
+            <a href="https://github.com/MISP/misp-objects/blob/main/objects/ftm-CourtCaseParty/definition.json">objects/ftm-CourtCaseParty</a> - .<a href="#section-3.1-1.78" class="pilcrow">¶</a>
 </li>
-          <li class="normal" id="section-3.1-1.74">
-            <a href="https://github.com/MISP/misp-objects/blob/main/objects/ftm-Debt/definition.json">objects/ftm-Debt</a> - A monetary debt between two parties.<a href="#section-3.1-1.74" class="pilcrow">¶</a>
+          <li class="compact" id="section-3.1-1.79">
+            <a href="https://github.com/MISP/misp-objects/blob/main/objects/ftm-Debt/definition.json">objects/ftm-Debt</a> - A monetary debt between two parties.<a href="#section-3.1-1.79" class="pilcrow">¶</a>
 </li>
-          <li class="normal" id="section-3.1-1.75">
-            <a href="https://github.com/MISP/misp-objects/blob/main/objects/ftm-Directorship/definition.json">objects/ftm-Directorship</a> - .<a href="#section-3.1-1.75" class="pilcrow">¶</a>
+          <li class="compact" id="section-3.1-1.80">
+            <a href="https://github.com/MISP/misp-objects/blob/main/objects/ftm-Directorship/definition.json">objects/ftm-Directorship</a> - .<a href="#section-3.1-1.80" class="pilcrow">¶</a>
 </li>
-          <li class="normal" id="section-3.1-1.76">
-            <a href="https://github.com/MISP/misp-objects/blob/main/objects/ftm-Document/definition.json">objects/ftm-Document</a> - .<a href="#section-3.1-1.76" class="pilcrow">¶</a>
+          <li class="compact" id="section-3.1-1.81">
+            <a href="https://github.com/MISP/misp-objects/blob/main/objects/ftm-Document/definition.json">objects/ftm-Document</a> - .<a href="#section-3.1-1.81" class="pilcrow">¶</a>
 </li>
-          <li class="normal" id="section-3.1-1.77">
-            <a href="https://github.com/MISP/misp-objects/blob/main/objects/ftm-Documentation/definition.json">objects/ftm-Documentation</a> - .<a href="#section-3.1-1.77" class="pilcrow">¶</a>
+          <li class="compact" id="section-3.1-1.82">
+            <a href="https://github.com/MISP/misp-objects/blob/main/objects/ftm-Documentation/definition.json">objects/ftm-Documentation</a> - .<a href="#section-3.1-1.82" class="pilcrow">¶</a>
 </li>
-          <li class="normal" id="section-3.1-1.78">
-            <a href="https://github.com/MISP/misp-objects/blob/main/objects/ftm-EconomicActivity/definition.json">objects/ftm-EconomicActivity</a> - A foreign economic activity.<a href="#section-3.1-1.78" class="pilcrow">¶</a>
+          <li class="compact" id="section-3.1-1.83">
+            <a href="https://github.com/MISP/misp-objects/blob/main/objects/ftm-EconomicActivity/definition.json">objects/ftm-EconomicActivity</a> - A foreign economic activity.<a href="#section-3.1-1.83" class="pilcrow">¶</a>
 </li>
-          <li class="normal" id="section-3.1-1.79">
-            <a href="https://github.com/MISP/misp-objects/blob/main/objects/ftm-Email/definition.json">objects/ftm-Email</a> - .<a href="#section-3.1-1.79" class="pilcrow">¶</a>
+          <li class="compact" id="section-3.1-1.84">
+            <a href="https://github.com/MISP/misp-objects/blob/main/objects/ftm-Email/definition.json">objects/ftm-Email</a> - .<a href="#section-3.1-1.84" class="pilcrow">¶</a>
 </li>
-          <li class="normal" id="section-3.1-1.80">
-            <a href="https://github.com/MISP/misp-objects/blob/main/objects/ftm-Event/definition.json">objects/ftm-Event</a> - .<a href="#section-3.1-1.80" class="pilcrow">¶</a>
+          <li class="compact" id="section-3.1-1.85">
+            <a href="https://github.com/MISP/misp-objects/blob/main/objects/ftm-Event/definition.json">objects/ftm-Event</a> - .<a href="#section-3.1-1.85" class="pilcrow">¶</a>
 </li>
-          <li class="normal" id="section-3.1-1.81">
-            <a href="https://github.com/MISP/misp-objects/blob/main/objects/ftm-Family/definition.json">objects/ftm-Family</a> - Family relationship between two people.<a href="#section-3.1-1.81" class="pilcrow">¶</a>
+          <li class="compact" id="section-3.1-1.86">
+            <a href="https://github.com/MISP/misp-objects/blob/main/objects/ftm-Family/definition.json">objects/ftm-Family</a> - Family relationship between two people.<a href="#section-3.1-1.86" class="pilcrow">¶</a>
 </li>
-          <li class="normal" id="section-3.1-1.82">
-            <a href="https://github.com/MISP/misp-objects/blob/main/objects/ftm-Folder/definition.json">objects/ftm-Folder</a> - .<a href="#section-3.1-1.82" class="pilcrow">¶</a>
+          <li class="compact" id="section-3.1-1.87">
+            <a href="https://github.com/MISP/misp-objects/blob/main/objects/ftm-Folder/definition.json">objects/ftm-Folder</a> - .<a href="#section-3.1-1.87" class="pilcrow">¶</a>
 </li>
-          <li class="normal" id="section-3.1-1.83">
-            <a href="https://github.com/MISP/misp-objects/blob/main/objects/ftm-HyperText/definition.json">objects/ftm-HyperText</a> - .<a href="#section-3.1-1.83" class="pilcrow">¶</a>
+          <li class="compact" id="section-3.1-1.88">
+            <a href="https://github.com/MISP/misp-objects/blob/main/objects/ftm-HyperText/definition.json">objects/ftm-HyperText</a> - .<a href="#section-3.1-1.88" class="pilcrow">¶</a>
 </li>
-          <li class="normal" id="section-3.1-1.84">
-            <a href="https://github.com/MISP/misp-objects/blob/main/objects/ftm-Image/definition.json">objects/ftm-Image</a> - .<a href="#section-3.1-1.84" class="pilcrow">¶</a>
+          <li class="compact" id="section-3.1-1.89">
+            <a href="https://github.com/MISP/misp-objects/blob/main/objects/ftm-Image/definition.json">objects/ftm-Image</a> - .<a href="#section-3.1-1.89" class="pilcrow">¶</a>
 </li>
-          <li class="normal" id="section-3.1-1.85">
-            <a href="https://github.com/MISP/misp-objects/blob/main/objects/ftm-Land/definition.json">objects/ftm-Land</a> - .<a href="#section-3.1-1.85" class="pilcrow">¶</a>
+          <li class="compact" id="section-3.1-1.90">
+            <a href="https://github.com/MISP/misp-objects/blob/main/objects/ftm-Land/definition.json">objects/ftm-Land</a> - .<a href="#section-3.1-1.90" class="pilcrow">¶</a>
 </li>
-          <li class="normal" id="section-3.1-1.86">
-            <a href="https://github.com/MISP/misp-objects/blob/main/objects/ftm-LegalEntity/definition.json">objects/ftm-LegalEntity</a> - A legal entity may be a person or a company.<a href="#section-3.1-1.86" class="pilcrow">¶</a>
+          <li class="compact" id="section-3.1-1.91">
+            <a href="https://github.com/MISP/misp-objects/blob/main/objects/ftm-LegalEntity/definition.json">objects/ftm-LegalEntity</a> - A legal entity may be a person or a company.<a href="#section-3.1-1.91" class="pilcrow">¶</a>
 </li>
-          <li class="normal" id="section-3.1-1.87">
-            <a href="https://github.com/MISP/misp-objects/blob/main/objects/ftm-License/definition.json">objects/ftm-License</a> - A grant of land, rights or property. A type of Contract.<a href="#section-3.1-1.87" class="pilcrow">¶</a>
+          <li class="compact" id="section-3.1-1.92">
+            <a href="https://github.com/MISP/misp-objects/blob/main/objects/ftm-License/definition.json">objects/ftm-License</a> - A grant of land, rights or property. A type of Contract.<a href="#section-3.1-1.92" class="pilcrow">¶</a>
 </li>
-          <li class="normal" id="section-3.1-1.88">
-            <a href="https://github.com/MISP/misp-objects/blob/main/objects/ftm-Membership/definition.json">objects/ftm-Membership</a> - .<a href="#section-3.1-1.88" class="pilcrow">¶</a>
+          <li class="compact" id="section-3.1-1.93">
+            <a href="https://github.com/MISP/misp-objects/blob/main/objects/ftm-Membership/definition.json">objects/ftm-Membership</a> - .<a href="#section-3.1-1.93" class="pilcrow">¶</a>
 </li>
-          <li class="normal" id="section-3.1-1.89">
-            <a href="https://github.com/MISP/misp-objects/blob/main/objects/ftm-Message/definition.json">objects/ftm-Message</a> - .<a href="#section-3.1-1.89" class="pilcrow">¶</a>
+          <li class="compact" id="section-3.1-1.94">
+            <a href="https://github.com/MISP/misp-objects/blob/main/objects/ftm-Message/definition.json">objects/ftm-Message</a> - .<a href="#section-3.1-1.94" class="pilcrow">¶</a>
 </li>
-          <li class="normal" id="section-3.1-1.90">
-            <a href="https://github.com/MISP/misp-objects/blob/main/objects/ftm-Organization/definition.json">objects/ftm-Organization</a> - .<a href="#section-3.1-1.90" class="pilcrow">¶</a>
+          <li class="compact" id="section-3.1-1.95">
+            <a href="https://github.com/MISP/misp-objects/blob/main/objects/ftm-Organization/definition.json">objects/ftm-Organization</a> - .<a href="#section-3.1-1.95" class="pilcrow">¶</a>
 </li>
-          <li class="normal" id="section-3.1-1.91">
-            <a href="https://github.com/MISP/misp-objects/blob/main/objects/ftm-Ownership/definition.json">objects/ftm-Ownership</a> - .<a href="#section-3.1-1.91" class="pilcrow">¶</a>
+          <li class="compact" id="section-3.1-1.96">
+            <a href="https://github.com/MISP/misp-objects/blob/main/objects/ftm-Ownership/definition.json">objects/ftm-Ownership</a> - .<a href="#section-3.1-1.96" class="pilcrow">¶</a>
 </li>
-          <li class="normal" id="section-3.1-1.92">
-            <a href="https://github.com/MISP/misp-objects/blob/main/objects/ftm-Package/definition.json">objects/ftm-Package</a> - .<a href="#section-3.1-1.92" class="pilcrow">¶</a>
+          <li class="compact" id="section-3.1-1.97">
+            <a href="https://github.com/MISP/misp-objects/blob/main/objects/ftm-Package/definition.json">objects/ftm-Package</a> - .<a href="#section-3.1-1.97" class="pilcrow">¶</a>
 </li>
-          <li class="normal" id="section-3.1-1.93">
-            <a href="https://github.com/MISP/misp-objects/blob/main/objects/ftm-Page/definition.json">objects/ftm-Page</a> - .<a href="#section-3.1-1.93" class="pilcrow">¶</a>
+          <li class="compact" id="section-3.1-1.98">
+            <a href="https://github.com/MISP/misp-objects/blob/main/objects/ftm-Page/definition.json">objects/ftm-Page</a> - .<a href="#section-3.1-1.98" class="pilcrow">¶</a>
 </li>
-          <li class="normal" id="section-3.1-1.94">
-            <a href="https://github.com/MISP/misp-objects/blob/main/objects/ftm-Pages/definition.json">objects/ftm-Pages</a> - .<a href="#section-3.1-1.94" class="pilcrow">¶</a>
+          <li class="compact" id="section-3.1-1.99">
+            <a href="https://github.com/MISP/misp-objects/blob/main/objects/ftm-Pages/definition.json">objects/ftm-Pages</a> - .<a href="#section-3.1-1.99" class="pilcrow">¶</a>
 </li>
-          <li class="normal" id="section-3.1-1.95">
-            <a href="https://github.com/MISP/misp-objects/blob/main/objects/ftm-Passport/definition.json">objects/ftm-Passport</a> - Passport.<a href="#section-3.1-1.95" class="pilcrow">¶</a>
+          <li class="compact" id="section-3.1-1.100">
+            <a href="https://github.com/MISP/misp-objects/blob/main/objects/ftm-Passport/definition.json">objects/ftm-Passport</a> - Passport.<a href="#section-3.1-1.100" class="pilcrow">¶</a>
 </li>
-          <li class="normal" id="section-3.1-1.96">
-            <a href="https://github.com/MISP/misp-objects/blob/main/objects/ftm-Payment/definition.json">objects/ftm-Payment</a> - A monetary payment between two parties.<a href="#section-3.1-1.96" class="pilcrow">¶</a>
+          <li class="compact" id="section-3.1-1.101">
+            <a href="https://github.com/MISP/misp-objects/blob/main/objects/ftm-Payment/definition.json">objects/ftm-Payment</a> - A monetary payment between two parties.<a href="#section-3.1-1.101" class="pilcrow">¶</a>
 </li>
-          <li class="normal" id="section-3.1-1.97">
-            <a href="https://github.com/MISP/misp-objects/blob/main/objects/ftm-Person/definition.json">objects/ftm-Person</a> - An individual.<a href="#section-3.1-1.97" class="pilcrow">¶</a>
+          <li class="compact" id="section-3.1-1.102">
+            <a href="https://github.com/MISP/misp-objects/blob/main/objects/ftm-Person/definition.json">objects/ftm-Person</a> - An individual.<a href="#section-3.1-1.102" class="pilcrow">¶</a>
 </li>
-          <li class="normal" id="section-3.1-1.98">
-            <a href="https://github.com/MISP/misp-objects/blob/main/objects/ftm-PlainText/definition.json">objects/ftm-PlainText</a> - .<a href="#section-3.1-1.98" class="pilcrow">¶</a>
+          <li class="compact" id="section-3.1-1.103">
+            <a href="https://github.com/MISP/misp-objects/blob/main/objects/ftm-PlainText/definition.json">objects/ftm-PlainText</a> - .<a href="#section-3.1-1.103" class="pilcrow">¶</a>
 </li>
-          <li class="normal" id="section-3.1-1.99">
-            <a href="https://github.com/MISP/misp-objects/blob/main/objects/ftm-PublicBody/definition.json">objects/ftm-PublicBody</a> - A public body, such as a ministry, department or state company.<a href="#section-3.1-1.99" class="pilcrow">¶</a>
+          <li class="compact" id="section-3.1-1.104">
+            <a href="https://github.com/MISP/misp-objects/blob/main/objects/ftm-PublicBody/definition.json">objects/ftm-PublicBody</a> - A public body, such as a ministry, department or state company.<a href="#section-3.1-1.104" class="pilcrow">¶</a>
 </li>
-          <li class="normal" id="section-3.1-1.100">
-            <a href="https://github.com/MISP/misp-objects/blob/main/objects/ftm-RealEstate/definition.json">objects/ftm-RealEstate</a> - A piece of land or property.<a href="#section-3.1-1.100" class="pilcrow">¶</a>
+          <li class="compact" id="section-3.1-1.105">
+            <a href="https://github.com/MISP/misp-objects/blob/main/objects/ftm-RealEstate/definition.json">objects/ftm-RealEstate</a> - A piece of land or property.<a href="#section-3.1-1.105" class="pilcrow">¶</a>
 </li>
-          <li class="normal" id="section-3.1-1.101">
-            <a href="https://github.com/MISP/misp-objects/blob/main/objects/ftm-Representation/definition.json">objects/ftm-Representation</a> - A mediatory, intermediary, middleman, or broker acting on behalf of a legal entity.<a href="#section-3.1-1.101" class="pilcrow">¶</a>
+          <li class="compact" id="section-3.1-1.106">
+            <a href="https://github.com/MISP/misp-objects/blob/main/objects/ftm-Representation/definition.json">objects/ftm-Representation</a> - A mediatory, intermediary, middleman, or broker acting on behalf of a legal entity.<a href="#section-3.1-1.106" class="pilcrow">¶</a>
 </li>
-          <li class="normal" id="section-3.1-1.102">
-            <a href="https://github.com/MISP/misp-objects/blob/main/objects/ftm-Row/definition.json">objects/ftm-Row</a> - .<a href="#section-3.1-1.102" class="pilcrow">¶</a>
+          <li class="compact" id="section-3.1-1.107">
+            <a href="https://github.com/MISP/misp-objects/blob/main/objects/ftm-Row/definition.json">objects/ftm-Row</a> - .<a href="#section-3.1-1.107" class="pilcrow">¶</a>
 </li>
-          <li class="normal" id="section-3.1-1.103">
-            <a href="https://github.com/MISP/misp-objects/blob/main/objects/ftm-Sanction/definition.json">objects/ftm-Sanction</a> - A sanction designation.<a href="#section-3.1-1.103" class="pilcrow">¶</a>
+          <li class="compact" id="section-3.1-1.108">
+            <a href="https://github.com/MISP/misp-objects/blob/main/objects/ftm-Sanction/definition.json">objects/ftm-Sanction</a> - A sanction designation.<a href="#section-3.1-1.108" class="pilcrow">¶</a>
 </li>
-          <li class="normal" id="section-3.1-1.104">
-            <a href="https://github.com/MISP/misp-objects/blob/main/objects/ftm-Succession/definition.json">objects/ftm-Succession</a> - Two entities that legally succeed each other.<a href="#section-3.1-1.104" class="pilcrow">¶</a>
+          <li class="compact" id="section-3.1-1.109">
+            <a href="https://github.com/MISP/misp-objects/blob/main/objects/ftm-Succession/definition.json">objects/ftm-Succession</a> - Two entities that legally succeed each other.<a href="#section-3.1-1.109" class="pilcrow">¶</a>
 </li>
-          <li class="normal" id="section-3.1-1.105">
-            <a href="https://github.com/MISP/misp-objects/blob/main/objects/ftm-Table/definition.json">objects/ftm-Table</a> - .<a href="#section-3.1-1.105" class="pilcrow">¶</a>
+          <li class="compact" id="section-3.1-1.110">
+            <a href="https://github.com/MISP/misp-objects/blob/main/objects/ftm-Table/definition.json">objects/ftm-Table</a> - .<a href="#section-3.1-1.110" class="pilcrow">¶</a>
 </li>
-          <li class="normal" id="section-3.1-1.106">
-            <a href="https://github.com/MISP/misp-objects/blob/main/objects/ftm-TaxRoll/definition.json">objects/ftm-TaxRoll</a> - A tax declaration of an individual.<a href="#section-3.1-1.106" class="pilcrow">¶</a>
+          <li class="compact" id="section-3.1-1.111">
+            <a href="https://github.com/MISP/misp-objects/blob/main/objects/ftm-TaxRoll/definition.json">objects/ftm-TaxRoll</a> - A tax declaration of an individual.<a href="#section-3.1-1.111" class="pilcrow">¶</a>
 </li>
-          <li class="normal" id="section-3.1-1.107">
-            <a href="https://github.com/MISP/misp-objects/blob/main/objects/ftm-UnknownLink/definition.json">objects/ftm-UnknownLink</a> - .<a href="#section-3.1-1.107" class="pilcrow">¶</a>
+          <li class="compact" id="section-3.1-1.112">
+            <a href="https://github.com/MISP/misp-objects/blob/main/objects/ftm-UnknownLink/definition.json">objects/ftm-UnknownLink</a> - .<a href="#section-3.1-1.112" class="pilcrow">¶</a>
 </li>
-          <li class="normal" id="section-3.1-1.108">
-            <a href="https://github.com/MISP/misp-objects/blob/main/objects/ftm-UserAccount/definition.json">objects/ftm-UserAccount</a> - .<a href="#section-3.1-1.108" class="pilcrow">¶</a>
+          <li class="compact" id="section-3.1-1.113">
+            <a href="https://github.com/MISP/misp-objects/blob/main/objects/ftm-UserAccount/definition.json">objects/ftm-UserAccount</a> - .<a href="#section-3.1-1.113" class="pilcrow">¶</a>
 </li>
-          <li class="normal" id="section-3.1-1.109">
-            <a href="https://github.com/MISP/misp-objects/blob/main/objects/ftm-Vehicle/definition.json">objects/ftm-Vehicle</a> - .<a href="#section-3.1-1.109" class="pilcrow">¶</a>
+          <li class="compact" id="section-3.1-1.114">
+            <a href="https://github.com/MISP/misp-objects/blob/main/objects/ftm-Vehicle/definition.json">objects/ftm-Vehicle</a> - .<a href="#section-3.1-1.114" class="pilcrow">¶</a>
 </li>
-          <li class="normal" id="section-3.1-1.110">
-            <a href="https://github.com/MISP/misp-objects/blob/main/objects/ftm-Vessel/definition.json">objects/ftm-Vessel</a> - A boat or ship.<a href="#section-3.1-1.110" class="pilcrow">¶</a>
+          <li class="compact" id="section-3.1-1.115">
+            <a href="https://github.com/MISP/misp-objects/blob/main/objects/ftm-Vessel/definition.json">objects/ftm-Vessel</a> - A boat or ship.<a href="#section-3.1-1.115" class="pilcrow">¶</a>
 </li>
-          <li class="normal" id="section-3.1-1.111">
-            <a href="https://github.com/MISP/misp-objects/blob/main/objects/ftm-Video/definition.json">objects/ftm-Video</a> - .<a href="#section-3.1-1.111" class="pilcrow">¶</a>
+          <li class="compact" id="section-3.1-1.116">
+            <a href="https://github.com/MISP/misp-objects/blob/main/objects/ftm-Video/definition.json">objects/ftm-Video</a> - .<a href="#section-3.1-1.116" class="pilcrow">¶</a>
 </li>
-          <li class="normal" id="section-3.1-1.112">
-            <a href="https://github.com/MISP/misp-objects/blob/main/objects/ftm-Workbook/definition.json">objects/ftm-Workbook</a> - .<a href="#section-3.1-1.112" class="pilcrow">¶</a>
+          <li class="compact" id="section-3.1-1.117">
+            <a href="https://github.com/MISP/misp-objects/blob/main/objects/ftm-Workbook/definition.json">objects/ftm-Workbook</a> - .<a href="#section-3.1-1.117" class="pilcrow">¶</a>
 </li>
-          <li class="normal" id="section-3.1-1.113">
-            <a href="https://github.com/MISP/misp-objects/blob/main/objects/geolocation/definition.json">objects/geolocation</a> - An object to describe a geographic location.<a href="#section-3.1-1.113" class="pilcrow">¶</a>
+          <li class="compact" id="section-3.1-1.118">
+            <a href="https://github.com/MISP/misp-objects/blob/main/objects/geolocation/definition.json">objects/geolocation</a> - An object to describe a geographic location.<a href="#section-3.1-1.118" class="pilcrow">¶</a>
 </li>
-          <li class="normal" id="section-3.1-1.114">
-            <a href="https://github.com/MISP/misp-objects/blob/main/objects/git-vuln-finder/definition.json">objects/git-vuln-finder</a> - Export from git-vuln-finder.<a href="#section-3.1-1.114" class="pilcrow">¶</a>
+          <li class="compact" id="section-3.1-1.119">
+            <a href="https://github.com/MISP/misp-objects/blob/main/objects/git-vuln-finder/definition.json">objects/git-vuln-finder</a> - Export from git-vuln-finder.<a href="#section-3.1-1.119" class="pilcrow">¶</a>
 </li>
-          <li class="normal" id="section-3.1-1.115">
-            <a href="https://github.com/MISP/misp-objects/blob/main/objects/github-user/definition.json">objects/github-user</a> - GitHub user.<a href="#section-3.1-1.115" class="pilcrow">¶</a>
+          <li class="compact" id="section-3.1-1.120">
+            <a href="https://github.com/MISP/misp-objects/blob/main/objects/github-user/definition.json">objects/github-user</a> - GitHub user.<a href="#section-3.1-1.120" class="pilcrow">¶</a>
 </li>
-          <li class="normal" id="section-3.1-1.116">
-            <a href="https://github.com/MISP/misp-objects/blob/main/objects/gitlab-user/definition.json">objects/gitlab-user</a> - GitLab user. Gitlab.com user or self-hosted GitLab instance.<a href="#section-3.1-1.116" class="pilcrow">¶</a>
+          <li class="compact" id="section-3.1-1.121">
+            <a href="https://github.com/MISP/misp-objects/blob/main/objects/gitlab-user/definition.json">objects/gitlab-user</a> - GitLab user. Gitlab.com user or self-hosted GitLab instance.<a href="#section-3.1-1.121" class="pilcrow">¶</a>
 </li>
-          <li class="normal" id="section-3.1-1.117">
-            <a href="https://github.com/MISP/misp-objects/blob/main/objects/gtp-attack/definition.json">objects/gtp-attack</a> - GTP attack object as seen on a GSM, UMTS or LTE network.<a href="#section-3.1-1.117" class="pilcrow">¶</a>
+          <li class="compact" id="section-3.1-1.122">
+            <a href="https://github.com/MISP/misp-objects/blob/main/objects/gtp-attack/definition.json">objects/gtp-attack</a> - GTP attack object as attack as seen on the GTP signaling protocol supporting GPRS/LTE networks.<a href="#section-3.1-1.122" class="pilcrow">¶</a>
 </li>
-          <li class="normal" id="section-3.1-1.118">
-            <a href="https://github.com/MISP/misp-objects/blob/main/objects/http-request/definition.json">objects/http-request</a> - A single HTTP request header.<a href="#section-3.1-1.118" class="pilcrow">¶</a>
+          <li class="compact" id="section-3.1-1.123">
+            <a href="https://github.com/MISP/misp-objects/blob/main/objects/hashlookup/definition.json">objects/hashlookup</a> - hashlookup object as described on hashlookup services from circl.lu - <a href="https://www.circl.lu/services/hashlookup">https://www.circl.lu/services/hashlookup</a>.<a href="#section-3.1-1.123" class="pilcrow">¶</a>
 </li>
-          <li class="normal" id="section-3.1-1.119">
-            <a href="https://github.com/MISP/misp-objects/blob/main/objects/ilr-impact/definition.json">objects/ilr-impact</a> - Institut Luxembourgeois de Regulation - Impact.<a href="#section-3.1-1.119" class="pilcrow">¶</a>
+          <li class="compact" id="section-3.1-1.124">
+            <a href="https://github.com/MISP/misp-objects/blob/main/objects/http-request/definition.json">objects/http-request</a> - A single HTTP request header.<a href="#section-3.1-1.124" class="pilcrow">¶</a>
 </li>
-          <li class="normal" id="section-3.1-1.120">
-            <a href="https://github.com/MISP/misp-objects/blob/main/objects/ilr-notification-incident/definition.json">objects/ilr-notification-incident</a> - Institut Luxembourgeois de Regulation - Notification d'incident.<a href="#section-3.1-1.120" class="pilcrow">¶</a>
+          <li class="compact" id="section-3.1-1.125">
+            <a href="https://github.com/MISP/misp-objects/blob/main/objects/identity/definition.json">objects/identity</a> - Identities can represent actual individuals, organizations, or groups (e.g., ACME, Inc.) as well as classes of individuals, organizations, systems or groups (e.g., the finance sector).  The Identity SDO can capture basic identifying information, contact information, and the sectors that the Identity belongs to. Identity is used in STIX to represent, among other things, targets of attacks, information sources, object creators, and threat actor identities. (ref. STIX 2.1 - 4.5).<a href="#section-3.1-1.125" class="pilcrow">¶</a>
 </li>
-          <li class="normal" id="section-3.1-1.121">
-            <a href="https://github.com/MISP/misp-objects/blob/main/objects/image/definition.json">objects/image</a> - Object describing an image file.<a href="#section-3.1-1.121" class="pilcrow">¶</a>
+          <li class="compact" id="section-3.1-1.126">
+            <a href="https://github.com/MISP/misp-objects/blob/main/objects/ilr-impact/definition.json">objects/ilr-impact</a> - Institut Luxembourgeois de Regulation - Impact.<a href="#section-3.1-1.126" class="pilcrow">¶</a>
 </li>
-          <li class="normal" id="section-3.1-1.122">
-            <a href="https://github.com/MISP/misp-objects/blob/main/objects/impersonation/definition.json">objects/impersonation</a> - Represent an impersonating account.<a href="#section-3.1-1.122" class="pilcrow">¶</a>
+          <li class="compact" id="section-3.1-1.127">
+            <a href="https://github.com/MISP/misp-objects/blob/main/objects/ilr-notification-incident/definition.json">objects/ilr-notification-incident</a> - Institut Luxembourgeois de Regulation - Notification d'incident.<a href="#section-3.1-1.127" class="pilcrow">¶</a>
 </li>
-          <li class="normal" id="section-3.1-1.123">
-            <a href="https://github.com/MISP/misp-objects/blob/main/objects/imsi-catcher/definition.json">objects/imsi-catcher</a> - IMSI Catcher entry object based on the open source IMSI cather.<a href="#section-3.1-1.123" class="pilcrow">¶</a>
+          <li class="compact" id="section-3.1-1.128">
+            <a href="https://github.com/MISP/misp-objects/blob/main/objects/image/definition.json">objects/image</a> - Object describing an image file.<a href="#section-3.1-1.128" class="pilcrow">¶</a>
 </li>
-          <li class="normal" id="section-3.1-1.124">
-            <a href="https://github.com/MISP/misp-objects/blob/main/objects/instant-message/definition.json">objects/instant-message</a> - Instant Message (IM) object template describing one or more IM message.<a href="#section-3.1-1.124" class="pilcrow">¶</a>
+          <li class="compact" id="section-3.1-1.129">
+            <a href="https://github.com/MISP/misp-objects/blob/main/objects/impersonation/definition.json">objects/impersonation</a> - Represent an impersonating account.<a href="#section-3.1-1.129" class="pilcrow">¶</a>
 </li>
-          <li class="normal" id="section-3.1-1.125">
-            <a href="https://github.com/MISP/misp-objects/blob/main/objects/instant-message-group/definition.json">objects/instant-message-group</a> - Instant Message (IM) group object template describing a public or private IM group, channel or conversation.<a href="#section-3.1-1.125" class="pilcrow">¶</a>
+          <li class="compact" id="section-3.1-1.130">
+            <a href="https://github.com/MISP/misp-objects/blob/main/objects/imsi-catcher/definition.json">objects/imsi-catcher</a> - IMSI Catcher entry object based on the open source IMSI cather.<a href="#section-3.1-1.130" class="pilcrow">¶</a>
 </li>
-          <li class="normal" id="section-3.1-1.126">
-            <a href="https://github.com/MISP/misp-objects/blob/main/objects/intel471-vulnerability-intelligence/definition.json">objects/intel471-vulnerability-intelligence</a> - Intel 471 vulnerability intelligence object.<a href="#section-3.1-1.126" class="pilcrow">¶</a>
+          <li class="compact" id="section-3.1-1.131">
+            <a href="https://github.com/MISP/misp-objects/blob/main/objects/infrastructure/definition.json">objects/infrastructure</a> - The Infrastructure object represents a type of TTP and describes any systems, software services and any associated physical or virtual resources intended to support some purpose (e.g., C2 servers used as part of an attack, device or server that are part of defense, database servers targeted by an attack, etc.). While elements of an attack can be represented by other objects, the Infrastructure object represents a named group of related data that constitutes the infrastructure. STIX 2.1 - 4.8.<a href="#section-3.1-1.131" class="pilcrow">¶</a>
 </li>
-          <li class="normal" id="section-3.1-1.127">
-            <a href="https://github.com/MISP/misp-objects/blob/main/objects/intelmq_event/definition.json">objects/intelmq_event</a> - IntelMQ Event.<a href="#section-3.1-1.127" class="pilcrow">¶</a>
+          <li class="compact" id="section-3.1-1.132">
+            <a href="https://github.com/MISP/misp-objects/blob/main/objects/instant-message/definition.json">objects/instant-message</a> - Instant Message (IM) object template describing one or more IM message.<a href="#section-3.1-1.132" class="pilcrow">¶</a>
 </li>
-          <li class="normal" id="section-3.1-1.128">
-            <a href="https://github.com/MISP/misp-objects/blob/main/objects/intelmq_report/definition.json">objects/intelmq_report</a> - IntelMQ Report.<a href="#section-3.1-1.128" class="pilcrow">¶</a>
+          <li class="compact" id="section-3.1-1.133">
+            <a href="https://github.com/MISP/misp-objects/blob/main/objects/instant-message-group/definition.json">objects/instant-message-group</a> - Instant Message (IM) group object template describing a public or private IM group, channel or conversation.<a href="#section-3.1-1.133" class="pilcrow">¶</a>
 </li>
-          <li class="normal" id="section-3.1-1.129">
-            <a href="https://github.com/MISP/misp-objects/blob/main/objects/internal-reference/definition.json">objects/internal-reference</a> - Internal reference.<a href="#section-3.1-1.129" class="pilcrow">¶</a>
+          <li class="compact" id="section-3.1-1.134">
+            <a href="https://github.com/MISP/misp-objects/blob/main/objects/intel471-vulnerability-intelligence/definition.json">objects/intel471-vulnerability-intelligence</a> - Intel 471 vulnerability intelligence object.<a href="#section-3.1-1.134" class="pilcrow">¶</a>
 </li>
-          <li class="normal" id="section-3.1-1.130">
-            <a href="https://github.com/MISP/misp-objects/blob/main/objects/interpol-notice/definition.json">objects/interpol-notice</a> - An object which describes a Interpol notice.<a href="#section-3.1-1.130" class="pilcrow">¶</a>
+          <li class="compact" id="section-3.1-1.135">
+            <a href="https://github.com/MISP/misp-objects/blob/main/objects/intelmq_event/definition.json">objects/intelmq_event</a> - IntelMQ Event.<a href="#section-3.1-1.135" class="pilcrow">¶</a>
 </li>
-          <li class="normal" id="section-3.1-1.131">
-            <a href="https://github.com/MISP/misp-objects/blob/main/objects/iot-device/definition.json">objects/iot-device</a> - An IoT device.<a href="#section-3.1-1.131" class="pilcrow">¶</a>
+          <li class="compact" id="section-3.1-1.136">
+            <a href="https://github.com/MISP/misp-objects/blob/main/objects/intelmq_report/definition.json">objects/intelmq_report</a> - IntelMQ Report.<a href="#section-3.1-1.136" class="pilcrow">¶</a>
 </li>
-          <li class="normal" id="section-3.1-1.132">
-            <a href="https://github.com/MISP/misp-objects/blob/main/objects/iot-firmware/definition.json">objects/iot-firmware</a> - A firmware for an IoT device.<a href="#section-3.1-1.132" class="pilcrow">¶</a>
+          <li class="compact" id="section-3.1-1.137">
+            <a href="https://github.com/MISP/misp-objects/blob/main/objects/internal-reference/definition.json">objects/internal-reference</a> - Internal reference.<a href="#section-3.1-1.137" class="pilcrow">¶</a>
 </li>
-          <li class="normal" id="section-3.1-1.133">
-            <a href="https://github.com/MISP/misp-objects/blob/main/objects/ip-api-address/definition.json">objects/ip-api-address</a> - IP Address information. Useful if you are pulling your ip information from ip-api.com.<a href="#section-3.1-1.133" class="pilcrow">¶</a>
+          <li class="compact" id="section-3.1-1.138">
+            <a href="https://github.com/MISP/misp-objects/blob/main/objects/interpol-notice/definition.json">objects/interpol-notice</a> - An object which describes a Interpol notice.<a href="#section-3.1-1.138" class="pilcrow">¶</a>
 </li>
-          <li class="normal" id="section-3.1-1.134">
-            <a href="https://github.com/MISP/misp-objects/blob/main/objects/ip-port/definition.json">objects/ip-port</a> - An IP address (or domain or hostname) and a port seen as a tuple (or as a triple) in a specific time frame.<a href="#section-3.1-1.134" class="pilcrow">¶</a>
+          <li class="compact" id="section-3.1-1.139">
+            <a href="https://github.com/MISP/misp-objects/blob/main/objects/iot-device/definition.json">objects/iot-device</a> - An IoT device.<a href="#section-3.1-1.139" class="pilcrow">¶</a>
 </li>
-          <li class="normal" id="section-3.1-1.135">
-            <a href="https://github.com/MISP/misp-objects/blob/main/objects/irc/definition.json">objects/irc</a> - An IRC object to describe an IRC server and the associated channels.<a href="#section-3.1-1.135" class="pilcrow">¶</a>
+          <li class="compact" id="section-3.1-1.140">
+            <a href="https://github.com/MISP/misp-objects/blob/main/objects/iot-firmware/definition.json">objects/iot-firmware</a> - A firmware for an IoT device.<a href="#section-3.1-1.140" class="pilcrow">¶</a>
 </li>
-          <li class="normal" id="section-3.1-1.136">
-            <a href="https://github.com/MISP/misp-objects/blob/main/objects/ja3/definition.json">objects/ja3</a> - JA3 is a new technique for creating SSL client fingerprints that are easy to produce and can be easily shared for threat intelligence. Fingerprints are composed of Client Hello packet; SSL Version, Accepted Ciphers, List of Extensions, Elliptic Curves, and Elliptic Curve Formats. <a href="https://github.com/salesforce/ja3">https://github.com/salesforce/ja3</a>.<a href="#section-3.1-1.136" class="pilcrow">¶</a>
+          <li class="compact" id="section-3.1-1.141">
+            <a href="https://github.com/MISP/misp-objects/blob/main/objects/ip-api-address/definition.json">objects/ip-api-address</a> - IP Address information. Useful if you are pulling your ip information from ip-api.com.<a href="#section-3.1-1.141" class="pilcrow">¶</a>
 </li>
-          <li class="normal" id="section-3.1-1.137">
-            <a href="https://github.com/MISP/misp-objects/blob/main/objects/keybase-account/definition.json">objects/keybase-account</a> - Information related to a keybase account, from API Users Object.<a href="#section-3.1-1.137" class="pilcrow">¶</a>
+          <li class="compact" id="section-3.1-1.142">
+            <a href="https://github.com/MISP/misp-objects/blob/main/objects/ip-port/definition.json">objects/ip-port</a> - An IP address (or domain or hostname) and a port seen as a tuple (or as a triple) in a specific time frame.<a href="#section-3.1-1.142" class="pilcrow">¶</a>
 </li>
-          <li class="normal" id="section-3.1-1.138">
-            <a href="https://github.com/MISP/misp-objects/blob/main/objects/leaked-document/definition.json">objects/leaked-document</a> - Object describing a leaked document.<a href="#section-3.1-1.138" class="pilcrow">¶</a>
+          <li class="compact" id="section-3.1-1.143">
+            <a href="https://github.com/MISP/misp-objects/blob/main/objects/irc/definition.json">objects/irc</a> - An IRC object to describe an IRC server and the associated channels.<a href="#section-3.1-1.143" class="pilcrow">¶</a>
 </li>
-          <li class="normal" id="section-3.1-1.139">
-            <a href="https://github.com/MISP/misp-objects/blob/main/objects/legal-entity/definition.json">objects/legal-entity</a> - An object to describe a legal entity.<a href="#section-3.1-1.139" class="pilcrow">¶</a>
+          <li class="compact" id="section-3.1-1.144">
+            <a href="https://github.com/MISP/misp-objects/blob/main/objects/ja3/definition.json">objects/ja3</a> - JA3 is a new technique for creating SSL client fingerprints that are easy to produce and can be easily shared for threat intelligence. Fingerprints are composed of Client Hello packet; SSL Version, Accepted Ciphers, List of Extensions, Elliptic Curves, and Elliptic Curve Formats. <a href="https://github.com/salesforce/ja3">https://github.com/salesforce/ja3</a>.<a href="#section-3.1-1.144" class="pilcrow">¶</a>
 </li>
-          <li class="normal" id="section-3.1-1.140">
-            <a href="https://github.com/MISP/misp-objects/blob/main/objects/lnk/definition.json">objects/lnk</a> - LNK object describing a Windows LNK binary file (aka Windows shortcut).<a href="#section-3.1-1.140" class="pilcrow">¶</a>
+          <li class="compact" id="section-3.1-1.145">
+            <a href="https://github.com/MISP/misp-objects/blob/main/objects/ja3s/definition.json">objects/ja3s</a> - JA3S is JA3 for the Server side of the SSL/TLS communication and fingerprints how servers respond to particular clients. JA3S fingerprints are composed of Server Hello packet; SSL Version, Cipher, SSLExtensions. <a href="https://github.com/salesforce/ja3">https://github.com/salesforce/ja3</a>.<a href="#section-3.1-1.145" class="pilcrow">¶</a>
 </li>
-          <li class="normal" id="section-3.1-1.141">
-            <a href="https://github.com/MISP/misp-objects/blob/main/objects/macho/definition.json">objects/macho</a> - Object describing a file in Mach-O format.<a href="#section-3.1-1.141" class="pilcrow">¶</a>
+          <li class="compact" id="section-3.1-1.146">
+            <a href="https://github.com/MISP/misp-objects/blob/main/objects/jarm/definition.json">objects/jarm</a> - Jarm object to describe an TLS/SSL implementation used for malicious or legitimate use-case.<a href="#section-3.1-1.146" class="pilcrow">¶</a>
 </li>
-          <li class="normal" id="section-3.1-1.142">
-            <a href="https://github.com/MISP/misp-objects/blob/main/objects/macho-section/definition.json">objects/macho-section</a> - Object describing a section of a file in Mach-O format.<a href="#section-3.1-1.142" class="pilcrow">¶</a>
+          <li class="compact" id="section-3.1-1.147">
+            <a href="https://github.com/MISP/misp-objects/blob/main/objects/keybase-account/definition.json">objects/keybase-account</a> - Information related to a keybase account, from API Users Object.<a href="#section-3.1-1.147" class="pilcrow">¶</a>
 </li>
-          <li class="normal" id="section-3.1-1.143">
-            <a href="https://github.com/MISP/misp-objects/blob/main/objects/mactime-timeline-analysis/definition.json">objects/mactime-timeline-analysis</a> - Mactime template, used in forensic investigations to describe the timeline of a file activity.<a href="#section-3.1-1.143" class="pilcrow">¶</a>
+          <li class="compact" id="section-3.1-1.148">
+            <a href="https://github.com/MISP/misp-objects/blob/main/objects/language-content/definition.json">objects/language-content</a> - The Language Content object represents text content for objects represented in languages other than that of the original object. Language content may be a translation of the original object by a third-party, a first-source translation by the original publisher, or additional official language content provided at the time of creation. STIX 2.1 ref 7.1.<a href="#section-3.1-1.148" class="pilcrow">¶</a>
 </li>
-          <li class="normal" id="section-3.1-1.144">
-            <a href="https://github.com/MISP/misp-objects/blob/main/objects/malware-config/definition.json">objects/malware-config</a> - Malware configuration recovered or extracted from a malicious binary.<a href="#section-3.1-1.144" class="pilcrow">¶</a>
+          <li class="compact" id="section-3.1-1.149">
+            <a href="https://github.com/MISP/misp-objects/blob/main/objects/leaked-document/definition.json">objects/leaked-document</a> - Object describing a leaked document.<a href="#section-3.1-1.149" class="pilcrow">¶</a>
 </li>
-          <li class="normal" id="section-3.1-1.145">
-            <a href="https://github.com/MISP/misp-objects/blob/main/objects/meme-image/definition.json">objects/meme-image</a> - Object describing a meme (image).<a href="#section-3.1-1.145" class="pilcrow">¶</a>
+          <li class="compact" id="section-3.1-1.150">
+            <a href="https://github.com/MISP/misp-objects/blob/main/objects/legal-entity/definition.json">objects/legal-entity</a> - An object to describe a legal entity.<a href="#section-3.1-1.150" class="pilcrow">¶</a>
 </li>
-          <li class="normal" id="section-3.1-1.146">
-            <a href="https://github.com/MISP/misp-objects/blob/main/objects/microblog/definition.json">objects/microblog</a> - Microblog post like a Twitter tweet or a post on a Facebook wall.<a href="#section-3.1-1.146" class="pilcrow">¶</a>
+          <li class="compact" id="section-3.1-1.151">
+            <a href="https://github.com/MISP/misp-objects/blob/main/objects/lnk/definition.json">objects/lnk</a> - LNK object describing a Windows LNK binary file (aka Windows shortcut).<a href="#section-3.1-1.151" class="pilcrow">¶</a>
 </li>
-          <li class="normal" id="section-3.1-1.147">
-            <a href="https://github.com/MISP/misp-objects/blob/main/objects/mutex/definition.json">objects/mutex</a> - Object to describe mutual exclusion locks (mutex) as seen in memory or computer program.<a href="#section-3.1-1.147" class="pilcrow">¶</a>
+          <li class="compact" id="section-3.1-1.152">
+            <a href="https://github.com/MISP/misp-objects/blob/main/objects/macho/definition.json">objects/macho</a> - Object describing a file in Mach-O format.<a href="#section-3.1-1.152" class="pilcrow">¶</a>
 </li>
-          <li class="normal" id="section-3.1-1.148">
-            <a href="https://github.com/MISP/misp-objects/blob/main/objects/narrative/definition.json">objects/narrative</a> - Object describing a narrative.<a href="#section-3.1-1.148" class="pilcrow">¶</a>
+          <li class="compact" id="section-3.1-1.153">
+            <a href="https://github.com/MISP/misp-objects/blob/main/objects/macho-section/definition.json">objects/macho-section</a> - Object describing a section of a file in Mach-O format.<a href="#section-3.1-1.153" class="pilcrow">¶</a>
 </li>
-          <li class="normal" id="section-3.1-1.149">
-            <a href="https://github.com/MISP/misp-objects/blob/main/objects/netflow/definition.json">objects/netflow</a> - Netflow object describes an network object based on the Netflowv5/v9 minimal definition.<a href="#section-3.1-1.149" class="pilcrow">¶</a>
+          <li class="compact" id="section-3.1-1.154">
+            <a href="https://github.com/MISP/misp-objects/blob/main/objects/mactime-timeline-analysis/definition.json">objects/mactime-timeline-analysis</a> - Mactime template, used in forensic investigations to describe the timeline of a file activity.<a href="#section-3.1-1.154" class="pilcrow">¶</a>
 </li>
-          <li class="normal" id="section-3.1-1.150">
-            <a href="https://github.com/MISP/misp-objects/blob/main/objects/network-connection/definition.json">objects/network-connection</a> - A local or remote network connection.<a href="#section-3.1-1.150" class="pilcrow">¶</a>
+          <li class="compact" id="section-3.1-1.155">
+            <a href="https://github.com/MISP/misp-objects/blob/main/objects/malware-config/definition.json">objects/malware-config</a> - Malware configuration recovered or extracted from a malicious binary.<a href="#section-3.1-1.155" class="pilcrow">¶</a>
 </li>
-          <li class="normal" id="section-3.1-1.151">
-            <a href="https://github.com/MISP/misp-objects/blob/main/objects/network-socket/definition.json">objects/network-socket</a> - Network socket object describes a local or remote network connections based on the socket data structure.<a href="#section-3.1-1.151" class="pilcrow">¶</a>
+          <li class="compact" id="section-3.1-1.156">
+            <a href="https://github.com/MISP/misp-objects/blob/main/objects/meme-image/definition.json">objects/meme-image</a> - Object describing a meme (image).<a href="#section-3.1-1.156" class="pilcrow">¶</a>
 </li>
-          <li class="normal" id="section-3.1-1.152">
-            <a href="https://github.com/MISP/misp-objects/blob/main/objects/news-agency/definition.json">objects/news-agency</a> - News agencies compile news and disseminate news in bulk.<a href="#section-3.1-1.152" class="pilcrow">¶</a>
+          <li class="compact" id="section-3.1-1.157">
+            <a href="https://github.com/MISP/misp-objects/blob/main/objects/microblog/definition.json">objects/microblog</a> - Microblog post like a Twitter tweet or a post on a Facebook wall.<a href="#section-3.1-1.157" class="pilcrow">¶</a>
 </li>
-          <li class="normal" id="section-3.1-1.153">
-            <a href="https://github.com/MISP/misp-objects/blob/main/objects/news-media/definition.json">objects/news-media</a> - News media are forms of mass media delivering news to the general public.<a href="#section-3.1-1.153" class="pilcrow">¶</a>
+          <li class="compact" id="section-3.1-1.158">
+            <a href="https://github.com/MISP/misp-objects/blob/main/objects/mutex/definition.json">objects/mutex</a> - Object to describe mutual exclusion locks (mutex) as seen in memory or computer program.<a href="#section-3.1-1.158" class="pilcrow">¶</a>
 </li>
-          <li class="normal" id="section-3.1-1.154">
-            <a href="https://github.com/MISP/misp-objects/blob/main/objects/organization/definition.json">objects/organization</a> - An object which describes an organization.<a href="#section-3.1-1.154" class="pilcrow">¶</a>
+          <li class="compact" id="section-3.1-1.159">
+            <a href="https://github.com/MISP/misp-objects/blob/main/objects/narrative/definition.json">objects/narrative</a> - Object describing a narrative.<a href="#section-3.1-1.159" class="pilcrow">¶</a>
 </li>
-          <li class="normal" id="section-3.1-1.155">
-            <a href="https://github.com/MISP/misp-objects/blob/main/objects/original-imported-file/definition.json">objects/original-imported-file</a> - Object describing the original file used to import data in MISP.<a href="#section-3.1-1.155" class="pilcrow">¶</a>
+          <li class="compact" id="section-3.1-1.160">
+            <a href="https://github.com/MISP/misp-objects/blob/main/objects/netflow/definition.json">objects/netflow</a> - Netflow object describes an network object based on the Netflowv5/v9 minimal definition.<a href="#section-3.1-1.160" class="pilcrow">¶</a>
 </li>
-          <li class="normal" id="section-3.1-1.156">
-            <a href="https://github.com/MISP/misp-objects/blob/main/objects/parler-account/definition.json">objects/parler-account</a> - Parler account.<a href="#section-3.1-1.156" class="pilcrow">¶</a>
+          <li class="compact" id="section-3.1-1.161">
+            <a href="https://github.com/MISP/misp-objects/blob/main/objects/network-connection/definition.json">objects/network-connection</a> - A local or remote network connection.<a href="#section-3.1-1.161" class="pilcrow">¶</a>
 </li>
-          <li class="normal" id="section-3.1-1.157">
-            <a href="https://github.com/MISP/misp-objects/blob/main/objects/parler-comment/definition.json">objects/parler-comment</a> - Parler comment.<a href="#section-3.1-1.157" class="pilcrow">¶</a>
+          <li class="compact" id="section-3.1-1.162">
+            <a href="https://github.com/MISP/misp-objects/blob/main/objects/network-profile/definition.json">objects/network-profile</a> - Elements that can be used to profile, pivot or identify a network infrastructure, including domains, ip and urls.<a href="#section-3.1-1.162" class="pilcrow">¶</a>
 </li>
-          <li class="normal" id="section-3.1-1.158">
-            <a href="https://github.com/MISP/misp-objects/blob/main/objects/parler-post/definition.json">objects/parler-post</a> - Parler post (parley).<a href="#section-3.1-1.158" class="pilcrow">¶</a>
+          <li class="compact" id="section-3.1-1.163">
+            <a href="https://github.com/MISP/misp-objects/blob/main/objects/network-socket/definition.json">objects/network-socket</a> - Network socket object describes a local or remote network connections based on the socket data structure.<a href="#section-3.1-1.163" class="pilcrow">¶</a>
 </li>
-          <li class="normal" id="section-3.1-1.159">
-            <a href="https://github.com/MISP/misp-objects/blob/main/objects/passive-dns/definition.json">objects/passive-dns</a> - Passive DNS records as expressed in draft-dulaunoy-dnsop-passive-dns-cof-01.<a href="#section-3.1-1.159" class="pilcrow">¶</a>
+          <li class="compact" id="section-3.1-1.164">
+            <a href="https://github.com/MISP/misp-objects/blob/main/objects/news-agency/definition.json">objects/news-agency</a> - News agencies compile news and disseminate news in bulk.<a href="#section-3.1-1.164" class="pilcrow">¶</a>
 </li>
-          <li class="normal" id="section-3.1-1.160">
-            <a href="https://github.com/MISP/misp-objects/blob/main/objects/paste/definition.json">objects/paste</a> - Paste or similar post from a website allowing to share privately or publicly posts.<a href="#section-3.1-1.160" class="pilcrow">¶</a>
+          <li class="compact" id="section-3.1-1.165">
+            <a href="https://github.com/MISP/misp-objects/blob/main/objects/news-media/definition.json">objects/news-media</a> - News media are forms of mass media delivering news to the general public.<a href="#section-3.1-1.165" class="pilcrow">¶</a>
 </li>
-          <li class="normal" id="section-3.1-1.161">
-            <a href="https://github.com/MISP/misp-objects/blob/main/objects/pcap-metadata/definition.json">objects/pcap-metadata</a> - Network packet capture metadata.<a href="#section-3.1-1.161" class="pilcrow">¶</a>
+          <li class="compact" id="section-3.1-1.166">
+            <a href="https://github.com/MISP/misp-objects/blob/main/objects/open-data-security/definition.json">objects/open-data-security</a> - An object describing an open dataset available and described under the open data security model. ref. <a href="https://github.com/CIRCL/open-data-security">https://github.com/CIRCL/open-data-security</a>.<a href="#section-3.1-1.166" class="pilcrow">¶</a>
 </li>
-          <li class="normal" id="section-3.1-1.162">
-            <a href="https://github.com/MISP/misp-objects/blob/main/objects/pe/definition.json">objects/pe</a> - Object describing a Portable Executable.<a href="#section-3.1-1.162" class="pilcrow">¶</a>
+          <li class="compact" id="section-3.1-1.167">
+            <a href="https://github.com/MISP/misp-objects/blob/main/objects/organization/definition.json">objects/organization</a> - An object which describes an organization.<a href="#section-3.1-1.167" class="pilcrow">¶</a>
 </li>
-          <li class="normal" id="section-3.1-1.163">
-            <a href="https://github.com/MISP/misp-objects/blob/main/objects/pe-section/definition.json">objects/pe-section</a> - Object describing a section of a Portable Executable.<a href="#section-3.1-1.163" class="pilcrow">¶</a>
+          <li class="compact" id="section-3.1-1.168">
+            <a href="https://github.com/MISP/misp-objects/blob/main/objects/original-imported-file/definition.json">objects/original-imported-file</a> - Object describing the original file used to import data in MISP.<a href="#section-3.1-1.168" class="pilcrow">¶</a>
 </li>
-          <li class="normal" id="section-3.1-1.164">
-            <a href="https://github.com/MISP/misp-objects/blob/main/objects/person/definition.json">objects/person</a> - An object which describes a person or an identity.<a href="#section-3.1-1.164" class="pilcrow">¶</a>
+          <li class="compact" id="section-3.1-1.169">
+            <a href="https://github.com/MISP/misp-objects/blob/main/objects/paloalto-threat-event/definition.json">objects/paloalto-threat-event</a> - Palo Alto Threat Log Event.<a href="#section-3.1-1.169" class="pilcrow">¶</a>
 </li>
-          <li class="normal" id="section-3.1-1.165">
-            <a href="https://github.com/MISP/misp-objects/blob/main/objects/pgp-meta/definition.json">objects/pgp-meta</a> - Metadata extracted from a PGP keyblock, message or signature.<a href="#section-3.1-1.165" class="pilcrow">¶</a>
+          <li class="compact" id="section-3.1-1.170">
+            <a href="https://github.com/MISP/misp-objects/blob/main/objects/parler-account/definition.json">objects/parler-account</a> - Parler account.<a href="#section-3.1-1.170" class="pilcrow">¶</a>
 </li>
-          <li class="normal" id="section-3.1-1.166">
-            <a href="https://github.com/MISP/misp-objects/blob/main/objects/phishing/definition.json">objects/phishing</a> - Phishing template to describe a phishing website and its analysis.<a href="#section-3.1-1.166" class="pilcrow">¶</a>
+          <li class="compact" id="section-3.1-1.171">
+            <a href="https://github.com/MISP/misp-objects/blob/main/objects/parler-comment/definition.json">objects/parler-comment</a> - Parler comment.<a href="#section-3.1-1.171" class="pilcrow">¶</a>
 </li>
-          <li class="normal" id="section-3.1-1.167">
-            <a href="https://github.com/MISP/misp-objects/blob/main/objects/phishing-kit/definition.json">objects/phishing-kit</a> - Object to describe a phishing-kit.<a href="#section-3.1-1.167" class="pilcrow">¶</a>
+          <li class="compact" id="section-3.1-1.172">
+            <a href="https://github.com/MISP/misp-objects/blob/main/objects/parler-post/definition.json">objects/parler-post</a> - Parler post (parley).<a href="#section-3.1-1.172" class="pilcrow">¶</a>
 </li>
-          <li class="normal" id="section-3.1-1.168">
-            <a href="https://github.com/MISP/misp-objects/blob/main/objects/phone/definition.json">objects/phone</a> - A phone or mobile phone object which describe a phone.<a href="#section-3.1-1.168" class="pilcrow">¶</a>
+          <li class="compact" id="section-3.1-1.173">
+            <a href="https://github.com/MISP/misp-objects/blob/main/objects/passive-dns/definition.json">objects/passive-dns</a> - Passive DNS records as expressed in draft-dulaunoy-dnsop-passive-dns-cof-07. See <a href="https://tools.ietf.org/id/draft-dulaunoy-dnsop-passive-dns-cof-07.html">https://tools.ietf.org/id/draft-dulaunoy-dnsop-passive-dns-cof-07.html</a>.<a href="#section-3.1-1.173" class="pilcrow">¶</a>
 </li>
-          <li class="normal" id="section-3.1-1.169">
-            <a href="https://github.com/MISP/misp-objects/blob/main/objects/process/definition.json">objects/process</a> - Object describing a system process.<a href="#section-3.1-1.169" class="pilcrow">¶</a>
+          <li class="compact" id="section-3.1-1.174">
+            <a href="https://github.com/MISP/misp-objects/blob/main/objects/passive-dns-dnsdbflex/definition.json">objects/passive-dns-dnsdbflex</a> - DNSDBFLEX object. This object is used at farsight security. Roughly based on Passive DNS records as expressed in draft-dulaunoy-dnsop-passive-dns-cof-07. See <a href="https://tools.ietf.org/id/draft-dulaunoy-dnsop-passive-dns-cof-07.html">https://tools.ietf.org/id/draft-dulaunoy-dnsop-passive-dns-cof-07.html</a>.<a href="#section-3.1-1.174" class="pilcrow">¶</a>
 </li>
-          <li class="normal" id="section-3.1-1.170">
-            <a href="https://github.com/MISP/misp-objects/blob/main/objects/publication/definition.json">objects/publication</a> - An object to describe a book, journal, or academic publication.<a href="#section-3.1-1.170" class="pilcrow">¶</a>
+          <li class="compact" id="section-3.1-1.175">
+            <a href="https://github.com/MISP/misp-objects/blob/main/objects/passive-ssh/definition.json">objects/passive-ssh</a> - Passive-ssh object as described on passive-ssh services from circl.lu - <a href="https://github.com/D4-project/passive-ssh">https://github.com/D4-project/passive-ssh</a>.<a href="#section-3.1-1.175" class="pilcrow">¶</a>
 </li>
-          <li class="normal" id="section-3.1-1.171">
-            <a href="https://github.com/MISP/misp-objects/blob/main/objects/python-etvx-event-log/definition.json">objects/python-etvx-event-log</a> - Event log object template to share information of the activities conducted on a system. .<a href="#section-3.1-1.171" class="pilcrow">¶</a>
+          <li class="compact" id="section-3.1-1.176">
+            <a href="https://github.com/MISP/misp-objects/blob/main/objects/paste/definition.json">objects/paste</a> - Paste or similar post from a website allowing to share privately or publicly posts.<a href="#section-3.1-1.176" class="pilcrow">¶</a>
 </li>
-          <li class="normal" id="section-3.1-1.172">
-            <a href="https://github.com/MISP/misp-objects/blob/main/objects/r2graphity/definition.json">objects/r2graphity</a> - Indicators extracted from files using radare2 and graphml.<a href="#section-3.1-1.172" class="pilcrow">¶</a>
+          <li class="compact" id="section-3.1-1.177">
+            <a href="https://github.com/MISP/misp-objects/blob/main/objects/pcap-metadata/definition.json">objects/pcap-metadata</a> - Network packet capture metadata.<a href="#section-3.1-1.177" class="pilcrow">¶</a>
 </li>
-          <li class="normal" id="section-3.1-1.173">
-            <a href="https://github.com/MISP/misp-objects/blob/main/objects/reddit-account/definition.json">objects/reddit-account</a> - Reddit account.<a href="#section-3.1-1.173" class="pilcrow">¶</a>
+          <li class="compact" id="section-3.1-1.178">
+            <a href="https://github.com/MISP/misp-objects/blob/main/objects/pe/definition.json">objects/pe</a> - Object describing a Portable Executable.<a href="#section-3.1-1.178" class="pilcrow">¶</a>
 </li>
-          <li class="normal" id="section-3.1-1.174">
-            <a href="https://github.com/MISP/misp-objects/blob/main/objects/reddit-comment/definition.json">objects/reddit-comment</a> - A Reddit post comment.<a href="#section-3.1-1.174" class="pilcrow">¶</a>
+          <li class="compact" id="section-3.1-1.179">
+            <a href="https://github.com/MISP/misp-objects/blob/main/objects/pe-section/definition.json">objects/pe-section</a> - Object describing a section of a Portable Executable.<a href="#section-3.1-1.179" class="pilcrow">¶</a>
 </li>
-          <li class="normal" id="section-3.1-1.175">
-            <a href="https://github.com/MISP/misp-objects/blob/main/objects/reddit-post/definition.json">objects/reddit-post</a> - A Reddit post.<a href="#section-3.1-1.175" class="pilcrow">¶</a>
+          <li class="compact" id="section-3.1-1.180">
+            <a href="https://github.com/MISP/misp-objects/blob/main/objects/person/definition.json">objects/person</a> - An object which describes a person or an identity.<a href="#section-3.1-1.180" class="pilcrow">¶</a>
 </li>
-          <li class="normal" id="section-3.1-1.176">
-            <a href="https://github.com/MISP/misp-objects/blob/main/objects/reddit-subreddit/definition.json">objects/reddit-subreddit</a> - Public or private subreddit.<a href="#section-3.1-1.176" class="pilcrow">¶</a>
+          <li class="compact" id="section-3.1-1.181">
+            <a href="https://github.com/MISP/misp-objects/blob/main/objects/pgp-meta/definition.json">objects/pgp-meta</a> - Metadata extracted from a PGP keyblock, message or signature.<a href="#section-3.1-1.181" class="pilcrow">¶</a>
 </li>
-          <li class="normal" id="section-3.1-1.177">
-            <a href="https://github.com/MISP/misp-objects/blob/main/objects/regexp/definition.json">objects/regexp</a> - An object describing a regular expression (regex or regexp). The object can be linked via a relationship to other attributes or objects to describe how it can be represented as a regular expression.<a href="#section-3.1-1.177" class="pilcrow">¶</a>
+          <li class="compact" id="section-3.1-1.182">
+            <a href="https://github.com/MISP/misp-objects/blob/main/objects/phishing/definition.json">objects/phishing</a> - Phishing template to describe a phishing website and its analysis.<a href="#section-3.1-1.182" class="pilcrow">¶</a>
 </li>
-          <li class="normal" id="section-3.1-1.178">
-            <a href="https://github.com/MISP/misp-objects/blob/main/objects/registry-key/definition.json">objects/registry-key</a> - Registry key object describing a Windows registry key with value and last-modified timestamp.<a href="#section-3.1-1.178" class="pilcrow">¶</a>
+          <li class="compact" id="section-3.1-1.183">
+            <a href="https://github.com/MISP/misp-objects/blob/main/objects/phishing-kit/definition.json">objects/phishing-kit</a> - Object to describe a phishing-kit.<a href="#section-3.1-1.183" class="pilcrow">¶</a>
 </li>
-          <li class="normal" id="section-3.1-1.179">
-            <a href="https://github.com/MISP/misp-objects/blob/main/objects/regripper-NTUser/definition.json">objects/regripper-NTUser</a> - Regripper Object template designed to present user specific configuration details extracted from the NTUSER.dat hive.<a href="#section-3.1-1.179" class="pilcrow">¶</a>
+          <li class="compact" id="section-3.1-1.184">
+            <a href="https://github.com/MISP/misp-objects/blob/main/objects/phone/definition.json">objects/phone</a> - A phone or mobile phone object which describe a phone.<a href="#section-3.1-1.184" class="pilcrow">¶</a>
 </li>
-          <li class="normal" id="section-3.1-1.180">
-            <a href="https://github.com/MISP/misp-objects/blob/main/objects/regripper-sam-hive-single-user/definition.json">objects/regripper-sam-hive-single-user</a> - Regripper Object template designed to present user profile details extracted from the SAM hive.<a href="#section-3.1-1.180" class="pilcrow">¶</a>
+          <li class="compact" id="section-3.1-1.185">
+            <a href="https://github.com/MISP/misp-objects/blob/main/objects/postal-address/definition.json">objects/postal-address</a> - A postal address.<a href="#section-3.1-1.185" class="pilcrow">¶</a>
 </li>
-          <li class="normal" id="section-3.1-1.181">
-            <a href="https://github.com/MISP/misp-objects/blob/main/objects/regripper-sam-hive-user-group/definition.json">objects/regripper-sam-hive-user-group</a> - Regripper Object template designed to present group profile details extracted from the SAM hive.<a href="#section-3.1-1.181" class="pilcrow">¶</a>
+          <li class="compact" id="section-3.1-1.186">
+            <a href="https://github.com/MISP/misp-objects/blob/main/objects/probabilistic-data-structure/definition.json">objects/probabilistic-data-structure</a> - Probabilistic data structure object describe a space-efficient data structure such as Bloom filter or similar structure.<a href="#section-3.1-1.186" class="pilcrow">¶</a>
 </li>
-          <li class="normal" id="section-3.1-1.182">
-            <a href="https://github.com/MISP/misp-objects/blob/main/objects/regripper-software-hive-BHO/definition.json">objects/regripper-software-hive-BHO</a> - Regripper Object template designed to gather information of the browser helper objects installed on the system.<a href="#section-3.1-1.182" class="pilcrow">¶</a>
+          <li class="compact" id="section-3.1-1.187">
+            <a href="https://github.com/MISP/misp-objects/blob/main/objects/process/definition.json">objects/process</a> - Object describing a system process.<a href="#section-3.1-1.187" class="pilcrow">¶</a>
 </li>
-          <li class="normal" id="section-3.1-1.183">
-            <a href="https://github.com/MISP/misp-objects/blob/main/objects/regripper-software-hive-appInit-DLLS/definition.json">objects/regripper-software-hive-appInit-DLLS</a> - Regripper Object template designed to gather information of the DLL files installed on the system.<a href="#section-3.1-1.183" class="pilcrow">¶</a>
+          <li class="compact" id="section-3.1-1.188">
+            <a href="https://github.com/MISP/misp-objects/blob/main/objects/publication/definition.json">objects/publication</a> - An object to describe a book, journal, or academic publication.<a href="#section-3.1-1.188" class="pilcrow">¶</a>
 </li>
-          <li class="normal" id="section-3.1-1.184">
-            <a href="https://github.com/MISP/misp-objects/blob/main/objects/regripper-software-hive-application-paths/definition.json">objects/regripper-software-hive-application-paths</a> - Regripper Object template designed to gather information of the application paths.<a href="#section-3.1-1.184" class="pilcrow">¶</a>
+          <li class="compact" id="section-3.1-1.189">
+            <a href="https://github.com/MISP/misp-objects/blob/main/objects/python-etvx-event-log/definition.json">objects/python-etvx-event-log</a> - Event log object template to share information of the activities conducted on a system. .<a href="#section-3.1-1.189" class="pilcrow">¶</a>
 </li>
-          <li class="normal" id="section-3.1-1.185">
-            <a href="https://github.com/MISP/misp-objects/blob/main/objects/regripper-software-hive-applications-installed/definition.json">objects/regripper-software-hive-applications-installed</a> - Regripper Object template designed to gather information of the applications installed on the system.<a href="#section-3.1-1.185" class="pilcrow">¶</a>
+          <li class="compact" id="section-3.1-1.190">
+            <a href="https://github.com/MISP/misp-objects/blob/main/objects/r2graphity/definition.json">objects/r2graphity</a> - Indicators extracted from files using radare2 and graphml.<a href="#section-3.1-1.190" class="pilcrow">¶</a>
 </li>
-          <li class="normal" id="section-3.1-1.186">
-            <a href="https://github.com/MISP/misp-objects/blob/main/objects/regripper-software-hive-command-shell/definition.json">objects/regripper-software-hive-command-shell</a> - Regripper Object template designed to gather information of the shell commands executed on the system.<a href="#section-3.1-1.186" class="pilcrow">¶</a>
+          <li class="compact" id="section-3.1-1.191">
+            <a href="https://github.com/MISP/misp-objects/blob/main/objects/reddit-account/definition.json">objects/reddit-account</a> - Reddit account.<a href="#section-3.1-1.191" class="pilcrow">¶</a>
 </li>
-          <li class="normal" id="section-3.1-1.187">
-            <a href="https://github.com/MISP/misp-objects/blob/main/objects/regripper-software-hive-software-run/definition.json">objects/regripper-software-hive-software-run</a> - Regripper Object template designed to gather information of the applications set to run on the system.<a href="#section-3.1-1.187" class="pilcrow">¶</a>
+          <li class="compact" id="section-3.1-1.192">
+            <a href="https://github.com/MISP/misp-objects/blob/main/objects/reddit-comment/definition.json">objects/reddit-comment</a> - A Reddit post comment.<a href="#section-3.1-1.192" class="pilcrow">¶</a>
 </li>
-          <li class="normal" id="section-3.1-1.188">
-            <a href="https://github.com/MISP/misp-objects/blob/main/objects/regripper-software-hive-userprofile-winlogon/definition.json">objects/regripper-software-hive-userprofile-winlogon</a> - Regripper Object template designed to gather user profile information when the user logs onto the system, gathered from the software hive.<a href="#section-3.1-1.188" class="pilcrow">¶</a>
+          <li class="compact" id="section-3.1-1.193">
+            <a href="https://github.com/MISP/misp-objects/blob/main/objects/reddit-post/definition.json">objects/reddit-post</a> - A Reddit post.<a href="#section-3.1-1.193" class="pilcrow">¶</a>
 </li>
-          <li class="normal" id="section-3.1-1.189">
-            <a href="https://github.com/MISP/misp-objects/blob/main/objects/regripper-software-hive-windows-general-info/definition.json">objects/regripper-software-hive-windows-general-info</a> - Regripper Object template designed to gather general windows information extracted from the software-hive.<a href="#section-3.1-1.189" class="pilcrow">¶</a>
+          <li class="compact" id="section-3.1-1.194">
+            <a href="https://github.com/MISP/misp-objects/blob/main/objects/reddit-subreddit/definition.json">objects/reddit-subreddit</a> - Public or private subreddit.<a href="#section-3.1-1.194" class="pilcrow">¶</a>
 </li>
-          <li class="normal" id="section-3.1-1.190">
-            <a href="https://github.com/MISP/misp-objects/blob/main/objects/regripper-system-hive-firewall-configuration/definition.json">objects/regripper-system-hive-firewall-configuration</a> - Regripper Object template designed to present firewall configuration information extracted from the system-hive.<a href="#section-3.1-1.190" class="pilcrow">¶</a>
+          <li class="compact" id="section-3.1-1.195">
+            <a href="https://github.com/MISP/misp-objects/blob/main/objects/regexp/definition.json">objects/regexp</a> - An object describing a regular expression (regex or regexp). The object can be linked via a relationship to other attributes or objects to describe how it can be represented as a regular expression.<a href="#section-3.1-1.195" class="pilcrow">¶</a>
 </li>
-          <li class="normal" id="section-3.1-1.191">
-            <a href="https://github.com/MISP/misp-objects/blob/main/objects/regripper-system-hive-general-configuration/definition.json">objects/regripper-system-hive-general-configuration</a> - Regripper Object template designed to present general system properties extracted from the system-hive.<a href="#section-3.1-1.191" class="pilcrow">¶</a>
+          <li class="compact" id="section-3.1-1.196">
+            <a href="https://github.com/MISP/misp-objects/blob/main/objects/registry-key/definition.json">objects/registry-key</a> - Registry key object describing a Windows registry key with value and last-modified timestamp.<a href="#section-3.1-1.196" class="pilcrow">¶</a>
 </li>
-          <li class="normal" id="section-3.1-1.192">
-            <a href="https://github.com/MISP/misp-objects/blob/main/objects/regripper-system-hive-network-information/definition.json">objects/regripper-system-hive-network-information</a> - Regripper object template designed to gather network information from the system-hive.<a href="#section-3.1-1.192" class="pilcrow">¶</a>
+          <li class="compact" id="section-3.1-1.197">
+            <a href="https://github.com/MISP/misp-objects/blob/main/objects/regripper-NTUser/definition.json">objects/regripper-NTUser</a> - Regripper Object template designed to present user specific configuration details extracted from the NTUSER.dat hive.<a href="#section-3.1-1.197" class="pilcrow">¶</a>
 </li>
-          <li class="normal" id="section-3.1-1.193">
-            <a href="https://github.com/MISP/misp-objects/blob/main/objects/regripper-system-hive-services-drivers/definition.json">objects/regripper-system-hive-services-drivers</a> - Regripper Object template designed to gather information regarding the services/drivers from the system-hive.<a href="#section-3.1-1.193" class="pilcrow">¶</a>
+          <li class="compact" id="section-3.1-1.198">
+            <a href="https://github.com/MISP/misp-objects/blob/main/objects/regripper-sam-hive-single-user/definition.json">objects/regripper-sam-hive-single-user</a> - Regripper Object template designed to present user profile details extracted from the SAM hive.<a href="#section-3.1-1.198" class="pilcrow">¶</a>
 </li>
-          <li class="normal" id="section-3.1-1.194">
-            <a href="https://github.com/MISP/misp-objects/blob/main/objects/report/definition.json">objects/report</a> - Metadata used to generate an executive level report.<a href="#section-3.1-1.194" class="pilcrow">¶</a>
+          <li class="compact" id="section-3.1-1.199">
+            <a href="https://github.com/MISP/misp-objects/blob/main/objects/regripper-sam-hive-user-group/definition.json">objects/regripper-sam-hive-user-group</a> - Regripper Object template designed to present group profile details extracted from the SAM hive.<a href="#section-3.1-1.199" class="pilcrow">¶</a>
 </li>
-          <li class="normal" id="section-3.1-1.195">
-            <a href="https://github.com/MISP/misp-objects/blob/main/objects/research-scanner/definition.json">objects/research-scanner</a> - Information related to known scanning activity (e.g. from research projects).<a href="#section-3.1-1.195" class="pilcrow">¶</a>
+          <li class="compact" id="section-3.1-1.200">
+            <a href="https://github.com/MISP/misp-objects/blob/main/objects/regripper-software-hive-BHO/definition.json">objects/regripper-software-hive-BHO</a> - Regripper Object template designed to gather information of the browser helper objects installed on the system.<a href="#section-3.1-1.200" class="pilcrow">¶</a>
 </li>
-          <li class="normal" id="section-3.1-1.196">
-            <a href="https://github.com/MISP/misp-objects/blob/main/objects/rogue-dns/definition.json">objects/rogue-dns</a> - Rogue DNS as defined by CERT.br.<a href="#section-3.1-1.196" class="pilcrow">¶</a>
+          <li class="compact" id="section-3.1-1.201">
+            <a href="https://github.com/MISP/misp-objects/blob/main/objects/regripper-software-hive-appInit-DLLS/definition.json">objects/regripper-software-hive-appInit-DLLS</a> - Regripper Object template designed to gather information of the DLL files installed on the system.<a href="#section-3.1-1.201" class="pilcrow">¶</a>
 </li>
-          <li class="normal" id="section-3.1-1.197">
-            <a href="https://github.com/MISP/misp-objects/blob/main/objects/rtir/definition.json">objects/rtir</a> - RTIR - Request Tracker for Incident Response.<a href="#section-3.1-1.197" class="pilcrow">¶</a>
+          <li class="compact" id="section-3.1-1.202">
+            <a href="https://github.com/MISP/misp-objects/blob/main/objects/regripper-software-hive-application-paths/definition.json">objects/regripper-software-hive-application-paths</a> - Regripper Object template designed to gather information of the application paths.<a href="#section-3.1-1.202" class="pilcrow">¶</a>
 </li>
-          <li class="normal" id="section-3.1-1.198">
-            <a href="https://github.com/MISP/misp-objects/blob/main/objects/sandbox-report/definition.json">objects/sandbox-report</a> - Sandbox report.<a href="#section-3.1-1.198" class="pilcrow">¶</a>
+          <li class="compact" id="section-3.1-1.203">
+            <a href="https://github.com/MISP/misp-objects/blob/main/objects/regripper-software-hive-applications-installed/definition.json">objects/regripper-software-hive-applications-installed</a> - Regripper Object template designed to gather information of the applications installed on the system.<a href="#section-3.1-1.203" class="pilcrow">¶</a>
 </li>
-          <li class="normal" id="section-3.1-1.199">
-            <a href="https://github.com/MISP/misp-objects/blob/main/objects/sb-signature/definition.json">objects/sb-signature</a> - Sandbox detection signature.<a href="#section-3.1-1.199" class="pilcrow">¶</a>
+          <li class="compact" id="section-3.1-1.204">
+            <a href="https://github.com/MISP/misp-objects/blob/main/objects/regripper-software-hive-command-shell/definition.json">objects/regripper-software-hive-command-shell</a> - Regripper Object template designed to gather information of the shell commands executed on the system.<a href="#section-3.1-1.204" class="pilcrow">¶</a>
 </li>
-          <li class="normal" id="section-3.1-1.200">
-            <a href="https://github.com/MISP/misp-objects/blob/main/objects/scheduled-event/definition.json">objects/scheduled-event</a> - Event object template describing a gathering of individuals in meatspace.<a href="#section-3.1-1.200" class="pilcrow">¶</a>
+          <li class="compact" id="section-3.1-1.205">
+            <a href="https://github.com/MISP/misp-objects/blob/main/objects/regripper-software-hive-software-run/definition.json">objects/regripper-software-hive-software-run</a> - Regripper Object template designed to gather information of the applications set to run on the system.<a href="#section-3.1-1.205" class="pilcrow">¶</a>
 </li>
-          <li class="normal" id="section-3.1-1.201">
-            <a href="https://github.com/MISP/misp-objects/blob/main/objects/scrippsco2-c13-daily/definition.json">objects/scrippsco2-c13-daily</a> - Daily average C13 concentrations (ppm) derived from flask air samples.<a href="#section-3.1-1.201" class="pilcrow">¶</a>
+          <li class="compact" id="section-3.1-1.206">
+            <a href="https://github.com/MISP/misp-objects/blob/main/objects/regripper-software-hive-userprofile-winlogon/definition.json">objects/regripper-software-hive-userprofile-winlogon</a> - Regripper Object template designed to gather user profile information when the user logs onto the system, gathered from the software hive.<a href="#section-3.1-1.206" class="pilcrow">¶</a>
 </li>
-          <li class="normal" id="section-3.1-1.202">
-            <a href="https://github.com/MISP/misp-objects/blob/main/objects/scrippsco2-c13-monthly/definition.json">objects/scrippsco2-c13-monthly</a> - Monthly average C13 concentrations (ppm) derived from flask air samples.<a href="#section-3.1-1.202" class="pilcrow">¶</a>
+          <li class="compact" id="section-3.1-1.207">
+            <a href="https://github.com/MISP/misp-objects/blob/main/objects/regripper-software-hive-windows-general-info/definition.json">objects/regripper-software-hive-windows-general-info</a> - Regripper Object template designed to gather general windows information extracted from the software-hive.<a href="#section-3.1-1.207" class="pilcrow">¶</a>
 </li>
-          <li class="normal" id="section-3.1-1.203">
-            <a href="https://github.com/MISP/misp-objects/blob/main/objects/scrippsco2-co2-daily/definition.json">objects/scrippsco2-co2-daily</a> - Daily average CO2 concentrations (ppm) derived from flask air samples.<a href="#section-3.1-1.203" class="pilcrow">¶</a>
+          <li class="compact" id="section-3.1-1.208">
+            <a href="https://github.com/MISP/misp-objects/blob/main/objects/regripper-system-hive-firewall-configuration/definition.json">objects/regripper-system-hive-firewall-configuration</a> - Regripper Object template designed to present firewall configuration information extracted from the system-hive.<a href="#section-3.1-1.208" class="pilcrow">¶</a>
 </li>
-          <li class="normal" id="section-3.1-1.204">
-            <a href="https://github.com/MISP/misp-objects/blob/main/objects/scrippsco2-co2-monthly/definition.json">objects/scrippsco2-co2-monthly</a> - Monthly average CO2 concentrations (ppm) derived from flask air samples.<a href="#section-3.1-1.204" class="pilcrow">¶</a>
+          <li class="compact" id="section-3.1-1.209">
+            <a href="https://github.com/MISP/misp-objects/blob/main/objects/regripper-system-hive-general-configuration/definition.json">objects/regripper-system-hive-general-configuration</a> - Regripper Object template designed to present general system properties extracted from the system-hive.<a href="#section-3.1-1.209" class="pilcrow">¶</a>
 </li>
-          <li class="normal" id="section-3.1-1.205">
-            <a href="https://github.com/MISP/misp-objects/blob/main/objects/scrippsco2-o18-daily/definition.json">objects/scrippsco2-o18-daily</a> - Daily average O18 concentrations (ppm) derived from flask air samples.<a href="#section-3.1-1.205" class="pilcrow">¶</a>
+          <li class="compact" id="section-3.1-1.210">
+            <a href="https://github.com/MISP/misp-objects/blob/main/objects/regripper-system-hive-network-information/definition.json">objects/regripper-system-hive-network-information</a> - Regripper object template designed to gather network information from the system-hive.<a href="#section-3.1-1.210" class="pilcrow">¶</a>
 </li>
-          <li class="normal" id="section-3.1-1.206">
-            <a href="https://github.com/MISP/misp-objects/blob/main/objects/scrippsco2-o18-monthly/definition.json">objects/scrippsco2-o18-monthly</a> - Monthly average O18 concentrations (ppm) derived from flask air samples.<a href="#section-3.1-1.206" class="pilcrow">¶</a>
+          <li class="compact" id="section-3.1-1.211">
+            <a href="https://github.com/MISP/misp-objects/blob/main/objects/regripper-system-hive-services-drivers/definition.json">objects/regripper-system-hive-services-drivers</a> - Regripper Object template designed to gather information regarding the services/drivers from the system-hive.<a href="#section-3.1-1.211" class="pilcrow">¶</a>
 </li>
-          <li class="normal" id="section-3.1-1.207">
-            <a href="https://github.com/MISP/misp-objects/blob/main/objects/script/definition.json">objects/script</a> - Object describing a computer program written to be run in a special run-time environment. The script or shell script can be used for malicious activities but also as support tools for threat analysts.<a href="#section-3.1-1.207" class="pilcrow">¶</a>
+          <li class="compact" id="section-3.1-1.212">
+            <a href="https://github.com/MISP/misp-objects/blob/main/objects/report/definition.json">objects/report</a> - Metadata used to generate an executive level report.<a href="#section-3.1-1.212" class="pilcrow">¶</a>
 </li>
-          <li class="normal" id="section-3.1-1.208">
-            <a href="https://github.com/MISP/misp-objects/blob/main/objects/shell-commands/definition.json">objects/shell-commands</a> - Object describing a series of shell commands executed. This object can be linked with malicious files in order to describe a specific execution of shell commands.<a href="#section-3.1-1.208" class="pilcrow">¶</a>
+          <li class="compact" id="section-3.1-1.213">
+            <a href="https://github.com/MISP/misp-objects/blob/main/objects/research-scanner/definition.json">objects/research-scanner</a> - Information related to known scanning activity (e.g. from research projects).<a href="#section-3.1-1.213" class="pilcrow">¶</a>
 </li>
-          <li class="normal" id="section-3.1-1.209">
-            <a href="https://github.com/MISP/misp-objects/blob/main/objects/shodan-report/definition.json">objects/shodan-report</a> - Shodan Report for a given IP.<a href="#section-3.1-1.209" class="pilcrow">¶</a>
+          <li class="compact" id="section-3.1-1.214">
+            <a href="https://github.com/MISP/misp-objects/blob/main/objects/rogue-dns/definition.json">objects/rogue-dns</a> - Rogue DNS as defined by CERT.br.<a href="#section-3.1-1.214" class="pilcrow">¶</a>
 </li>
-          <li class="normal" id="section-3.1-1.210">
-            <a href="https://github.com/MISP/misp-objects/blob/main/objects/short-message-service/definition.json">objects/short-message-service</a> - Short Message Service (SMS) object template describing one or more SMS message. Restriction of the initial format 3GPP 23.038 GSM character set doesn't apply.<a href="#section-3.1-1.210" class="pilcrow">¶</a>
+          <li class="compact" id="section-3.1-1.215">
+            <a href="https://github.com/MISP/misp-objects/blob/main/objects/rtir/definition.json">objects/rtir</a> - RTIR - Request Tracker for Incident Response.<a href="#section-3.1-1.215" class="pilcrow">¶</a>
 </li>
-          <li class="normal" id="section-3.1-1.211">
-            <a href="https://github.com/MISP/misp-objects/blob/main/objects/shortened-link/definition.json">objects/shortened-link</a> - Shortened link and its redirect target.<a href="#section-3.1-1.211" class="pilcrow">¶</a>
+          <li class="compact" id="section-3.1-1.216">
+            <a href="https://github.com/MISP/misp-objects/blob/main/objects/sandbox-report/definition.json">objects/sandbox-report</a> - Sandbox report.<a href="#section-3.1-1.216" class="pilcrow">¶</a>
 </li>
-          <li class="normal" id="section-3.1-1.212">
-            <a href="https://github.com/MISP/misp-objects/blob/main/objects/social-media-group/definition.json">objects/social-media-group</a> - Social media group object template describing a public or private group or channel.<a href="#section-3.1-1.212" class="pilcrow">¶</a>
+          <li class="compact" id="section-3.1-1.217">
+            <a href="https://github.com/MISP/misp-objects/blob/main/objects/sb-signature/definition.json">objects/sb-signature</a> - Sandbox detection signature.<a href="#section-3.1-1.217" class="pilcrow">¶</a>
 </li>
-          <li class="normal" id="section-3.1-1.213">
-            <a href="https://github.com/MISP/misp-objects/blob/main/objects/splunk/definition.json">objects/splunk</a> - Splunk / Splunk ES object.<a href="#section-3.1-1.213" class="pilcrow">¶</a>
+          <li class="compact" id="section-3.1-1.218">
+            <a href="https://github.com/MISP/misp-objects/blob/main/objects/scheduled-event/definition.json">objects/scheduled-event</a> - Event object template describing a gathering of individuals in meatspace.<a href="#section-3.1-1.218" class="pilcrow">¶</a>
 </li>
-          <li class="normal" id="section-3.1-1.214">
-            <a href="https://github.com/MISP/misp-objects/blob/main/objects/ss7-attack/definition.json">objects/ss7-attack</a> - SS7 object of an attack seen on a GSM, UMTS or LTE network via SS7 logging.<a href="#section-3.1-1.214" class="pilcrow">¶</a>
+          <li class="compact" id="section-3.1-1.219">
+            <a href="https://github.com/MISP/misp-objects/blob/main/objects/scrippsco2-c13-daily/definition.json">objects/scrippsco2-c13-daily</a> - Daily average C13 concentrations (ppm) derived from flask air samples.<a href="#section-3.1-1.219" class="pilcrow">¶</a>
 </li>
-          <li class="normal" id="section-3.1-1.215">
-            <a href="https://github.com/MISP/misp-objects/blob/main/objects/ssh-authorized-keys/definition.json">objects/ssh-authorized-keys</a> - An object to store ssh authorized keys file.<a href="#section-3.1-1.215" class="pilcrow">¶</a>
+          <li class="compact" id="section-3.1-1.220">
+            <a href="https://github.com/MISP/misp-objects/blob/main/objects/scrippsco2-c13-monthly/definition.json">objects/scrippsco2-c13-monthly</a> - Monthly average C13 concentrations (ppm) derived from flask air samples.<a href="#section-3.1-1.220" class="pilcrow">¶</a>
 </li>
-          <li class="normal" id="section-3.1-1.216">
-            <a href="https://github.com/MISP/misp-objects/blob/main/objects/stix2-pattern/definition.json">objects/stix2-pattern</a> - An object describing a STIX pattern. The object can be linked via a relationship to other attributes or objects to describe how it can be represented as a STIX pattern.<a href="#section-3.1-1.216" class="pilcrow">¶</a>
+          <li class="compact" id="section-3.1-1.221">
+            <a href="https://github.com/MISP/misp-objects/blob/main/objects/scrippsco2-co2-daily/definition.json">objects/scrippsco2-co2-daily</a> - Daily average CO2 concentrations (ppm) derived from flask air samples.<a href="#section-3.1-1.221" class="pilcrow">¶</a>
 </li>
-          <li class="normal" id="section-3.1-1.217">
-            <a href="https://github.com/MISP/misp-objects/blob/main/objects/suricata/definition.json">objects/suricata</a> - An object describing one or more Suricata rule(s) along with version and contextual information.<a href="#section-3.1-1.217" class="pilcrow">¶</a>
+          <li class="compact" id="section-3.1-1.222">
+            <a href="https://github.com/MISP/misp-objects/blob/main/objects/scrippsco2-co2-monthly/definition.json">objects/scrippsco2-co2-monthly</a> - Monthly average CO2 concentrations (ppm) derived from flask air samples.<a href="#section-3.1-1.222" class="pilcrow">¶</a>
 </li>
-          <li class="normal" id="section-3.1-1.218">
-            <a href="https://github.com/MISP/misp-objects/blob/main/objects/target-system/definition.json">objects/target-system</a> - Description about an targeted system, this could potentially be a compromissed internal system.<a href="#section-3.1-1.218" class="pilcrow">¶</a>
+          <li class="compact" id="section-3.1-1.223">
+            <a href="https://github.com/MISP/misp-objects/blob/main/objects/scrippsco2-o18-daily/definition.json">objects/scrippsco2-o18-daily</a> - Daily average O18 concentrations (ppm) derived from flask air samples.<a href="#section-3.1-1.223" class="pilcrow">¶</a>
 </li>
-          <li class="normal" id="section-3.1-1.219">
-            <a href="https://github.com/MISP/misp-objects/blob/main/objects/threatgrid-report/definition.json">objects/threatgrid-report</a> - ThreatGrid report.<a href="#section-3.1-1.219" class="pilcrow">¶</a>
+          <li class="compact" id="section-3.1-1.224">
+            <a href="https://github.com/MISP/misp-objects/blob/main/objects/scrippsco2-o18-monthly/definition.json">objects/scrippsco2-o18-monthly</a> - Monthly average O18 concentrations (ppm) derived from flask air samples.<a href="#section-3.1-1.224" class="pilcrow">¶</a>
 </li>
-          <li class="normal" id="section-3.1-1.220">
-            <a href="https://github.com/MISP/misp-objects/blob/main/objects/timecode/definition.json">objects/timecode</a> - Timecode object to describe a start of video sequence (e.g. CCTV evidence) and the end of the video sequence.<a href="#section-3.1-1.220" class="pilcrow">¶</a>
+          <li class="compact" id="section-3.1-1.225">
+            <a href="https://github.com/MISP/misp-objects/blob/main/objects/script/definition.json">objects/script</a> - Object describing a computer program written to be run in a special run-time environment. The script or shell script can be used for malicious activities but also as support tools for threat analysts.<a href="#section-3.1-1.225" class="pilcrow">¶</a>
 </li>
-          <li class="normal" id="section-3.1-1.221">
-            <a href="https://github.com/MISP/misp-objects/blob/main/objects/timesketch-timeline/definition.json">objects/timesketch-timeline</a> - A timesketch timeline object based on mandatory field in timesketch to describe a log entry.<a href="#section-3.1-1.221" class="pilcrow">¶</a>
+          <li class="compact" id="section-3.1-1.226">
+            <a href="https://github.com/MISP/misp-objects/blob/main/objects/security-playbook/definition.json">objects/security-playbook</a> - An object to manage, represent, and share course of action playbooks (security playbooks) for cyberspace defense.<a href="#section-3.1-1.226" class="pilcrow">¶</a>
 </li>
-          <li class="normal" id="section-3.1-1.222">
-            <a href="https://github.com/MISP/misp-objects/blob/main/objects/timesketch_message/definition.json">objects/timesketch_message</a> - A timesketch message entry.<a href="#section-3.1-1.222" class="pilcrow">¶</a>
+          <li class="compact" id="section-3.1-1.227">
+            <a href="https://github.com/MISP/misp-objects/blob/main/objects/shell-commands/definition.json">objects/shell-commands</a> - Object describing a series of shell commands executed. This object can be linked with malicious files in order to describe a specific execution of shell commands.<a href="#section-3.1-1.227" class="pilcrow">¶</a>
 </li>
-          <li class="normal" id="section-3.1-1.223">
-            <a href="https://github.com/MISP/misp-objects/blob/main/objects/timestamp/definition.json">objects/timestamp</a> - A generic timestamp object to represent time including first time and last time seen. Relationship will then define the kind of time relationship.<a href="#section-3.1-1.223" class="pilcrow">¶</a>
+          <li class="compact" id="section-3.1-1.228">
+            <a href="https://github.com/MISP/misp-objects/blob/main/objects/shodan-report/definition.json">objects/shodan-report</a> - Shodan Report for a given IP.<a href="#section-3.1-1.228" class="pilcrow">¶</a>
 </li>
-          <li class="normal" id="section-3.1-1.224">
-            <a href="https://github.com/MISP/misp-objects/blob/main/objects/tor-hiddenservice/definition.json">objects/tor-hiddenservice</a> - Tor hidden service (onion service) object.<a href="#section-3.1-1.224" class="pilcrow">¶</a>
+          <li class="compact" id="section-3.1-1.229">
+            <a href="https://github.com/MISP/misp-objects/blob/main/objects/short-message-service/definition.json">objects/short-message-service</a> - Short Message Service (SMS) object template describing one or more SMS message. Restriction of the initial format 3GPP 23.038 GSM character set doesn't apply.<a href="#section-3.1-1.229" class="pilcrow">¶</a>
 </li>
-          <li class="normal" id="section-3.1-1.225">
-            <a href="https://github.com/MISP/misp-objects/blob/main/objects/tor-node/definition.json">objects/tor-node</a> - Tor node (which protects your privacy on the internet by hiding the connection between users Internet address and the services used by the users) description which are part of the Tor network at a time.<a href="#section-3.1-1.225" class="pilcrow">¶</a>
+          <li class="compact" id="section-3.1-1.230">
+            <a href="https://github.com/MISP/misp-objects/blob/main/objects/shortened-link/definition.json">objects/shortened-link</a> - Shortened link and its redirect target.<a href="#section-3.1-1.230" class="pilcrow">¶</a>
 </li>
-          <li class="normal" id="section-3.1-1.226">
-            <a href="https://github.com/MISP/misp-objects/blob/main/objects/tracking-id/definition.json">objects/tracking-id</a> - Analytics and tracking ID such as used in Google Analytics or other analytic platform.<a href="#section-3.1-1.226" class="pilcrow">¶</a>
+          <li class="compact" id="section-3.1-1.231">
+            <a href="https://github.com/MISP/misp-objects/blob/main/objects/social-media-group/definition.json">objects/social-media-group</a> - Social media group object template describing a public or private group or channel.<a href="#section-3.1-1.231" class="pilcrow">¶</a>
 </li>
-          <li class="normal" id="section-3.1-1.227">
-            <a href="https://github.com/MISP/misp-objects/blob/main/objects/transaction/definition.json">objects/transaction</a> - An object to describe a financial transaction.<a href="#section-3.1-1.227" class="pilcrow">¶</a>
+          <li class="compact" id="section-3.1-1.232">
+            <a href="https://github.com/MISP/misp-objects/blob/main/objects/software/definition.json">objects/software</a> - The Software object represents high-level properties associated with software, including software products. STIX 2.1 - 6.14.<a href="#section-3.1-1.232" class="pilcrow">¶</a>
 </li>
-          <li class="normal" id="section-3.1-1.228">
-            <a href="https://github.com/MISP/misp-objects/blob/main/objects/translation/definition.json">objects/translation</a> - Used to keep a text and its translation.<a href="#section-3.1-1.228" class="pilcrow">¶</a>
+          <li class="compact" id="section-3.1-1.233">
+            <a href="https://github.com/MISP/misp-objects/blob/main/objects/splunk/definition.json">objects/splunk</a> - Splunk / Splunk ES object.<a href="#section-3.1-1.233" class="pilcrow">¶</a>
 </li>
-          <li class="normal" id="section-3.1-1.229">
-            <a href="https://github.com/MISP/misp-objects/blob/main/objects/trustar_report/definition.json">objects/trustar_report</a> - TruStar Report.<a href="#section-3.1-1.229" class="pilcrow">¶</a>
+          <li class="compact" id="section-3.1-1.234">
+            <a href="https://github.com/MISP/misp-objects/blob/main/objects/ss7-attack/definition.json">objects/ss7-attack</a> - SS7 object of an attack as seen on the SS7 signaling protocol supporting GSM/GPRS/UMTS networks.<a href="#section-3.1-1.234" class="pilcrow">¶</a>
 </li>
-          <li class="normal" id="section-3.1-1.230">
-            <a href="https://github.com/MISP/misp-objects/blob/main/objects/tsk-chats/definition.json">objects/tsk-chats</a> - An Object Template to gather information from evidential or interesting exchange of messages identified during a digital forensic investigation.<a href="#section-3.1-1.230" class="pilcrow">¶</a>
+          <li class="compact" id="section-3.1-1.235">
+            <a href="https://github.com/MISP/misp-objects/blob/main/objects/ssh-authorized-keys/definition.json">objects/ssh-authorized-keys</a> - An object to store ssh authorized keys file.<a href="#section-3.1-1.235" class="pilcrow">¶</a>
 </li>
-          <li class="normal" id="section-3.1-1.231">
-            <a href="https://github.com/MISP/misp-objects/blob/main/objects/tsk-web-bookmark/definition.json">objects/tsk-web-bookmark</a> - An Object Template to add evidential bookmarks identified during a digital forensic investigation.<a href="#section-3.1-1.231" class="pilcrow">¶</a>
+          <li class="compact" id="section-3.1-1.236">
+            <a href="https://github.com/MISP/misp-objects/blob/main/objects/stix2-pattern/definition.json">objects/stix2-pattern</a> - An object describing a STIX pattern. The object can be linked via a relationship to other attributes or objects to describe how it can be represented as a STIX pattern.<a href="#section-3.1-1.236" class="pilcrow">¶</a>
 </li>
-          <li class="normal" id="section-3.1-1.232">
-            <a href="https://github.com/MISP/misp-objects/blob/main/objects/tsk-web-cookie/definition.json">objects/tsk-web-cookie</a> - An TSK-Autopsy Object Template to represent cookies identified during a forensic investigation.<a href="#section-3.1-1.232" class="pilcrow">¶</a>
+          <li class="compact" id="section-3.1-1.237">
+            <a href="https://github.com/MISP/misp-objects/blob/main/objects/submarine/definition.json">objects/submarine</a> - Submarine description.<a href="#section-3.1-1.237" class="pilcrow">¶</a>
 </li>
-          <li class="normal" id="section-3.1-1.233">
-            <a href="https://github.com/MISP/misp-objects/blob/main/objects/tsk-web-downloads/definition.json">objects/tsk-web-downloads</a> - An Object Template to add web-downloads.<a href="#section-3.1-1.233" class="pilcrow">¶</a>
+          <li class="compact" id="section-3.1-1.238">
+            <a href="https://github.com/MISP/misp-objects/blob/main/objects/suricata/definition.json">objects/suricata</a> - An object describing one or more Suricata rule(s) along with version and contextual information.<a href="#section-3.1-1.238" class="pilcrow">¶</a>
 </li>
-          <li class="normal" id="section-3.1-1.234">
-            <a href="https://github.com/MISP/misp-objects/blob/main/objects/tsk-web-history/definition.json">objects/tsk-web-history</a> - An Object Template to share web history information.<a href="#section-3.1-1.234" class="pilcrow">¶</a>
+          <li class="compact" id="section-3.1-1.239">
+            <a href="https://github.com/MISP/misp-objects/blob/main/objects/target-system/definition.json">objects/target-system</a> - Description about an targeted system, this could potentially be a compromissed internal system.<a href="#section-3.1-1.239" class="pilcrow">¶</a>
 </li>
-          <li class="normal" id="section-3.1-1.235">
-            <a href="https://github.com/MISP/misp-objects/blob/main/objects/tsk-web-search-query/definition.json">objects/tsk-web-search-query</a> - An Object Template to share web search query information.<a href="#section-3.1-1.235" class="pilcrow">¶</a>
+          <li class="compact" id="section-3.1-1.240">
+            <a href="https://github.com/MISP/misp-objects/blob/main/objects/telegram-account/definition.json">objects/telegram-account</a> - Information related to a telegram account.<a href="#section-3.1-1.240" class="pilcrow">¶</a>
 </li>
-          <li class="normal" id="section-3.1-1.236">
-            <a href="https://github.com/MISP/misp-objects/blob/main/objects/twitter-account/definition.json">objects/twitter-account</a> - Twitter account.<a href="#section-3.1-1.236" class="pilcrow">¶</a>
+          <li class="compact" id="section-3.1-1.241">
+            <a href="https://github.com/MISP/misp-objects/blob/main/objects/temporal-event/definition.json">objects/temporal-event</a> - A temporal event consists of some temporal and spacial boundaries. Spacial boundaries can be physical, virtual or hybrid.<a href="#section-3.1-1.241" class="pilcrow">¶</a>
 </li>
-          <li class="normal" id="section-3.1-1.237">
-            <a href="https://github.com/MISP/misp-objects/blob/main/objects/twitter-list/definition.json">objects/twitter-list</a> - Twitter list.<a href="#section-3.1-1.237" class="pilcrow">¶</a>
+          <li class="compact" id="section-3.1-1.242">
+            <a href="https://github.com/MISP/misp-objects/blob/main/objects/threatgrid-report/definition.json">objects/threatgrid-report</a> - ThreatGrid report.<a href="#section-3.1-1.242" class="pilcrow">¶</a>
 </li>
-          <li class="normal" id="section-3.1-1.238">
-            <a href="https://github.com/MISP/misp-objects/blob/main/objects/twitter-post/definition.json">objects/twitter-post</a> - Twitter post (tweet).<a href="#section-3.1-1.238" class="pilcrow">¶</a>
+          <li class="compact" id="section-3.1-1.243">
+            <a href="https://github.com/MISP/misp-objects/blob/main/objects/timecode/definition.json">objects/timecode</a> - Timecode object to describe a start of video sequence (e.g. CCTV evidence) and the end of the video sequence.<a href="#section-3.1-1.243" class="pilcrow">¶</a>
 </li>
-          <li class="normal" id="section-3.1-1.239">
-            <a href="https://github.com/MISP/misp-objects/blob/main/objects/url/definition.json">objects/url</a> - url object describes an url along with its normalized field (like extracted using faup parsing library) and its metadata.<a href="#section-3.1-1.239" class="pilcrow">¶</a>
+          <li class="compact" id="section-3.1-1.244">
+            <a href="https://github.com/MISP/misp-objects/blob/main/objects/timesketch-timeline/definition.json">objects/timesketch-timeline</a> - A timesketch timeline object based on mandatory field in timesketch to describe a log entry.<a href="#section-3.1-1.244" class="pilcrow">¶</a>
 </li>
-          <li class="normal" id="section-3.1-1.240">
-            <a href="https://github.com/MISP/misp-objects/blob/main/objects/user-account/definition.json">objects/user-account</a> - .<a href="#section-3.1-1.240" class="pilcrow">¶</a>
+          <li class="compact" id="section-3.1-1.245">
+            <a href="https://github.com/MISP/misp-objects/blob/main/objects/timesketch_message/definition.json">objects/timesketch_message</a> - A timesketch message entry.<a href="#section-3.1-1.245" class="pilcrow">¶</a>
 </li>
-          <li class="normal" id="section-3.1-1.241">
-            <a href="https://github.com/MISP/misp-objects/blob/main/objects/vehicle/definition.json">objects/vehicle</a> - Vehicle object template to describe a vehicle information and registration.<a href="#section-3.1-1.241" class="pilcrow">¶</a>
+          <li class="compact" id="section-3.1-1.246">
+            <a href="https://github.com/MISP/misp-objects/blob/main/objects/timestamp/definition.json">objects/timestamp</a> - A generic timestamp object to represent time including first time and last time seen. Relationship will then define the kind of time relationship.<a href="#section-3.1-1.246" class="pilcrow">¶</a>
 </li>
-          <li class="normal" id="section-3.1-1.242">
-            <a href="https://github.com/MISP/misp-objects/blob/main/objects/victim/definition.json">objects/victim</a> - Victim object describes the target of an attack or abuse.<a href="#section-3.1-1.242" class="pilcrow">¶</a>
+          <li class="compact" id="section-3.1-1.247">
+            <a href="https://github.com/MISP/misp-objects/blob/main/objects/tor-hiddenservice/definition.json">objects/tor-hiddenservice</a> - Tor hidden service (onion service) object.<a href="#section-3.1-1.247" class="pilcrow">¶</a>
 </li>
-          <li class="normal" id="section-3.1-1.243">
-            <a href="https://github.com/MISP/misp-objects/blob/main/objects/virustotal-graph/definition.json">objects/virustotal-graph</a> - VirusTotal graph.<a href="#section-3.1-1.243" class="pilcrow">¶</a>
+          <li class="compact" id="section-3.1-1.248">
+            <a href="https://github.com/MISP/misp-objects/blob/main/objects/tor-node/definition.json">objects/tor-node</a> - Tor node (which protects your privacy on the internet by hiding the connection between users Internet address and the services used by the users) description which are part of the Tor network at a time.<a href="#section-3.1-1.248" class="pilcrow">¶</a>
 </li>
-          <li class="normal" id="section-3.1-1.244">
-            <a href="https://github.com/MISP/misp-objects/blob/main/objects/virustotal-report/definition.json">objects/virustotal-report</a> - VirusTotal report.<a href="#section-3.1-1.244" class="pilcrow">¶</a>
+          <li class="compact" id="section-3.1-1.249">
+            <a href="https://github.com/MISP/misp-objects/blob/main/objects/tracking-id/definition.json">objects/tracking-id</a> - Analytics and tracking ID such as used in Google Analytics or other analytic platform.<a href="#section-3.1-1.249" class="pilcrow">¶</a>
 </li>
-          <li class="normal" id="section-3.1-1.245">
-            <a href="https://github.com/MISP/misp-objects/blob/main/objects/vulnerability/definition.json">objects/vulnerability</a> - Vulnerability object describing a common vulnerability enumeration which can describe published, unpublished, under review or embargo vulnerability for software, equipments or hardware.<a href="#section-3.1-1.245" class="pilcrow">¶</a>
+          <li class="compact" id="section-3.1-1.250">
+            <a href="https://github.com/MISP/misp-objects/blob/main/objects/transaction/definition.json">objects/transaction</a> - An object to describe a financial transaction.<a href="#section-3.1-1.250" class="pilcrow">¶</a>
 </li>
-          <li class="normal" id="section-3.1-1.246">
-            <a href="https://github.com/MISP/misp-objects/blob/main/objects/weakness/definition.json">objects/weakness</a> - Weakness object describing a common weakness enumeration which can describe usable, incomplete, draft or deprecated weakness for software, equipment of hardware.<a href="#section-3.1-1.246" class="pilcrow">¶</a>
+          <li class="compact" id="section-3.1-1.251">
+            <a href="https://github.com/MISP/misp-objects/blob/main/objects/translation/definition.json">objects/translation</a> - Used to keep a text and its translation.<a href="#section-3.1-1.251" class="pilcrow">¶</a>
 </li>
-          <li class="normal" id="section-3.1-1.247">
-            <a href="https://github.com/MISP/misp-objects/blob/main/objects/whois/definition.json">objects/whois</a> - Whois records information for a domain name or an IP address.<a href="#section-3.1-1.247" class="pilcrow">¶</a>
+          <li class="compact" id="section-3.1-1.252">
+            <a href="https://github.com/MISP/misp-objects/blob/main/objects/trustar_report/definition.json">objects/trustar_report</a> - TruStar Report.<a href="#section-3.1-1.252" class="pilcrow">¶</a>
 </li>
-          <li class="normal" id="section-3.1-1.248">
-            <a href="https://github.com/MISP/misp-objects/blob/main/objects/x509/definition.json">objects/x509</a> - x509 object describing a X.509 certificate.<a href="#section-3.1-1.248" class="pilcrow">¶</a>
+          <li class="compact" id="section-3.1-1.253">
+            <a href="https://github.com/MISP/misp-objects/blob/main/objects/tsk-chats/definition.json">objects/tsk-chats</a> - An Object Template to gather information from evidential or interesting exchange of messages identified during a digital forensic investigation.<a href="#section-3.1-1.253" class="pilcrow">¶</a>
 </li>
-          <li class="normal" id="section-3.1-1.249">
-            <a href="https://github.com/MISP/misp-objects/blob/main/objects/yabin/definition.json">objects/yabin</a> - yabin.py generates Yara rules from function prologs, for matching and hunting binaries. ref: <a href="https://github.com/AlienVault-OTX/yabin">https://github.com/AlienVault-OTX/yabin</a>.<a href="#section-3.1-1.249" class="pilcrow">¶</a>
+          <li class="compact" id="section-3.1-1.254">
+            <a href="https://github.com/MISP/misp-objects/blob/main/objects/tsk-web-bookmark/definition.json">objects/tsk-web-bookmark</a> - An Object Template to add evidential bookmarks identified during a digital forensic investigation.<a href="#section-3.1-1.254" class="pilcrow">¶</a>
 </li>
-          <li class="normal" id="section-3.1-1.250">
-            <a href="https://github.com/MISP/misp-objects/blob/main/objects/yara/definition.json">objects/yara</a> - An object describing a YARA rule (or a YARA rule name) along with its version.<a href="#section-3.1-1.250" class="pilcrow">¶</a>
+          <li class="compact" id="section-3.1-1.255">
+            <a href="https://github.com/MISP/misp-objects/blob/main/objects/tsk-web-cookie/definition.json">objects/tsk-web-cookie</a> - An TSK-Autopsy Object Template to represent cookies identified during a forensic investigation.<a href="#section-3.1-1.255" class="pilcrow">¶</a>
 </li>
-          <li class="normal" id="section-3.1-1.251">
-            <a href="https://github.com/MISP/misp-objects/blob/main/objects/youtube-channel/definition.json">objects/youtube-channel</a> - A YouTube channel.<a href="#section-3.1-1.251" class="pilcrow">¶</a>
+          <li class="compact" id="section-3.1-1.256">
+            <a href="https://github.com/MISP/misp-objects/blob/main/objects/tsk-web-downloads/definition.json">objects/tsk-web-downloads</a> - An Object Template to add web-downloads.<a href="#section-3.1-1.256" class="pilcrow">¶</a>
 </li>
-          <li class="normal" id="section-3.1-1.252">
-            <a href="https://github.com/MISP/misp-objects/blob/main/objects/youtube-comment/definition.json">objects/youtube-comment</a> - A YouTube video comment.<a href="#section-3.1-1.252" class="pilcrow">¶</a>
+          <li class="compact" id="section-3.1-1.257">
+            <a href="https://github.com/MISP/misp-objects/blob/main/objects/tsk-web-history/definition.json">objects/tsk-web-history</a> - An Object Template to share web history information.<a href="#section-3.1-1.257" class="pilcrow">¶</a>
 </li>
-          <li class="normal" id="section-3.1-1.253">
-            <a href="https://github.com/MISP/misp-objects/blob/main/objects/youtube-playlist/definition.json">objects/youtube-playlist</a> - A YouTube playlist.<a href="#section-3.1-1.253" class="pilcrow">¶</a>
+          <li class="compact" id="section-3.1-1.258">
+            <a href="https://github.com/MISP/misp-objects/blob/main/objects/tsk-web-search-query/definition.json">objects/tsk-web-search-query</a> - An Object Template to share web search query information.<a href="#section-3.1-1.258" class="pilcrow">¶</a>
 </li>
-          <li class="normal" id="section-3.1-1.254">
-            <a href="https://github.com/MISP/misp-objects/blob/main/objects/youtube-video/definition.json">objects/youtube-video</a> - A YouTube video.<a href="#section-3.1-1.254" class="pilcrow">¶</a>
+          <li class="compact" id="section-3.1-1.259">
+            <a href="https://github.com/MISP/misp-objects/blob/main/objects/twitter-account/definition.json">objects/twitter-account</a> - Twitter account.<a href="#section-3.1-1.259" class="pilcrow">¶</a>
+</li>
+          <li class="compact" id="section-3.1-1.260">
+            <a href="https://github.com/MISP/misp-objects/blob/main/objects/twitter-list/definition.json">objects/twitter-list</a> - Twitter list.<a href="#section-3.1-1.260" class="pilcrow">¶</a>
+</li>
+          <li class="compact" id="section-3.1-1.261">
+            <a href="https://github.com/MISP/misp-objects/blob/main/objects/twitter-post/definition.json">objects/twitter-post</a> - Twitter post (tweet).<a href="#section-3.1-1.261" class="pilcrow">¶</a>
+</li>
+          <li class="compact" id="section-3.1-1.262">
+            <a href="https://github.com/MISP/misp-objects/blob/main/objects/url/definition.json">objects/url</a> - url object describes an url along with its normalized field (like extracted using faup parsing library) and its metadata.<a href="#section-3.1-1.262" class="pilcrow">¶</a>
+</li>
+          <li class="compact" id="section-3.1-1.263">
+            <a href="https://github.com/MISP/misp-objects/blob/main/objects/user-account/definition.json">objects/user-account</a> - User-account object, defining aspects of user identification, authentication, privileges and other relevant data points.<a href="#section-3.1-1.263" class="pilcrow">¶</a>
+</li>
+          <li class="compact" id="section-3.1-1.264">
+            <a href="https://github.com/MISP/misp-objects/blob/main/objects/vehicle/definition.json">objects/vehicle</a> - Vehicle object template to describe a vehicle information and registration.<a href="#section-3.1-1.264" class="pilcrow">¶</a>
+</li>
+          <li class="compact" id="section-3.1-1.265">
+            <a href="https://github.com/MISP/misp-objects/blob/main/objects/victim/definition.json">objects/victim</a> - Victim object describes the target of an attack or abuse.<a href="#section-3.1-1.265" class="pilcrow">¶</a>
+</li>
+          <li class="compact" id="section-3.1-1.266">
+            <a href="https://github.com/MISP/misp-objects/blob/main/objects/virustotal-graph/definition.json">objects/virustotal-graph</a> - VirusTotal graph.<a href="#section-3.1-1.266" class="pilcrow">¶</a>
+</li>
+          <li class="compact" id="section-3.1-1.267">
+            <a href="https://github.com/MISP/misp-objects/blob/main/objects/virustotal-report/definition.json">objects/virustotal-report</a> - VirusTotal report.<a href="#section-3.1-1.267" class="pilcrow">¶</a>
+</li>
+          <li class="compact" id="section-3.1-1.268">
+            <a href="https://github.com/MISP/misp-objects/blob/main/objects/vulnerability/definition.json">objects/vulnerability</a> - Vulnerability object describing a common vulnerability enumeration which can describe published, unpublished, under review or embargo vulnerability for software, equipments or hardware.<a href="#section-3.1-1.268" class="pilcrow">¶</a>
+</li>
+          <li class="compact" id="section-3.1-1.269">
+            <a href="https://github.com/MISP/misp-objects/blob/main/objects/weakness/definition.json">objects/weakness</a> - Weakness object describing a common weakness enumeration which can describe usable, incomplete, draft or deprecated weakness for software, equipment of hardware.<a href="#section-3.1-1.269" class="pilcrow">¶</a>
+</li>
+          <li class="compact" id="section-3.1-1.270">
+            <a href="https://github.com/MISP/misp-objects/blob/main/objects/whois/definition.json">objects/whois</a> - Whois records information for a domain name or an IP address.<a href="#section-3.1-1.270" class="pilcrow">¶</a>
+</li>
+          <li class="compact" id="section-3.1-1.271">
+            <a href="https://github.com/MISP/misp-objects/blob/main/objects/windows-service/definition.json">objects/windows-service</a> - Windows service and detailed about a service running a Windows operating system.<a href="#section-3.1-1.271" class="pilcrow">¶</a>
+</li>
+          <li class="compact" id="section-3.1-1.272">
+            <a href="https://github.com/MISP/misp-objects/blob/main/objects/x509/definition.json">objects/x509</a> - x509 object describing a X.509 certificate.<a href="#section-3.1-1.272" class="pilcrow">¶</a>
+</li>
+          <li class="compact" id="section-3.1-1.273">
+            <a href="https://github.com/MISP/misp-objects/blob/main/objects/yabin/definition.json">objects/yabin</a> - yabin.py generates Yara rules from function prologs, for matching and hunting binaries. ref: <a href="https://github.com/AlienVault-OTX/yabin">https://github.com/AlienVault-OTX/yabin</a>.<a href="#section-3.1-1.273" class="pilcrow">¶</a>
+</li>
+          <li class="compact" id="section-3.1-1.274">
+            <a href="https://github.com/MISP/misp-objects/blob/main/objects/yara/definition.json">objects/yara</a> - An object describing a YARA rule (or a YARA rule name) along with its version.<a href="#section-3.1-1.274" class="pilcrow">¶</a>
+</li>
+          <li class="compact" id="section-3.1-1.275">
+            <a href="https://github.com/MISP/misp-objects/blob/main/objects/youtube-channel/definition.json">objects/youtube-channel</a> - A YouTube channel.<a href="#section-3.1-1.275" class="pilcrow">¶</a>
+</li>
+          <li class="compact" id="section-3.1-1.276">
+            <a href="https://github.com/MISP/misp-objects/blob/main/objects/youtube-comment/definition.json">objects/youtube-comment</a> - A YouTube video comment.<a href="#section-3.1-1.276" class="pilcrow">¶</a>
+</li>
+          <li class="compact" id="section-3.1-1.277">
+            <a href="https://github.com/MISP/misp-objects/blob/main/objects/youtube-playlist/definition.json">objects/youtube-playlist</a> - A YouTube playlist.<a href="#section-3.1-1.277" class="pilcrow">¶</a>
+</li>
+          <li class="compact" id="section-3.1-1.278">
+            <a href="https://github.com/MISP/misp-objects/blob/main/objects/youtube-video/definition.json">objects/youtube-video</a> - A YouTube video.<a href="#section-3.1-1.278" class="pilcrow">¶</a>
 </li>
         </ul>
 </section>
@@ -2503,11 +2580,11 @@ of open standards in threat intelligence sharing.<a href="#section-4-1" class="p
 <dl class="references">
 <dt id="MISP-O">[MISP-O]</dt>
       <dd>
-<span class="refAuthor">Community, M.</span>, <span class="refTitle">"MISP Objects - shared and common object templates"</span>, <span class="refContent"></span>, <span>&lt;<a href="https://github.com/MISP/misp-objects">https://github.com/MISP/misp-objects</a>&gt;</span>. </dd>
+<span class="refAuthor">Community, M.</span>, <span class="refTitle">"MISP Objects - shared and common object templates"</span>, <span>&lt;<a href="https://github.com/MISP/misp-objects">https://github.com/MISP/misp-objects</a>&gt;</span>. </dd>
 <dd class="break"></dd>
 <dt id="MISP-O-DOC">[MISP-O-DOC]</dt>
     <dd>
-<span class="refAuthor">community, M.</span>, <span class="refTitle">"MISP objects directory"</span>, <span class="refContent"></span>, <time datetime="2018" class="refDate">2018</time>, <span>&lt;<a href="https://www.misp-project.org/objects.html">https://www.misp-project.org/objects.html</a>&gt;</span>. </dd>
+<span class="refAuthor">community, M.</span>, <span class="refTitle">"MISP objects directory"</span>, <time datetime="2018" class="refDate">2018</time>, <span>&lt;<a href="https://www.misp-project.org/objects.html">https://www.misp-project.org/objects.html</a>&gt;</span>. </dd>
 <dd class="break"></dd>
 </dl>
 </section>
diff --git a/rfc/misp-standard-object-template-format.txt b/rfc/misp-standard-object-template-format.txt
index 09f4bd0..c39a770 100644
--- a/rfc/misp-standard-object-template-format.txt
+++ b/rfc/misp-standard-object-template-format.txt
@@ -5,7 +5,7 @@
 Network Working Group                                        A. Dulaunoy
 Internet-Draft                                                 A. Iklody
 Intended status: Informational                                     CIRCL
-Expires: 25 May 2022                                    21 November 2021
+Expires: 19 August 2022                                 15 February 2022
 
 
                       MISP object template format
@@ -34,11 +34,11 @@ Status of This Memo
    time.  It is inappropriate to use Internet-Drafts as reference
    material or to cite them other than as "work in progress."
 
-   This Internet-Draft will expire on 25 May 2022.
+   This Internet-Draft will expire on 19 August 2022.
 
 Copyright Notice
 
-   Copyright (c) 2021 IETF Trust and the persons identified as the
+   Copyright (c) 2022 IETF Trust and the persons identified as the
    document authors.  All rights reserved.
 
    This document is subject to BCP 78 and the IETF Trust's Legal
@@ -53,9 +53,9 @@ Copyright Notice
 
 
 
-Dulaunoy & Iklody          Expires 25 May 2022                  [Page 1]
+Dulaunoy & Iklody        Expires 19 August 2022                 [Page 1]
 
-Internet-Draft         MISP object template format         November 2021
+Internet-Draft         MISP object template format         February 2022
 
 
 Table of Contents
@@ -70,10 +70,10 @@ Table of Contents
        2.1.4.  Object Relationships  . . . . . . . . . . . . . . . .   9
    3.  Directory . . . . . . . . . . . . . . . . . . . . . . . . . .  10
      3.1.  Existing and public MISP object templates . . . . . . . .  10
-   4.  Acknowledgements  . . . . . . . . . . . . . . . . . . . . . .  34
-   5.  Normative References  . . . . . . . . . . . . . . . . . . . .  34
-   6.  Informative References  . . . . . . . . . . . . . . . . . . .  34
-   Authors' Addresses  . . . . . . . . . . . . . . . . . . . . . . .  34
+   4.  Acknowledgements  . . . . . . . . . . . . . . . . . . . . . .  31
+   5.  Normative References  . . . . . . . . . . . . . . . . . . . .  31
+   6.  Informative References  . . . . . . . . . . . . . . . . . . .  32
+   Authors' Addresses  . . . . . . . . . . . . . . . . . . . . . . .  32
 
 1.  Introduction
 
@@ -109,9 +109,9 @@ Table of Contents
 
 
 
-Dulaunoy & Iklody          Expires 25 May 2022                  [Page 2]
+Dulaunoy & Iklody        Expires 19 August 2022                 [Page 2]
 
-Internet-Draft         MISP object template format         November 2021
+Internet-Draft         MISP object template format         February 2022
 
 
 2.  Format
@@ -165,9 +165,9 @@ Internet-Draft         MISP object template format         November 2021
 
 
 
-Dulaunoy & Iklody          Expires 25 May 2022                  [Page 3]
+Dulaunoy & Iklody        Expires 19 August 2022                 [Page 3]
 
-Internet-Draft         MISP object template format         November 2021
+Internet-Draft         MISP object template format         February 2022
 
 
 2.1.1.3.  required
@@ -221,9 +221,9 @@ Internet-Draft         MISP object template format         November 2021
 
 
 
-Dulaunoy & Iklody          Expires 25 May 2022                  [Page 4]
+Dulaunoy & Iklody        Expires 19 August 2022                 [Page 4]
 
-Internet-Draft         MISP object template format         November 2021
+Internet-Draft         MISP object template format         February 2022
 
 
 2.1.2.1.  description
@@ -277,9 +277,9 @@ Internet-Draft         MISP object template format         November 2021
 
 
 
-Dulaunoy & Iklody          Expires 25 May 2022                  [Page 5]
+Dulaunoy & Iklody        Expires 19 August 2022                 [Page 5]
 
-Internet-Draft         MISP object template format         November 2021
+Internet-Draft         MISP object template format         February 2022
 
 
 2.1.2.7.  sane_default
@@ -333,9 +333,9 @@ Internet-Draft         MISP object template format         November 2021
 
 
 
-Dulaunoy & Iklody          Expires 25 May 2022                  [Page 6]
+Dulaunoy & Iklody        Expires 19 August 2022                 [Page 6]
 
-Internet-Draft         MISP object template format         November 2021
+Internet-Draft         MISP object template format         February 2022
 
 
 {
@@ -389,9 +389,9 @@ Internet-Draft         MISP object template format         November 2021
 
 
 
-Dulaunoy & Iklody          Expires 25 May 2022                  [Page 7]
+Dulaunoy & Iklody        Expires 19 August 2022                 [Page 7]
 
-Internet-Draft         MISP object template format         November 2021
+Internet-Draft         MISP object template format         February 2022
 
 
 2.1.3.2.  credential object template
@@ -445,9 +445,9 @@ Internet-Draft         MISP object template format         November 2021
 
 
 
-Dulaunoy & Iklody          Expires 25 May 2022                  [Page 8]
+Dulaunoy & Iklody        Expires 19 August 2022                 [Page 8]
 
-Internet-Draft         MISP object template format         November 2021
+Internet-Draft         MISP object template format         February 2022
 
 
     "format": {
@@ -501,9 +501,9 @@ Internet-Draft         MISP object template format         November 2021
 
 
 
-Dulaunoy & Iklody          Expires 25 May 2022                  [Page 9]
+Dulaunoy & Iklody        Expires 19 August 2022                 [Page 9]
 
-Internet-Draft         MISP object template format         November 2021
+Internet-Draft         MISP object template format         February 2022
 
 
 2.1.4.3.  format
@@ -531,37 +531,20 @@ Internet-Draft         MISP object template format         November 2021
       objects/blob/main/objects/ail-leak/definition.json) - An
       information leak as defined by the AIL Analysis Information Leak
       framework.
-
    *  objects/ais-info (https://github.com/MISP/misp-
       objects/blob/main/objects/ais-info/definition.json) - Automated
       Indicator Sharing (AIS) Information Source Markings.
-
    *  objects/android-app (https://github.com/MISP/misp-
       objects/blob/main/objects/android-app/definition.json) -
       Indicators related to an Android app.
-
    *  objects/android-permission (https://github.com/MISP/misp-
       objects/blob/main/objects/android-permission/definition.json) - A
       set of android permissions - one or more permission(s) which can
       be linked to other objects (e.g. malware, app).
-
    *  objects/annotation (https://github.com/MISP/misp-
       objects/blob/main/objects/annotation/definition.json) - An
       annotation object allowing analysts to add annotations, comments,
       executive summary to a MISP event, objects or attributes.
-
-
-
-
-
-
-
-
-Dulaunoy & Iklody          Expires 25 May 2022                 [Page 10]
-
-Internet-Draft         MISP object template format         November 2021
-
-
    *  objects/anonymisation (https://github.com/MISP/misp-
       objects/blob/main/objects/anonymisation/definition.json) -
       Anonymisation object describing an anonymisation technique used to
@@ -569,39 +552,52 @@ Internet-Draft         MISP object template format         November 2021
       https://www.caida.org/tools/taxonomy/anonymization.xml
       (https://www.caida.org/tools/taxonomy/anonymization.xml).
 
+
+
+
+
+
+Dulaunoy & Iklody        Expires 19 August 2022                [Page 10]
+
+Internet-Draft         MISP object template format         February 2022
+
+
+   *  objects/apivoid-email-verification (https://github.com/MISP/misp-
+      objects/blob/main/objects/apivoid-email-verification/
+      definition.json) - Apivoid email verification API result.
+      Reference: https://www.apivoid.com/api/email-verify/
+      (https://www.apivoid.com/api/email-verify/).
+   *  objects/artifact (https://github.com/MISP/misp-
+      objects/blob/main/objects/artifact/definition.json) - The Artifact
+      object permits capturing an array of bytes (8-bits), as a
+      base64-encoded string, or linking to a file-like payload. from
+      STIX 2.1 (6.1).
    *  objects/asn (https://github.com/MISP/misp-
       objects/blob/main/objects/asn/definition.json) - Autonomous system
       object describing an autonomous system which can include one or
       more network operators management an entity (e.g.  ISP) along with
       their routing policy, routing prefixes or alike.
-
    *  objects/attack-pattern (https://github.com/MISP/misp-
       objects/blob/main/objects/attack-pattern/definition.json) - Attack
       pattern describing a common attack pattern enumeration and
       classification.
-
    *  objects/authentication-failure-report (https://github.com/MISP/
       misp-objects/blob/main/objects/authentication-failure-report/
       definition.json) - Authentication Failure Report.
-
    *  objects/authenticode-signerinfo (https://github.com/MISP/misp-
       objects/blob/main/objects/authenticode-signerinfo/definition.json)
       - Authenticode Signer Info.
-
    *  objects/av-signature (https://github.com/MISP/misp-
       objects/blob/main/objects/av-signature/definition.json) -
       Antivirus detection signature.
-
    *  objects/bank-account (https://github.com/MISP/misp-
       objects/blob/main/objects/bank-account/definition.json) - An
       object describing bank account information based on account
       description from goAML 4.0.
-
    *  objects/bgp-hijack (https://github.com/MISP/misp-
       objects/blob/main/objects/bgp-hijack/definition.json) - Object
       encapsulating BGP Hijack description as specified, for example, by
       bgpstream.com.
-
    *  objects/bgp-ranking (https://github.com/MISP/misp-
       objects/blob/main/objects/bgp-ranking/definition.json) - BGP
       Ranking object describing the ranking of an ASN for a given day,
@@ -609,239 +605,202 @@ Internet-Draft         MISP object template format         November 2021
       day, with the highest ranking.  This object is meant to have a
       relationship with the corresponding ASN object and represents its
       ranking for a specific date.
-
-
-
-
-Dulaunoy & Iklody          Expires 25 May 2022                 [Page 11]
-
-Internet-Draft         MISP object template format         November 2021
-
-
    *  objects/blog (https://github.com/MISP/misp-
       objects/blob/main/objects/blog/definition.json) - Blog post like
       Medium or WordPress.
 
+
+
+
+
+Dulaunoy & Iklody        Expires 19 August 2022                [Page 11]
+
+Internet-Draft         MISP object template format         February 2022
+
+
    *  objects/boleto (https://github.com/MISP/misp-
       objects/blob/main/objects/boleto/definition.json) - A common form
       of payment used in Brazil.
-
    *  objects/btc-transaction (https://github.com/MISP/misp-
       objects/blob/main/objects/btc-transaction/definition.json) - An
       object to describe a Bitcoin transaction.  Best to be used with
       bitcoin-wallet.
-
    *  objects/btc-wallet (https://github.com/MISP/misp-
       objects/blob/main/objects/btc-wallet/definition.json) - An object
       to describe a Bitcoin wallet.  Best to be used with bitcoin-
       transactions.
-
    *  objects/cap-alert (https://github.com/MISP/misp-
       objects/blob/main/objects/cap-alert/definition.json) - Common
       Alerting Protocol Version (CAP) alert object.
-
    *  objects/cap-info (https://github.com/MISP/misp-
       objects/blob/main/objects/cap-info/definition.json) - Common
       Alerting Protocol Version (CAP) info object.
-
    *  objects/cap-resource (https://github.com/MISP/misp-
       objects/blob/main/objects/cap-resource/definition.json) - Common
       Alerting Protocol Version (CAP) resource object.
-
    *  objects/coin-address (https://github.com/MISP/misp-
       objects/blob/main/objects/coin-address/definition.json) - An
       address used in a cryptocurrency.
-
    *  objects/command (https://github.com/MISP/misp-
       objects/blob/main/objects/command/definition.json) - Command
       functionalities related to specific commands executed by a
       program, whether it is malicious or not.  Command-line are
       attached to this object for the related commands.
-
    *  objects/command-line (https://github.com/MISP/misp-
       objects/blob/main/objects/command-line/definition.json) - Command
       line and options related to a specific command executed by a
       program, whether it is malicious or not.
-
+   *  objects/concordia-mtmf-intrusion-set (https://github.com/MISP/
+      misp-objects/blob/main/objects/concordia-mtmf-intrusion-set/
+      definition.json) - Intrusion Set - Phase Description.
    *  objects/cookie (https://github.com/MISP/misp-
       objects/blob/main/objects/cookie/definition.json) - An HTTP cookie
       (web cookie, browser cookie) is a small piece of data that a
-
-
-
-Dulaunoy & Iklody          Expires 25 May 2022                 [Page 12]
-
-Internet-Draft         MISP object template format         November 2021
-
-
       server sends to the user's web browser.  The browser may store it
       and send it back with the next request to the same server.
       Typically, it's used to tell if two requests came from the same
       browser — (U+2014) keeping a user logged-in, for example.  It
       remembers stateful information for the stateless HTTP protocol.
       (as defined by the Mozilla foundation.
-
    *  objects/cortex (https://github.com/MISP/misp-
       objects/blob/main/objects/cortex/definition.json) - Cortex object
       describing a complete cortex analysis.  Observables would be
       attribute with a relationship from this object.
 
+
+
+Dulaunoy & Iklody        Expires 19 August 2022                [Page 12]
+
+Internet-Draft         MISP object template format         February 2022
+
+
    *  objects/cortex-taxonomy (https://github.com/MISP/misp-
       objects/blob/main/objects/cortex-taxonomy/definition.json) -
       Cortex object describing an Cortex Taxonomy (or mini report).
-
    *  objects/course-of-action (https://github.com/MISP/misp-
       objects/blob/main/objects/course-of-action/definition.json) - An
       object describing a specific measure taken to prevent or respond
       to an attack.
-
    *  objects/covid19-csse-daily-report (https://github.com/MISP/misp-
       objects/blob/main/objects/covid19-csse-daily-report/
       definition.json) - CSSE COVID-19 Daily report.
-
    *  objects/covid19-dxy-live-city (https://github.com/MISP/misp-
       objects/blob/main/objects/covid19-dxy-live-city/definition.json) -
       COVID 19 from dxy.cn - Aggregation by city.
-
    *  objects/covid19-dxy-live-province (https://github.com/MISP/misp-
       objects/blob/main/objects/covid19-dxy-live-province/
       definition.json) - COVID 19 from dxy.cn - Aggregation by province.
-
    *  objects/cowrie (https://github.com/MISP/misp-
       objects/blob/main/objects/cowrie/definition.json) - Cowrie
       honeypot object template.
-
    *  objects/cpe-asset (https://github.com/MISP/misp-
       objects/blob/main/objects/cpe-asset/definition.json) - An asset
       which can be defined by a CPE.  This can be a generic asset.  CPE
       is a structured naming scheme for information technology systems,
       software, and packages.
-
    *  objects/credential (https://github.com/MISP/misp-
       objects/blob/main/objects/credential/definition.json) - Credential
       describes one or more credential(s) including password(s), api
       key(s) or decryption key(s).
-
-
-
-
-Dulaunoy & Iklody          Expires 25 May 2022                 [Page 13]
-
-Internet-Draft         MISP object template format         November 2021
-
-
    *  objects/credit-card (https://github.com/MISP/misp-
       objects/blob/main/objects/credit-card/definition.json) - A payment
       card like credit card, debit card or any similar cards which can
       be used for financial transactions.
-
    *  objects/crypto-material (https://github.com/MISP/misp-
       objects/blob/main/objects/crypto-material/definition.json) -
       Cryptographic materials such as public or/and private keys.
-
    *  objects/cytomic-orion-file (https://github.com/MISP/misp-
       objects/blob/main/objects/cytomic-orion-file/definition.json) -
       Cytomic Orion File Detection.
-
    *  objects/cytomic-orion-machine (https://github.com/MISP/misp-
       objects/blob/main/objects/cytomic-orion-machine/definition.json) -
       Cytomic Orion File at Machine Detection.
-
    *  objects/dark-pattern-item (https://github.com/MISP/misp-
       objects/blob/main/objects/dark-pattern-item/definition.json) - An
       Item whose User Interface implements a dark pattern.
 
+
+
+
+
+
+
+Dulaunoy & Iklody        Expires 19 August 2022                [Page 13]
+
+Internet-Draft         MISP object template format         February 2022
+
+
    *  objects/ddos (https://github.com/MISP/misp-
       objects/blob/main/objects/ddos/definition.json) - DDoS object
       describes a current DDoS activity from a specific or/and to a
       specific target.  Type of DDoS can be attached to the object as a
       taxonomy.
-
    *  objects/device (https://github.com/MISP/misp-
       objects/blob/main/objects/device/definition.json) - An object to
       define a device.
-
    *  objects/diameter-attack (https://github.com/MISP/misp-
       objects/blob/main/objects/diameter-attack/definition.json) -
-      Attack as seen on diameter authentication against a GSM, UMTS or
-      LTE network.
-
+      Attack as seen on the diameter signaling protocol supporting LTE
+      networks.
+   *  objects/dkim (https://github.com/MISP/misp-
+      objects/blob/main/objects/dkim/definition.json) - DomainKeys
+      Identified Mail - DKIM.
    *  objects/dns-record (https://github.com/MISP/misp-
       objects/blob/main/objects/dns-record/definition.json) - A set of
       DNS records observed for a specific domain.
-
    *  objects/domain-crawled (https://github.com/MISP/misp-
       objects/blob/main/objects/domain-crawled/definition.json) - A
       domain crawled over time.
-
    *  objects/domain-ip (https://github.com/MISP/misp-
       objects/blob/main/objects/domain-ip/definition.json) - A domain/
       hostname and IP address seen as a tuple in a specific time frame.
-
-
-
-
-Dulaunoy & Iklody          Expires 25 May 2022                 [Page 14]
-
-Internet-Draft         MISP object template format         November 2021
-
-
+   *  objects/edr-report (https://github.com/MISP/misp-
+      objects/blob/main/objects/edr-report/definition.json) - An Object
+      Template to encode an EDR  (U+00A0)detection report.
    *  objects/elf (https://github.com/MISP/misp-
       objects/blob/main/objects/elf/definition.json) - Object describing
       a Executable and Linkable Format.
-
    *  objects/elf-section (https://github.com/MISP/misp-
       objects/blob/main/objects/elf-section/definition.json) - Object
       describing a section of an Executable and Linkable Format.
-
    *  objects/email (https://github.com/MISP/misp-
       objects/blob/main/objects/email/definition.json) - Email object
       describing an email with meta-information.
-
    *  objects/employee (https://github.com/MISP/misp-
       objects/blob/main/objects/employee/definition.json) - An employee
       and related data points.
-
    *  objects/exploit-poc (https://github.com/MISP/misp-
       objects/blob/main/objects/exploit-poc/definition.json) - Exploit-
       poc object describing a proof of concept or exploit of a
       vulnerability.  This object has often a relationship with a
       vulnerability object.
-
    *  objects/facebook-account (https://github.com/MISP/misp-
       objects/blob/main/objects/facebook-account/definition.json) -
       Facebook account.
 
+
+
+
+Dulaunoy & Iklody        Expires 19 August 2022                [Page 14]
+
+Internet-Draft         MISP object template format         February 2022
+
+
    *  objects/facebook-group (https://github.com/MISP/misp-
       objects/blob/main/objects/facebook-group/definition.json) - Public
       or private facebook group.
-
    *  objects/facebook-page (https://github.com/MISP/misp-
       objects/blob/main/objects/facebook-page/definition.json) -
       Facebook page.
-
    *  objects/facebook-post (https://github.com/MISP/misp-
       objects/blob/main/objects/facebook-post/definition.json) - Post on
       a Facebook wall.
-
    *  objects/facial-composite (https://github.com/MISP/misp-
       objects/blob/main/objects/facial-composite/definition.json) - An
       object which describes a facial composite.
-
    *  objects/fail2ban (https://github.com/MISP/misp-
       objects/blob/main/objects/fail2ban/definition.json) - Fail2ban
       event.
-
-
-
-
-
-
-Dulaunoy & Iklody          Expires 25 May 2022                 [Page 15]
-
-Internet-Draft         MISP object template format         November 2021
-
-
    *  objects/favicon (https://github.com/MISP/misp-
       objects/blob/main/objects/favicon/definition.json) - A favicon,
       also known as a shortcut icon, website icon, tab icon, URL icon,
@@ -849,344 +808,293 @@ Internet-Draft         MISP object template format         November 2021
       associated with a particular website or web page.  The object
       template can include the murmur3 hash of the favicon to facilitate
       correlation.
-
    *  objects/file (https://github.com/MISP/misp-
       objects/blob/main/objects/file/definition.json) - File object
       describing a file with meta-information.
-
    *  objects/forensic-case (https://github.com/MISP/misp-
       objects/blob/main/objects/forensic-case/definition.json) - An
       object template to describe a digital forensic case.
-
    *  objects/forensic-evidence (https://github.com/MISP/misp-
       objects/blob/main/objects/forensic-evidence/definition.json) - An
       object template to describe a digital forensic evidence.
-
    *  objects/forged-document (https://github.com/MISP/misp-
       objects/blob/main/objects/forged-document/definition.json) -
       Object describing a forged document.
-
    *  objects/ftm-Airplane (https://github.com/MISP/misp-
       objects/blob/main/objects/ftm-Airplane/definition.json) - .
-
    *  objects/ftm-Assessment (https://github.com/MISP/misp-
       objects/blob/main/objects/ftm-Assessment/definition.json) - .
-
    *  objects/ftm-Asset (https://github.com/MISP/misp-
       objects/blob/main/objects/ftm-Asset/definition.json) - .
-
    *  objects/ftm-Associate (https://github.com/MISP/misp-
       objects/blob/main/objects/ftm-Associate/definition.json) - Non-
       family association between two people.
-
    *  objects/ftm-Audio (https://github.com/MISP/misp-
       objects/blob/main/objects/ftm-Audio/definition.json) - .
-
    *  objects/ftm-BankAccount (https://github.com/MISP/misp-
       objects/blob/main/objects/ftm-BankAccount/definition.json) - .
 
+
+
+
+Dulaunoy & Iklody        Expires 19 August 2022                [Page 15]
+
+Internet-Draft         MISP object template format         February 2022
+
+
    *  objects/ftm-Call (https://github.com/MISP/misp-
       objects/blob/main/objects/ftm-Call/definition.json) - .
-
    *  objects/ftm-Company (https://github.com/MISP/misp-
-      objects/blob/main/objects/ftm-Company/definition.json) - .
-
-
-
-Dulaunoy & Iklody          Expires 25 May 2022                 [Page 16]
-
-Internet-Draft         MISP object template format         November 2021
-
-
+      objects/blob/main/objects/ftm-Company/definition.json) - A legal
+      entity representing an association of people, whether natural,
+      legal or a mixture of both, with a specific objective.
    *  objects/ftm-Contract (https://github.com/MISP/misp-
       objects/blob/main/objects/ftm-Contract/definition.json) - An
       contract or contract lot issued by an authority.  Multiple lots
       may be awarded to different suppliers (see ContractAward). .
-
    *  objects/ftm-ContractAward (https://github.com/MISP/misp-
       objects/blob/main/objects/ftm-ContractAward/definition.json) - A
       contract or contract lot as awarded to a supplier.
-
    *  objects/ftm-CourtCase (https://github.com/MISP/misp-
       objects/blob/main/objects/ftm-CourtCase/definition.json) - .
-
    *  objects/ftm-CourtCaseParty (https://github.com/MISP/misp-
       objects/blob/main/objects/ftm-CourtCaseParty/definition.json) - .
-
    *  objects/ftm-Debt (https://github.com/MISP/misp-
       objects/blob/main/objects/ftm-Debt/definition.json) - A monetary
       debt between two parties.
-
    *  objects/ftm-Directorship (https://github.com/MISP/misp-
       objects/blob/main/objects/ftm-Directorship/definition.json) - .
-
    *  objects/ftm-Document (https://github.com/MISP/misp-
       objects/blob/main/objects/ftm-Document/definition.json) - .
-
    *  objects/ftm-Documentation (https://github.com/MISP/misp-
       objects/blob/main/objects/ftm-Documentation/definition.json) - .
-
    *  objects/ftm-EconomicActivity (https://github.com/MISP/misp-
       objects/blob/main/objects/ftm-EconomicActivity/definition.json) -
       A foreign economic activity.
-
    *  objects/ftm-Email (https://github.com/MISP/misp-
       objects/blob/main/objects/ftm-Email/definition.json) - .
-
    *  objects/ftm-Event (https://github.com/MISP/misp-
       objects/blob/main/objects/ftm-Event/definition.json) - .
-
    *  objects/ftm-Family (https://github.com/MISP/misp-
       objects/blob/main/objects/ftm-Family/definition.json) - Family
       relationship between two people.
-
    *  objects/ftm-Folder (https://github.com/MISP/misp-
       objects/blob/main/objects/ftm-Folder/definition.json) - .
-
    *  objects/ftm-HyperText (https://github.com/MISP/misp-
       objects/blob/main/objects/ftm-HyperText/definition.json) - .
-
-
-
-
-Dulaunoy & Iklody          Expires 25 May 2022                 [Page 17]
-
-Internet-Draft         MISP object template format         November 2021
-
-
    *  objects/ftm-Image (https://github.com/MISP/misp-
       objects/blob/main/objects/ftm-Image/definition.json) - .
-
    *  objects/ftm-Land (https://github.com/MISP/misp-
       objects/blob/main/objects/ftm-Land/definition.json) - .
-
    *  objects/ftm-LegalEntity (https://github.com/MISP/misp-
       objects/blob/main/objects/ftm-LegalEntity/definition.json) - A
       legal entity may be a person or a company.
 
+
+
+
+Dulaunoy & Iklody        Expires 19 August 2022                [Page 16]
+
+Internet-Draft         MISP object template format         February 2022
+
+
    *  objects/ftm-License (https://github.com/MISP/misp-
       objects/blob/main/objects/ftm-License/definition.json) - A grant
       of land, rights or property.  A type of Contract.
-
    *  objects/ftm-Membership (https://github.com/MISP/misp-
       objects/blob/main/objects/ftm-Membership/definition.json) - .
-
    *  objects/ftm-Message (https://github.com/MISP/misp-
       objects/blob/main/objects/ftm-Message/definition.json) - .
-
    *  objects/ftm-Organization (https://github.com/MISP/misp-
       objects/blob/main/objects/ftm-Organization/definition.json) - .
-
    *  objects/ftm-Ownership (https://github.com/MISP/misp-
       objects/blob/main/objects/ftm-Ownership/definition.json) - .
-
    *  objects/ftm-Package (https://github.com/MISP/misp-
       objects/blob/main/objects/ftm-Package/definition.json) - .
-
    *  objects/ftm-Page (https://github.com/MISP/misp-
       objects/blob/main/objects/ftm-Page/definition.json) - .
-
    *  objects/ftm-Pages (https://github.com/MISP/misp-
       objects/blob/main/objects/ftm-Pages/definition.json) - .
-
    *  objects/ftm-Passport (https://github.com/MISP/misp-
       objects/blob/main/objects/ftm-Passport/definition.json) -
       Passport.
-
    *  objects/ftm-Payment (https://github.com/MISP/misp-
       objects/blob/main/objects/ftm-Payment/definition.json) - A
       monetary payment between two parties.
-
    *  objects/ftm-Person (https://github.com/MISP/misp-
       objects/blob/main/objects/ftm-Person/definition.json) - An
       individual.
-
-
-
-
-
-Dulaunoy & Iklody          Expires 25 May 2022                 [Page 18]
-
-Internet-Draft         MISP object template format         November 2021
-
-
    *  objects/ftm-PlainText (https://github.com/MISP/misp-
       objects/blob/main/objects/ftm-PlainText/definition.json) - .
-
    *  objects/ftm-PublicBody (https://github.com/MISP/misp-
       objects/blob/main/objects/ftm-PublicBody/definition.json) - A
       public body, such as a ministry, department or state company.
-
    *  objects/ftm-RealEstate (https://github.com/MISP/misp-
       objects/blob/main/objects/ftm-RealEstate/definition.json) - A
       piece of land or property.
-
    *  objects/ftm-Representation (https://github.com/MISP/misp-
       objects/blob/main/objects/ftm-Representation/definition.json) - A
       mediatory, intermediary, middleman, or broker acting on behalf of
       a legal entity.
-
    *  objects/ftm-Row (https://github.com/MISP/misp-
       objects/blob/main/objects/ftm-Row/definition.json) - .
-
    *  objects/ftm-Sanction (https://github.com/MISP/misp-
       objects/blob/main/objects/ftm-Sanction/definition.json) - A
       sanction designation.
-
    *  objects/ftm-Succession (https://github.com/MISP/misp-
       objects/blob/main/objects/ftm-Succession/definition.json) - Two
       entities that legally succeed each other.
-
    *  objects/ftm-Table (https://github.com/MISP/misp-
       objects/blob/main/objects/ftm-Table/definition.json) - .
 
+
+
+Dulaunoy & Iklody        Expires 19 August 2022                [Page 17]
+
+Internet-Draft         MISP object template format         February 2022
+
+
    *  objects/ftm-TaxRoll (https://github.com/MISP/misp-
       objects/blob/main/objects/ftm-TaxRoll/definition.json) - A tax
       declaration of an individual.
-
    *  objects/ftm-UnknownLink (https://github.com/MISP/misp-
       objects/blob/main/objects/ftm-UnknownLink/definition.json) - .
-
    *  objects/ftm-UserAccount (https://github.com/MISP/misp-
       objects/blob/main/objects/ftm-UserAccount/definition.json) - .
-
    *  objects/ftm-Vehicle (https://github.com/MISP/misp-
       objects/blob/main/objects/ftm-Vehicle/definition.json) - .
-
    *  objects/ftm-Vessel (https://github.com/MISP/misp-
       objects/blob/main/objects/ftm-Vessel/definition.json) - A boat or
       ship.
-
-
-
-
-
-Dulaunoy & Iklody          Expires 25 May 2022                 [Page 19]
-
-Internet-Draft         MISP object template format         November 2021
-
-
    *  objects/ftm-Video (https://github.com/MISP/misp-
       objects/blob/main/objects/ftm-Video/definition.json) - .
-
    *  objects/ftm-Workbook (https://github.com/MISP/misp-
       objects/blob/main/objects/ftm-Workbook/definition.json) - .
-
    *  objects/geolocation (https://github.com/MISP/misp-
       objects/blob/main/objects/geolocation/definition.json) - An object
       to describe a geographic location.
-
    *  objects/git-vuln-finder (https://github.com/MISP/misp-
       objects/blob/main/objects/git-vuln-finder/definition.json) -
       Export from git-vuln-finder.
-
    *  objects/github-user (https://github.com/MISP/misp-
       objects/blob/main/objects/github-user/definition.json) - GitHub
       user.
-
    *  objects/gitlab-user (https://github.com/MISP/misp-
       objects/blob/main/objects/gitlab-user/definition.json) - GitLab
       user.  Gitlab.com user or self-hosted GitLab instance.
-
    *  objects/gtp-attack (https://github.com/MISP/misp-
       objects/blob/main/objects/gtp-attack/definition.json) - GTP attack
-      object as seen on a GSM, UMTS or LTE network.
-
+      object as attack as seen on the GTP signaling protocol supporting
+      GPRS/LTE networks.
+   *  objects/hashlookup (https://github.com/MISP/misp-
+      objects/blob/main/objects/hashlookup/definition.json) - hashlookup
+      object as described on hashlookup services from circl.lu -
+      https://www.circl.lu/services/hashlookup
+      (https://www.circl.lu/services/hashlookup).
    *  objects/http-request (https://github.com/MISP/misp-
       objects/blob/main/objects/http-request/definition.json) - A single
       HTTP request header.
 
+
+
+
+
+
+
+
+
+
+
+Dulaunoy & Iklody        Expires 19 August 2022                [Page 18]
+
+Internet-Draft         MISP object template format         February 2022
+
+
+   *  objects/identity (https://github.com/MISP/misp-
+      objects/blob/main/objects/identity/definition.json) - Identities
+      can represent actual individuals, organizations, or groups (e.g.,
+      ACME, Inc.) as well as classes of individuals, organizations,
+      systems or groups (e.g., the finance sector).  The Identity SDO
+      can capture basic identifying information, contact information,
+      and the sectors that the Identity belongs to.  Identity is used in
+      STIX to represent, among other things, targets of attacks,
+      information sources, object creators, and threat actor identities.
+      (ref.  STIX 2.1 - 4.5).
    *  objects/ilr-impact (https://github.com/MISP/misp-
       objects/blob/main/objects/ilr-impact/definition.json) - Institut
       Luxembourgeois de Regulation - Impact.
-
    *  objects/ilr-notification-incident (https://github.com/MISP/misp-
       objects/blob/main/objects/ilr-notification-incident/
       definition.json) - Institut Luxembourgeois de Regulation -
       Notification d'incident.
-
    *  objects/image (https://github.com/MISP/misp-
       objects/blob/main/objects/image/definition.json) - Object
       describing an image file.
-
    *  objects/impersonation (https://github.com/MISP/misp-
       objects/blob/main/objects/impersonation/definition.json) -
       Represent an impersonating account.
-
-
-
-
-
-Dulaunoy & Iklody          Expires 25 May 2022                 [Page 20]
-
-Internet-Draft         MISP object template format         November 2021
-
-
    *  objects/imsi-catcher (https://github.com/MISP/misp-
       objects/blob/main/objects/imsi-catcher/definition.json) - IMSI
       Catcher entry object based on the open source IMSI cather.
-
+   *  objects/infrastructure (https://github.com/MISP/misp-
+      objects/blob/main/objects/infrastructure/definition.json) - The
+      Infrastructure object represents a type of TTP and describes any
+      systems, software services and any associated physical or virtual
+      resources intended to support some purpose (e.g., C2 servers used
+      as part of an attack, device or server that are part of defense,
+      database servers targeted by an attack, etc.).  While elements of
+      an attack can be represented by other objects, the Infrastructure
+      object represents a named group of related data that constitutes
+      the infrastructure.  STIX 2.1 - 4.8.
    *  objects/instant-message (https://github.com/MISP/misp-
       objects/blob/main/objects/instant-message/definition.json) -
       Instant Message (IM) object template describing one or more IM
       message.
-
    *  objects/instant-message-group (https://github.com/MISP/misp-
       objects/blob/main/objects/instant-message-group/definition.json) -
       Instant Message (IM) group object template describing a public or
       private IM group, channel or conversation.
-
    *  objects/intel471-vulnerability-intelligence
       (https://github.com/MISP/misp-objects/blob/main/objects/intel471-
       vulnerability-intelligence/definition.json) - Intel 471
       vulnerability intelligence object.
 
+
+
+Dulaunoy & Iklody        Expires 19 August 2022                [Page 19]
+
+Internet-Draft         MISP object template format         February 2022
+
+
    *  objects/intelmq_event (https://github.com/MISP/misp-
       objects/blob/main/objects/intelmq_event/definition.json) - IntelMQ
       Event.
-
    *  objects/intelmq_report (https://github.com/MISP/misp-
       objects/blob/main/objects/intelmq_report/definition.json) -
       IntelMQ Report.
-
    *  objects/internal-reference (https://github.com/MISP/misp-
       objects/blob/main/objects/internal-reference/definition.json) -
       Internal reference.
-
    *  objects/interpol-notice (https://github.com/MISP/misp-
       objects/blob/main/objects/interpol-notice/definition.json) - An
       object which describes a Interpol notice.
-
    *  objects/iot-device (https://github.com/MISP/misp-
       objects/blob/main/objects/iot-device/definition.json) - An IoT
       device.
-
    *  objects/iot-firmware (https://github.com/MISP/misp-
       objects/blob/main/objects/iot-firmware/definition.json) - A
       firmware for an IoT device.
-
    *  objects/ip-api-address (https://github.com/MISP/misp-
       objects/blob/main/objects/ip-api-address/definition.json) - IP
       Address information.  Useful if you are pulling your ip
       information from ip-api.com.
-
-
-
-
-Dulaunoy & Iklody          Expires 25 May 2022                 [Page 21]
-
-Internet-Draft         MISP object template format         November 2021
-
-
    *  objects/ip-port (https://github.com/MISP/misp-
       objects/blob/main/objects/ip-port/definition.json) - An IP address
       (or domain or hostname) and a port seen as a tuple (or as a
       triple) in a specific time frame.
-
    *  objects/irc (https://github.com/MISP/misp-
       objects/blob/main/objects/irc/definition.json) - An IRC object to
       describe an IRC server and the associated channels.
-
    *  objects/ja3 (https://github.com/MISP/misp-
       objects/blob/main/objects/ja3/definition.json) - JA3 is a new
       technique for creating SSL client fingerprints that are easy to
@@ -1195,665 +1103,618 @@ Internet-Draft         MISP object template format         November 2021
       Accepted Ciphers, List of Extensions, Elliptic Curves, and
       Elliptic Curve Formats. https://github.com/salesforce/ja3
       (https://github.com/salesforce/ja3).
+   *  objects/ja3s (https://github.com/MISP/misp-
+      objects/blob/main/objects/ja3s/definition.json) - JA3S is JA3 for
+      the Server side of the SSL/TLS communication and fingerprints how
+      servers respond to particular clients.  JA3S fingerprints are
+      composed of Server Hello packet; SSL Version, Cipher,
+      SSLExtensions. https://github.com/salesforce/ja3
+      (https://github.com/salesforce/ja3).
+   *  objects/jarm (https://github.com/MISP/misp-
+      objects/blob/main/objects/jarm/definition.json) - Jarm object to
+      describe an TLS/SSL implementation used for malicious or
+      legitimate use-case.
+
+
+
+Dulaunoy & Iklody        Expires 19 August 2022                [Page 20]
+
+Internet-Draft         MISP object template format         February 2022
+
 
    *  objects/keybase-account (https://github.com/MISP/misp-
       objects/blob/main/objects/keybase-account/definition.json) -
       Information related to a keybase account, from API Users Object.
-
+   *  objects/language-content (https://github.com/MISP/misp-
+      objects/blob/main/objects/language-content/definition.json) - The
+      Language Content object represents text content for objects
+      represented in languages other than that of the original object.
+      Language content may be a translation of the original object by a
+      third-party, a first-source translation by the original publisher,
+      or additional official language content provided at the time of
+      creation.  STIX 2.1 ref 7.1.
    *  objects/leaked-document (https://github.com/MISP/misp-
       objects/blob/main/objects/leaked-document/definition.json) -
       Object describing a leaked document.
-
    *  objects/legal-entity (https://github.com/MISP/misp-
       objects/blob/main/objects/legal-entity/definition.json) - An
       object to describe a legal entity.
-
    *  objects/lnk (https://github.com/MISP/misp-
       objects/blob/main/objects/lnk/definition.json) - LNK object
       describing a Windows LNK binary file (aka Windows shortcut).
-
    *  objects/macho (https://github.com/MISP/misp-
       objects/blob/main/objects/macho/definition.json) - Object
       describing a file in Mach-O format.
-
    *  objects/macho-section (https://github.com/MISP/misp-
       objects/blob/main/objects/macho-section/definition.json) - Object
       describing a section of a file in Mach-O format.
-
    *  objects/mactime-timeline-analysis (https://github.com/MISP/misp-
       objects/blob/main/objects/mactime-timeline-analysis/
       definition.json) - Mactime template, used in forensic
       investigations to describe the timeline of a file activity.
-
-
-
-
-
-Dulaunoy & Iklody          Expires 25 May 2022                 [Page 22]
-
-Internet-Draft         MISP object template format         November 2021
-
-
    *  objects/malware-config (https://github.com/MISP/misp-
       objects/blob/main/objects/malware-config/definition.json) -
       Malware configuration recovered or extracted from a malicious
       binary.
-
    *  objects/meme-image (https://github.com/MISP/misp-
       objects/blob/main/objects/meme-image/definition.json) - Object
       describing a meme (image).
-
    *  objects/microblog (https://github.com/MISP/misp-
       objects/blob/main/objects/microblog/definition.json) - Microblog
       post like a Twitter tweet or a post on a Facebook wall.
-
    *  objects/mutex (https://github.com/MISP/misp-
       objects/blob/main/objects/mutex/definition.json) - Object to
       describe mutual exclusion locks (mutex) as seen in memory or
       computer program.
-
    *  objects/narrative (https://github.com/MISP/misp-
       objects/blob/main/objects/narrative/definition.json) - Object
       describing a narrative.
 
+
+
+
+Dulaunoy & Iklody        Expires 19 August 2022                [Page 21]
+
+Internet-Draft         MISP object template format         February 2022
+
+
    *  objects/netflow (https://github.com/MISP/misp-
       objects/blob/main/objects/netflow/definition.json) - Netflow
       object describes an network object based on the Netflowv5/v9
       minimal definition.
-
    *  objects/network-connection (https://github.com/MISP/misp-
       objects/blob/main/objects/network-connection/definition.json) - A
       local or remote network connection.
-
+   *  objects/network-profile (https://github.com/MISP/misp-
+      objects/blob/main/objects/network-profile/definition.json) -
+      Elements that can be used to profile, pivot or identify a network
+      infrastructure, including domains, ip and urls.
    *  objects/network-socket (https://github.com/MISP/misp-
       objects/blob/main/objects/network-socket/definition.json) -
       Network socket object describes a local or remote network
       connections based on the socket data structure.
-
    *  objects/news-agency (https://github.com/MISP/misp-
       objects/blob/main/objects/news-agency/definition.json) - News
       agencies compile news and disseminate news in bulk.
-
    *  objects/news-media (https://github.com/MISP/misp-
       objects/blob/main/objects/news-media/definition.json) - News media
       are forms of mass media delivering news to the general public.
-
+   *  objects/open-data-security (https://github.com/MISP/misp-
+      objects/blob/main/objects/open-data-security/definition.json) - An
+      object describing an open dataset available and described under
+      the open data security model. ref. https://github.com/CIRCL/open-
+      data-security (https://github.com/CIRCL/open-data-security).
    *  objects/organization (https://github.com/MISP/misp-
       objects/blob/main/objects/organization/definition.json) - An
       object which describes an organization.
-
-
-
-
-Dulaunoy & Iklody          Expires 25 May 2022                 [Page 23]
-
-Internet-Draft         MISP object template format         November 2021
-
-
    *  objects/original-imported-file (https://github.com/MISP/misp-
       objects/blob/main/objects/original-imported-file/definition.json)
       - Object describing the original file used to import data in MISP.
-
+   *  objects/paloalto-threat-event (https://github.com/MISP/misp-
+      objects/blob/main/objects/paloalto-threat-event/definition.json) -
+      Palo Alto Threat Log Event.
    *  objects/parler-account (https://github.com/MISP/misp-
       objects/blob/main/objects/parler-account/definition.json) - Parler
       account.
-
    *  objects/parler-comment (https://github.com/MISP/misp-
       objects/blob/main/objects/parler-comment/definition.json) - Parler
       comment.
-
    *  objects/parler-post (https://github.com/MISP/misp-
       objects/blob/main/objects/parler-post/definition.json) - Parler
       post (parley).
 
+
+
+
+
+
+
+Dulaunoy & Iklody        Expires 19 August 2022                [Page 22]
+
+Internet-Draft         MISP object template format         February 2022
+
+
    *  objects/passive-dns (https://github.com/MISP/misp-
       objects/blob/main/objects/passive-dns/definition.json) - Passive
       DNS records as expressed in draft-dulaunoy-dnsop-passive-dns-cof-
-      01.
-
+      07.  See https://tools.ietf.org/id/draft-dulaunoy-dnsop-passive-
+      dns-cof-07.html (https://tools.ietf.org/id/draft-dulaunoy-dnsop-
+      passive-dns-cof-07.html).
+   *  objects/passive-dns-dnsdbflex (https://github.com/MISP/misp-
+      objects/blob/main/objects/passive-dns-dnsdbflex/definition.json) -
+      DNSDBFLEX object.  This object is used at farsight security.
+      Roughly based on Passive DNS records as expressed in draft-
+      dulaunoy-dnsop-passive-dns-cof-07.  See https://tools.ietf.org/id/
+      draft-dulaunoy-dnsop-passive-dns-cof-07.html
+      (https://tools.ietf.org/id/draft-dulaunoy-dnsop-passive-dns-cof-
+      07.html).
+   *  objects/passive-ssh (https://github.com/MISP/misp-
+      objects/blob/main/objects/passive-ssh/definition.json) - Passive-
+      ssh object as described on passive-ssh services from circl.lu -
+      https://github.com/D4-project/passive-ssh (https://github.com/D4-
+      project/passive-ssh).
    *  objects/paste (https://github.com/MISP/misp-
       objects/blob/main/objects/paste/definition.json) - Paste or
       similar post from a website allowing to share privately or
       publicly posts.
-
    *  objects/pcap-metadata (https://github.com/MISP/misp-
       objects/blob/main/objects/pcap-metadata/definition.json) - Network
       packet capture metadata.
-
    *  objects/pe (https://github.com/MISP/misp-
       objects/blob/main/objects/pe/definition.json) - Object describing
       a Portable Executable.
-
    *  objects/pe-section (https://github.com/MISP/misp-
       objects/blob/main/objects/pe-section/definition.json) - Object
       describing a section of a Portable Executable.
-
    *  objects/person (https://github.com/MISP/misp-
       objects/blob/main/objects/person/definition.json) - An object
       which describes a person or an identity.
-
    *  objects/pgp-meta (https://github.com/MISP/misp-
       objects/blob/main/objects/pgp-meta/definition.json) - Metadata
       extracted from a PGP keyblock, message or signature.
-
-
-
-
-
-
-Dulaunoy & Iklody          Expires 25 May 2022                 [Page 24]
-
-Internet-Draft         MISP object template format         November 2021
-
-
    *  objects/phishing (https://github.com/MISP/misp-
       objects/blob/main/objects/phishing/definition.json) - Phishing
       template to describe a phishing website and its analysis.
-
    *  objects/phishing-kit (https://github.com/MISP/misp-
       objects/blob/main/objects/phishing-kit/definition.json) - Object
       to describe a phishing-kit.
-
    *  objects/phone (https://github.com/MISP/misp-
       objects/blob/main/objects/phone/definition.json) - A phone or
       mobile phone object which describe a phone.
 
+
+
+
+Dulaunoy & Iklody        Expires 19 August 2022                [Page 23]
+
+Internet-Draft         MISP object template format         February 2022
+
+
+   *  objects/postal-address (https://github.com/MISP/misp-
+      objects/blob/main/objects/postal-address/definition.json) - A
+      postal address.
+   *  objects/probabilistic-data-structure (https://github.com/MISP/
+      misp-objects/blob/main/objects/probabilistic-data-structure/
+      definition.json) - Probabilistic data structure object describe a
+      space-efficient data structure such as Bloom filter or similar
+      structure.
    *  objects/process (https://github.com/MISP/misp-
       objects/blob/main/objects/process/definition.json) - Object
       describing a system process.
-
    *  objects/publication (https://github.com/MISP/misp-
       objects/blob/main/objects/publication/definition.json) - An object
       to describe a book, journal, or academic publication.
-
    *  objects/python-etvx-event-log (https://github.com/MISP/misp-
       objects/blob/main/objects/python-etvx-event-log/definition.json) -
       Event log object template to share information of the activities
       conducted on a system. .
-
    *  objects/r2graphity (https://github.com/MISP/misp-
       objects/blob/main/objects/r2graphity/definition.json) - Indicators
       extracted from files using radare2 and graphml.
-
    *  objects/reddit-account (https://github.com/MISP/misp-
       objects/blob/main/objects/reddit-account/definition.json) - Reddit
       account.
-
    *  objects/reddit-comment (https://github.com/MISP/misp-
       objects/blob/main/objects/reddit-comment/definition.json) - A
       Reddit post comment.
-
    *  objects/reddit-post (https://github.com/MISP/misp-
       objects/blob/main/objects/reddit-post/definition.json) - A Reddit
       post.
-
    *  objects/reddit-subreddit (https://github.com/MISP/misp-
       objects/blob/main/objects/reddit-subreddit/definition.json) -
       Public or private subreddit.
-
-
-
-
-
-
-
-Dulaunoy & Iklody          Expires 25 May 2022                 [Page 25]
-
-Internet-Draft         MISP object template format         November 2021
-
-
    *  objects/regexp (https://github.com/MISP/misp-
       objects/blob/main/objects/regexp/definition.json) - An object
       describing a regular expression (regex or regexp).  The object can
       be linked via a relationship to other attributes or objects to
       describe how it can be represented as a regular expression.
-
    *  objects/registry-key (https://github.com/MISP/misp-
       objects/blob/main/objects/registry-key/definition.json) - Registry
       key object describing a Windows registry key with value and last-
       modified timestamp.
-
    *  objects/regripper-NTUser (https://github.com/MISP/misp-
       objects/blob/main/objects/regripper-NTUser/definition.json) -
       Regripper Object template designed to present user specific
       configuration details extracted from the NTUSER.dat hive.
 
+
+
+
+
+Dulaunoy & Iklody        Expires 19 August 2022                [Page 24]
+
+Internet-Draft         MISP object template format         February 2022
+
+
    *  objects/regripper-sam-hive-single-user (https://github.com/MISP/
       misp-objects/blob/main/objects/regripper-sam-hive-single-user/
       definition.json) - Regripper Object template designed to present
       user profile details extracted from the SAM hive.
-
    *  objects/regripper-sam-hive-user-group (https://github.com/MISP/
       misp-objects/blob/main/objects/regripper-sam-hive-user-group/
       definition.json) - Regripper Object template designed to present
       group profile details extracted from the SAM hive.
-
    *  objects/regripper-software-hive-BHO (https://github.com/MISP/misp-
       objects/blob/main/objects/regripper-software-hive-BHO/
       definition.json) - Regripper Object template designed to gather
       information of the browser helper objects installed on the system.
-
    *  objects/regripper-software-hive-appInit-DLLS
       (https://github.com/MISP/misp-objects/blob/main/objects/regripper-
       software-hive-appInit-DLLS/definition.json) - Regripper Object
       template designed to gather information of the DLL files installed
       on the system.
-
    *  objects/regripper-software-hive-application-paths
       (https://github.com/MISP/misp-objects/blob/main/objects/regripper-
       software-hive-application-paths/definition.json) - Regripper
       Object template designed to gather information of the application
       paths.
-
    *  objects/regripper-software-hive-applications-installed
       (https://github.com/MISP/misp-objects/blob/main/objects/regripper-
       software-hive-applications-installed/definition.json) - Regripper
       Object template designed to gather information of the applications
       installed on the system.
-
-
-
-Dulaunoy & Iklody          Expires 25 May 2022                 [Page 26]
-
-Internet-Draft         MISP object template format         November 2021
-
-
    *  objects/regripper-software-hive-command-shell
       (https://github.com/MISP/misp-objects/blob/main/objects/regripper-
       software-hive-command-shell/definition.json) - Regripper Object
       template designed to gather information of the shell commands
       executed on the system.
-
    *  objects/regripper-software-hive-software-run
       (https://github.com/MISP/misp-objects/blob/main/objects/regripper-
       software-hive-software-run/definition.json) - Regripper Object
       template designed to gather information of the applications set to
       run on the system.
-
    *  objects/regripper-software-hive-userprofile-winlogon
       (https://github.com/MISP/misp-objects/blob/main/objects/regripper-
       software-hive-userprofile-winlogon/definition.json) - Regripper
       Object template designed to gather user profile information when
       the user logs onto the system, gathered from the software hive.
-
    *  objects/regripper-software-hive-windows-general-info
       (https://github.com/MISP/misp-objects/blob/main/objects/regripper-
       software-hive-windows-general-info/definition.json) - Regripper
       Object template designed to gather general windows information
       extracted from the software-hive.
 
+
+
+
+Dulaunoy & Iklody        Expires 19 August 2022                [Page 25]
+
+Internet-Draft         MISP object template format         February 2022
+
+
    *  objects/regripper-system-hive-firewall-configuration
       (https://github.com/MISP/misp-objects/blob/main/objects/regripper-
       system-hive-firewall-configuration/definition.json) - Regripper
       Object template designed to present firewall configuration
       information extracted from the system-hive.
-
    *  objects/regripper-system-hive-general-configuration
       (https://github.com/MISP/misp-objects/blob/main/objects/regripper-
       system-hive-general-configuration/definition.json) - Regripper
       Object template designed to present general system properties
       extracted from the system-hive.
-
    *  objects/regripper-system-hive-network-information
       (https://github.com/MISP/misp-objects/blob/main/objects/regripper-
       system-hive-network-information/definition.json) - Regripper
       object template designed to gather network information from the
       system-hive.
-
    *  objects/regripper-system-hive-services-drivers
       (https://github.com/MISP/misp-objects/blob/main/objects/regripper-
       system-hive-services-drivers/definition.json) - Regripper Object
       template designed to gather information regarding the services/
       drivers from the system-hive.
-
-
-
-
-Dulaunoy & Iklody          Expires 25 May 2022                 [Page 27]
-
-Internet-Draft         MISP object template format         November 2021
-
-
    *  objects/report (https://github.com/MISP/misp-
       objects/blob/main/objects/report/definition.json) - Metadata used
       to generate an executive level report.
-
    *  objects/research-scanner (https://github.com/MISP/misp-
       objects/blob/main/objects/research-scanner/definition.json) -
       Information related to known scanning activity (e.g. from research
       projects).
-
    *  objects/rogue-dns (https://github.com/MISP/misp-
       objects/blob/main/objects/rogue-dns/definition.json) - Rogue DNS
       as defined by CERT.br.
-
    *  objects/rtir (https://github.com/MISP/misp-
       objects/blob/main/objects/rtir/definition.json) - RTIR - Request
       Tracker for Incident Response.
-
    *  objects/sandbox-report (https://github.com/MISP/misp-
       objects/blob/main/objects/sandbox-report/definition.json) -
       Sandbox report.
-
    *  objects/sb-signature (https://github.com/MISP/misp-
       objects/blob/main/objects/sb-signature/definition.json) - Sandbox
       detection signature.
-
    *  objects/scheduled-event (https://github.com/MISP/misp-
       objects/blob/main/objects/scheduled-event/definition.json) - Event
       object template describing a gathering of individuals in
       meatspace.
-
    *  objects/scrippsco2-c13-daily (https://github.com/MISP/misp-
       objects/blob/main/objects/scrippsco2-c13-daily/definition.json) -
       Daily average C13 concentrations (ppm) derived from flask air
       samples.
 
+
+
+
+Dulaunoy & Iklody        Expires 19 August 2022                [Page 26]
+
+Internet-Draft         MISP object template format         February 2022
+
+
    *  objects/scrippsco2-c13-monthly (https://github.com/MISP/misp-
       objects/blob/main/objects/scrippsco2-c13-monthly/definition.json)
       - Monthly average C13 concentrations (ppm) derived from flask air
       samples.
-
    *  objects/scrippsco2-co2-daily (https://github.com/MISP/misp-
       objects/blob/main/objects/scrippsco2-co2-daily/definition.json) -
       Daily average CO2 concentrations (ppm) derived from flask air
       samples.
-
-
-
-
-
-
-
-Dulaunoy & Iklody          Expires 25 May 2022                 [Page 28]
-
-Internet-Draft         MISP object template format         November 2021
-
-
    *  objects/scrippsco2-co2-monthly (https://github.com/MISP/misp-
       objects/blob/main/objects/scrippsco2-co2-monthly/definition.json)
       - Monthly average CO2 concentrations (ppm) derived from flask air
       samples.
-
    *  objects/scrippsco2-o18-daily (https://github.com/MISP/misp-
       objects/blob/main/objects/scrippsco2-o18-daily/definition.json) -
       Daily average O18 concentrations (ppm) derived from flask air
       samples.
-
    *  objects/scrippsco2-o18-monthly (https://github.com/MISP/misp-
       objects/blob/main/objects/scrippsco2-o18-monthly/definition.json)
       - Monthly average O18 concentrations (ppm) derived from flask air
       samples.
-
    *  objects/script (https://github.com/MISP/misp-
       objects/blob/main/objects/script/definition.json) - Object
       describing a computer program written to be run in a special run-
       time environment.  The script or shell script can be used for
       malicious activities but also as support tools for threat
       analysts.
-
+   *  objects/security-playbook (https://github.com/MISP/misp-
+      objects/blob/main/objects/security-playbook/definition.json) - An
+      object to manage, represent, and share course of action playbooks
+      (security playbooks) for cyberspace defense.
    *  objects/shell-commands (https://github.com/MISP/misp-
       objects/blob/main/objects/shell-commands/definition.json) - Object
       describing a series of shell commands executed.  This object can
       be linked with malicious files in order to describe a specific
       execution of shell commands.
-
    *  objects/shodan-report (https://github.com/MISP/misp-
       objects/blob/main/objects/shodan-report/definition.json) - Shodan
       Report for a given IP.
-
    *  objects/short-message-service (https://github.com/MISP/misp-
       objects/blob/main/objects/short-message-service/definition.json) -
       Short Message Service (SMS) object template describing one or more
       SMS message.  Restriction of the initial format 3GPP 23.038 GSM
       character set doesn't apply.
-
    *  objects/shortened-link (https://github.com/MISP/misp-
       objects/blob/main/objects/shortened-link/definition.json) -
       Shortened link and its redirect target.
 
+
+
+
+
+Dulaunoy & Iklody        Expires 19 August 2022                [Page 27]
+
+Internet-Draft         MISP object template format         February 2022
+
+
    *  objects/social-media-group (https://github.com/MISP/misp-
       objects/blob/main/objects/social-media-group/definition.json) -
       Social media group object template describing a public or private
       group or channel.
-
-
-
-
-
-Dulaunoy & Iklody          Expires 25 May 2022                 [Page 29]
-
-Internet-Draft         MISP object template format         November 2021
-
-
+   *  objects/software (https://github.com/MISP/misp-
+      objects/blob/main/objects/software/definition.json) - The Software
+      object represents high-level properties associated with software,
+      including software products.  STIX 2.1 - 6.14.
    *  objects/splunk (https://github.com/MISP/misp-
       objects/blob/main/objects/splunk/definition.json) - Splunk /
       Splunk ES object.
-
    *  objects/ss7-attack (https://github.com/MISP/misp-
       objects/blob/main/objects/ss7-attack/definition.json) - SS7 object
-      of an attack seen on a GSM, UMTS or LTE network via SS7 logging.
-
+      of an attack as seen on the SS7 signaling protocol supporting
+      GSM/GPRS/UMTS networks.
    *  objects/ssh-authorized-keys (https://github.com/MISP/misp-
       objects/blob/main/objects/ssh-authorized-keys/definition.json) -
       An object to store ssh authorized keys file.
-
    *  objects/stix2-pattern (https://github.com/MISP/misp-
       objects/blob/main/objects/stix2-pattern/definition.json) - An
       object describing a STIX pattern.  The object can be linked via a
       relationship to other attributes or objects to describe how it can
       be represented as a STIX pattern.
-
+   *  objects/submarine (https://github.com/MISP/misp-
+      objects/blob/main/objects/submarine/definition.json) - Submarine
+      description.
    *  objects/suricata (https://github.com/MISP/misp-
       objects/blob/main/objects/suricata/definition.json) - An object
       describing one or more Suricata rule(s) along with version and
       contextual information.
-
    *  objects/target-system (https://github.com/MISP/misp-
       objects/blob/main/objects/target-system/definition.json) -
       Description about an targeted system, this could potentially be a
       compromissed internal system.
-
+   *  objects/telegram-account (https://github.com/MISP/misp-
+      objects/blob/main/objects/telegram-account/definition.json) -
+      Information related to a telegram account.
+   *  objects/temporal-event (https://github.com/MISP/misp-
+      objects/blob/main/objects/temporal-event/definition.json) - A
+      temporal event consists of some temporal and spacial boundaries.
+      Spacial boundaries can be physical, virtual or hybrid.
    *  objects/threatgrid-report (https://github.com/MISP/misp-
       objects/blob/main/objects/threatgrid-report/definition.json) -
       ThreatGrid report.
-
    *  objects/timecode (https://github.com/MISP/misp-
       objects/blob/main/objects/timecode/definition.json) - Timecode
       object to describe a start of video sequence (e.g.  CCTV evidence)
       and the end of the video sequence.
 
+
+
+Dulaunoy & Iklody        Expires 19 August 2022                [Page 28]
+
+Internet-Draft         MISP object template format         February 2022
+
+
    *  objects/timesketch-timeline (https://github.com/MISP/misp-
       objects/blob/main/objects/timesketch-timeline/definition.json) - A
       timesketch timeline object based on mandatory field in timesketch
       to describe a log entry.
-
    *  objects/timesketch_message (https://github.com/MISP/misp-
       objects/blob/main/objects/timesketch_message/definition.json) - A
       timesketch message entry.
-
-
-
-
-
-
-Dulaunoy & Iklody          Expires 25 May 2022                 [Page 30]
-
-Internet-Draft         MISP object template format         November 2021
-
-
    *  objects/timestamp (https://github.com/MISP/misp-
       objects/blob/main/objects/timestamp/definition.json) - A generic
       timestamp object to represent time including first time and last
       time seen.  Relationship will then define the kind of time
       relationship.
-
    *  objects/tor-hiddenservice (https://github.com/MISP/misp-
       objects/blob/main/objects/tor-hiddenservice/definition.json) - Tor
       hidden service (onion service) object.
-
    *  objects/tor-node (https://github.com/MISP/misp-
       objects/blob/main/objects/tor-node/definition.json) - Tor node
       (which protects your privacy on the internet by hiding the
       connection between users Internet address and the services used by
       the users) description which are part of the Tor network at a
       time.
-
    *  objects/tracking-id (https://github.com/MISP/misp-
       objects/blob/main/objects/tracking-id/definition.json) - Analytics
       and tracking ID such as used in Google Analytics or other analytic
       platform.
-
    *  objects/transaction (https://github.com/MISP/misp-
       objects/blob/main/objects/transaction/definition.json) - An object
       to describe a financial transaction.
-
    *  objects/translation (https://github.com/MISP/misp-
       objects/blob/main/objects/translation/definition.json) - Used to
       keep a text and its translation.
-
    *  objects/trustar_report (https://github.com/MISP/misp-
       objects/blob/main/objects/trustar_report/definition.json) -
       TruStar Report.
-
    *  objects/tsk-chats (https://github.com/MISP/misp-
       objects/blob/main/objects/tsk-chats/definition.json) - An Object
       Template to gather information from evidential or interesting
       exchange of messages identified during a digital forensic
       investigation.
-
    *  objects/tsk-web-bookmark (https://github.com/MISP/misp-
       objects/blob/main/objects/tsk-web-bookmark/definition.json) - An
       Object Template to add evidential bookmarks identified during a
       digital forensic investigation.
-
-
-
-
-
-
-
-Dulaunoy & Iklody          Expires 25 May 2022                 [Page 31]
-
-Internet-Draft         MISP object template format         November 2021
-
-
    *  objects/tsk-web-cookie (https://github.com/MISP/misp-
       objects/blob/main/objects/tsk-web-cookie/definition.json) - An
       TSK-Autopsy Object Template to represent cookies identified during
       a forensic investigation.
 
+
+
+
+Dulaunoy & Iklody        Expires 19 August 2022                [Page 29]
+
+Internet-Draft         MISP object template format         February 2022
+
+
    *  objects/tsk-web-downloads (https://github.com/MISP/misp-
       objects/blob/main/objects/tsk-web-downloads/definition.json) - An
       Object Template to add web-downloads.
-
    *  objects/tsk-web-history (https://github.com/MISP/misp-
       objects/blob/main/objects/tsk-web-history/definition.json) - An
       Object Template to share web history information.
-
    *  objects/tsk-web-search-query (https://github.com/MISP/misp-
       objects/blob/main/objects/tsk-web-search-query/definition.json) -
       An Object Template to share web search query information.
-
    *  objects/twitter-account (https://github.com/MISP/misp-
       objects/blob/main/objects/twitter-account/definition.json) -
       Twitter account.
-
    *  objects/twitter-list (https://github.com/MISP/misp-
       objects/blob/main/objects/twitter-list/definition.json) - Twitter
       list.
-
    *  objects/twitter-post (https://github.com/MISP/misp-
       objects/blob/main/objects/twitter-post/definition.json) - Twitter
       post (tweet).
-
    *  objects/url (https://github.com/MISP/misp-
       objects/blob/main/objects/url/definition.json) - url object
       describes an url along with its normalized field (like extracted
       using faup parsing library) and its metadata.
-
    *  objects/user-account (https://github.com/MISP/misp-
-      objects/blob/main/objects/user-account/definition.json) - .
-
+      objects/blob/main/objects/user-account/definition.json) - User-
+      account object, defining aspects of user identification,
+      authentication, privileges and other relevant data points.
    *  objects/vehicle (https://github.com/MISP/misp-
       objects/blob/main/objects/vehicle/definition.json) - Vehicle
       object template to describe a vehicle information and
       registration.
-
    *  objects/victim (https://github.com/MISP/misp-
       objects/blob/main/objects/victim/definition.json) - Victim object
       describes the target of an attack or abuse.
-
-
-
-
-
-
-Dulaunoy & Iklody          Expires 25 May 2022                 [Page 32]
-
-Internet-Draft         MISP object template format         November 2021
-
-
    *  objects/virustotal-graph (https://github.com/MISP/misp-
       objects/blob/main/objects/virustotal-graph/definition.json) -
       VirusTotal graph.
-
    *  objects/virustotal-report (https://github.com/MISP/misp-
       objects/blob/main/objects/virustotal-report/definition.json) -
       VirusTotal report.
-
    *  objects/vulnerability (https://github.com/MISP/misp-
       objects/blob/main/objects/vulnerability/definition.json) -
       Vulnerability object describing a common vulnerability enumeration
       which can describe published, unpublished, under review or embargo
       vulnerability for software, equipments or hardware.
 
+
+
+
+
+
+
+Dulaunoy & Iklody        Expires 19 August 2022                [Page 30]
+
+Internet-Draft         MISP object template format         February 2022
+
+
    *  objects/weakness (https://github.com/MISP/misp-
       objects/blob/main/objects/weakness/definition.json) - Weakness
       object describing a common weakness enumeration which can describe
       usable, incomplete, draft or deprecated weakness for software,
       equipment of hardware.
-
    *  objects/whois (https://github.com/MISP/misp-
       objects/blob/main/objects/whois/definition.json) - Whois records
       information for a domain name or an IP address.
-
+   *  objects/windows-service (https://github.com/MISP/misp-
+      objects/blob/main/objects/windows-service/definition.json) -
+      Windows service and detailed about a service running a Windows
+      operating system.
    *  objects/x509 (https://github.com/MISP/misp-
       objects/blob/main/objects/x509/definition.json) - x509 object
       describing a X.509 certificate.
-
    *  objects/yabin (https://github.com/MISP/misp-
       objects/blob/main/objects/yabin/definition.json) - yabin.py
       generates Yara rules from function prologs, for matching and
       hunting binaries. ref: https://github.com/AlienVault-OTX/yabin
       (https://github.com/AlienVault-OTX/yabin).
-
    *  objects/yara (https://github.com/MISP/misp-
       objects/blob/main/objects/yara/definition.json) - An object
       describing a YARA rule (or a YARA rule name) along with its
       version.
-
    *  objects/youtube-channel (https://github.com/MISP/misp-
       objects/blob/main/objects/youtube-channel/definition.json) - A
       YouTube channel.
-
    *  objects/youtube-comment (https://github.com/MISP/misp-
       objects/blob/main/objects/youtube-comment/definition.json) - A
       YouTube video comment.
-
-
-
-
-
-Dulaunoy & Iklody          Expires 25 May 2022                 [Page 33]
-
-Internet-Draft         MISP object template format         November 2021
-
-
    *  objects/youtube-playlist (https://github.com/MISP/misp-
       objects/blob/main/objects/youtube-playlist/definition.json) - A
       YouTube playlist.
-
    *  objects/youtube-video (https://github.com/MISP/misp-
       objects/blob/main/objects/youtube-video/definition.json) - A
       YouTube video.
@@ -1870,6 +1731,13 @@ Internet-Draft         MISP object template format         November 2021
               DOI 10.17487/RFC2119, March 1997,
               <https://www.rfc-editor.org/info/rfc2119>.
 
+
+
+Dulaunoy & Iklody        Expires 19 August 2022                [Page 31]
+
+Internet-Draft         MISP object template format         February 2022
+
+
    [RFC4122]  Leach, P., Mealling, M., and R. Salz, "A Universally
               Unique IDentifier (UUID) URN Namespace", RFC 4122,
               DOI 10.17487/RFC4122, July 2005,
@@ -1898,14 +1766,6 @@ Authors' Addresses
    Luxembourg
 
    Phone: +352 247 88444
-
-
-
-Dulaunoy & Iklody          Expires 25 May 2022                 [Page 34]
-
-Internet-Draft         MISP object template format         November 2021
-
-
    Email: alexandre.dulaunoy@circl.lu
 
 
@@ -1929,32 +1789,4 @@ Internet-Draft         MISP object template format         November 2021
 
 
 
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-Dulaunoy & Iklody          Expires 25 May 2022                 [Page 35]
+Dulaunoy & Iklody        Expires 19 August 2022                [Page 32]