From e65b6bb788fabc4e8406e5937859f87e63a3433d Mon Sep 17 00:00:00 2001 From: Alexandre Dulaunoy Date: Sun, 21 Nov 2021 16:37:56 +0100 Subject: [PATCH] chg: [rfc] updated to the latest version --- rfc/misp-standard-core.html | 4649 +++++++++++------ rfc/misp-standard-core.txt | 1212 ++--- rfc/misp-standard-galaxy-format.html | 2217 +++++--- rfc/misp-standard-galaxy-format.txt | 234 +- rfc/misp-standard-object-template-format.html | 3226 +++++++++--- rfc/misp-standard-object-template-format.txt | 1606 ++++-- rfc/misp-standard-taxonomy-format.html | 2871 ++++++---- rfc/misp-standard-taxonomy-format.txt | 852 ++- 8 files changed, 11350 insertions(+), 5517 deletions(-) diff --git a/rfc/misp-standard-core.html b/rfc/misp-standard-core.html index 33c49a8..747ba01 100644 --- a/rfc/misp-standard-core.html +++ b/rfc/misp-standard-core.html @@ -1,781 +1,1775 @@ - + + + + + + +MISP core format + + + + + + + + + +*/ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - +/* fonts */ +@import url('https://fonts.googleapis.com/css?family=Noto+Sans'); /* Sans-serif */ +@import url('https://fonts.googleapis.com/css?family=Noto+Serif'); /* Serif (print) */ +@import url('https://fonts.googleapis.com/css?family=Roboto+Mono'); /* Monospace */ + +@viewport { + zoom: 1.0; + width: extend-to-zoom; +} +@-ms-viewport { + width: extend-to-zoom; + zoom: 1.0; +} +/* general and mobile first */ +html { +} +body { + max-width: 90%; + margin: 1.5em auto; + color: #222; + background-color: #fff; + font-size: 14px; + font-family: 'Noto Sans', Arial, Helvetica, sans-serif; + line-height: 1.6; + scroll-behavior: smooth; +} +.ears { + display: none; +} + +/* headings */ +#title, h1, h2, h3, h4, h5, h6 { + margin: 1em 0 0.5em; + font-weight: bold; + line-height: 1.3; +} +#title { + clear: both; + border-bottom: 1px solid #ddd; + margin: 0 0 0.5em 0; + padding: 1em 0 0.5em; +} +.author { + padding-bottom: 4px; +} +h1 { + font-size: 26px; + margin: 1em 0; +} +h2 { + font-size: 22px; + margin-top: -20px; /* provide offset for in-page anchors */ + padding-top: 33px; +} +h3 { + font-size: 18px; + margin-top: -36px; /* provide offset for in-page anchors */ + padding-top: 42px; +} +h4 { + font-size: 16px; + margin-top: -36px; /* provide offset for in-page anchors */ + padding-top: 42px; +} +h5, h6 { + font-size: 14px; +} +#n-copyright-notice { + border-bottom: 1px solid #ddd; + padding-bottom: 1em; + margin-bottom: 1em; +} +/* general structure */ +p { + padding: 0; + margin: 0 0 1em 0; + text-align: left; +} +div, span { + position: relative; +} +div { + margin: 0; +} +.alignRight.art-text { + background-color: #f9f9f9; + border: 1px solid #eee; + border-radius: 3px; + padding: 1em 1em 0; + margin-bottom: 1.5em; +} +.alignRight.art-text pre { + padding: 0; +} +.alignRight { + margin: 1em 0; +} +.alignRight > *:first-child { + border: none; + margin: 0; + float: right; + clear: both; +} +.alignRight > *:nth-child(2) { + clear: both; + display: block; + border: none; +} +svg { + display: block; +} +.alignCenter.art-text { + background-color: #f9f9f9; + border: 1px solid #eee; + border-radius: 3px; + padding: 1em 1em 0; + margin-bottom: 1.5em; +} +.alignCenter.art-text pre { + padding: 0; +} +.alignCenter { + margin: 1em 0; +} +.alignCenter > *:first-child { + border: none; + /* this isn't optimal, but it's an existence proof. PrinceXML doesn't + support flexbox yet. + */ + display: table; + margin: 0 auto; +} + +/* lists */ +ol, ul { + padding: 0; + margin: 0 0 1em 2em; +} +ol ol, ul ul, ol ul, ul ol { + margin-left: 1em; +} +li { + margin: 0 0 0.25em 0; +} +.ulCompact li { + margin: 0; +} +ul.empty, .ulEmpty { + list-style-type: none; +} +ul.empty li, .ulEmpty li { + margin-top: 0.5em; +} +ul.ulBare, li.ulBare { + margin-left: 0em !important; +} +ul.compact, .ulCompact, +ol.compact, .olCompact { + line-height: 100%; + margin: 0 0 0 2em; +} + +/* definition lists */ +dl { +} +dl > dt { + float: left; + margin-right: 1em; +} +/* +dl.nohang > dt { + float: none; +} +*/ +dl > dd { + margin-bottom: .8em; + min-height: 1.3em; +} +dl.compact > dd, .dlCompact > dd { + margin-bottom: 0em; +} +dl > dd > dl { + margin-top: 0.5em; + margin-bottom: 0em; +} + +/* links */ +a { + text-decoration: none; +} +a[href] { + color: #22e; /* Arlen: WCAG 2019 */ +} +a[href]:hover { + background-color: #f2f2f2; +} +figcaption a[href], +a[href].selfRef { + color: #222; +} +/* XXX probably not this: +a.selfRef:hover { + background-color: transparent; + cursor: default; +} */ + +/* Figures */ +tt, code, pre, code { + background-color: #f9f9f9; + font-family: 'Roboto Mono', monospace; +} +pre { + border: 1px solid #eee; + margin: 0; + padding: 1em; +} +img { + max-width: 100%; +} +figure { + margin: 0; +} +figure blockquote { + margin: 0.8em 0.4em 0.4em; +} +figcaption { + font-style: italic; + margin: 0 0 1em 0; +} +@media screen { + pre { + overflow-x: auto; + max-width: 100%; + max-width: calc(100% - 22px); + } +} + +/* aside, blockquote */ +aside, blockquote { + margin-left: 0; + padding: 1.2em 2em; +} +blockquote { + background-color: #f9f9f9; + color: #111; /* Arlen: WCAG 2019 */ + border: 1px solid #ddd; + border-radius: 3px; + margin: 1em 0; +} +cite { + display: block; + text-align: right; + font-style: italic; +} + +/* tables */ +table { + width: 100%; + margin: 0 0 1em; + border-collapse: collapse; + border: 1px solid #eee; +} +th, td { + text-align: left; + vertical-align: top; + padding: 0.5em 0.75em; +} +th { + text-align: left; + background-color: #e9e9e9; +} +tr:nth-child(2n+1) > td { + background-color: #f5f5f5; +} +table caption { + font-style: italic; + margin: 0; + padding: 0; + text-align: left; +} +table p { + /* XXX to avoid bottom margin on table row signifiers. If paragraphs should + be allowed within tables more generally, it would be far better to select on a class. */ + margin: 0; +} + +/* pilcrow */ +a.pilcrow { + color: #666; /* Arlen: AHDJ 2019 */ + text-decoration: none; + visibility: hidden; + user-select: none; + -ms-user-select: none; + -o-user-select:none; + -moz-user-select: none; + -khtml-user-select: none; + -webkit-user-select: none; + -webkit-touch-callout: none; +} +@media screen { + aside:hover > a.pilcrow, + p:hover > a.pilcrow, + blockquote:hover > a.pilcrow, + div:hover > a.pilcrow, + li:hover > a.pilcrow, + pre:hover > a.pilcrow { + visibility: visible; + } + a.pilcrow:hover { + background-color: transparent; + } +} + +/* misc */ +hr { + border: 0; + border-top: 1px solid #eee; +} +.bcp14 { + font-variant: small-caps; +} + +.role { + font-variant: all-small-caps; +} + +/* info block */ +#identifiers { + margin: 0; + font-size: 0.9em; +} +#identifiers dt { + width: 3em; + clear: left; +} +#identifiers dd { + float: left; + margin-bottom: 0; +} +#identifiers .authors .author { + display: inline-block; + margin-right: 1.5em; +} +#identifiers .authors .org { + font-style: italic; +} + +/* The prepared/rendered info at the very bottom of the page */ +.docInfo { + color: #666; /* Arlen: WCAG 2019 */ + font-size: 0.9em; + font-style: italic; + margin-top: 2em; +} +.docInfo .prepared { + float: left; +} +.docInfo .prepared { + float: right; +} + +/* table of contents */ +#toc { + padding: 0.75em 0 2em 0; + margin-bottom: 1em; +} +nav.toc ul { + margin: 0 0.5em 0 0; + padding: 0; + list-style: none; +} +nav.toc li { + line-height: 1.3em; + margin: 0.75em 0; + padding-left: 1.2em; + text-indent: -1.2em; +} +/* references */ +.references dt { + text-align: right; + font-weight: bold; + min-width: 7em; +} +.references dd { + margin-left: 8em; + overflow: auto; +} + +.refInstance { + margin-bottom: 1.25em; +} + +.references .ascii { + margin-bottom: 0.25em; +} + +/* index */ +.index ul { + margin: 0 0 0 1em; + padding: 0; + list-style: none; +} +.index ul ul { + margin: 0; +} +.index li { + margin: 0; + text-indent: -2em; + padding-left: 2em; + padding-bottom: 5px; +} +.indexIndex { + margin: 0.5em 0 1em; +} +.index a { + font-weight: 700; +} +/* make the index two-column on all but the smallest screens */ +@media (min-width: 600px) { + .index ul { + -moz-column-count: 2; + -moz-column-gap: 20px; + } + .index ul ul { + -moz-column-count: 1; + -moz-column-gap: 0; + } +} + +/* authors */ +address.vcard { + font-style: normal; + margin: 1em 0; +} + +address.vcard .nameRole { + font-weight: 700; + margin-left: 0; +} +address.vcard .label { + font-family: "Noto Sans",Arial,Helvetica,sans-serif; + margin: 0.5em 0; +} +address.vcard .type { + display: none; +} +.alternative-contact { + margin: 1.5em 0 1em; +} +hr.addr { + border-top: 1px dashed; + margin: 0; + color: #ddd; + max-width: calc(100% - 16px); +} + +/* temporary notes */ +.rfcEditorRemove::before { + position: absolute; + top: 0.2em; + right: 0.2em; + padding: 0.2em; + content: "The RFC Editor will remove this note"; + color: #9e2a00; /* Arlen: WCAG 2019 */ + background-color: #ffd; /* Arlen: WCAG 2019 */ +} +.rfcEditorRemove { + position: relative; + padding-top: 1.8em; + background-color: #ffd; /* Arlen: WCAG 2019 */ + border-radius: 3px; +} +.cref { + background-color: #ffd; /* Arlen: WCAG 2019 */ + padding: 2px 4px; +} +.crefSource { + font-style: italic; +} +/* alternative layout for smaller screens */ +@media screen and (max-width: 1023px) { + body { + padding-top: 2em; + } + #title { + padding: 1em 0; + } + h1 { + font-size: 24px; + } + h2 { + font-size: 20px; + margin-top: -18px; /* provide offset for in-page anchors */ + padding-top: 38px; + } + #identifiers dd { + max-width: 60%; + } + #toc { + position: fixed; + z-index: 2; + top: 0; + right: 0; + padding: 0; + margin: 0; + background-color: inherit; + border-bottom: 1px solid #ccc; + } + #toc h2 { + margin: -1px 0 0 0; + padding: 4px 0 4px 6px; + padding-right: 1em; + min-width: 190px; + font-size: 1.1em; + text-align: right; + background-color: #444; + color: white; + cursor: pointer; + } + #toc h2::before { /* css hamburger */ + float: right; + position: relative; + width: 1em; + height: 1px; + left: -164px; + margin: 6px 0 0 0; + background: white none repeat scroll 0 0; + box-shadow: 0 4px 0 0 white, 0 8px 0 0 white; + content: ""; + } + #toc nav { + display: none; + padding: 0.5em 1em 1em; + overflow: auto; + height: calc(100vh - 48px); + border-left: 1px solid #ddd; + } +} + +/* alternative layout for wide screens */ +@media screen and (min-width: 1024px) { + body { + max-width: 724px; + margin: 42px auto; + padding-left: 1.5em; + padding-right: 29em; + } + #toc { + position: fixed; + top: 42px; + right: 42px; + width: 25%; + margin: 0; + padding: 0 1em; + z-index: 1; + } + #toc h2 { + border-top: none; + border-bottom: 1px solid #ddd; + font-size: 1em; + font-weight: normal; + margin: 0; + padding: 0.25em 1em 1em 0; + } + #toc nav { + display: block; + height: calc(90vh - 84px); + bottom: 0; + padding: 0.5em 0 0; + overflow: auto; + } + img { /* future proofing */ + max-width: 100%; + height: auto; + } +} + +/* pagination */ +@media print { + body { + + width: 100%; + } + p { + orphans: 3; + widows: 3; + } + #n-copyright-notice { + border-bottom: none; + } + #toc, #n-introduction { + page-break-before: always; + } + #toc { + border-top: none; + padding-top: 0; + } + figure, pre { + page-break-inside: avoid; + } + figure { + overflow: scroll; + } + h1, h2, h3, h4, h5, h6 { + page-break-after: avoid; + } + h2+*, h3+*, h4+*, h5+*, h6+* { + page-break-before: avoid; + } + pre { + white-space: pre-wrap; + word-wrap: break-word; + font-size: 10pt; + } + table { + border: 1px solid #ddd; + } + td { + border-top: 1px solid #ddd; + } +} + +/* This is commented out here, as the string-set: doesn't + pass W3C validation currently */ +/* +.ears thead .left { + string-set: ears-top-left content(); +} + +.ears thead .center { + string-set: ears-top-center content(); +} + +.ears thead .right { + string-set: ears-top-right content(); +} + +.ears tfoot .left { + string-set: ears-bottom-left content(); +} + +.ears tfoot .center { + string-set: ears-bottom-center content(); +} + +.ears tfoot .right { + string-set: ears-bottom-right content(); +} +*/ + +@page :first { + padding-top: 0; + @top-left { + content: normal; + border: none; + } + @top-center { + content: normal; + border: none; + } + @top-right { + content: normal; + border: none; + } +} + +@page { + size: A4; + margin-bottom: 45mm; + padding-top: 20px; + /* The follwing is commented out here, but set appropriately by in code, as + the content depends on the document */ + /* + @top-left { + content: 'Internet-Draft'; + vertical-align: bottom; + border-bottom: solid 1px #ccc; + } + @top-left { + content: string(ears-top-left); + vertical-align: bottom; + border-bottom: solid 1px #ccc; + } + @top-center { + content: string(ears-top-center); + vertical-align: bottom; + border-bottom: solid 1px #ccc; + } + @top-right { + content: string(ears-top-right); + vertical-align: bottom; + border-bottom: solid 1px #ccc; + } + @bottom-left { + content: string(ears-bottom-left); + vertical-align: top; + border-top: solid 1px #ccc; + } + @bottom-center { + content: string(ears-bottom-center); + vertical-align: top; + border-top: solid 1px #ccc; + } + @bottom-right { + content: '[Page ' counter(page) ']'; + vertical-align: top; + border-top: solid 1px #ccc; + } + */ + +} + +/* Changes introduced to fix issues found during implementation */ +/* Make sure links are clickable even if overlapped by following H* */ +a { + z-index: 2; +} +/* Separate body from document info even without intervening H1 */ +section { + clear: both; +} - - +/* Top align author divs, to avoid names without organization dropping level with org names */ +.author { + vertical-align: top; +} - - - - - +/* Leave room in document info to show Internet-Draft on one line */ +#identifiers dt { + width: 8em; +} +/* Don't waste quite as much whitespace between label and value in doc info */ +#identifiers dd { + margin-left: 1em; +} + +/* Give floating toc a background color (needed when it's a div inside section */ +#toc { + background-color: white; +} + +/* Make the collapsed ToC header render white on gray also when it's a link */ +@media screen and (max-width: 1023px) { + #toc h2 a, + #toc h2 a:link, + #toc h2 a:focus, + #toc h2 a:hover, + #toc a.toplink, + #toc a.toplink:hover { + color: white; + background-color: #444; + text-decoration: none; + } +} + +/* Give the bottom of the ToC some whitespace */ +@media screen and (min-width: 1024px) { + #toc { + padding: 0 0 1em 1em; + } +} + +/* Style section numbers with more space between number and title */ +.section-number { + padding-right: 0.5em; +} + +/* prevent monospace from becoming overly large */ +tt, code, pre, code { + font-size: 95%; +} + +/* Fix the height/width aspect for ascii art*/ +pre.sourcecode, +.art-text pre { + line-height: 1.12; +} + + +/* Add styling for a link in the ToC that points to the top of the document */ +a.toplink { + float: right; + margin-right: 0.5em; +} + +/* Fix the dl styling to match the RFC 7992 attributes */ +dl > dt, +dl.dlParallel > dt { + float: left; + margin-right: 1em; +} +dl.dlNewline > dt { + float: none; +} + +/* Provide styling for table cell text alignment */ +table td.text-left, +table th.text-left { + text-align: left; +} +table td.text-center, +table th.text-center { + text-align: center; +} +table td.text-right, +table th.text-right { + text-align: right; +} + +/* Make the alternative author contact informatio look less like just another + author, and group it closer with the primary author contact information */ +.alternative-contact { + margin: 0.5em 0 0.25em 0; +} +address .non-ascii { + margin: 0 0 0 2em; +} + +/* With it being possible to set tables with alignment + left, center, and right, { width: 100%; } does not make sense */ +table { + width: auto; +} + +/* Avoid reference text that sits in a block with very wide left margin, + because of a long floating dt label.*/ +.references dd { + overflow: visible; +} + +/* Control caption placement */ +caption { + caption-side: bottom; +} + +/* Limit the width of the author address vcard, so names in right-to-left + script don't end up on the other side of the page. */ + +address.vcard { + max-width: 30em; + margin-right: auto; +} + +/* For address alignment dependent on LTR or RTL scripts */ +address div.left { + text-align: left; +} +address div.right { + text-align: right; +} + +/* Provide table alignment support. We can't use the alignX classes above + since they do unwanted things with caption and other styling. */ +table.right { + margin-left: auto; + margin-right: 0; +} +table.center { + margin-left: auto; + margin-right: auto; +} +table.left { + margin-left: 0; + margin-right: auto; +} + +/* Give the table caption label the same styling as the figcaption */ +caption a[href] { + color: #222; +} + +@media print { + .toplink { + display: none; + } + + /* avoid overwriting the top border line with the ToC header */ + #toc { + padding-top: 1px; + } + + /* Avoid page breaks inside dl and author address entries */ + .vcard { + page-break-inside: avoid; + } + +} +/* Tweak the bcp14 keyword presentation */ +.bcp14 { + font-variant: small-caps; + font-weight: bold; + font-size: 0.9em; +} +/* Tweak the invisible space above H* in order not to overlay links in text above */ + h2 { + margin-top: -18px; /* provide offset for in-page anchors */ + padding-top: 31px; + } + h3 { + margin-top: -18px; /* provide offset for in-page anchors */ + padding-top: 24px; + } + h4 { + margin-top: -18px; /* provide offset for in-page anchors */ + padding-top: 24px; + } +/* Float artwork pilcrow to the right */ +@media screen { + .artwork a.pilcrow { + display: block; + line-height: 0.7; + margin-top: 0.15em; + } +} +/* Make pilcrows on dd visible */ +@media screen { + dd:hover > a.pilcrow { + visibility: visible; + } +} +/* Make the placement of figcaption match that of a table's caption + by removing the figure's added bottom margin */ +.alignLeft.art-text, +.alignCenter.art-text, +.alignRight.art-text { + margin-bottom: 0; +} +.alignLeft, +.alignCenter, +.alignRight { + margin: 1em 0 0 0; +} +/* In print, the pilcrow won't show on hover, so prevent it from taking up space, + possibly even requiring a new line */ +@media print { + a.pilcrow { + display: none; + } +} +/* Styling for the external metadata */ +div#external-metadata { + background-color: #eee; + padding: 0.5em; + margin-bottom: 0.5em; + display: none; +} +div#internal-metadata { + padding: 0.5em; /* to match the external-metadata padding */ +} +/* Styling for title RFC Number */ +h1#rfcnum { + clear: both; + margin: 0 0 -1em; + padding: 1em 0 0 0; +} +/* Make .olPercent look the same as
  1. */ +dl.olPercent > dd { + margin-bottom: 0.25em; + min-height: initial; +} +/* Give aside some styling to set it apart */ +aside { + border-left: 1px solid #ddd; + margin: 1em 0 1em 2em; + padding: 0.2em 2em; +} +aside > dl, +aside > ol, +aside > ul, +aside > table, +aside > p { + margin-bottom: 0.5em; +} +/* Additional page break settings */ +@media print { + figcaption, table caption { + page-break-before: avoid; + } +} +/* Font size adjustments for print */ +@media print { + body { font-size: 10pt; line-height: normal; max-width: 96%; } + h1 { font-size: 1.72em; padding-top: 1.5em; } /* 1*1.2*1.2*1.2 */ + h2 { font-size: 1.44em; padding-top: 1.5em; } /* 1*1.2*1.2 */ + h3 { font-size: 1.2em; padding-top: 1.5em; } /* 1*1.2 */ + h4 { font-size: 1em; padding-top: 1.5em; } + h5, h6 { font-size: 1em; margin: initial; padding: 0.5em 0 0.3em; } +} +/* Sourcecode margin in print, when there's no pilcrow */ +@media print { + .artwork, + .sourcecode { + margin-bottom: 1em; + } +} +/* Avoid narrow tables forcing too narrow table captions, which may render badly */ +table { + min-width: 20em; +} +/* ol type a */ +ol.type-a { list-style-type: lower-alpha; } +ol.type-A { list-style-type: upper-alpha; } +ol.type-i { list-style-type: lower-roman; } +ol.type-I { list-style-type: lower-roman; } +/* Apply the print table and row borders in general, on request from the RPC, +and increase the contrast between border and odd row background sligthtly */ +table { + border: 1px solid #ddd; +} +td { + border-top: 1px solid #ddd; +} +tr:nth-child(2n+1) > td { + background-color: #f8f8f8; +} +/* Use style rules to govern display of the TOC. */ +@media screen and (max-width: 1023px) { + #toc nav { display: none; } + #toc.active nav { display: block; } +} +/* Add support for keepWithNext */ +.keepWithNext { + break-after: avoid-page; + break-after: avoid-page; +} +/* Add support for keepWithPrevious */ +.keepWithPrevious { + break-before: avoid-page; +} +/* Change the approach to avoiding breaks inside artwork etc. */ +figure, pre, table, .artwork, .sourcecode { + break-before: avoid-page; + break-after: auto; +} +/* Avoid breaks between
    and
    */ +dl { + break-before: auto; + break-inside: auto; +} +dt { + break-before: auto; + break-after: avoid-page; +} +dd { + break-before: avoid-page; + break-after: auto; + orphans: 3; + widows: 3 +} +span.break, dd.break { + margin-bottom: 0; + min-height: 0; + break-before: auto; + break-inside: auto; + break-after: auto; +} +/* Undo break-before ToC */ +@media print { + #toc { + break-before: auto; + } +} +/* Text in compact lists should not get extra bottim margin space, + since that would makes the list not compact */ +ul.compact p, .ulCompact p, +ol.compact p, .olCompact p { + margin: 0; +} +/* But the list as a whole needs the extra space at the end */ +section ul.compact, +section .ulCompact, +section ol.compact, +section .olCompact { + margin-bottom: 1em; /* same as p not within ul.compact etc. */ +} +/* The tt and code background above interferes with for instance table cell + backgrounds. Changed to something a bit more selective. */ +tt, code { + background-color: transparent; +} +p tt, p code, li tt, li code { + background-color: #f8f8f8; +} +/* Tweak the pre margin -- 0px doesn't come out well */ +pre { + margin-top: 0.5px; +} +/* Tweak the comact list text */ +ul.compact, .ulCompact, +ol.compact, .olCompact, +dl.compact, .dlCompact { + line-height: normal; +} +/* Don't add top margin for nested lists */ +li > ul, li > ol, li > dl, +dd > ul, dd > ol, dd > dl, +dl > dd > dl { + margin-top: initial; +} +/* Elements that should not be rendered on the same line as a
    */ +/* This should match the element list in writer.text.TextWriter.render_dl() */ +dd > div.artwork:first-child, +dd > aside:first-child, +dd > figure:first-child, +dd > ol:first-child, +dd > div:first-child > pre.sourcecode, +dd > table:first-child, +dd > ul:first-child { + clear: left; +} +/* fix for weird browser behaviour when
    is empty */ +dt+dd:empty::before{ + content: "\00a0"; +} +/* Make paragraph spacing inside
  2. smaller than in body text, to fit better within the list */ +li > p { + margin-bottom: 0.5em +} +/* Don't let p margin spill out from inside list items */ +li > p:last-of-type { + margin-bottom: 0; +} + + + - - - - - - - - - - + +
    Network Working GroupA. Dulaunoy
    + - - - - - - - - - - - - - -
    Internet-DraftA. Iklody
    Expires: April 24, 2021CIRCL
    October 21, 2020
    - -

    MISP core format
    -

    - -

    Abstract

    -

    This document describes the MISP core format used to exchange indicators and threat information between MISP (Open Source Threat Intelligence Sharing Platform formerly known as Malware Information Sharing Platform) instances. The JSON format includes the overall structure along with the semantic associated for each respective key. The format is described to support other implementations which reuse the format and ensuring an interoperability with existing MISP [MISP-P] software and other Threat Intelligence Platforms.

    -

    Status of This Memo

    -

    This Internet-Draft is submitted in full conformance with the provisions of BCP 78 and BCP 79.

    -

    Internet-Drafts are working documents of the Internet Engineering Task Force (IETF). Note that other groups may also distribute working documents as Internet-Drafts. The list of current Internet-Drafts is at https://datatracker.ietf.org/drafts/current/.

    -

    Internet-Drafts are draft documents valid for a maximum of six months and may be updated, replaced, or obsoleted by other documents at any time. It is inappropriate to use Internet-Drafts as reference material or to cite them other than as "work in progress."

    -

    This Internet-Draft will expire on April 24, 2021.

    -

    Copyright Notice

    -

    Copyright (c) 2020 IETF Trust and the persons identified as the document authors. All rights reserved.

    -

    This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (https://trustee.ietf.org/license-info) in effect on the date of publication of this document. Please review these documents carefully, as they describe your rights and restrictions with respect to this document. Code Components extracted from this document must include Simplified BSD License text as described in Section 4.e of the Trust Legal Provisions and are provided without warranty as described in the Simplified BSD License.

    - - -
    -

    Table of Contents

    - - -

    -1. Introduction -

    -

    Sharing threat information became a fundamental requirements in the Internet, security and intelligence community at large. Threat information can include indicators of compromise, malicious file indicators, financial fraud indicators or even detailed information about a threat actor. MISP [MISP-P] started as an open source project in late 2011 and the MISP format started to be widely used as an exchange format within the community in the past years. The aim of this document is to describe the specification and the MISP core format.

    -

    -1.1. Conventions and Terminology -

    -

    The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in RFC 2119 [RFC2119].

    -

    -2. Format -

    -

    -2.1. Overview -

    -

    The MISP core format is in the JSON [RFC8259] format. In MISP, an event is composed of a single JSON object.

    -

    A capitalized key (like Event, Org) represent a data model and a non-capitalised key is just an attribute. This nomenclature can support an implementation to represent the MISP format in another data structure.

    -

    -2.2. Event -

    -

    An event is a simple meta structure scheme where attributes and meta-data are embedded to compose a coherent set of indicators. An event can be composed from an incident, a security analysis report or a specific threat actor analysis. The meaning of an event only depends of the information embedded in the event.

    -

    -2.2.1. Event Attributes -

    -

    -2.2.1.1. uuid -

    -

    uuid represents the Universally Unique IDentifier (UUID) [RFC4122] of the event. The uuid MUST be preserved for any updates or transfer of the same event. UUID version 4 is RECOMMENDED when assigning it to a new event.

    -

    uuid is represented as a JSON string. uuid MUST be present.

    -

    -2.2.1.2. id -

    -

    id represents the human-readable identifier associated to the event for a specific MISP instance. A human-readable identifier MUST be represented as an unsigned integer.

    -

    id is represented as a JSON string. id SHALL be present.

    -

    -2.2.1.3. published -

    -

    published represents the event publication state. If the event was published, the published value MUST be true. In any other publication state, the published value MUST be false.

    -

    published is represented as a JSON boolean. published MUST be present.

    -

    -2.2.1.4. info -

    -

    info represents the information field of the event. info is a free-text value to provide a human-readable summary of the event. info SHOULD NOT be bigger than 256 characters and SHOULD NOT include new-lines.

    -

    info is represented as a JSON string. info MUST be present.

    -

    -2.2.1.5. threat_level_id -

    -

    threatlevelid represents the threat level.

    -

    - -
    -
    4:
    -
    -
    Undefined
    -
    3:
    -
    -
    Low
    -
    2:
    -
    -
    Medium
    -
    1:
    -
    -
    High
    +MISP core format +October 2021 + + +Dulaunoy & Iklody +Expires 1 May 2022 +[Page] + + +
    +
    +
    +
    Workgroup:
    +
    Network Working Group
    +
    Internet-Draft:
    +
    draft-00
    +
    Published:
    +
    + +
    +
    Intended Status:
    +
    Informational
    +
    Expires:
    +
    +
    Authors:
    +
    +
    +
    A. Dulaunoy
    +
    CIRCL
    +
    +
    +
    A. Iklody
    +
    CIRCL
    +
    +
    - -

    -

    If a higher granularity is required, a MISP taxonomy applied as a Tag SHOULD be preferred.

    -

    threatlevelid is represented as a JSON string. threatlevelid SHALL be present.

    -

    -2.2.1.6. analysis -

    -

    analysis represents the analysis level.

    -

    - -
    -
    0:
    -
    -
    Initial
    -
    1:
    -
    -
    Ongoing
    -
    2:
    -
    -
    Complete
    +
    +

    MISP core format

    +
    +

    Abstract

    +

    This document describes the MISP core format used to exchange indicators and threat information between +MISP (Open Source Threat Intelligence Sharing Platform formerly known as Malware Information Sharing Platform) instances. +The JSON format includes the overall structure along with the semantic associated for each +respective key. The format is described to support other implementations which reuse the +format and ensuring an interoperability with existing MISP [MISP-P] software and other Threat Intelligence Platforms.

    +
    +
    +
    +

    +Status of This Memo +

    +

    + This Internet-Draft is submitted in full conformance with the + provisions of BCP 78 and BCP 79.

    +

    + Internet-Drafts are working documents of the Internet Engineering Task + Force (IETF). Note that other groups may also distribute working + documents as Internet-Drafts. The list of current Internet-Drafts is + at https://datatracker.ietf.org/drafts/current/.

    +

    + Internet-Drafts are draft documents valid for a maximum of six months + and may be updated, replaced, or obsoleted by other documents at any + time. It is inappropriate to use Internet-Drafts as reference + material or to cite them other than as "work in progress."

    +

    + This Internet-Draft will expire on 1 May 2022.

    +
    +
    + +
    +
    + ▲

    +Table of Contents +

    + +
    +
    +
    +
    +

    +1. Introduction +

    +

    Sharing threat information became a fundamental requirements in the Internet, security and intelligence community at large. Threat +information can include indicators of compromise, malicious file indicators, financial fraud indicators +or even detailed information about a threat actor. MISP [MISP-P] started as an open source project in late 2011 and +the MISP format started to be widely used as an exchange format within the community in the past years. The aim of this document +is to describe the specification and the MISP core format.

    +
    +
    +

    +1.1. Conventions and Terminology +

    +

    The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", +"SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this +document are to be interpreted as described in RFC 2119 [RFC2119].

    +
    +
    +
    +
    +
    +
    +

    +2. Format +

    +
    +
    +

    +2.1. Overview +

    +

    The MISP core format is in the JSON [RFC8259] format. In MISP, an event is composed of a single JSON object.

    +

    A capitalized key (like Event, Org) represent a data model and a non-capitalised key is just an attribute. This nomenclature +can support an implementation to represent the MISP format in another data structure.

    +
    +
    +
    +
    +

    +2.2. Event +

    +

    An event is a simple meta structure scheme where attributes and meta-data are embedded to compose a coherent set +of indicators. An event can be composed from an incident, a security analysis report or a specific threat actor +analysis. The meaning of an event only depends of the information embedded in the event.

    +
    +
    +

    +2.2.1. Event Attributes +

    +
    +
    +
    +2.2.1.1. uuid +
    +

    uuid represents the Universally Unique IDentifier (UUID) [RFC4122] of the event. The uuid MUST be preserved +for any updates or transfer of the same event. UUID version 4 is RECOMMENDED when assigning it to a new event.

    +

    uuid is represented as a JSON string. uuid MUST be present.

    +
    +
    +
    +
    +
    +2.2.1.2. id +
    +

    id represents the human-readable identifier associated to the event for a specific MISP instance. A human-readable identifier MUST be +represented as an unsigned integer.

    +

    id is represented as a JSON string. id SHALL be present.

    +
    +
    +
    +
    +
    +2.2.1.3. published +
    +

    published represents the event publication state. If the event was published, the published value MUST be true. +In any other publication state, the published value MUST be false.

    +

    published is represented as a JSON boolean. published MUST be present.

    +
    +
    +
    +
    +
    +2.2.1.4. info +
    +

    info represents the information field of the event. info is a free-text value to provide a human-readable summary +of the event. info SHOULD NOT be bigger than 256 characters and SHOULD NOT include new-lines.

    +

    info is represented as a JSON string. info MUST be present.

    +
    +
    +
    +
    +
    +2.2.1.5. threat_level_id +
    +

    threatlevelid represents the threat level.

    +
    +
    4:
    +
    Undefined +
    +
    +
    3:
    +
    Low +
    +
    +
    2:
    +
    Medium +
    +
    +
    1:
    +
    High +
    +
    - -

    -

    If a higher granularity is required, a MISP taxonomy applied as a Tag SHOULD be preferred.

    -

    analysis is represented as a JSON string. analysis SHALL be present.

    -

    -2.2.1.7. date -

    -

    date represents a reference date to the event in ISO 8601 format (date only: YYYY-MM-DD). This date corresponds to the date the event occurred, which may be in the past.

    -

    date is represented as a JSON string. date MUST be present.

    -

    -2.2.1.8. timestamp -

    -

    timestamp represents a reference time when the event, or one of the attributes within the event was created, or last updated/edited on the instance. timestamp is expressed in seconds (decimal) since 1st of January 1970 (Unix timestamp). The time zone MUST be UTC.

    -

    timestamp is represented as a JSON string. timestamp MUST be present.

    -

    -2.2.1.9. publish_timestamp -

    -

    publishtimestamp represents a reference time when the event was published on the instance. publishedtimestamp is expressed in seconds (decimal) since 1st of January 1970 (Unix timestamp). At each publication of an event, publishtimestamp MUST be updated. The time zone MUST be UTC. If the publishedtimestamp is present and the published flag is set to false, the publishtimestamp represents the previous publication timestamp. If the event was never published, the publishedtimestamp MUST be set to 0.

    -

    publishtimestamp is represented as a JSON string. publishtimestamp MUST be present.

    -

    -2.2.1.10. org_id -

    -

    org_id represents a human-readable identifier referencing an Org object of the organisation which generated the event. A human-readable identifier MUST be represented as an unsigned integer.

    -

    The org_id MUST be updated when the event is generated by a new instance.

    -

    orgid is represented as a JSON string. orgid MUST be present.

    -

    -2.2.1.11. orgc_id -

    -

    orgc_id represents a human-readable identifier referencing an Orgc object of the organisation which created the event.

    -

    The orgc_id and Org object MUST be preserved for any updates or transfer of the same event.

    -

    orgcid is represented as a JSON string. orgcid MUST be present.

    -

    -2.2.1.12. attribute_count -

    -

    attributecount represents the number of attributes in the event. attributecount is expressed in decimal.

    -

    attributecount is represented as a JSON string. attributecount SHALL be present.

    -

    -2.2.1.13. distribution -

    -

    distribution represents the basic distribution rules of the event. The system must adhere to the distribution setting for access control and for dissemination of the event.

    -

    distribution is represented by a JSON string. distribution MUST be present and be one of the following options:

    -

    - -
    -
    0
    -
    -
    Your Organisation Only
    -
    1
    -
    -
    This Community Only
    -
    2
    -
    -
    Connected Communities
    -
    3
    -
    -
    All Communities
    -
    4
    -
    -
    Sharing Group
    +

    If a higher granularity is required, a MISP taxonomy applied as a Tag SHOULD be preferred.

    +

    threatlevelid is represented as a JSON string. threatlevelid SHALL be present.

    +
    +
    +
    +
    +
    +2.2.1.6. analysis +
    +

    analysis represents the analysis level.

    +
    +
    0:
    +
    Initial +
    +
    +
    1:
    +
    Ongoing +
    +
    +
    2:
    +
    Complete +
    +
    - -

    -

    -2.2.1.14. sharing_group_id -

    -

    sharing_group_id represents a human-readable identifier referencing a Sharing Group object that defines the distribution of the event, if distribution level "4" is set. A human-readable identifier MUST be represented as an unsigned integer.

    -

    sharing_group_id is represented by a JSON string and SHOULD be present. If a distribution level other than "4" is chosen the sharing_group_id MUST be set to "0".

    -

    -2.2.1.15. extends_uuid -

    -

    extends_uuid represents which event is extended by this event. The extends_uuid is described as a Universally Unique IDentifier (UUID) [RFC4122] with the UUID of the extended event.

    -

    extends_uuid is represented as a JSON string. extends_uuid SHOULD be present.

    -

    -2.3. Objects -

    -

    -2.3.1. Org -

    -

    An Org object is composed of an uuid, name and id.

    -

    The uuid represents the Universally Unique IDentifier (UUID) [RFC4122] of the organisation. The organisation UUID is globally assigned to an organisation and SHALL be kept overtime.

    -

    The name is a readable description of the organisation and SHOULD be present. The id is a human-readable identifier generated by the instance and used as reference in the event. A human-readable identifier MUST be represented as an unsigned integer.

    -

    uuid, name and id are represented as a JSON string. uuid, name and id MUST be present.

    -

    -2.3.1.1. Sample Org Object -

    +

    If a higher granularity is required, a MISP taxonomy applied as a Tag SHOULD be preferred.

    +

    analysis is represented as a JSON string. analysis SHALL be present.

    +
    +
    +
    +
    +
    +2.2.1.7. date +
    +

    date represents a reference date to the event in ISO 8601 format (date only: YYYY-MM-DD). This date corresponds to the date the event occurred, which may be in the past.

    +

    date is represented as a JSON string. date MUST be present.

    +
    +
    +
    +
    +
    +2.2.1.8. timestamp +
    +

    timestamp represents a reference time when the event, or one of the attributes within the event was created, or last updated/edited on the instance. timestamp is expressed in seconds (decimal) since 1st of January 1970 (Unix timestamp). The time zone MUST be UTC.

    +

    timestamp is represented as a JSON string. timestamp MUST be present.

    +
    +
    +
    +
    +
    +2.2.1.9. publish_timestamp +
    +

    publishtimestamp represents a reference time when the event was published on the instance. publishedtimestamp is expressed in seconds (decimal) since 1st of January 1970 (Unix timestamp). At each publication of an event, publishtimestamp MUST be updated. The time zone MUST be UTC. If the publishedtimestamp is present and the published flag is set to false, the publishtimestamp represents the previous publication timestamp. If the event was never published, the publishedtimestamp MUST be set to 0.

    +

    publishtimestamp is represented as a JSON string. publishtimestamp MUST be present.

    +
    +
    +
    +
    +
    +2.2.1.10. org_id +
    +

    org_id represents a human-readable identifier referencing an Org object of the organisation which generated the event. A human-readable identifier MUST be +represented as an unsigned integer.

    +

    The org_id MUST be updated when the event is generated by a new instance.

    +

    orgid is represented as a JSON string. orgid MUST be present.

    +
    +
    +
    +
    +
    +2.2.1.11. orgc_id +
    +

    orgc_id represents a human-readable identifier referencing an Orgc object of the organisation which created the event.

    +

    The orgc_id and Org object MUST be preserved for any updates or transfer of the same event.

    +

    orgcid is represented as a JSON string. orgcid MUST be present.

    +
    +
    +
    +
    +
    +2.2.1.12. attribute_count +
    +

    attributecount represents the number of attributes in the event. attributecount is expressed in decimal.

    +

    attributecount is represented as a JSON string. attributecount SHALL be present.

    +
    +
    +
    +
    +
    +2.2.1.13. distribution +
    +

    distribution represents the basic distribution rules of the event. The system must adhere to the distribution setting for access control and for dissemination of the event.

    +

    distribution is represented by a JSON string. distribution MUST be present and be one of the following options:

    +
    +
    0
    +
    Your Organisation Only +
    +
    +
    1
    +
    This Community Only +
    +
    +
    2
    +
    Connected Communities +
    +
    +
    3
    +
    All Communities +
    +
    +
    4
    +
    Sharing Group +
    +
    +
    +
    +
    +
    +
    +
    +2.2.1.14. sharing_group_id +
    +

    sharing_group_id represents a human-readable identifier referencing a Sharing Group object that defines the distribution of the event, if distribution level "4" is set. A human-readable identifier MUST be represented as an unsigned integer.

    +

    sharing_group_id is represented by a JSON string and SHOULD be present. If a distribution level other than "4" is chosen the sharing_group_id MUST be set to "0".

    +
    +
    +
    +
    +
    +2.2.1.15. extends_uuid +
    +

    extends_uuid represents which event is extended by this event. The extends_uuid is described as a Universally Unique IDentifier (UUID) [RFC4122] with the UUID of the extended event.

    +

    extends_uuid is represented as a JSON string. extends_uuid SHOULD be present.

    +
    +
    +
    +
    +
    +
    +
    +
    +

    +2.3. Objects +

    +
    +
    +

    +2.3.1. Org +

    +

    An Org object is composed of an uuid, name and id.

    +

    The uuid represents the Universally Unique IDentifier (UUID) [RFC4122] of the organisation. +The organisation UUID is globally assigned to an organisation and SHALL be kept overtime.

    +

    The name is a readable description of the organisation and SHOULD be present. +The id is a human-readable identifier generated by the instance and used as reference in the event. +A human-readable identifier MUST be represented as an unsigned integer.

    +

    uuid, name and id are represented as a JSON string. uuid, name and id MUST be present.

    +
    +
    +
    +2.3.1.1. Sample Org Object +
    +
    "Org": {
         "id": "2",
         "name": "CIRCL",
         "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"
        }
-
    -

    -2.3.2. Orgc -

    -

    An Orgc object is composed of an uuid, name and id.

    -

    The uuid MUST be preserved for any updates or transfer of the same event. UUID version 4 is RECOMMENDED when assigning it to a new event. The organisation UUID is globally assigned to an organisation and SHALL be kept overtime.

    -

    The name is a readable description of the organisation and SHOULD be present. The id is a human-readable identifier generated by the instance and used as reference in the event. A human-readable identifier MUST be represented as an unsigned integer.

    -

    uuid, name and id are represented as a JSON string. uuid, name and id MUST be present.

    -

    -2.4. Attribute -

    -

    Attributes are used to describe the indicators and contextual data of an event. The main information contained in an attribute is made up of a category-type-value triplet, where the category and type give meaning and context to the value. Through the various category-type combinations a wide range of information can be conveyed.

    -

    A MISP document MUST at least includes category-type-value triplet described in section "Attribute Attributes".

    -

    -2.4.1. Sample Attribute Object -

    + +
    +
    +
    +
    +
    +
    +
    +

    +2.3.2. Orgc +

    +

    An Orgc object is composed of an uuid, name and id.

    +

    The uuid MUST be preserved for any updates or transfer of the same event. UUID version 4 is RECOMMENDED when assigning it to a new event. +The organisation UUID is globally assigned to an organisation and SHALL be kept overtime.

    +

    The name is a readable description of the organisation and SHOULD be present. +The id is a human-readable identifier generated by the instance and used as reference in the event. +A human-readable identifier MUST be represented as an unsigned integer.

    +

    uuid, name and id are represented as a JSON string. uuid, name and id MUST be present.

    +
    +
    +
    +
    +
    +
    +

    +2.4. Attribute +

    +

    Attributes are used to describe the indicators and contextual data of an event. The main information contained in an attribute is made up of a category-type-value triplet, +where the category and type give meaning and context to the value. Through the various category-type combinations a wide range of information can be conveyed.

    +

    A MISP document MUST at least includes category-type-value triplet described in section "Attribute Attributes".

    +
    +
    +

    +2.4.1. Sample Attribute Object +

    +
    "Attribute": {
               "id": "346056",
               "type": "comment",
@@ -795,183 +1789,284 @@
               "first_seen": "2019-06-02T22:14:28.711954+00:00",
               "last_seen": null
              }
-
    -

    -2.4.2. Attribute Attributes -

    -

    -2.4.2.1. uuid -

    -

    uuid represents the Universally Unique IDentifier (UUID) [RFC4122] of the event. The uuid MUST be preserved for any updates or transfer of the same event. UUID version 4 is RECOMMENDED when assigning it to a new event.

    -

    uuid is represented as a JSON string. uuid MUST be present.

    -

    -2.4.2.2. id -

    -

    id represents the human-readable identifier associated to the event for a specific MISP instance. A human-readable identifier MUST be represented as an unsigned integer.

    -

    id is represented as a JSON string. id SHALL be present.

    -

    -2.4.2.3. type -

    -

    type represents the means through which an attribute tries to describe the intent of the attribute creator, using a list of pre-defined attribute types.

    -

    type is represented as a JSON string. type MUST be present and it MUST be a valid selection for the chosen category. The list of valid category-type combinations is as follows:

    -

    - -
    -
    Antivirus detection
    -
    -
    link, comment, text, hex, attachment, other, anonymised
    -
    Artifacts dropped
    -
    -
    md5, sha1, sha224, sha256, sha384, sha512, sha512/224, sha512/256, sha3-224, sha3-256, sha3-384, sha3-512, ssdeep, imphash, telfhash, impfuzzy, authentihash, vhash, cdhash, filename, filename|md5, filename|sha1, filename|sha224, filename|sha256, filename|sha384, filename|sha512, filename|sha512/224, filename|sha512/256, filename|sha3-224, filename|sha3-256, filename|sha3-384, filename|sha3-512, filename|authentihash, filename|vhash, filename|ssdeep, filename|tlsh, filename|imphash, filename|impfuzzy, filename|pehash, regkey, regkey|value, pattern-in-file, pattern-in-memory, filename-pattern, pdb, stix2-pattern, yara, sigma, attachment, malware-sample, named pipe, mutex, windows-scheduled-task, windows-service-name, windows-service-displayname, comment, text, hex, x509-fingerprint-sha1, x509-fingerprint-md5, x509-fingerprint-sha256, other, cookie, gene, kusto-query, mime-type, anonymised, pgp-public-key, pgp-private-key
    -
    Attribution
    -
    -
    threat-actor, campaign-name, campaign-id, whois-registrant-phone, whois-registrant-email, whois-registrant-name, whois-registrant-org, whois-registrar, whois-creation-date, comment, text, x509-fingerprint-sha1, x509-fingerprint-md5, x509-fingerprint-sha256, other, dns-soa-email, anonymised, email
    -
    External analysis
    -
    -
    md5, sha1, sha256, sha3-224, sha3-256, sha3-384, sha3-512, filename, filename|md5, filename|sha1, filename|sha256, filename|sha3-224, filename|sha3-256, filename|sha3-384, filename|sha3-512, ip-src, ip-dst, ip-dst|port, ip-src|port, mac-address, mac-eui-64, hostname, domain, domain|ip, url, user-agent, regkey, regkey|value, AS, snort, bro, zeek, pattern-in-file, pattern-in-traffic, pattern-in-memory, filename-pattern, vulnerability, cpe, weakness, attachment, malware-sample, link, comment, text, x509-fingerprint-sha1, x509-fingerprint-md5, x509-fingerprint-sha256, ja3-fingerprint-md5, hassh-md5, hasshserver-md5, github-repository, other, cortex, anonymised, community-id
    -
    Financial fraud
    -
    -
    btc, dash, xmr, iban, bic, bank-account-nr, aba-rtn, bin, cc-number, prtn, phone-number, comment, text, other, hex, anonymised
    -
    Internal reference
    -
    -
    text, link, comment, other, hex, anonymised, git-commit-id
    -
    Network activity
    -
    -
    ip-src, ip-dst, ip-dst|port, ip-src|port, port, hostname, domain, domain|ip, mac-address, mac-eui-64, email, email-dst, email-src, eppn, url, uri, user-agent, http-method, AS, snort, pattern-in-file, filename-pattern, stix2-pattern, pattern-in-traffic, attachment, comment, text, x509-fingerprint-md5, x509-fingerprint-sha1, x509-fingerprint-sha256, ja3-fingerprint-md5, hassh-md5, hasshserver-md5, other, hex, cookie, hostname|port, bro, zeek, anonymised, community-id, email-subject
    -
    Other
    -
    -
    comment, text, other, size-in-bytes, counter, datetime, cpe, port, float, hex, phone-number, boolean, anonymised, pgp-public-key, pgp-private-key
    -
    Payload delivery
    -
    -
    md5, sha1, sha224, sha256, sha384, sha512, sha512/224, sha512/256, sha3-224, sha3-256, sha3-384, sha3-512, ssdeep, imphash, telfhash, impfuzzy, authentihash, vhash, pehash, tlsh, cdhash, filename, filename|md5, filename|sha1, filename|sha224, filename|sha256, filename|sha384, filename|sha512, filename|sha512/224, filename|sha512/256, filename|sha3-224, filename|sha3-256, filename|sha3-384, filename|sha3-512, filename|authentihash, filename|vhash, filename|ssdeep, filename|tlsh, filename|imphash, filename|impfuzzy, filename|pehash, mac-address, mac-eui-64, ip-src, ip-dst, ip-dst|port, ip-src|port, hostname, domain, email, email-src, email-dst, email-subject, email-attachment, email-body, url, user-agent, AS, pattern-in-file, pattern-in-traffic, filename-pattern, stix2-pattern, yara, sigma, mime-type, attachment, malware-sample, link, malware-type, comment, text, hex, vulnerability, cpe, weakness, x509-fingerprint-sha1, x509-fingerprint-md5, x509-fingerprint-sha256, ja3-fingerprint-md5, hassh-md5, hasshserver-md5, other, hostname|port, email-dst-display-name, email-src-display-name, email-header, email-reply-to, email-x-mailer, email-mime-boundary, email-thread-index, email-message-id, mobile-application-id, chrome-extension-id, whois-registrant-email, anonymised
    -
    Payload installation
    -
    -
    md5, sha1, sha224, sha256, sha384, sha512, sha512/224, sha512/256, sha3-224, sha3-256, sha3-384, sha3-512, ssdeep, imphash, telfhash, impfuzzy, authentihash, vhash, pehash, tlsh, cdhash, filename, filename|md5, filename|sha1, filename|sha224, filename|sha256, filename|sha384, filename|sha512, filename|sha512/224, filename|sha512/256, filename|sha3-224, filename|sha3-256, filename|sha3-384, filename|sha3-512, filename|authentihash, filename|vhash, filename|ssdeep, filename|tlsh, filename|imphash, filename|impfuzzy, filename|pehash, pattern-in-file, pattern-in-traffic, pattern-in-memory, filename-pattern, stix2-pattern, yara, sigma, vulnerability, cpe, weakness, attachment, malware-sample, malware-type, comment, text, hex, x509-fingerprint-sha1, x509-fingerprint-md5, x509-fingerprint-sha256, mobile-application-id, chrome-extension-id, other, mime-type, anonymised
    -
    Payload type
    -
    -
    comment, text, other, anonymised
    -
    Persistence mechanism
    -
    -
    filename, regkey, regkey|value, comment, text, other, hex, anonymised
    -
    Person
    -
    -
    first-name, middle-name, last-name, date-of-birth, place-of-birth, gender, passport-number, passport-country, passport-expiration, redress-number, nationality, visa-number, issue-date-of-the-visa, primary-residence, country-of-residence, special-service-request, frequent-flyer-number, travel-details, payment-details, place-port-of-original-embarkation, place-port-of-clearance, place-port-of-onward-foreign-destination, passenger-name-record-locator-number, comment, text, other, phone-number, identity-card-number, anonymised, email, pgp-public-key, pgp-private-key
    -
    Social network
    -
    -
    github-username, github-repository, github-organisation, jabber-id, twitter-id, email, email-src, email-dst, eppn, comment, text, other, whois-registrant-email, anonymised, pgp-public-key, pgp-private-key
    -
    Support Tool
    -
    -
    link, text, attachment, comment, other, hex, anonymised
    -
    Targeting data
    -
    -
    target-user, target-email, target-machine, target-org, target-location, target-external, comment, anonymised
    + +
    +
    +
    +
    +
    +

    +2.4.2. Attribute Attributes +

    +
    +
    +
    +2.4.2.1. uuid +
    +

    uuid represents the Universally Unique IDentifier (UUID) [RFC4122] of the event. The uuid MUST be preserved +for any updates or transfer of the same event. UUID version 4 is RECOMMENDED when assigning it to a new event.

    +

    uuid is represented as a JSON string. uuid MUST be present.

    +
    +
    +
    +
    +
    +2.4.2.2. id +
    +

    id represents the human-readable identifier associated to the event for a specific MISP instance. A human-readable identifier MUST be +represented as an unsigned integer.

    +

    id is represented as a JSON string. id SHALL be present.

    +
    +
    +
    +
    +
    +2.4.2.3. type +
    +

    type represents the means through which an attribute tries to describe the intent of the attribute creator, using a list of pre-defined attribute types.

    +

    type is represented as a JSON string. type MUST be present and it MUST be a valid selection for the chosen category. The list of valid category-type combinations is as follows:

    +
    +
    Antivirus detection
    +
    link, comment, text, hex, attachment, other, anonymised +
    +
    +
    Artifacts dropped
    +
    md5, sha1, sha224, sha256, sha384, sha512, sha512/224, sha512/256, sha3-224, sha3-256, sha3-384, sha3-512, ssdeep, imphash, telfhash, impfuzzy, authentihash, vhash, cdhash, filename, filename|md5, filename|sha1, filename|sha224, filename|sha256, filename|sha384, filename|sha512, filename|sha512/224, filename|sha512/256, filename|sha3-224, filename|sha3-256, filename|sha3-384, filename|sha3-512, filename|authentihash, filename|vhash, filename|ssdeep, filename|tlsh, filename|imphash, filename|impfuzzy, filename|pehash, regkey, regkey|value, pattern-in-file, pattern-in-memory, filename-pattern, pdb, stix2-pattern, yara, sigma, attachment, malware-sample, named pipe, mutex, process-state, windows-scheduled-task, windows-service-name, windows-service-displayname, comment, text, hex, x509-fingerprint-sha1, x509-fingerprint-md5, x509-fingerprint-sha256, other, cookie, gene, kusto-query, mime-type, anonymised, pgp-public-key, pgp-private-key +
    +
    +
    Attribution
    +
    threat-actor, campaign-name, campaign-id, whois-registrant-phone, whois-registrant-email, whois-registrant-name, whois-registrant-org, whois-registrar, whois-creation-date, comment, text, x509-fingerprint-sha1, x509-fingerprint-md5, x509-fingerprint-sha256, other, dns-soa-email, anonymised, email +
    +
    +
    External analysis
    +
    md5, sha1, sha256, sha3-224, sha3-256, sha3-384, sha3-512, filename, filename|md5, filename|sha1, filename|sha256, filename|sha3-224, filename|sha3-256, filename|sha3-384, filename|sha3-512, ip-src, ip-dst, ip-dst|port, ip-src|port, mac-address, mac-eui-64, hostname, domain, domain|ip, url, user-agent, regkey, regkey|value, AS, snort, bro, zeek, pattern-in-file, pattern-in-traffic, pattern-in-memory, filename-pattern, vulnerability, cpe, weakness, attachment, malware-sample, link, comment, text, x509-fingerprint-sha1, x509-fingerprint-md5, x509-fingerprint-sha256, ja3-fingerprint-md5, jarm-fingerprint, hassh-md5, hasshserver-md5, github-repository, other, cortex, anonymised, community-id +
    +
    +
    Financial fraud
    +
    btc, dash, xmr, iban, bic, bank-account-nr, aba-rtn, bin, cc-number, prtn, phone-number, comment, text, other, hex, anonymised +
    +
    +
    Internal reference
    +
    text, link, comment, other, hex, anonymised, git-commit-id +
    +
    +
    Network activity
    +
    ip-src, ip-dst, ip-dst|port, ip-src|port, port, hostname, domain, domain|ip, mac-address, mac-eui-64, email, email-dst, email-src, eppn, url, uri, user-agent, http-method, AS, snort, pattern-in-file, filename-pattern, stix2-pattern, pattern-in-traffic, attachment, comment, text, x509-fingerprint-md5, x509-fingerprint-sha1, x509-fingerprint-sha256, ja3-fingerprint-md5, jarm-fingerprint, hassh-md5, hasshserver-md5, other, hex, cookie, hostname|port, bro, zeek, anonymised, community-id, email-subject, favicon-mmh3, dkim, dkim-signature, ssh-fingerprint +
    +
    +
    Other
    +
    comment, text, other, size-in-bytes, counter, datetime, cpe, port, float, hex, phone-number, boolean, anonymised, pgp-public-key, pgp-private-key +
    +
    +
    Payload delivery
    +
    md5, sha1, sha224, sha256, sha384, sha512, sha512/224, sha512/256, sha3-224, sha3-256, sha3-384, sha3-512, ssdeep, imphash, telfhash, impfuzzy, authentihash, vhash, pehash, tlsh, cdhash, filename, filename|md5, filename|sha1, filename|sha224, filename|sha256, filename|sha384, filename|sha512, filename|sha512/224, filename|sha512/256, filename|sha3-224, filename|sha3-256, filename|sha3-384, filename|sha3-512, filename|authentihash, filename|vhash, filename|ssdeep, filename|tlsh, filename|imphash, filename|impfuzzy, filename|pehash, mac-address, mac-eui-64, ip-src, ip-dst, ip-dst|port, ip-src|port, hostname, domain, email, email-src, email-dst, email-subject, email-attachment, email-body, url, user-agent, AS, pattern-in-file, pattern-in-traffic, filename-pattern, stix2-pattern, yara, sigma, mime-type, attachment, malware-sample, link, malware-type, comment, text, hex, vulnerability, cpe, weakness, x509-fingerprint-sha1, x509-fingerprint-md5, x509-fingerprint-sha256, ja3-fingerprint-md5, jarm-fingerprint, hassh-md5, hasshserver-md5, other, hostname|port, email-dst-display-name, email-src-display-name, email-header, email-reply-to, email-x-mailer, email-mime-boundary, email-thread-index, email-message-id, mobile-application-id, chrome-extension-id, whois-registrant-email, anonymised +
    +
    +
    Payload installation
    +
    md5, sha1, sha224, sha256, sha384, sha512, sha512/224, sha512/256, sha3-224, sha3-256, sha3-384, sha3-512, ssdeep, imphash, telfhash, impfuzzy, authentihash, vhash, pehash, tlsh, cdhash, filename, filename|md5, filename|sha1, filename|sha224, filename|sha256, filename|sha384, filename|sha512, filename|sha512/224, filename|sha512/256, filename|sha3-224, filename|sha3-256, filename|sha3-384, filename|sha3-512, filename|authentihash, filename|vhash, filename|ssdeep, filename|tlsh, filename|imphash, filename|impfuzzy, filename|pehash, pattern-in-file, pattern-in-traffic, pattern-in-memory, filename-pattern, stix2-pattern, yara, sigma, vulnerability, cpe, weakness, attachment, malware-sample, malware-type, comment, text, hex, x509-fingerprint-sha1, x509-fingerprint-md5, x509-fingerprint-sha256, mobile-application-id, chrome-extension-id, other, mime-type, anonymised +
    +
    +
    Payload type
    +
    comment, text, other, anonymised +
    +
    +
    Persistence mechanism
    +
    filename, regkey, regkey|value, comment, text, other, hex, anonymised +
    +
    +
    Person
    +
    first-name, middle-name, last-name, full-name, date-of-birth, place-of-birth, gender, passport-number, passport-country, passport-expiration, redress-number, nationality, visa-number, issue-date-of-the-visa, primary-residence, country-of-residence, special-service-request, frequent-flyer-number, travel-details, payment-details, place-port-of-original-embarkation, place-port-of-clearance, place-port-of-onward-foreign-destination, passenger-name-record-locator-number, comment, text, other, phone-number, identity-card-number, anonymised, email, pgp-public-key, pgp-private-key +
    +
    +
    Social network
    +
    github-username, github-repository, github-organisation, jabber-id, twitter-id, email, email-src, email-dst, eppn, comment, text, other, whois-registrant-email, anonymised, pgp-public-key, pgp-private-key +
    +
    +
    Support Tool
    +
    link, text, attachment, comment, other, hex, anonymised +
    +
    +
    Targeting data
    +
    target-user, target-email, target-machine, target-org, target-location, target-external, comment, anonymised +
    +
    - -

    -

    Attributes are based on the usage within their different communities. Attributes can be extended on a regular basis and this reference document is updated accordingly.

    -

    -2.4.2.4. category -

    -

    category represents the intent of what the attribute is describing as selected by the attribute creator, using a list of pre-defined attribute categories.

    -

    category is represented as a JSON string. category MUST be present and it MUST be a valid selection for the chosen type. The list of valid category-type combinations is mentioned above.

    -

    -2.4.2.5. to_ids -

    -

    to_ids represents whether the attribute is meant to be actionable. Actionable defined attributes that can be used in automated processes as a pattern for detection in Local or Network Intrusion Detection System, log analysis tools or even filtering mechanisms.

    -

    to_ids is represented as a JSON boolean. to_ids MUST be present.

    -

    -2.4.2.6. event_id -

    -

    event_id represents a human-readable identifier referencing the Event object that the attribute belongs to. A human-readable identifier MUST be represented as an unsigned integer.

    -

    The event_id SHOULD be updated when the event is imported to reflect the newly created event's id on the instance.

    -

    event_id is represented as a JSON string. event_id MUST be present.

    -

    -2.4.2.7. distribution -

    -

    distribution represents the basic distribution rules of the attribute. The system must adhere to the distribution setting for access control and for dissemination of the attribute.

    -

    distribution is represented by a JSON string. distribution MUST be present and be one of the following options:

    -

    - -
    -
    0
    -
    -
    Your Organisation Only
    -
    1
    -
    -
    This Community Only
    -
    2
    -
    -
    Connected Communities
    -
    3
    -
    -
    All Communities
    -
    4
    -
    -
    Sharing Group
    -
    5
    -
    -
    Inherit Event
    +

    Attributes are based on the usage within their different communities. Attributes can be extended on a regular basis and this reference document is updated accordingly.

    +
    +
    +
    +
    +
    +2.4.2.4. category +
    +

    category represents the intent of what the attribute is describing as selected by the attribute creator, using a list of pre-defined attribute categories.

    +

    category is represented as a JSON string. category MUST be present and it MUST be a valid selection for the chosen type. The list of valid category-type combinations is mentioned above.

    +
    +
    +
    +
    +
    +2.4.2.5. to_ids +
    +

    to_ids represents whether the attribute is meant to be actionable. Actionable defined attributes that can be used in automated processes as a pattern for detection in Local or Network Intrusion Detection System, log analysis tools or even filtering mechanisms.

    +

    to_ids is represented as a JSON boolean. to_ids MUST be present.

    +
    +
    +
    +
    +
    +2.4.2.6. event_id +
    +

    event_id represents a human-readable identifier referencing the Event object that the attribute belongs to. A human-readable identifier MUST be +represented as an unsigned integer.

    +

    The event_id SHOULD be updated when the event is imported to reflect the newly created event's id on the instance.

    +

    event_id is represented as a JSON string. event_id MUST be present.

    +
    +
    +
    +
    +
    +2.4.2.7. distribution +
    +

    distribution represents the basic distribution rules of the attribute. The system must adhere to the distribution setting for access control and for dissemination of the attribute.

    +

    distribution is represented by a JSON string. distribution MUST be present and be one of the following options:

    +
    +
    0
    +
    Your Organisation Only +
    +
    +
    1
    +
    This Community Only +
    +
    +
    2
    +
    Connected Communities +
    +
    +
    3
    +
    All Communities +
    +
    +
    4
    +
    Sharing Group +
    +
    +
    5
    +
    Inherit Event +
    +
    - -

    -

    -2.4.2.8. timestamp -

    -

    timestamp represents a reference time when the attribute was created or last modified. timestamp is expressed in seconds (decimal) since 1st of January 1970 (Unix timestamp). The time zone MUST be UTC.

    -

    timestamp is represented as a JSON string. timestamp MUST be present.

    -

    -2.4.2.9. comment -

    -

    comment is a contextual comment field.

    -

    comment is represented by a JSON string. comment MAY be present.

    -

    -2.4.2.10. sharing_group_id -

    -

    sharing_group_id represents a human-readable identifier referencing a Sharing Group object that defines the distribution of the attribute, if distribution level "4" is set. A human-readable identifier MUST be represented as an unsigned integer.

    -

    sharing_group_id is represented by a JSON string and SHOULD be present. If a distribution level other than "4" is chosen the sharing_group_id MUST be set to "0".

    -

    -2.4.2.11. deleted -

    -

    deleted represents a setting that allows attributes to be revoked. Revoked attributes are not actionable and exist merely to inform other instances of a revocation.

    -

    deleted is represented by a JSON boolean. deleted MUST be present.

    -

    -2.4.2.12. data -

    -

    data contains the base64 encoded contents of an attachment or a malware sample. For malware samples, the sample MUST be encrypted using a password protected zip archive, with the password being "infected".

    -

    data is represented by a JSON string in base64 encoding. data MUST be set for attributes of type malware-sample and attachment.

    -

    -2.4.2.13. RelatedAttribute -

    -

    RelatedAttribute is an array of attributes correlating with the current attribute. Each element in the array represents an JSON object which contains an Attribute dictionnary with the external attributes who correlate. Each Attribute MUST include the id, org_id, info and a value. Only the correlations found on the local instance are shown in RelatedAttribute.

    -

    RelatedAttribute MAY be present.

    -

    -2.4.2.14. ShadowAttribute -

    -

    ShadowAttribute is an array of shadow attributes that serve as proposals by third parties to alter the containing attribute. The structure of a ShadowAttribute is similar to that of an Attribute, which can be accepted or discarded by the event creator. If accepted, the original attribute containing the shadow attribute is removed and the shadow attribute is converted into an attribute.

    -

    Each shadow attribute that references an attribute MUST contain the containing attribute's ID in the oldid field and the event's ID in the eventid field.

    -

    -2.4.2.15. value -

    -

    value represents the payload of an attribute. The format of the value is dependent on the type of the attribute.

    -

    value is represented by a JSON string. value MUST be present.

    -

    -2.4.2.16. first_seen -

    -

    firstseen represents a reference time when the attribute was first seen. firstseen is expressed as an ISO 8601 datetime up to the micro-second with time zone support.

    -

    firstseen is represented as a JSON string. firstseen MAY be present.

    -

    -2.4.2.17. last_seen -

    -

    lastseen represents a reference time when the attribute was last seen. lastseen is expressed as an ISO 8601 datetime up to the micro-second with time zone support.

    -

    lastseen is represented as a JSON string. lastseen MAY be present.

    -

    -2.5. ShadowAttribute -

    -

    ShadowAttributes are 3rd party created attributes that either propose to add new information to an event or modify existing information. They are not meant to be actionable until the event creator accepts them - at which point they will be converted into attributes or modify an existing attribute.

    -

    They are similar in structure to Attributes but additionally carry a reference to the creator of the ShadowAttribute as well as a revocation flag.

    -

    -2.5.1. Sample Attribute Object -

    +
    +
    +
    +
    +
    +2.4.2.8. timestamp +
    +

    timestamp represents a reference time when the attribute was created or last modified. timestamp is expressed in seconds (decimal) since 1st of January 1970 (Unix timestamp). The time zone MUST be UTC.

    +

    timestamp is represented as a JSON string. timestamp MUST be present.

    +
    +
    +
    +
    +
    +2.4.2.9. comment +
    +

    comment is a contextual comment field.

    +

    comment is represented by a JSON string. comment MAY be present.

    +
    +
    +
    +
    +
    +2.4.2.10. sharing_group_id +
    +

    sharing_group_id represents a human-readable identifier referencing a Sharing Group object that defines the distribution of the attribute, if distribution level "4" is set. A human-readable identifier MUST be represented as an unsigned integer.

    +

    sharing_group_id is represented by a JSON string and SHOULD be present. If a distribution level other than "4" is chosen the sharing_group_id MUST be set to "0".

    +
    +
    +
    +
    +
    +2.4.2.11. deleted +
    +

    deleted represents a setting that allows attributes to be revoked. Revoked attributes are not actionable and exist merely to inform other instances of a revocation.

    +

    deleted is represented by a JSON boolean. deleted MUST be present.

    +
    +
    +
    +
    +
    +2.4.2.12. data +
    +

    data contains the base64 encoded contents of an attachment or a malware sample. For malware samples, +the sample MUST be encrypted using a password protected zip archive, with the password being "infected".

    +

    data is represented by a JSON string in base64 encoding. data MUST be set for attributes of type malware-sample and attachment.

    +
    +
    +
    +
    +
    +2.4.2.13. RelatedAttribute +
    +

    RelatedAttribute is an array of attributes correlating with the current attribute. Each element in the array represents an JSON object which contains an Attribute dictionnary with the external attributes who correlate. Each Attribute MUST include the id, org_id, info and a value. Only the correlations found on the local instance are shown in RelatedAttribute.

    +

    RelatedAttribute MAY be present.

    +
    +
    +
    +
    +
    +2.4.2.14. ShadowAttribute +
    +

    ShadowAttribute is an array of shadow attributes that serve as proposals by third parties to alter the containing attribute. The structure of a ShadowAttribute is similar to that of an Attribute, +which can be accepted or discarded by the event creator. If accepted, the original attribute containing the shadow attribute is removed and the shadow attribute is converted into an attribute.

    +

    Each shadow attribute that references an attribute MUST contain the containing attribute's ID in the oldid field and the event's ID in the eventid field.

    +
    +
    +
    +
    +
    +2.4.2.15. value +
    +

    value represents the payload of an attribute. The format of the value is dependent on the type of the attribute.

    +

    value is represented by a JSON string. value MUST be present.

    +
    +
    +
    +
    +
    +2.4.2.16. first_seen +
    +

    firstseen represents a reference time when the attribute was first seen. firstseen is expressed as an ISO 8601 datetime up to the micro-second with time zone support.

    +

    firstseen is represented as a JSON string. firstseen MAY be present.

    +
    +
    +
    +
    +
    +2.4.2.17. last_seen +
    +

    lastseen represents a reference time when the attribute was last seen. lastseen is expressed as an ISO 8601 datetime up to the micro-second with time zone support.

    +

    lastseen is represented as a JSON string. lastseen MAY be present.

    +
    +
    +
    +
    +
    +
    +
    +
    +

    +2.5. ShadowAttribute +

    +

    ShadowAttributes are 3rd party created attributes that either propose to add new information to an event or modify existing information. They are not meant to be actionable until the event creator accepts them - at which point they will be converted into attributes or modify an existing attribute.

    +

    They are similar in structure to Attributes but additionally carry a reference to the creator of the ShadowAttribute as well as a revocation flag.

    +
    +
    +

    +2.5.1. Sample Attribute Object +

    +
    "ShadowAttribute":  {
                        "id": "8",
                        "type": "ip-src",
@@ -994,175 +2089,281 @@
                        "first_seen": "2019-06-02T22:14:28.711954+00:00",
                        "last_seen": null
                    }
-
    -

    -2.5.2. ShadowAttribute Attributes -

    -

    -2.5.2.1. uuid -

    -

    uuid represents the Universally Unique IDentifier (UUID) [RFC4122] of the event. The uuid MUST be preserved for any updates or transfer of the same event. UUID version 4 is RECOMMENDED when assigning it to a new event.

    -

    uuid is represented as a JSON string. uuid MUST be present.

    -

    -2.5.2.2. id -

    -

    id represents the human-readable identifier associated to the event for a specific MISP instance. human-readable identifier MUST be represented as an unsigned integer. id is represented as a JSON string. id SHALL be present.

    -

    -2.5.2.3. type -

    -

    type represents the means through which an attribute tries to describe the intent of the attribute creator, using a list of pre-defined attribute types.

    -

    type is represented as a JSON string. type MUST be present and it MUST be a valid selection for the chosen category. The list of valid category-type combinations is as follows:

    -

    - -
    -
    Antivirus detection
    -
    -
    link, comment, text, hex, attachment, other, anonymised
    -
    Artifacts dropped
    -
    -
    md5, sha1, sha224, sha256, sha384, sha512, sha512/224, sha512/256, sha3-224, sha3-256, sha3-384, sha3-512, ssdeep, imphash, telfhash, impfuzzy, authentihash, vhash, cdhash, filename, filename|md5, filename|sha1, filename|sha224, filename|sha256, filename|sha384, filename|sha512, filename|sha512/224, filename|sha512/256, filename|sha3-224, filename|sha3-256, filename|sha3-384, filename|sha3-512, filename|authentihash, filename|vhash, filename|ssdeep, filename|tlsh, filename|imphash, filename|impfuzzy, filename|pehash, regkey, regkey|value, pattern-in-file, pattern-in-memory, filename-pattern, pdb, stix2-pattern, yara, sigma, attachment, malware-sample, named pipe, mutex, windows-scheduled-task, windows-service-name, windows-service-displayname, comment, text, hex, x509-fingerprint-sha1, x509-fingerprint-md5, x509-fingerprint-sha256, other, cookie, gene, kusto-query, mime-type, anonymised, pgp-public-key, pgp-private-key
    -
    Attribution
    -
    -
    threat-actor, campaign-name, campaign-id, whois-registrant-phone, whois-registrant-email, whois-registrant-name, whois-registrant-org, whois-registrar, whois-creation-date, comment, text, x509-fingerprint-sha1, x509-fingerprint-md5, x509-fingerprint-sha256, other, dns-soa-email, anonymised, email
    -
    External analysis
    -
    -
    md5, sha1, sha256, sha3-224, sha3-256, sha3-384, sha3-512, filename, filename|md5, filename|sha1, filename|sha256, filename|sha3-224, filename|sha3-256, filename|sha3-384, filename|sha3-512, ip-src, ip-dst, ip-dst|port, ip-src|port, mac-address, mac-eui-64, hostname, domain, domain|ip, url, user-agent, regkey, regkey|value, AS, snort, bro, zeek, pattern-in-file, pattern-in-traffic, pattern-in-memory, filename-pattern, vulnerability, cpe, weakness, attachment, malware-sample, link, comment, text, x509-fingerprint-sha1, x509-fingerprint-md5, x509-fingerprint-sha256, ja3-fingerprint-md5, hassh-md5, hasshserver-md5, github-repository, other, cortex, anonymised, community-id
    -
    Financial fraud
    -
    -
    btc, dash, xmr, iban, bic, bank-account-nr, aba-rtn, bin, cc-number, prtn, phone-number, comment, text, other, hex, anonymised
    -
    Internal reference
    -
    -
    text, link, comment, other, hex, anonymised, git-commit-id
    -
    Network activity
    -
    -
    ip-src, ip-dst, ip-dst|port, ip-src|port, port, hostname, domain, domain|ip, mac-address, mac-eui-64, email, email-dst, email-src, eppn, url, uri, user-agent, http-method, AS, snort, pattern-in-file, filename-pattern, stix2-pattern, pattern-in-traffic, attachment, comment, text, x509-fingerprint-md5, x509-fingerprint-sha1, x509-fingerprint-sha256, ja3-fingerprint-md5, hassh-md5, hasshserver-md5, other, hex, cookie, hostname|port, bro, zeek, anonymised, community-id, email-subject
    -
    Other
    -
    -
    comment, text, other, size-in-bytes, counter, datetime, cpe, port, float, hex, phone-number, boolean, anonymised, pgp-public-key, pgp-private-key
    -
    Payload delivery
    -
    -
    md5, sha1, sha224, sha256, sha384, sha512, sha512/224, sha512/256, sha3-224, sha3-256, sha3-384, sha3-512, ssdeep, imphash, telfhash, impfuzzy, authentihash, vhash, pehash, tlsh, cdhash, filename, filename|md5, filename|sha1, filename|sha224, filename|sha256, filename|sha384, filename|sha512, filename|sha512/224, filename|sha512/256, filename|sha3-224, filename|sha3-256, filename|sha3-384, filename|sha3-512, filename|authentihash, filename|vhash, filename|ssdeep, filename|tlsh, filename|imphash, filename|impfuzzy, filename|pehash, mac-address, mac-eui-64, ip-src, ip-dst, ip-dst|port, ip-src|port, hostname, domain, email, email-src, email-dst, email-subject, email-attachment, email-body, url, user-agent, AS, pattern-in-file, pattern-in-traffic, filename-pattern, stix2-pattern, yara, sigma, mime-type, attachment, malware-sample, link, malware-type, comment, text, hex, vulnerability, cpe, weakness, x509-fingerprint-sha1, x509-fingerprint-md5, x509-fingerprint-sha256, ja3-fingerprint-md5, hassh-md5, hasshserver-md5, other, hostname|port, email-dst-display-name, email-src-display-name, email-header, email-reply-to, email-x-mailer, email-mime-boundary, email-thread-index, email-message-id, mobile-application-id, chrome-extension-id, whois-registrant-email, anonymised
    -
    Payload installation
    -
    -
    md5, sha1, sha224, sha256, sha384, sha512, sha512/224, sha512/256, sha3-224, sha3-256, sha3-384, sha3-512, ssdeep, imphash, telfhash, impfuzzy, authentihash, vhash, pehash, tlsh, cdhash, filename, filename|md5, filename|sha1, filename|sha224, filename|sha256, filename|sha384, filename|sha512, filename|sha512/224, filename|sha512/256, filename|sha3-224, filename|sha3-256, filename|sha3-384, filename|sha3-512, filename|authentihash, filename|vhash, filename|ssdeep, filename|tlsh, filename|imphash, filename|impfuzzy, filename|pehash, pattern-in-file, pattern-in-traffic, pattern-in-memory, filename-pattern, stix2-pattern, yara, sigma, vulnerability, cpe, weakness, attachment, malware-sample, malware-type, comment, text, hex, x509-fingerprint-sha1, x509-fingerprint-md5, x509-fingerprint-sha256, mobile-application-id, chrome-extension-id, other, mime-type, anonymised
    -
    Payload type
    -
    -
    comment, text, other, anonymised
    -
    Persistence mechanism
    -
    -
    filename, regkey, regkey|value, comment, text, other, hex, anonymised
    -
    Person
    -
    -
    first-name, middle-name, last-name, date-of-birth, place-of-birth, gender, passport-number, passport-country, passport-expiration, redress-number, nationality, visa-number, issue-date-of-the-visa, primary-residence, country-of-residence, special-service-request, frequent-flyer-number, travel-details, payment-details, place-port-of-original-embarkation, place-port-of-clearance, place-port-of-onward-foreign-destination, passenger-name-record-locator-number, comment, text, other, phone-number, identity-card-number, anonymised, email, pgp-public-key, pgp-private-key
    -
    Social network
    -
    -
    github-username, github-repository, github-organisation, jabber-id, twitter-id, email, email-src, email-dst, eppn, comment, text, other, whois-registrant-email, anonymised, pgp-public-key, pgp-private-key
    -
    Support Tool
    -
    -
    link, text, attachment, comment, other, hex, anonymised
    -
    Targeting data
    -
    -
    target-user, target-email, target-machine, target-org, target-location, target-external, comment, anonymised
    + +
    +
    +
    +
    +
    +

    +2.5.2. ShadowAttribute Attributes +

    +
    +
    +
    +2.5.2.1. uuid +
    +

    uuid represents the Universally Unique IDentifier (UUID) [RFC4122] of the event. The uuid MUST be preserved +for any updates or transfer of the same event. UUID version 4 is RECOMMENDED when assigning it to a new event.

    +

    uuid is represented as a JSON string. uuid MUST be present.

    +
    +
    +
    +
    +
    +2.5.2.2. id +
    +

    id represents the human-readable identifier associated to the event for a specific MISP instance. human-readable identifier MUST be represented as an unsigned integer. +id is represented as a JSON string. id SHALL be present.

    +
    +
    +
    +
    +
    +2.5.2.3. type +
    +

    type represents the means through which an attribute tries to describe the intent of the attribute creator, using a list of pre-defined attribute types.

    +

    type is represented as a JSON string. type MUST be present and it MUST be a valid selection for the chosen category. The list of valid category-type combinations is as follows:

    +
    +
    Antivirus detection
    +
    link, comment, text, hex, attachment, other, anonymised +
    +
    +
    Artifacts dropped
    +
    md5, sha1, sha224, sha256, sha384, sha512, sha512/224, sha512/256, sha3-224, sha3-256, sha3-384, sha3-512, ssdeep, imphash, telfhash, impfuzzy, authentihash, vhash, cdhash, filename, filename|md5, filename|sha1, filename|sha224, filename|sha256, filename|sha384, filename|sha512, filename|sha512/224, filename|sha512/256, filename|sha3-224, filename|sha3-256, filename|sha3-384, filename|sha3-512, filename|authentihash, filename|vhash, filename|ssdeep, filename|tlsh, filename|imphash, filename|impfuzzy, filename|pehash, regkey, regkey|value, pattern-in-file, pattern-in-memory, filename-pattern, pdb, stix2-pattern, yara, sigma, attachment, malware-sample, named pipe, mutex, process-state, windows-scheduled-task, windows-service-name, windows-service-displayname, comment, text, hex, x509-fingerprint-sha1, x509-fingerprint-md5, x509-fingerprint-sha256, other, cookie, gene, kusto-query, mime-type, anonymised, pgp-public-key, pgp-private-key +
    +
    +
    Attribution
    +
    threat-actor, campaign-name, campaign-id, whois-registrant-phone, whois-registrant-email, whois-registrant-name, whois-registrant-org, whois-registrar, whois-creation-date, comment, text, x509-fingerprint-sha1, x509-fingerprint-md5, x509-fingerprint-sha256, other, dns-soa-email, anonymised, email +
    +
    +
    External analysis
    +
    md5, sha1, sha256, sha3-224, sha3-256, sha3-384, sha3-512, filename, filename|md5, filename|sha1, filename|sha256, filename|sha3-224, filename|sha3-256, filename|sha3-384, filename|sha3-512, ip-src, ip-dst, ip-dst|port, ip-src|port, mac-address, mac-eui-64, hostname, domain, domain|ip, url, user-agent, regkey, regkey|value, AS, snort, bro, zeek, pattern-in-file, pattern-in-traffic, pattern-in-memory, filename-pattern, vulnerability, cpe, weakness, attachment, malware-sample, link, comment, text, x509-fingerprint-sha1, x509-fingerprint-md5, x509-fingerprint-sha256, ja3-fingerprint-md5, jarm-fingerprint, hassh-md5, hasshserver-md5, github-repository, other, cortex, anonymised, community-id +
    +
    +
    Financial fraud
    +
    btc, dash, xmr, iban, bic, bank-account-nr, aba-rtn, bin, cc-number, prtn, phone-number, comment, text, other, hex, anonymised +
    +
    +
    Internal reference
    +
    text, link, comment, other, hex, anonymised, git-commit-id +
    +
    +
    Network activity
    +
    ip-src, ip-dst, ip-dst|port, ip-src|port, port, hostname, domain, domain|ip, mac-address, mac-eui-64, email, email-dst, email-src, eppn, url, uri, user-agent, http-method, AS, snort, pattern-in-file, filename-pattern, stix2-pattern, pattern-in-traffic, attachment, comment, text, x509-fingerprint-md5, x509-fingerprint-sha1, x509-fingerprint-sha256, ja3-fingerprint-md5, jarm-fingerprint, hassh-md5, hasshserver-md5, other, hex, cookie, hostname|port, bro, zeek, anonymised, community-id, email-subject, favicon-mmh3, dkim, dkim-signature, ssh-fingerprint +
    +
    +
    Other
    +
    comment, text, other, size-in-bytes, counter, datetime, cpe, port, float, hex, phone-number, boolean, anonymised, pgp-public-key, pgp-private-key +
    +
    +
    Payload delivery
    +
    md5, sha1, sha224, sha256, sha384, sha512, sha512/224, sha512/256, sha3-224, sha3-256, sha3-384, sha3-512, ssdeep, imphash, telfhash, impfuzzy, authentihash, vhash, pehash, tlsh, cdhash, filename, filename|md5, filename|sha1, filename|sha224, filename|sha256, filename|sha384, filename|sha512, filename|sha512/224, filename|sha512/256, filename|sha3-224, filename|sha3-256, filename|sha3-384, filename|sha3-512, filename|authentihash, filename|vhash, filename|ssdeep, filename|tlsh, filename|imphash, filename|impfuzzy, filename|pehash, mac-address, mac-eui-64, ip-src, ip-dst, ip-dst|port, ip-src|port, hostname, domain, email, email-src, email-dst, email-subject, email-attachment, email-body, url, user-agent, AS, pattern-in-file, pattern-in-traffic, filename-pattern, stix2-pattern, yara, sigma, mime-type, attachment, malware-sample, link, malware-type, comment, text, hex, vulnerability, cpe, weakness, x509-fingerprint-sha1, x509-fingerprint-md5, x509-fingerprint-sha256, ja3-fingerprint-md5, jarm-fingerprint, hassh-md5, hasshserver-md5, other, hostname|port, email-dst-display-name, email-src-display-name, email-header, email-reply-to, email-x-mailer, email-mime-boundary, email-thread-index, email-message-id, mobile-application-id, chrome-extension-id, whois-registrant-email, anonymised +
    +
    +
    Payload installation
    +
    md5, sha1, sha224, sha256, sha384, sha512, sha512/224, sha512/256, sha3-224, sha3-256, sha3-384, sha3-512, ssdeep, imphash, telfhash, impfuzzy, authentihash, vhash, pehash, tlsh, cdhash, filename, filename|md5, filename|sha1, filename|sha224, filename|sha256, filename|sha384, filename|sha512, filename|sha512/224, filename|sha512/256, filename|sha3-224, filename|sha3-256, filename|sha3-384, filename|sha3-512, filename|authentihash, filename|vhash, filename|ssdeep, filename|tlsh, filename|imphash, filename|impfuzzy, filename|pehash, pattern-in-file, pattern-in-traffic, pattern-in-memory, filename-pattern, stix2-pattern, yara, sigma, vulnerability, cpe, weakness, attachment, malware-sample, malware-type, comment, text, hex, x509-fingerprint-sha1, x509-fingerprint-md5, x509-fingerprint-sha256, mobile-application-id, chrome-extension-id, other, mime-type, anonymised +
    +
    +
    Payload type
    +
    comment, text, other, anonymised +
    +
    +
    Persistence mechanism
    +
    filename, regkey, regkey|value, comment, text, other, hex, anonymised +
    +
    +
    Person
    +
    first-name, middle-name, last-name, full-name, date-of-birth, place-of-birth, gender, passport-number, passport-country, passport-expiration, redress-number, nationality, visa-number, issue-date-of-the-visa, primary-residence, country-of-residence, special-service-request, frequent-flyer-number, travel-details, payment-details, place-port-of-original-embarkation, place-port-of-clearance, place-port-of-onward-foreign-destination, passenger-name-record-locator-number, comment, text, other, phone-number, identity-card-number, anonymised, email, pgp-public-key, pgp-private-key +
    +
    +
    Social network
    +
    github-username, github-repository, github-organisation, jabber-id, twitter-id, email, email-src, email-dst, eppn, comment, text, other, whois-registrant-email, anonymised, pgp-public-key, pgp-private-key +
    +
    +
    Support Tool
    +
    link, text, attachment, comment, other, hex, anonymised +
    +
    +
    Targeting data
    +
    target-user, target-email, target-machine, target-org, target-location, target-external, comment, anonymised +
    +
    - -

    -

    Attributes are based on the usage within their different communities. Attributes can be extended on a regular basis and this reference document is updated accordingly.

    -

    -2.5.2.4. category -

    -

    category represents the intent of what the attribute is describing as selected by the attribute creator, using a list of pre-defined attribute categories.

    -

    category is represented as a JSON string. category MUST be present and it MUST be a valid selection for the chosen type. The list of valid category-type combinations is mentioned above.

    -

    -2.5.2.5. to_ids -

    -

    to_ids represents whether the Attribute to be created if the ShadowAttribute is accepted is meant to be actionable. Actionable defined attributes that can be used in automated processes as a pattern for detection in Local or Network Intrusion Detection System, log analysis tools or even filtering mechanisms.

    -

    to_ids is represented as a JSON boolean. to_ids MUST be present.

    -

    -2.5.2.6. event_id -

    -

    event_id represents a human-readable identifier referencing the Event object that the ShadowAttribute belongs to.

    -

    The event_id SHOULD be updated when the event is imported to reflect the newly created event's id on the instance.

    -

    event_id is represented as a JSON string. event_id MUST be present.

    -

    -2.5.2.7. old_id -

    -

    old_id represents a human-readable identifier referencing the Attribute object that the ShadowAttribute belongs to. A ShadowAttribute can this way target an existing Attribute, implying that it is a proposal to modify an existing Attribute, or alternatively it can be a proposal to create a new Attribute for the containing Event.

    -

    The old_id SHOULD be updated when the event is imported to reflect the newly created Attribute's id on the instance. Alternatively, if the ShadowAttribute proposes the creation of a new Attribute, it should be set to 0.

    -

    old_id is represented as a JSON string. old_id MUST be present.

    -

    -2.5.2.8. timestamp -

    -

    timestamp represents a reference time when the attribute was created or last modified. timestamp is expressed in seconds (decimal) since 1st of January 1970 (Unix timestamp). The time zone MUST be UTC.

    -

    timestamp is represented as a JSON string. timestamp MUST be present.

    -

    -2.5.2.9. comment -

    -

    comment is a contextual comment field.

    -

    comment is represented by a JSON string. comment MAY be present.

    -

    -2.5.2.10. org_id -

    -

    org_id represents a human-readable identifier referencing the proposal creator's Organisation object. A human-readable identifier MUST be represented as an unsigned integer.

    -

    Whilst attributes can only be created by the event creator organisation, shadow attributes can be created by third parties. org_id tracks the creator organisation.

    -

    org_id is represented by a JSON string and MUST be present.

    -

    -2.5.2.11. proposal_to_delete -

    -

    proposal_to_delete is a boolean flag that sets whether the shadow attribute proposes to alter an attribute, or whether it proposes to remove it completely.

    -

    Accepting a shadow attribute with this flag set will remove the target attribute.

    -

    proposal_to_delete is a JSON boolean and it MUST be present. If proposal_to_delete is set to true, old_id MUST NOT be 0.

    -

    -2.5.2.12. deleted -

    -

    deleted represents a setting that allows shadow attributes to be revoked. Revoked shadow attributes only serve to inform other instances that the shadow attribute is no longer active.

    -

    deleted is represented by a JSON boolean. deleted SHOULD be present.

    -

    -2.5.2.13. data -

    -

    data contains the base64 encoded contents of an attachment or a malware sample. For malware samples, the sample MUST be encrypted using a password protected zip archive, with the password being "infected".

    -

    data is represented by a JSON string in base64 encoding. data MUST be set for shadow attributes of type malware-sample and attachment.

    -

    -2.5.2.14. first_seen -

    -

    firstseen represents a reference time when the attribute was first seen. firstseen as an ISO 8601 datetime up to the micro-second with time zone support.

    -

    firstseen is represented as a JSON string. firstseen MAY be present.

    -

    -2.5.2.15. last_seen -

    -

    lastseen represents a reference time when the attribute was last seen. lastseen as an ISO 8601 datetime up to the micro-second with time zone support.

    -

    lastseen is represented as a JSON string. lastseen MAY be present.

    -

    -2.5.3. Org -

    -

    An Org object is composed of an uuid, name and id.

    -

    The uuid represents the Universally Unique IDentifier (UUID) [RFC4122] of the organization. The organization UUID is globally assigned to an organization and SHALL be kept overtime.

    -

    The name is a readable description of the organization and SHOULD be present. The id is a human-readable identifier generated by the instance and used as reference in the event. A human-readable identifier MUST be represented as an unsigned integer.

    -

    uuid, name and id are represented as a JSON string. uuid, name and id MUST be present.

    -

    -2.5.3.1. Sample Org Object -

    +

    Attributes are based on the usage within their different communities. Attributes can be extended on a regular basis and this reference document is updated accordingly.

    +
    +
    +
    +
    +
    +2.5.2.4. category +
    +

    category represents the intent of what the attribute is describing as selected by the attribute creator, using a list of pre-defined attribute categories.

    +

    category is represented as a JSON string. category MUST be present and it MUST be a valid selection for the chosen type. The list of valid category-type combinations is mentioned above.

    +
    +
    +
    +
    +
    +2.5.2.5. to_ids +
    +

    to_ids represents whether the Attribute to be created if the ShadowAttribute is accepted is meant to be actionable. Actionable defined attributes that can be used in automated processes as a pattern for detection in Local or Network Intrusion Detection System, log analysis tools or even filtering mechanisms.

    +

    to_ids is represented as a JSON boolean. to_ids MUST be present.

    +
    +
    +
    +
    +
    +2.5.2.6. event_id +
    +

    event_id represents a human-readable identifier referencing the Event object that the ShadowAttribute belongs to.

    +

    The event_id SHOULD be updated when the event is imported to reflect the newly created event's id on the instance.

    +

    event_id is represented as a JSON string. event_id MUST be present.

    +
    +
    +
    +
    +
    +2.5.2.7. old_id +
    +

    old_id represents a human-readable identifier referencing the Attribute object that the ShadowAttribute belongs to. A ShadowAttribute can this way target an existing Attribute, implying that it is a proposal to modify an existing Attribute, or alternatively it can be a proposal to create a new Attribute for the containing Event.

    +

    The old_id SHOULD be updated when the event is imported to reflect the newly created Attribute's id on the instance. Alternatively, if the ShadowAttribute proposes the creation of a new Attribute, it should be set to 0.

    +

    old_id is represented as a JSON string. old_id MUST be present.

    +
    +
    +
    +
    +
    +2.5.2.8. timestamp +
    +

    timestamp represents a reference time when the attribute was created or last modified. timestamp is expressed in seconds (decimal) since 1st of January 1970 (Unix timestamp). The time zone MUST be UTC.

    +

    timestamp is represented as a JSON string. timestamp MUST be present.

    +
    +
    +
    +
    +
    +2.5.2.9. comment +
    +

    comment is a contextual comment field.

    +

    comment is represented by a JSON string. comment MAY be present.

    +
    +
    +
    +
    +
    +2.5.2.10. org_id +
    +

    org_id represents a human-readable identifier referencing the proposal creator's Organisation object. A human-readable identifier MUST be represented as an unsigned integer.

    +

    Whilst attributes can only be created by the event creator organisation, shadow attributes can be created by third parties. org_id tracks the creator organisation.

    +

    org_id is represented by a JSON string and MUST be present.

    +
    +
    +
    +
    +
    +2.5.2.11. proposal_to_delete +
    +

    proposal_to_delete is a boolean flag that sets whether the shadow attribute proposes to alter an attribute, or whether it proposes to remove it completely.

    +

    Accepting a shadow attribute with this flag set will remove the target attribute.

    +

    proposal_to_delete is a JSON boolean and it MUST be present. If proposal_to_delete is set to true, old_id MUST NOT be 0.

    +
    +
    +
    +
    +
    +2.5.2.12. deleted +
    +

    deleted represents a setting that allows shadow attributes to be revoked. Revoked shadow attributes only serve to inform other instances that the shadow attribute is no longer active.

    +

    deleted is represented by a JSON boolean. deleted SHOULD be present.

    +
    +
    +
    +
    +
    +2.5.2.13. data +
    +

    data contains the base64 encoded contents of an attachment or a malware sample. For malware samples, +the sample MUST be encrypted using a password protected zip archive, with the password being "infected".

    +

    data is represented by a JSON string in base64 encoding. data MUST be set for shadow attributes of type malware-sample and attachment.

    +
    +
    +
    +
    +
    +2.5.2.14. first_seen +
    +

    firstseen represents a reference time when the attribute was first seen. firstseen as an ISO 8601 datetime up to the micro-second with time zone support.

    +

    firstseen is represented as a JSON string. firstseen MAY be present.

    +
    +
    +
    +
    +
    +2.5.2.15. last_seen +
    +

    lastseen represents a reference time when the attribute was last seen. lastseen as an ISO 8601 datetime up to the micro-second with time zone support.

    +

    lastseen is represented as a JSON string. lastseen MAY be present.

    +
    +
    +
    +
    +
    +
    +

    +2.5.3. Org +

    +

    An Org object is composed of an uuid, name and id.

    +

    The uuid represents the Universally Unique IDentifier (UUID) [RFC4122] of the organization. +The organization UUID is globally assigned to an organization and SHALL be kept overtime.

    +

    The name is a readable description of the organization and SHOULD be present. +The id is a human-readable identifier generated by the instance and used as reference in the event. +A human-readable identifier MUST be represented as an unsigned integer.

    +

    uuid, name and id are represented as a JSON string. uuid, name and id MUST be present.

    +
    +
    +
    +2.5.3.1. Sample Org Object +
    +
    "Org": {
         "id": "2",
         "name": "CIRCL",
         "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"
        }
-
    -

    -2.5.3.2. value -

    -

    value represents the payload of an attribute. The format of the value is dependent on the type of the attribute.

    -

    value is represented by a JSON string. value MUST be present.

    -

    -2.6. Object -

    -

    Objects serve as a contextual bond between a list of attributes within an event. Their main purpose is to describe more complex structures than can be described by a single attribute Each object is created using an Object Template and carries the meta-data of the template used for its creation within. Objects belong to a meta-category and are defined by a name.

    -

    The schema used is described by the templateuuid and templateversion fields.

    -

    A MISP document containing an Object MUST contain a name, a meta-category, a description, a templateuuid and a templateversion as described in the "Object Attributes" section.

    -

    -2.6.1. Sample Object -

    -
    -
    + +
    +
    +
    +
    +
    +
    +2.5.3.2. value +
    +

    value represents the payload of an attribute. The format of the value is dependent on the type of the attribute.

    +

    value is represented by a JSON string. value MUST be present.

    +
    +
    +
    +
    +
    +
    +
    +
    +

    +2.6. Object +

    +

    Objects serve as a contextual bond between a list of attributes within an event. Their main purpose is to describe more complex structures than can be described by a single attribute +Each object is created using an Object Template and carries the meta-data of the template used for its creation within. Objects belong to a meta-category and are defined by a name.

    +

    The schema used is described by the templateuuid and templateversion fields.

    +

    A MISP document containing an Object MUST contain a name, a meta-category, a description, a templateuuid and a templateversion as described in the "Object Attributes" section.

    +
    +
    +

    +2.6.1. Sample Object +

    +
    +
    "Object": {
    "id": "588",
    "name": "file",
@@ -1203,119 +2404,204 @@
      "last_seen": null
    ]
 }
-
    -

    Figure 1

    -

    -2.6.2. Object Attributes -

    -

    -2.6.2.1. uuid -

    -

    uuid represents the Universally Unique IDentifier (UUID) [RFC4122] of the object. The uuid MUST be preserved for any updates or transfer of the same object. UUID version 4 is RECOMMENDED when assigning it to a new object.

    -

    -2.6.2.2. id -

    -

    id represents the human-readable identifier associated to the object for a specific MISP instance. A human-readable identifier MUST be represented as an unsigned integer.

    -

    id is represented as a JSON string. id SHALL be present.

    -

    -2.6.2.3. name -

    -

    name represents the human-readable name of the object describing the intent of the object package.

    -

    name is represented as a JSON string. name MUST be present

    -

    -2.6.2.4. meta-category -

    -

    meta-category represents the sub-category of objects that the given object belongs to. meta-categories are not tied to a fixed list of options but can be created on the fly.

    -

    meta-category is represented as a JSON string. meta-category MUST be present

    -

    -2.6.2.5. description -

    -

    description is a human-readable description of the given object type, as derived from the template used for creation.

    -

    description is represented as a JSON string. id SHALL be present.

    -

    -2.6.2.6. template_uuid -

    -

    uuid represents the Universally Unique IDentifier (UUID) [RFC4122] of the template used to create the object. The uuid MUST be preserved to preserve the object's association with the correct template used for creation. UUID version 4 is RECOMMENDED when assigning it to a new object.

    -

    -2.6.2.7. template_version -

    -

    templateversion represents a numeric incrementing version of the template used to create the object. It is used to associate the object to the correct version of the template and together with the templateuuid forms an association to the correct template type and version.

    -

    version is represented as a JSON string. version MUST be present.

    -

    -2.6.2.8. event_id -

    -

    event_id represents the human-readable identifier of the event that the object belongs to on a specific MISP instance. A human-readable identifier MUST be represented as an unsigned integer.

    -

    eventid is represented as a JSON string. eventid SHALL be present.

    -

    -2.6.2.9. timestamp -

    -

    timestamp represents a reference time when the object was created or last modified. timestamp is expressed in seconds (decimal) since 1st of January 1970 (Unix timestamp). The time zone MUST be UTC.

    -

    timestamp is represented as a JSON string. timestamp MUST be present.

    -

    -2.6.2.10. distribution -

    -

    distribution represents the basic distribution rules of the object. The system must adhere to the distribution setting for access control and for dissemination of the object.

    -

    distribution is represented by a JSON string. distribution MUST be present and be one of the following options:

    -

    - -
    -
    0
    -
    -
    Your Organisation Only
    -
    1
    -
    -
    This Community Only
    -
    2
    -
    -
    Connected Communities
    -
    3
    -
    -
    All Communities
    -
    4
    -
    -
    Sharing Group
    + +
    +
    +
    +
    +
    +
    +

    +2.6.2. Object Attributes +

    +
    +
    +
    +2.6.2.1. uuid +
    +

    uuid represents the Universally Unique IDentifier (UUID) [RFC4122] of the object. The uuid MUST be preserved +for any updates or transfer of the same object. UUID version 4 is RECOMMENDED when assigning it to a new object.

    +
    +
    +
    +
    +
    +2.6.2.2. id +
    +

    id represents the human-readable identifier associated to the object for a specific MISP instance. A human-readable identifier MUST be +represented as an unsigned integer.

    +

    id is represented as a JSON string. id SHALL be present.

    +
    +
    +
    +
    +
    +2.6.2.3. name +
    +

    name represents the human-readable name of the object describing the intent of the object package.

    +

    name is represented as a JSON string. name MUST be present

    +
    +
    +
    +
    +
    +2.6.2.4. meta-category +
    +

    meta-category represents the sub-category of objects that the given object belongs to. meta-categories are not +tied to a fixed list of options but can be created on the fly.

    +

    meta-category is represented as a JSON string. meta-category MUST be present

    +
    +
    +
    +
    +
    +2.6.2.5. description +
    +

    description is a human-readable description of the given object type, as derived from the template used for creation.

    +

    description is represented as a JSON string. id SHALL be present.

    +
    +
    +
    +
    +
    +2.6.2.6. template_uuid +
    +

    uuid represents the Universally Unique IDentifier (UUID) [RFC4122] of the template used to create the object. The uuid MUST be preserved +to preserve the object's association with the correct template used for creation. UUID version 4 is RECOMMENDED when assigning it to a new object.

    +
    +
    +
    +
    +
    +2.6.2.7. template_version +
    +

    templateversion represents a numeric incrementing version of the template used to create the object. It is used to associate the object to the +correct version of the template and together with the templateuuid forms an association to the correct template type and version.

    +

    version is represented as a JSON string. version MUST be present.

    +
    +
    +
    +
    +
    +2.6.2.8. event_id +
    +

    event_id represents the human-readable identifier of the event that the object belongs to on a specific MISP instance. A human-readable identifier MUST be +represented as an unsigned integer.

    +

    eventid is represented as a JSON string. eventid SHALL be present.

    +
    +
    +
    +
    +
    +2.6.2.9. timestamp +
    +

    timestamp represents a reference time when the object was created or last modified. timestamp is expressed in seconds (decimal) since 1st of January 1970 (Unix timestamp). The time zone MUST be UTC.

    +

    timestamp is represented as a JSON string. timestamp MUST be present.

    +
    +
    +
    +
    +
    +2.6.2.10. distribution +
    +

    distribution represents the basic distribution rules of the object. The system must adhere to the distribution setting for access control and for dissemination of the object.

    +

    distribution is represented by a JSON string. distribution MUST be present and be one of the following options:

    +
    +
    0
    +
    Your Organisation Only +
    +
    +
    1
    +
    This Community Only +
    +
    +
    2
    +
    Connected Communities +
    +
    +
    3
    +
    All Communities +
    +
    +
    4
    +
    Sharing Group +
    +
    - -

    -

    -2.6.2.11. sharing_group_id -

    -

    sharing_group_id represents a human-readable identifier referencing a Sharing Group object that defines the distribution of the object, if distribution level "4" is set. A human-readable identifier MUST be represented as an unsigned integer.

    -

    sharing_group_id is represented by a JSON string and SHOULD be present. If a distribution level other than "4" is chosen the sharing_group_id MUST be set to "0".

    -

    -2.6.2.12. comment -

    -

    comment is a contextual comment field.

    -

    comment is represented by a JSON string. comment MAY be present.

    -

    -2.6.2.13. deleted -

    -

    deleted represents a setting that allows attributes to be revoked. Revoked attributes are not actionable and exist merely to inform other instances of a revocation.

    -

    deleted is represented by a JSON boolean. deleted MUST be present.

    -

    -2.6.2.14. Attribute -

    -

    Attribute is an array of attributes that describe the object with data.

    -

    Each attribute in an object MUST contain the parent event's ID in the eventid field and the parent object's ID in the objectid field.

    -

    -2.6.2.15. first_seen -

    -

    firstseen represents a reference time when the object was first seen. firstseen as an ISO 8601 datetime up to the micro-second with time zone support.

    -

    firstseen is represented as a JSON string. firstseen MAY be present.

    -

    -2.6.2.16. last_seen -

    -

    lastseen represents a reference time when the object was last seen. lastseen as an ISO 8601 datetime up to the micro-second with time zone support.

    -

    lastseen is represented as a JSON string. lastseen MAY be present.

    -

    -2.7. Object References -

    -

    Object References serve as a logical link between an Object and another referenced Object or Attribute. The relationship is categorised by an enumerated value from a fixed vocabulary.

    -

    The relationship_type is recommended to be taken from the MISP object relationship list [[MISP-R]] is RECOMMENDED to ensure a coherent naming of the tags

    -

    All Object References MUST contain an object_uuid, a referenced_uuid and a relationship type.

    -

    -2.7.1. Sample ObjectReference object -

    +
    +
    +
    +
    +
    +2.6.2.11. sharing_group_id +
    +

    sharing_group_id represents a human-readable identifier referencing a Sharing Group object that defines the distribution of the object, if distribution level "4" is set. A human-readable identifier MUST be represented as an unsigned integer.

    +

    sharing_group_id is represented by a JSON string and SHOULD be present. If a distribution level other than "4" is chosen the sharing_group_id MUST be set to "0".

    +
    +
    +
    +
    +
    +2.6.2.12. comment +
    +

    comment is a contextual comment field.

    +

    comment is represented by a JSON string. comment MAY be present.

    +
    +
    +
    +
    +
    +2.6.2.13. deleted +
    +

    deleted represents a setting that allows attributes to be revoked. Revoked attributes are not actionable and exist merely to inform other instances of a revocation.

    +

    deleted is represented by a JSON boolean. deleted MUST be present.

    +
    +
    +
    +
    +
    +2.6.2.14. Attribute +
    +

    Attribute is an array of attributes that describe the object with data.

    +

    Each attribute in an object MUST contain the parent event's ID in the eventid field and the parent object's ID in the objectid field.

    +
    +
    +
    +
    +
    +2.6.2.15. first_seen +
    +

    firstseen represents a reference time when the object was first seen. firstseen as an ISO 8601 datetime up to the micro-second with time zone support.

    +

    firstseen is represented as a JSON string. firstseen MAY be present.

    +
    +
    +
    +
    +
    +2.6.2.16. last_seen +
    +

    lastseen represents a reference time when the object was last seen. lastseen as an ISO 8601 datetime up to the micro-second with time zone support.

    +

    lastseen is represented as a JSON string. lastseen MAY be present.

    +
    +
    +
    +
    +
    +
    +
    +
    +

    +2.7. Object References +

    +

    Object References serve as a logical link between an Object and another referenced Object or Attribute. The relationship is categorised by an enumerated value from a fixed vocabulary.

    +

    The relationship_type is recommended to be taken from the MISP object relationship list [[MISP-R]] is RECOMMENDED to ensure a coherent naming of the tags

    +

    All Object References MUST contain an object_uuid, a referenced_uuid and a relationship type.

    +
    +
    +

    +2.7.1. Sample ObjectReference object +

    +
    "ObjectReference": {
                     "id": "195",
                     "uuid": "59c21a2c-c0ac-4083-93b3-363da07724d1",
@@ -1330,232 +2616,371 @@
                     "object_uuid": "59c1134d-8a40-4c14-ad94-0f7ba07724d1",
                     "referenced_uuid": "59c1133c-9adc-4d06-a34b-0f7ca07724d1",
                    }
-
    -

    -2.7.2. ObjectReference Attributes -

    -

    -2.7.2.1. uuid -

    -

    uuid represents the Universally Unique IDentifier (UUID) [RFC4122] of the object reference. The uuid MUST be preserved for any updates or transfer of the same object reference. UUID version 4 is RECOMMENDED when assigning it to a new object reference.

    -

    -2.7.2.2. id -

    -

    id represents the human-readable identifier associated to the object reference for a specific MISP instance.

    -

    id is represented as a JSON string. id SHALL be present.

    -

    -2.7.2.3. timestamp -

    -

    timestamp represents a reference time when the object was created or last modified. timestamp is expressed in seconds (decimal) since 1st of January 1970 (Unix timestamp). The time zone MUST be UTC.

    -

    timestamp is represented as a JSON string. timestamp MUST be present.

    -

    -2.7.2.4. object_id -

    -

    object_id represents the human-readable identifier of the object that the object reference belongs to on a specific MISP instance. A human-readable identifier MUST be represented as an unsigned integer.

    -

    eventid is represented as a JSON string. eventid SHALL be present.

    -

    -2.7.2.5. event_id -

    -

    event_id represents the human-readable identifier of the event that the object reference belongs to on a specific MISP instance. A human-readable identifier MUST be represented as an unsigned integer.

    -

    eventid is represented as a JSON string. eventid SHALL be present.

    -

    -2.7.2.6. referenced_id -

    -

    referenced_id represents the human-readable identifier of the object or attribute that the parent object of the object reference points to on a specific MISP instance.

    -

    referencedid is represented as a JSON string. referencedid MAY be present.

    -

    -2.7.2.7. referenced_type -

    -

    referenced_type represents the numeric value describing what the object reference points to, "0" representing an attribute and "1" representing an object

    -

    referencedtype is represented as a JSON string. referencedtype MAY be present.

    -

    -2.7.2.8. relationship_type -

    -

    relationshiptype represents the human-readable context of the relationship between an object and another object or attribute as described by the objectreference.

    -

    referencedtype is represented as a JSON string. relationshiptype MUST be present.

    -

    -2.7.2.9. comment -

    -

    comment is a contextual comment field.

    -

    comment is represented by a JSON string. comment MAY be present.

    -

    -2.7.2.10. deleted -

    -

    deleted represents a setting that allows object references to be revoked. Revoked object references are not actionable and exist merely to inform other instances of a revocation.

    -

    deleted is represented by a JSON boolean. deleted MUST be present.

    -

    -2.7.2.11. object_uuid -

    -

    object_uuid represents the Universally Unique IDentifier (UUID) [RFC4122] of the object that the given object reference belongs to. The object_uuid MUST be preserved to preserve the object reference's association with the object.

    -

    -2.7.2.12. referenced_uuid -

    -

    referenced_uuid represents the Universally Unique IDentifier (UUID) [RFC4122] of the object or attribute that is being referenced by the object reference. The referenced_uuid MUST be preserved to preserve the object reference's association with the object or attribute.

    -

    -2.8. EventReport -

    -

    EventReport are used to complement an event with one or more report in Markdown format. The EventReport contains unstructured information which can be linked to Attributes, Objects, Tags or Galaxy with an extension to the Markdown marking language.

    -

    -2.8.1. id -

    -

    id represents the human-readable identifier associated to the EventReport for a specific MISP instance. A human-readable identifier MUST be represented as an unsigned integer.

    -

    id is represented as a JSON string. id SHALL be present.

    -

    -2.8.2. UUID -

    -

    uuid represents the Universally Unique IDentifier (UUID) [RFC4122] of the EventReport. The uuid MUST be preserved for any updates or transfer of the same EventReport. UUID version 4 is RECOMMENDED when assigning it to a new EventReport.

    -

    uuid is represented as a JSON string. uuid MUST be present.

    -

    -2.8.3. event_id -

    -

    event_id represents the human-readable identifier associating the EventReport to an event on a specific MISP instance. A human-readable identifier MUST be represented as an unsigned integer.

    -

    event_id is represented as a JSON string. event_id MUST be present.

    -

    -2.8.4. name -

    -

    name represents the information field of the EventReport. name is a free-text value to provide a human-readable summary of the report. name SHOULD NOT be bigger than 256 characters and SHOULD NOT include new-lines.

    -

    name is represented as a JSON string. name MUST be present.

    -

    -2.8.5. content -

    -

    content includes the raw EventReport in Markdown format with or without the specific MISP Markdown markup extension.

    -

    The markdown extension for MISP is composed with a symbol as prefix then between square bracket the scope (attribute, object, tag or galaxymatrix) followed by the UUID in parenthesis.

    -

    content is represented as a JSON string. content MUST be present.

    -

    -2.8.6. distribution -

    -

    distribution represents the basic distribution rules of the EventReport. The system must adhere to the distribution setting for access control and for dissemination of the EventReport.

    -

    distribution is represented by a JSON string. distribution MUST be present and be one of the following options:

    -

    - -
    -
    0
    -
    -
    Your Organisation Only
    -
    1
    -
    -
    This Community Only
    -
    2
    -
    -
    Connected Communities
    -
    3
    -
    -
    All Communities
    -
    4
    -
    -
    Sharing Group
    -
    5
    -
    -
    Inherit Event
    + +
    +
    +
    +
    +
    +

    +2.7.2. ObjectReference Attributes +

    +
    +
    +
    +2.7.2.1. uuid +
    +

    uuid represents the Universally Unique IDentifier (UUID) [RFC4122] of the object reference. The uuid MUST be preserved +for any updates or transfer of the same object reference. UUID version 4 is RECOMMENDED when assigning it to a new object reference.

    +
    +
    +
    +
    +
    +2.7.2.2. id +
    +

    id represents the human-readable identifier associated to the object reference for a specific MISP instance.

    +

    id is represented as a JSON string. id SHALL be present.

    +
    +
    +
    +
    +
    +2.7.2.3. timestamp +
    +

    timestamp represents a reference time when the object was created or last modified. timestamp is expressed in seconds (decimal) since 1st of January 1970 (Unix timestamp). The time zone MUST be UTC.

    +

    timestamp is represented as a JSON string. timestamp MUST be present.

    +
    +
    +
    +
    +
    +2.7.2.4. object_id +
    +

    object_id represents the human-readable identifier of the object that the object reference belongs to on a specific MISP instance. A human-readable identifier MUST be +represented as an unsigned integer.

    +

    eventid is represented as a JSON string. eventid SHALL be present.

    +
    +
    +
    +
    +
    +2.7.2.5. event_id +
    +

    event_id represents the human-readable identifier of the event that the object reference belongs to on a specific MISP instance. A human-readable identifier MUST be +represented as an unsigned integer.

    +

    eventid is represented as a JSON string. eventid SHALL be present.

    +
    +
    +
    +
    +
    +2.7.2.6. referenced_id +
    +

    referenced_id represents the human-readable identifier of the object or attribute that the parent object of the object reference points to on a specific MISP instance.

    +

    referencedid is represented as a JSON string. referencedid MAY be present.

    +
    +
    +
    +
    +
    +2.7.2.7. referenced_type +
    +

    referenced_type represents the numeric value describing what the object reference points to, "0" representing an attribute and "1" representing an object

    +

    referencedtype is represented as a JSON string. referencedtype MAY be present.

    +
    +
    +
    +
    +
    +2.7.2.8. relationship_type +
    +

    relationshiptype represents the human-readable context of the relationship between an object and another object or attribute as described by the objectreference.

    +

    referencedtype is represented as a JSON string. relationshiptype MUST be present.

    +
    +
    +
    +
    +
    +2.7.2.9. comment +
    +

    comment is a contextual comment field.

    +

    comment is represented by a JSON string. comment MAY be present.

    +
    +
    +
    +
    +
    +2.7.2.10. deleted +
    +

    deleted represents a setting that allows object references to be revoked. Revoked object references are not actionable and exist merely to inform other instances of a revocation.

    +

    deleted is represented by a JSON boolean. deleted MUST be present.

    +
    +
    +
    +
    +
    +2.7.2.11. object_uuid +
    +

    object_uuid represents the Universally Unique IDentifier (UUID) [RFC4122] of the object that the given object reference belongs to. The object_uuid MUST be preserved +to preserve the object reference's association with the object.

    +
    +
    +
    +
    +
    +2.7.2.12. referenced_uuid +
    +

    referenced_uuid represents the Universally Unique IDentifier (UUID) [RFC4122] of the object or attribute that is being referenced by the object reference. The referenced_uuid MUST be preserved +to preserve the object reference's association with the object or attribute.

    +
    +
    +
    +
    +
    +
    +
    +
    +

    +2.8. EventReport +

    +

    EventReport are used to complement an event with one or more report in Markdown format. The EventReport contains unstructured information which can be linked to Attributes, Objects, Tags or Galaxy with +an extension to the Markdown marking language.

    +
    +
    +

    +2.8.1. id +

    +

    id represents the human-readable identifier associated to the EventReport for a specific MISP instance. A human-readable identifier MUST be +represented as an unsigned integer.

    +

    id is represented as a JSON string. id SHALL be present.

    +
    +
    +
    +
    +

    +2.8.2. UUID +

    +

    uuid represents the Universally Unique IDentifier (UUID) [RFC4122] of the EventReport. The uuid MUST be preserved for any updates or transfer of the same EventReport. UUID version 4 is RECOMMENDED when assigning it to a new EventReport.

    +

    uuid is represented as a JSON string. uuid MUST be present.

    +
    +
    +
    +
    +

    +2.8.3. event_id +

    +

    event_id represents the human-readable identifier associating the EventReport to an event on a specific MISP instance. A human-readable identifier MUST be +represented as an unsigned integer.

    +

    event_id is represented as a JSON string. event_id MUST be present.

    +
    +
    +
    +
    +

    +2.8.4. name +

    +

    name represents the information field of the EventReport. name is a free-text value to provide a human-readable summary +of the report. name SHOULD NOT be bigger than 256 characters and SHOULD NOT include new-lines.

    +

    name is represented as a JSON string. name MUST be present.

    +
    +
    +
    +
    +

    +2.8.5. content +

    +

    content includes the raw EventReport in Markdown format with or without the specific MISP Markdown markup extension.

    +

    The markdown extension for MISP is composed with a symbol as prefix then between square bracket the scope (attribute, object, tag or galaxymatrix) followed by the UUID in parenthesis.

    +

    content is represented as a JSON string. content MUST be present.

    +
    +
    +
    +
    +

    +2.8.6. distribution +

    +

    distribution represents the basic distribution rules of the EventReport. The system must adhere to the distribution setting for access control and for dissemination of the EventReport.

    +

    distribution is represented by a JSON string. distribution MUST be present and be one of the following options:

    +
    +
    0
    +
    Your Organisation Only +
    +
    +
    1
    +
    This Community Only +
    +
    +
    2
    +
    Connected Communities +
    +
    +
    3
    +
    All Communities +
    +
    +
    4
    +
    Sharing Group +
    +
    +
    5
    +
    Inherit Event +
    +
    - -

    -

    -2.8.7. sharing_group_id -

    -

    sharing_group_id represents the local id to the MISP local instance of the Sharing Group associated for the distribution.

    -

    sharing_group_id is represented by a JSON string. sharing_group_id MUST be present and set to "0" if not used.

    -

    -2.8.8. timestamp -

    -

    timestamp represents a reference time when the EventReport was created or last modified. timestamp is expressed in seconds (decimal) since 1st of January 1970 (Unix timestamp). The time zone MUST be UTC.

    -

    timestamp is represented as a JSON string. timestamp MUST be present.

    -

    -2.8.9. deleted -

    -

    deleted represents a setting that allows EventReport to be revoked. Revoked EventReport are not actionable and exist merely to inform other instances of a revocation.

    -

    deleted is represented by a JSON boolean. deleted MUST be present.

    -

    -2.9. Tag -

    -

    A tag is a simple method to classify an event with a simple string. The tag name can be freely chosen. The tag name can be also chosen from a fixed machine-tag vocabulary called MISP taxonomies[[MISP-T]]. When an event is distributed outside an organisation, the use of MISP taxonomies[[MISP-T]] is RECOMMENDED to ensure a coherent naming of the tags. A tag is represented as a JSON array where each element describes each tag associated. A tag array SHALL be at event level or attribute level. A tag element is described with a name, id, colour and exportable flag.

    -

    exportable represents a setting if the tag is kept local or exportable to other MISP instances. exportable is represented by a JSON boolean. id is a human-readable identifier that references the tag on the local instance. colour represents an RGB value of the tag.

    -

    name MUST be present. colour, id and exportable SHALL be present.

    -

    -2.9.1. Sample Tag -

    +
    +
    +
    +
    +

    +2.8.7. sharing_group_id +

    +

    sharing_group_id represents the local id to the MISP local instance of the Sharing Group associated for the distribution.

    +

    sharing_group_id is represented by a JSON string. sharing_group_id MUST be present and set to "0" if not used.

    +
    +
    +
    +
    +

    +2.8.8. timestamp +

    +

    timestamp represents a reference time when the EventReport was created or last modified. timestamp is expressed in seconds (decimal) since 1st of January 1970 (Unix timestamp). The time zone MUST be UTC.

    +

    timestamp is represented as a JSON string. timestamp MUST be present.

    +
    +
    +
    +
    +

    +2.8.9. deleted +

    +

    deleted represents a setting that allows EventReport to be revoked. Revoked EventReport are not actionable and exist merely to inform other instances of a revocation.

    +

    deleted is represented by a JSON boolean. deleted MUST be present.

    +
    +
    +
    +
    +
    +
    +

    +2.9. Tag +

    +

    A tag is a simple method to classify an event with a simple string. The tag name can be freely chosen. The tag name can be also chosen from a fixed machine-tag vocabulary called MISP taxonomies[[MISP-T]]. When an event is distributed outside an organisation, the use of MISP taxonomies[[MISP-T]] is RECOMMENDED to ensure a coherent naming of the tags. A tag is represented as a JSON array where each element describes each tag associated. A tag array SHALL be at event level or attribute level. A tag element is described with a name, id, colour and exportable flag.

    +

    exportable represents a setting if the tag is kept local or exportable to other MISP instances. exportable is represented by a JSON boolean. id is a human-readable identifier that references the tag on the local instance. colour represents an RGB value of the tag.

    +

    name MUST be present. colour, id and exportable SHALL be present.

    +
    +
    +

    +2.9.1. Sample Tag +

    +
    "Tag": [{
         "exportable": true,
         "colour": "#ffffff",
         "name": "tlp:white",
         "id": "2" }]
-
    -

    -2.10. Sighting -

    -

    A sighting is an ascertainment which describes whether an attribute has been seen under a given set of conditions. The sighting can include the organisation who sighted the attribute or can be anonymised. Sighting is composed of a JSON array in which each element describes one singular instance of a sighting. A sighting element is a JSON object composed of the following values:

    -

    type MUST be present. type describes the type of a sighting. MISP allows 3 default types:

    - - - - - - - - - - - - - - - - - - - -
    Sighting typeDescription
    0denotes an attribute which has been seen
    1denotes an attribute which has been seen and confirmed as false-positive
    2denotes an attribute which will be expired at the time of the sighting
    -

    uuid MUST be present. uuid references the uuid of the sighted attribute.

    -

    datesighting MUST be present. datesighting is expressed in seconds (decimal) elapsed since 1st of January 1970 (Unix timestamp). date_sighting represents when the referenced attribute, designated by its uuid, is sighted.

    -

    source MAY be present. source is represented as a JSON string and represents the human-readable version of the sighting source, which can be a given piece of software (e.g. SIEM), device or a specific analytical process.

    -

    id, eventid and attributeid MAY be present.

    -

    id represents the human-readable identifier of the sighting reference which belongs to a specific MISP instance. eventid represents the human-readable identifier of the event referenced by the sighting and belongs to a specific MISP instance. attributeid represents the human-readable identifier of the attribute referenced by the sighting and belongs to a specific MISP instance.

    -

    orgid MAY be present along the JSON object describing the organisation. If the orgid is not present, the sighting is considered as anonymised.

    -

    org_id represents the human-readable identifier of the organisation which did the sighting and belongs to a specific MISP instance.

    -

    A human-readable identifier MUST be represented as an unsigned integer.

    -

    -2.10.1. Sample Sighting -

    + +
    +
    +
    +
    +
    +
    +
    +

    +2.10. Sighting +

    +

    A sighting is an ascertainment which describes whether an attribute has been seen under a given set of conditions. The sighting can include the organisation who sighted the attribute or can +be anonymised. Sighting is composed of a JSON array in which each element describes one singular instance of a sighting. A sighting element is a JSON object composed of the following values:

    +

    type MUST be present. type describes the type of a sighting. MISP allows 3 default types:

    + + + + + + + + + + + + + + + + + + + + + + +
    Table 1
    Sighting typeDescription
    0denotes an attribute which has been seen
    1denotes an attribute which has been seen and confirmed as false-positive
    2denotes an attribute which will be expired at the time of the sighting
    +

    uuid MUST be present. uuid references the uuid of the sighted attribute.

    +

    datesighting MUST be present. datesighting is expressed in seconds (decimal) elapsed since 1st of January 1970 (Unix timestamp). date_sighting represents when the referenced attribute, designated by its uuid, is sighted.

    +

    source MAY be present. source is represented as a JSON string and represents the human-readable version of the sighting source, which can be a given piece of software (e.g. SIEM), device or a specific analytical process.

    +

    id, eventid and attributeid MAY be present.

    +

    id represents the human-readable identifier of the sighting reference which belongs to a specific MISP instance. +eventid represents the human-readable identifier of the event referenced by the sighting and belongs to a specific MISP instance. +attributeid represents the human-readable identifier of the attribute referenced by the sighting and belongs to a specific MISP instance.

    +

    orgid MAY be present along the JSON object describing the organisation. If the orgid is not present, the sighting is considered as anonymised.

    +

    org_id represents the human-readable identifier of the organisation which did the sighting and belongs to a specific MISP instance.

    +

    A human-readable identifier MUST be represented as an unsigned integer.

    +
    +
    +

    +2.10.1. Sample Sighting +

    +
    "Sighting": [
-		   {
-				"id": "13599",
-				"attribute_id": "1201615",
-				"event_id": "10164",
-				"org_id": "2",
-				"date_sighting": "1517581400",
-				"uuid": "5a747459-41b4-4826-9b29-42dd950d210f",
-				"source": "M2M-CIRCL",
-				"type": "0",
-				"Organisation": {
-					"id": "2",
-					"uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f",
-					"name": "CIRCL"
-				}
-			},
-			{
-				"id": "13601",
-				"attribute_id": "1201615",
-				"event_id": "10164",
-				"org_id": "2",
-				"date_sighting": "1517581401",
-				"uuid": "5a74745a-a190-4d04-b719-4916950d210f",
-				"source": "M2M-CIRCL",
-				"type": "0",
-				"Organisation": {
-					"id": "2",
-					"uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f",
-					"name": "CIRCL"
-				}
-			}
-		]
-
    -

    -2.11. Galaxy -

    -

    A galaxy is a simple method to express a large object called cluster that can be attached to MISP events. A cluster can be composed of one or more elements. Elements are expressed as key-values.

    -

    -2.11.1. Sample Galaxy -

    + { + "id": "13599", + "attribute_id": "1201615", + "event_id": "10164", + "org_id": "2", + "date_sighting": "1517581400", + "uuid": "5a747459-41b4-4826-9b29-42dd950d210f", + "source": "M2M-CIRCL", + "type": "0", + "Organisation": { + "id": "2", + "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f", + "name": "CIRCL" + } + }, + { + "id": "13601", + "attribute_id": "1201615", + "event_id": "10164", + "org_id": "2", + "date_sighting": "1517581401", + "uuid": "5a74745a-a190-4d04-b719-4916950d210f", + "source": "M2M-CIRCL", + "type": "0", + "Organisation": { + "id": "2", + "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f", + "name": "CIRCL" + } + } + ] + +
    +
    +
    +
    +
    +
    +
    +

    +2.11. Galaxy +

    +

    A galaxy is a simple method to express a large object called cluster that can be attached to MISP events. A cluster can be composed of one or more elements. Elements are expressed as key-values.

    +
    +
    +

    +2.11.1. Sample Galaxy +

    +
    "Galaxy": [ {
            "id": "18",
            "uuid": "698774c7-8022-42c4-917f-8d6e4f06ada3",
@@ -1600,11 +3025,23 @@
                 ]
             }
         ]
-
    -

    -3. JSON Schema -

    -

    The JSON Schema [JSON-SCHEMA] below defines the structure of the MISP core format as literally described before. The JSON Schema is used to validate MISP events at creation time or parsing.

    + +
    +
    +
    +
    +
    +
    +
    +
    +
    +

    +3. JSON Schema +

    +

    The JSON Schema [JSON-SCHEMA] below defines the structure of the MISP core format +as literally described before. The JSON Schema is used to validate MISP events at creation time +or parsing.

    +
    {
   "$schema": "http://json-schema.org/draft-04/schema#",
   "title": "Validator for misp events",
@@ -2279,42 +3716,57 @@
     "Event"
   ]
 }
-
    -

    -4. Manifest -

    -

    MISP events can be shared over an HTTP repository, a file package or USB key. A manifest file is used to provide an index of MISP events allowing to only fetch the recently updated files without the need to parse each json file.

    -

    -4.1. Format -

    -

    A manifest file is a simple JSON file named manifest.json in a directory where the MISP events are located. Each MISP event is a file located in the same directory with the event uuid as filename with the json extension.

    -

    The manifest format is a JSON object composed of a dictionary where the field is the uuid of the event.

    -

    Each uuid is composed of a JSON object with the following fields which came from the original event referenced by the same uuid:

    -

    - -
      -
    • info (MUST)
      • -
    • Orgc object (MUST)
      • -
    • analysis (SHALL)
      • -
    • timestamp (MUST)
      • -
    • date (MUST)
      • -
    • threatlevelid (SHALL)
      • -
    - -

    -

    In addition to the fields originating from the event, the following fields can be added:

    -

    - -
      -
    • integrity:sha256 represents the SHA256 value in hexadecimal representation of the associated MISP event file to ensure integrity of the file. (SHOULD)
      • -
    • integrity:pgp represents a detached PGP signature [RFC4880] of the associated MISP event file to ensure integrity of the file. (SHOULD)
      • -
    - -

    -

    If a detached PGP signature is used for each MISP event, a detached PGP signature is a MUST to ensure integrity of the manifest file. A detached PGP signature for a manifest file is a manifest.json.asc file containing the PGP signature.

    -

    -4.1.1. Sample Manifest -

    + +
    +
    +
    +
    +
    +

    +4. Manifest +

    +

    MISP events can be shared over an HTTP repository, a file package or USB key. A manifest file is used to +provide an index of MISP events allowing to only fetch the recently updated files without the need to parse +each json file.

    +
    +
    +

    +4.1. Format +

    +

    A manifest file is a simple JSON file named manifest.json in a directory where the MISP events are located. +Each MISP event is a file located in the same directory with the event uuid as filename with the json extension.

    +

    The manifest format is a JSON object composed of a dictionary where the field is the uuid of the event.

    +

    Each uuid is composed of a JSON object with the following fields which came from the original event referenced +by the same uuid:

    +
      +
    • info (MUST) +
      • +
    • Orgc object (MUST) +
      • +
    • analysis (SHALL) +
      • +
    • timestamp (MUST) +
      • +
    • date (MUST) +
      • +
    • threatlevelid (SHALL) +
      • +
    +

    In addition to the fields originating from the event, the following fields can be added:

    +
      +
    • integrity:sha256 represents the SHA256 value in hexadecimal representation of the associated MISP event file to ensure integrity of the file. (SHOULD) +
      • +
    • integrity:pgp represents a detached PGP signature [RFC4880] of the associated MISP event file to ensure integrity of the file. (SHOULD) +
      • +
    +

    If a detached PGP signature is used for each MISP event, a detached PGP signature is a MUST to ensure integrity of the manifest file. +A detached PGP signature for a manifest file is a manifest.json.asc file containing the PGP signature.

    +
    +
    +

    +4.1.1. Sample Manifest +

    +
    {
   "57c6ac4c-c60c-4f79-a38f-b666950d210f": {
     "info": "Malspam 2016-08-31 (.wsf in .zip) - campaign: Photo",
@@ -2364,123 +3816,148 @@
     "threat_level_id": "3"
   }
 }
-
    -

    -5. Implementation -

    -

    MISP format is implemented by different software including the MISP threat sharing platform and libraries like PyMISP [MISP-P]. Implementations use the format as an export/import mechanism, staging transport format or synchronisation format as used in the MISP core platform. MISP format doesn't impose any restriction on the data representation of the format in data-structure of other implementations.

    -

    -6. Security Considerations -

    -

    MISP events might contain sensitive or confidential information. Adequate access control and encryption measures shall be implemented to ensure the confidentiality of the MISP events.

    -

    Adversaries might include malicious content in MISP events and attributes. Implementation MUST consider the input of malicious inputs beside the standard threat information that might already include malicious intended inputs.

    -

    -7. Acknowledgements -

    -

    The authors wish to thank all the MISP community who are supporting the creation of open standards in threat intelligence sharing. A special thank to Nicolas Bareil for the review of the JSON Schema.

    -

    -8. References -

    -

    -9. References

    -

    -9.1. Normative References

    - - - - - - - - - - - - - - - - - -
    [RFC2119] -Bradner, S., "Key words for use in RFCs to Indicate Requirement Levels", BCP 14, RFC 2119, DOI 10.17487/RFC2119, March 1997.
    [RFC4122] -Leach, P., Mealling, M. and R. Salz, "A Universally Unique IDentifier (UUID) URN Namespace", RFC 4122, DOI 10.17487/RFC4122, July 2005.
    [RFC4880] -Callas, J., Donnerhacke, L., Finney, H., Shaw, D. and R. Thayer, "OpenPGP Message Format", RFC 4880, DOI 10.17487/RFC4880, November 2007.
    [RFC8259] -Bray, T., "The JavaScript Object Notation (JSON) Data Interchange Format", STD 90, RFC 8259, DOI 10.17487/RFC8259, December 2017.
    -

    -9.2. Informative References

    - - - - - - - - - - - - - - - - - -
    [JSON-SCHEMA] -Wright, A., "JSON Schema: A Media Type for Describing JSON Documents", 2016.
    [MISP-P] -Community, M., "MISP Project - Open Source Threat Intelligence Platform and Open Standards For Threat Information Sharing"
    [MISP-R] -Community, M., "MISP Object Relationship Types - common vocabulary of relationships"
    [MISP-T] -Community, M., "MISP Taxonomies - shared and common vocabularies of tags"
    -

    Authors' Addresses

    -
    -
    - - Alexandre Dulaunoy - - - Computer Incident Response Center Luxembourg - - 16, bd d'Avranches - - - Luxembourg, - - L-1160 - - Luxembourg - - Phone: +352 247 88444 - -EMail: alexandre.dulaunoy@circl.lu - -
    -
    -
    - - Andras Iklody - - - Computer Incident Response Center Luxembourg - - 16, bd d'Avranches - - - Luxembourg, - - L-1160 - - Luxembourg - - Phone: +352 247 88444 - -EMail: andras.iklody@circl.lu - -
    +
    - +
    +
    +
    +
    +
    +
    +
    +
    +

    +5. Implementation +

    +

    MISP format is implemented by different software including the MISP threat sharing +platform and libraries like PyMISP [MISP-P]. Implementations use the format +as an export/import mechanism, staging transport format or synchronisation format +as used in the MISP core platform. MISP format doesn't impose any restriction on +the data representation of the format in data-structure of other implementations.

    +
    +
    +
    +
    +

    +6. Security Considerations +

    +

    MISP events might contain sensitive or confidential information. Adequate +access control and encryption measures shall be implemented to ensure +the confidentiality of the MISP events.

    +

    Adversaries might include malicious content in MISP events and attributes. +Implementation MUST consider the input of malicious inputs beside the +standard threat information that might already include malicious intended inputs.

    +
    +
    +
    +
    +

    +7. Acknowledgements +

    +

    The authors wish to thank all the MISP community who are supporting the creation +of open standards in threat intelligence sharing. A special thank to Nicolas Bareil +for the review of the JSON Schema.

    +
    +
    +
    +
    +

    +8. References +

    +
    +
    +
    +

    +9. Normative References +

    +
    +
    [RFC2119]
    +
    +Bradner, S., "Key words for use in RFCs to Indicate Requirement Levels", BCP 14, RFC 2119, DOI 10.17487/RFC2119, , <https://www.rfc-editor.org/info/rfc2119>.
    +
    +
    [RFC4122]
    +
    +Leach, P., Mealling, M., and R. Salz, "A Universally Unique IDentifier (UUID) URN Namespace", RFC 4122, DOI 10.17487/RFC4122, , <https://www.rfc-editor.org/info/rfc4122>.
    +
    +
    [RFC4880]
    +
    +Callas, J., Donnerhacke, L., Finney, H., Shaw, D., and R. Thayer, "OpenPGP Message Format", RFC 4880, DOI 10.17487/RFC4880, , <https://www.rfc-editor.org/info/rfc4880>.
    +
    +
    [RFC8259]
    +
    +Bray, T., Ed., "The JavaScript Object Notation (JSON) Data Interchange Format", STD 90, RFC 8259, DOI 10.17487/RFC8259, , <https://www.rfc-editor.org/info/rfc8259>.
    +
    +
    +
    +
    +

    +10. Informative References +

    +
    +
    [JSON-SCHEMA]
    +
    +Wright, A., "JSON Schema: A Media Type for Describing JSON Documents", , , <https://tools.ietf.org/html/draft-wright-json-schema>.
    +
    +
    [MISP-P]
    +
    +Community, M., "MISP Project - Open Source Threat Intelligence Platform and Open Standards For Threat Information Sharing", , <https://github.com/MISP>.
    +
    +
    [MISP-R]
    +
    +Community, M., "MISP Object Relationship Types - common vocabulary of relationships", , <https://github.com/MISP/misp-objects/tree/master/relationships>.
    +
    +
    [MISP-T]
    +
    +Community, M., "MISP Taxonomies - shared and common vocabularies of tags", , <https://github.com/MISP/misp-taxonomies>.
    +
    +
    +
    +
    +
    +

    +Authors' Addresses +

    +
    +
    Alexandre Dulaunoy
    +
    Computer Incident Response Center Luxembourg
    +
    16, bd d'Avranches
    +
    L-L-1160 Luxembourg +
    +
    Luxembourg
    +
    +Phone: ++352 247 88444 +
    + +
    +
    +
    Andras Iklody
    +
    Computer Incident Response Center Luxembourg
    +
    16, bd d'Avranches
    +
    L-L-1160 Luxembourg +
    +
    Luxembourg
    +
    +Phone: ++352 247 88444 +
    + +
    +
    +
    + diff --git a/rfc/misp-standard-core.txt b/rfc/misp-standard-core.txt index 6dbbdc6..b2a6c8c 100644 --- a/rfc/misp-standard-core.txt +++ b/rfc/misp-standard-core.txt @@ -4,11 +4,12 @@ Network Working Group A. Dulaunoy Internet-Draft A. Iklody -Expires: April 24, 2021 CIRCL - October 21, 2020 +Intended status: Informational CIRCL +Expires: 1 May 2022 28 October 2021 MISP core format + draft-00 Abstract @@ -36,31 +37,27 @@ Status of This Memo time. It is inappropriate to use Internet-Drafts as reference material or to cite them other than as "work in progress." - This Internet-Draft will expire on April 24, 2021. + This Internet-Draft will expire on 1 May 2022. Copyright Notice - Copyright (c) 2020 IETF Trust and the persons identified as the + Copyright (c) 2021 IETF Trust and the persons identified as the document authors. All rights reserved. This document is subject to BCP 78 and the IETF Trust's Legal - Provisions Relating to IETF Documents - (https://trustee.ietf.org/license-info) in effect on the date of - publication of this document. Please review these documents - carefully, as they describe your rights and restrictions with respect - to this document. Code Components extracted from this document must - include Simplified BSD License text as described in Section 4.e of + Provisions Relating to IETF Documents (https://trustee.ietf.org/ + license-info) in effect on the date of publication of this document. + Please review these documents carefully, as they describe your rights + and restrictions with respect to this document. -Dulaunoy & Iklody Expires April 24, 2021 [Page 1] + +Dulaunoy & Iklody Expires 1 May 2022 [Page 1] -Internet-Draft MISP core format October 2020 +Internet-Draft MISP core format October 2021 - the Trust Legal Provisions and are provided without warranty as - described in the Simplified BSD License. - Table of Contents 1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . 3 @@ -68,14 +65,14 @@ Table of Contents 2. Format . . . . . . . . . . . . . . . . . . . . . . . . . . . 3 2.1. Overview . . . . . . . . . . . . . . . . . . . . . . . . 3 2.2. Event . . . . . . . . . . . . . . . . . . . . . . . . . . 3 - 2.2.1. Event Attributes . . . . . . . . . . . . . . . . . . 4 + 2.2.1. Event Attributes . . . . . . . . . . . . . . . . . . 3 2.3. Objects . . . . . . . . . . . . . . . . . . . . . . . . . 7 2.3.1. Org . . . . . . . . . . . . . . . . . . . . . . . . . 7 2.3.2. Orgc . . . . . . . . . . . . . . . . . . . . . . . . 8 2.4. Attribute . . . . . . . . . . . . . . . . . . . . . . . . 8 - 2.4.1. Sample Attribute Object . . . . . . . . . . . . . . . 9 + 2.4.1. Sample Attribute Object . . . . . . . . . . . . . . . 8 2.4.2. Attribute Attributes . . . . . . . . . . . . . . . . 9 - 2.5. ShadowAttribute . . . . . . . . . . . . . . . . . . . . . 16 + 2.5. ShadowAttribute . . . . . . . . . . . . . . . . . . . . . 15 2.5.1. Sample Attribute Object . . . . . . . . . . . . . . . 16 2.5.2. ShadowAttribute Attributes . . . . . . . . . . . . . 16 2.5.3. Org . . . . . . . . . . . . . . . . . . . . . . . . . 22 @@ -86,16 +83,16 @@ Table of Contents 2.7.1. Sample ObjectReference object . . . . . . . . . . . . 28 2.7.2. ObjectReference Attributes . . . . . . . . . . . . . 28 2.8. EventReport . . . . . . . . . . . . . . . . . . . . . . . 30 - 2.8.1. id . . . . . . . . . . . . . . . . . . . . . . . . . 31 + 2.8.1. id . . . . . . . . . . . . . . . . . . . . . . . . . 30 2.8.2. UUID . . . . . . . . . . . . . . . . . . . . . . . . 31 2.8.3. event_id . . . . . . . . . . . . . . . . . . . . . . 31 2.8.4. name . . . . . . . . . . . . . . . . . . . . . . . . 31 2.8.5. content . . . . . . . . . . . . . . . . . . . . . . . 31 - 2.8.6. distribution . . . . . . . . . . . . . . . . . . . . 32 + 2.8.6. distribution . . . . . . . . . . . . . . . . . . . . 31 2.8.7. sharing_group_id . . . . . . . . . . . . . . . . . . 32 2.8.8. timestamp . . . . . . . . . . . . . . . . . . . . . . 32 - 2.8.9. deleted . . . . . . . . . . . . . . . . . . . . . . . 33 - 2.9. Tag . . . . . . . . . . . . . . . . . . . . . . . . . . . 33 + 2.8.9. deleted . . . . . . . . . . . . . . . . . . . . . . . 32 + 2.9. Tag . . . . . . . . . . . . . . . . . . . . . . . . . . . 32 2.9.1. Sample Tag . . . . . . . . . . . . . . . . . . . . . 33 2.10. Sighting . . . . . . . . . . . . . . . . . . . . . . . . 33 2.10.1. Sample Sighting . . . . . . . . . . . . . . . . . . 34 @@ -106,20 +103,19 @@ Table of Contents 4.1. Format . . . . . . . . . . . . . . . . . . . . . . . . . 51 4.1.1. Sample Manifest . . . . . . . . . . . . . . . . . . . 52 5. Implementation . . . . . . . . . . . . . . . . . . . . . . . 53 - - - -Dulaunoy & Iklody Expires April 24, 2021 [Page 2] - -Internet-Draft MISP core format October 2020 - - 6. Security Considerations . . . . . . . . . . . . . . . . . . . 53 7. Acknowledgements . . . . . . . . . . . . . . . . . . . . . . 53 8. References . . . . . . . . . . . . . . . . . . . . . . . . . 53 - 9. References . . . . . . . . . . . . . . . . . . . . . . . . . 53 - 9.1. Normative References . . . . . . . . . . . . . . . . . . 54 - 9.2. Informative References . . . . . . . . . . . . . . . . . 54 + + + +Dulaunoy & Iklody Expires 1 May 2022 [Page 2] + +Internet-Draft MISP core format October 2021 + + + 9. Normative References . . . . . . . . . . . . . . . . . . . . 53 + 10. Informative References . . . . . . . . . . . . . . . . . . . 54 Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . . 54 1. Introduction @@ -160,18 +156,20 @@ Internet-Draft MISP core format October 2020 specific threat actor analysis. The meaning of an event only depends of the information embedded in the event. - - - - - -Dulaunoy & Iklody Expires April 24, 2021 [Page 3] - -Internet-Draft MISP core format October 2020 - - 2.2.1. Event Attributes + + + + + + + +Dulaunoy & Iklody Expires 1 May 2022 [Page 3] + +Internet-Draft MISP core format October 2021 + + 2.2.1.1. uuid uuid represents the Universally Unique IDentifier (UUID) [RFC4122] of @@ -211,26 +209,23 @@ Internet-Draft MISP core format October 2020 threat_level_id represents the threat level. - 4: - Undefined + 4: Undefined - 3: - Low + 3: Low - 2: + 2: Medium + + 1: High -Dulaunoy & Iklody Expires April 24, 2021 [Page 4] + + +Dulaunoy & Iklody Expires 1 May 2022 [Page 4] -Internet-Draft MISP core format October 2020 +Internet-Draft MISP core format October 2021 - Medium - - 1: - High - If a higher granularity is required, a MISP taxonomy applied as a Tag SHOULD be preferred. @@ -241,14 +236,11 @@ Internet-Draft MISP core format October 2020 analysis represents the analysis level. - 0: - Initial + 0: Initial - 1: - Ongoing + 1: Ongoing - 2: - Complete + 2: Complete If a higher granularity is required, a MISP taxonomy applied as a Tag SHOULD be preferred. @@ -272,16 +264,6 @@ Internet-Draft MISP core format October 2020 timestamp is represented as a JSON string. timestamp MUST be present. - - - - - -Dulaunoy & Iklody Expires April 24, 2021 [Page 5] - -Internet-Draft MISP core format October 2020 - - 2.2.1.9. publish_timestamp publish_timestamp represents a reference time when the event was @@ -293,6 +275,13 @@ Internet-Draft MISP core format October 2020 previous publication timestamp. If the event was never published, the published_timestamp MUST be set to 0. + + +Dulaunoy & Iklody Expires 1 May 2022 [Page 5] + +Internet-Draft MISP core format October 2021 + + publish_timestamp is represented as a JSON string. publish_timestamp MUST be present. @@ -331,30 +320,25 @@ Internet-Draft MISP core format October 2020 The system must adhere to the distribution setting for access control and for dissemination of the event. - - -Dulaunoy & Iklody Expires April 24, 2021 [Page 6] - -Internet-Draft MISP core format October 2020 - - distribution is represented by a JSON string. distribution MUST be present and be one of the following options: - 0 - Your Organisation Only + 0 Your Organisation Only - 1 - This Community Only + 1 This Community Only - 2 - Connected Communities + 2 Connected Communities - 3 - All Communities + 3 All Communities - 4 - Sharing Group + + +Dulaunoy & Iklody Expires 1 May 2022 [Page 6] + +Internet-Draft MISP core format October 2021 + + + 4 Sharing Group 2.2.1.14. sharing_group_id @@ -386,14 +370,6 @@ Internet-Draft MISP core format October 2020 [RFC4122] of the organisation. The organisation UUID is globally assigned to an organisation and SHALL be kept overtime. - - - -Dulaunoy & Iklody Expires April 24, 2021 [Page 7] - -Internet-Draft MISP core format October 2020 - - The name is a readable description of the organisation and SHOULD be present. The id is a human-readable identifier generated by the instance and used as reference in the event. A human-readable @@ -410,6 +386,14 @@ Internet-Draft MISP core format October 2020 "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f" } + + + +Dulaunoy & Iklody Expires 1 May 2022 [Page 7] + +Internet-Draft MISP core format October 2021 + + 2.3.2. Orgc An Orgc object is composed of an uuid, name and id. @@ -438,20 +422,34 @@ Internet-Draft MISP core format October 2020 A MISP document MUST at least includes category-type-value triplet described in section "Attribute Attributes". - - - - - - - -Dulaunoy & Iklody Expires April 24, 2021 [Page 8] - -Internet-Draft MISP core format October 2020 - - 2.4.1. Sample Attribute Object + + + + + + + + + + + + + + + + + + + + + +Dulaunoy & Iklody Expires 1 May 2022 [Page 8] + +Internet-Draft MISP core format October 2021 + + "Attribute": { "id": "346056", "type": "comment", @@ -497,50 +495,46 @@ Internet-Draft MISP core format October 2020 describe the intent of the attribute creator, using a list of pre- defined attribute types. - - - - -Dulaunoy & Iklody Expires April 24, 2021 [Page 9] - -Internet-Draft MISP core format October 2020 - - type is represented as a JSON string. type MUST be present and it MUST be a valid selection for the chosen category. The list of valid category-type combinations is as follows: - Antivirus detection - link, comment, text, hex, attachment, other, anonymised - Artifacts dropped - md5, sha1, sha224, sha256, sha384, sha512, sha512/224, sha512/256, - sha3-224, sha3-256, sha3-384, sha3-512, ssdeep, imphash, telfhash, - impfuzzy, authentihash, vhash, cdhash, filename, filename|md5, - filename|sha1, filename|sha224, filename|sha256, filename|sha384, - filename|sha512, filename|sha512/224, filename|sha512/256, - filename|sha3-224, filename|sha3-256, filename|sha3-384, - filename|sha3-512, filename|authentihash, filename|vhash, - filename|ssdeep, filename|tlsh, filename|imphash, - filename|impfuzzy, filename|pehash, regkey, regkey|value, pattern- - in-file, pattern-in-memory, filename-pattern, pdb, stix2-pattern, - yara, sigma, attachment, malware-sample, named pipe, mutex, + +Dulaunoy & Iklody Expires 1 May 2022 [Page 9] + +Internet-Draft MISP core format October 2021 + + + Antivirus detection link, comment, text, hex, attachment, other, + anonymised + + Artifacts dropped md5, sha1, sha224, sha256, sha384, sha512, + sha512/224, sha512/256, sha3-224, sha3-256, sha3-384, sha3-512, + ssdeep, imphash, telfhash, impfuzzy, authentihash, vhash, cdhash, + filename, filename|md5, filename|sha1, filename|sha224, + filename|sha256, filename|sha384, filename|sha512, + filename|sha512/224, filename|sha512/256, filename|sha3-224, + filename|sha3-256, filename|sha3-384, filename|sha3-512, + filename|authentihash, filename|vhash, filename|ssdeep, + filename|tlsh, filename|imphash, filename|impfuzzy, + filename|pehash, regkey, regkey|value, pattern-in-file, pattern- + in-memory, filename-pattern, pdb, stix2-pattern, yara, sigma, + attachment, malware-sample, named pipe, mutex, process-state, windows-scheduled-task, windows-service-name, windows-service- displayname, comment, text, hex, x509-fingerprint-sha1, x509- fingerprint-md5, x509-fingerprint-sha256, other, cookie, gene, kusto-query, mime-type, anonymised, pgp-public-key, pgp-private- key - Attribution - threat-actor, campaign-name, campaign-id, whois-registrant-phone, - whois-registrant-email, whois-registrant-name, whois-registrant- - org, whois-registrar, whois-creation-date, comment, text, x509- - fingerprint-sha1, x509-fingerprint-md5, x509-fingerprint-sha256, - other, dns-soa-email, anonymised, email + Attribution threat-actor, campaign-name, campaign-id, whois- + registrant-phone, whois-registrant-email, whois-registrant-name, + whois-registrant-org, whois-registrar, whois-creation-date, + comment, text, x509-fingerprint-sha1, x509-fingerprint-md5, x509- + fingerprint-sha256, other, dns-soa-email, anonymised, email - External analysis - md5, sha1, sha256, sha3-224, sha3-256, sha3-384, sha3-512, - filename, filename|md5, filename|sha1, filename|sha256, + External analysis md5, sha1, sha256, sha3-224, sha3-256, sha3-384, + sha3-512, filename, filename|md5, filename|sha1, filename|sha256, filename|sha3-224, filename|sha3-256, filename|sha3-384, filename|sha3-512, ip-src, ip-dst, ip-dst|port, ip-src|port, mac- address, mac-eui-64, hostname, domain, domain|ip, url, user-agent, @@ -548,47 +542,48 @@ Internet-Draft MISP core format October 2020 pattern-in-traffic, pattern-in-memory, filename-pattern, vulnerability, cpe, weakness, attachment, malware-sample, link, comment, text, x509-fingerprint-sha1, x509-fingerprint-md5, x509- - fingerprint-sha256, ja3-fingerprint-md5, hassh-md5, hasshserver- - md5, github-repository, other, cortex, anonymised, community-id + fingerprint-sha256, ja3-fingerprint-md5, jarm-fingerprint, hassh- + md5, hasshserver-md5, github-repository, other, cortex, + anonymised, community-id - Financial fraud - btc, dash, xmr, iban, bic, bank-account-nr, aba-rtn, bin, cc- - number, prtn, phone-number, comment, text, other, hex, anonymised + Financial fraud btc, dash, xmr, iban, bic, bank-account-nr, aba-rtn, + bin, cc-number, prtn, phone-number, comment, text, other, hex, + anonymised + + Internal reference text, link, comment, other, hex, anonymised, git- + commit-id + + Network activity ip-src, ip-dst, ip-dst|port, ip-src|port, port, -Dulaunoy & Iklody Expires April 24, 2021 [Page 10] +Dulaunoy & Iklody Expires 1 May 2022 [Page 10] -Internet-Draft MISP core format October 2020 +Internet-Draft MISP core format October 2021 - Internal reference - text, link, comment, other, hex, anonymised, git-commit-id + hostname, domain, domain|ip, mac-address, mac-eui-64, email, + email-dst, email-src, eppn, url, uri, user-agent, http-method, AS, + snort, pattern-in-file, filename-pattern, stix2-pattern, pattern- + in-traffic, attachment, comment, text, x509-fingerprint-md5, x509- + fingerprint-sha1, x509-fingerprint-sha256, ja3-fingerprint-md5, + jarm-fingerprint, hassh-md5, hasshserver-md5, other, hex, cookie, + hostname|port, bro, zeek, anonymised, community-id, email-subject, + favicon-mmh3, dkim, dkim-signature, ssh-fingerprint - Network activity - ip-src, ip-dst, ip-dst|port, ip-src|port, port, hostname, domain, - domain|ip, mac-address, mac-eui-64, email, email-dst, email-src, - eppn, url, uri, user-agent, http-method, AS, snort, pattern-in- - file, filename-pattern, stix2-pattern, pattern-in-traffic, - attachment, comment, text, x509-fingerprint-md5, x509-fingerprint- - sha1, x509-fingerprint-sha256, ja3-fingerprint-md5, hassh-md5, - hasshserver-md5, other, hex, cookie, hostname|port, bro, zeek, - anonymised, community-id, email-subject + Other comment, text, other, size-in-bytes, counter, datetime, cpe, + port, float, hex, phone-number, boolean, anonymised, pgp-public- + key, pgp-private-key - Other - comment, text, other, size-in-bytes, counter, datetime, cpe, port, - float, hex, phone-number, boolean, anonymised, pgp-public-key, - pgp-private-key - - Payload delivery - md5, sha1, sha224, sha256, sha384, sha512, sha512/224, sha512/256, - sha3-224, sha3-256, sha3-384, sha3-512, ssdeep, imphash, telfhash, - impfuzzy, authentihash, vhash, pehash, tlsh, cdhash, filename, - filename|md5, filename|sha1, filename|sha224, filename|sha256, - filename|sha384, filename|sha512, filename|sha512/224, - filename|sha512/256, filename|sha3-224, filename|sha3-256, - filename|sha3-384, filename|sha3-512, filename|authentihash, - filename|vhash, filename|ssdeep, filename|tlsh, filename|imphash, + Payload delivery md5, sha1, sha224, sha256, sha384, sha512, + sha512/224, sha512/256, sha3-224, sha3-256, sha3-384, sha3-512, + ssdeep, imphash, telfhash, impfuzzy, authentihash, vhash, pehash, + tlsh, cdhash, filename, filename|md5, filename|sha1, + filename|sha224, filename|sha256, filename|sha384, + filename|sha512, filename|sha512/224, filename|sha512/256, + filename|sha3-224, filename|sha3-256, filename|sha3-384, + filename|sha3-512, filename|authentihash, filename|vhash, + filename|ssdeep, filename|tlsh, filename|imphash, filename|impfuzzy, filename|pehash, mac-address, mac-eui-64, ip- src, ip-dst, ip-dst|port, ip-src|port, hostname, domain, email, email-src, email-dst, email-subject, email-attachment, email-body, @@ -597,83 +592,66 @@ Internet-Draft MISP core format October 2020 attachment, malware-sample, link, malware-type, comment, text, hex, vulnerability, cpe, weakness, x509-fingerprint-sha1, x509- fingerprint-md5, x509-fingerprint-sha256, ja3-fingerprint-md5, - hassh-md5, hasshserver-md5, other, hostname|port, email-dst- - display-name, email-src-display-name, email-header, email-reply- - to, email-x-mailer, email-mime-boundary, email-thread-index, - email-message-id, mobile-application-id, chrome-extension-id, - whois-registrant-email, anonymised + jarm-fingerprint, hassh-md5, hasshserver-md5, other, + hostname|port, email-dst-display-name, email-src-display-name, + email-header, email-reply-to, email-x-mailer, email-mime-boundary, + email-thread-index, email-message-id, mobile-application-id, + chrome-extension-id, whois-registrant-email, anonymised - Payload installation - md5, sha1, sha224, sha256, sha384, sha512, sha512/224, sha512/256, - sha3-224, sha3-256, sha3-384, sha3-512, ssdeep, imphash, telfhash, - impfuzzy, authentihash, vhash, pehash, tlsh, cdhash, filename, - filename|md5, filename|sha1, filename|sha224, filename|sha256, - filename|sha384, filename|sha512, filename|sha512/224, - filename|sha512/256, filename|sha3-224, filename|sha3-256, - - - -Dulaunoy & Iklody Expires April 24, 2021 [Page 11] - -Internet-Draft MISP core format October 2020 - - - filename|sha3-384, filename|sha3-512, filename|authentihash, - filename|vhash, filename|ssdeep, filename|tlsh, filename|imphash, + Payload installation md5, sha1, sha224, sha256, sha384, sha512, + sha512/224, sha512/256, sha3-224, sha3-256, sha3-384, sha3-512, + ssdeep, imphash, telfhash, impfuzzy, authentihash, vhash, pehash, + tlsh, cdhash, filename, filename|md5, filename|sha1, + filename|sha224, filename|sha256, filename|sha384, + filename|sha512, filename|sha512/224, filename|sha512/256, + filename|sha3-224, filename|sha3-256, filename|sha3-384, + filename|sha3-512, filename|authentihash, filename|vhash, + filename|ssdeep, filename|tlsh, filename|imphash, filename|impfuzzy, filename|pehash, pattern-in-file, pattern-in- traffic, pattern-in-memory, filename-pattern, stix2-pattern, yara, sigma, vulnerability, cpe, weakness, attachment, malware-sample, + + + +Dulaunoy & Iklody Expires 1 May 2022 [Page 11] + +Internet-Draft MISP core format October 2021 + + malware-type, comment, text, hex, x509-fingerprint-sha1, x509- fingerprint-md5, x509-fingerprint-sha256, mobile-application-id, chrome-extension-id, other, mime-type, anonymised - Payload type - comment, text, other, anonymised + Payload type comment, text, other, anonymised - Persistence mechanism - filename, regkey, regkey|value, comment, text, other, hex, - anonymised + Persistence mechanism filename, regkey, regkey|value, comment, text, + other, hex, anonymised - Person - first-name, middle-name, last-name, date-of-birth, place-of-birth, - gender, passport-number, passport-country, passport-expiration, - redress-number, nationality, visa-number, issue-date-of-the-visa, - primary-residence, country-of-residence, special-service-request, - frequent-flyer-number, travel-details, payment-details, place- - port-of-original-embarkation, place-port-of-clearance, place-port- - of-onward-foreign-destination, passenger-name-record-locator- - number, comment, text, other, phone-number, identity-card-number, - anonymised, email, pgp-public-key, pgp-private-key - - Social network - github-username, github-repository, github-organisation, jabber- - id, twitter-id, email, email-src, email-dst, eppn, comment, text, - other, whois-registrant-email, anonymised, pgp-public-key, pgp- + Person first-name, middle-name, last-name, full-name, date-of-birth, + place-of-birth, gender, passport-number, passport-country, + passport-expiration, redress-number, nationality, visa-number, + issue-date-of-the-visa, primary-residence, country-of-residence, + special-service-request, frequent-flyer-number, travel-details, + payment-details, place-port-of-original-embarkation, place-port- + of-clearance, place-port-of-onward-foreign-destination, passenger- + name-record-locator-number, comment, text, other, phone-number, + identity-card-number, anonymised, email, pgp-public-key, pgp- private-key - Support Tool - link, text, attachment, comment, other, hex, anonymised + Social network github-username, github-repository, github- + organisation, jabber-id, twitter-id, email, email-src, email-dst, + eppn, comment, text, other, whois-registrant-email, anonymised, + pgp-public-key, pgp-private-key - Targeting data - target-user, target-email, target-machine, target-org, target- - location, target-external, comment, anonymised + Support Tool link, text, attachment, comment, other, hex, anonymised + + Targeting data target-user, target-email, target-machine, target- + org, target-location, target-external, comment, anonymised Attributes are based on the usage within their different communities. Attributes can be extended on a regular basis and this reference document is updated accordingly. - - - - - - - -Dulaunoy & Iklody Expires April 24, 2021 [Page 12] - -Internet-Draft MISP core format October 2020 - - 2.4.2.4. category category represents the intent of what the attribute is describing as @@ -684,6 +662,18 @@ Internet-Draft MISP core format October 2020 and it MUST be a valid selection for the chosen type. The list of valid category-type combinations is mentioned above. + + + + + + + +Dulaunoy & Iklody Expires 1 May 2022 [Page 12] + +Internet-Draft MISP core format October 2021 + + 2.4.2.5. to_ids to_ids represents whether the attribute is meant to be actionable. @@ -713,31 +703,17 @@ Internet-Draft MISP core format October 2020 distribution is represented by a JSON string. distribution MUST be present and be one of the following options: - 0 - Your Organisation Only + 0 Your Organisation Only - 1 - This Community Only + 1 This Community Only - 2 - Connected Communities + 2 Connected Communities + 3 All Communities + 4 Sharing Group - -Dulaunoy & Iklody Expires April 24, 2021 [Page 13] - -Internet-Draft MISP core format October 2020 - - - 3 - All Communities - - 4 - Sharing Group - - 5 - Inherit Event + 5 Inherit Event 2.4.2.8. timestamp @@ -747,6 +723,13 @@ Internet-Draft MISP core format October 2020 timestamp is represented as a JSON string. timestamp MUST be present. + + +Dulaunoy & Iklody Expires 1 May 2022 [Page 13] + +Internet-Draft MISP core format October 2021 + + 2.4.2.9. comment comment is a contextual comment field. @@ -779,13 +762,6 @@ Internet-Draft MISP core format October 2020 using a password protected zip archive, with the password being "infected". - - -Dulaunoy & Iklody Expires April 24, 2021 [Page 14] - -Internet-Draft MISP core format October 2020 - - data is represented by a JSON string in base64 encoding. data MUST be set for attributes of type malware-sample and attachment. @@ -800,6 +776,16 @@ Internet-Draft MISP core format October 2020 RelatedAttribute MAY be present. + + + + + +Dulaunoy & Iklody Expires 1 May 2022 [Page 14] + +Internet-Draft MISP core format October 2021 + + 2.4.2.14. ShadowAttribute ShadowAttribute is an array of shadow attributes that serve as @@ -835,13 +821,6 @@ Internet-Draft MISP core format October 2020 seen. last_seen is expressed as an ISO 8601 datetime up to the micro- second with time zone support. - - -Dulaunoy & Iklody Expires April 24, 2021 [Page 15] - -Internet-Draft MISP core format October 2020 - - last_seen is represented as a JSON string. last_seen MAY be present. 2.5. ShadowAttribute @@ -856,6 +835,13 @@ Internet-Draft MISP core format October 2020 reference to the creator of the ShadowAttribute as well as a revocation flag. + + +Dulaunoy & Iklody Expires 1 May 2022 [Page 15] + +Internet-Draft MISP core format October 2021 + + 2.5.1. Sample Attribute Object "ShadowAttribute": { @@ -890,21 +876,13 @@ Internet-Draft MISP core format October 2020 the same event. UUID version 4 is RECOMMENDED when assigning it to a new event. - - - -Dulaunoy & Iklody Expires April 24, 2021 [Page 16] - -Internet-Draft MISP core format October 2020 - - uuid is represented as a JSON string. uuid MUST be present. 2.5.2.2. id id represents the human-readable identifier associated to the event for a specific MISP instance. human-readable identifier MUST be - represented as an unsigned integer. id is represented as a JSON + represented as an unsigned integer. id is represented as a JSON string. id SHALL be present. 2.5.2.3. type @@ -913,49 +891,46 @@ Internet-Draft MISP core format October 2020 describe the intent of the attribute creator, using a list of pre- defined attribute types. + + +Dulaunoy & Iklody Expires 1 May 2022 [Page 16] + +Internet-Draft MISP core format October 2021 + + type is represented as a JSON string. type MUST be present and it MUST be a valid selection for the chosen category. The list of valid category-type combinations is as follows: - Antivirus detection - link, comment, text, hex, attachment, other, anonymised + Antivirus detection link, comment, text, hex, attachment, other, + anonymised - Artifacts dropped - md5, sha1, sha224, sha256, sha384, sha512, sha512/224, sha512/256, - sha3-224, sha3-256, sha3-384, sha3-512, ssdeep, imphash, telfhash, - impfuzzy, authentihash, vhash, cdhash, filename, filename|md5, - filename|sha1, filename|sha224, filename|sha256, filename|sha384, - filename|sha512, filename|sha512/224, filename|sha512/256, - filename|sha3-224, filename|sha3-256, filename|sha3-384, - filename|sha3-512, filename|authentihash, filename|vhash, - filename|ssdeep, filename|tlsh, filename|imphash, - filename|impfuzzy, filename|pehash, regkey, regkey|value, pattern- - in-file, pattern-in-memory, filename-pattern, pdb, stix2-pattern, - yara, sigma, attachment, malware-sample, named pipe, mutex, + Artifacts dropped md5, sha1, sha224, sha256, sha384, sha512, + sha512/224, sha512/256, sha3-224, sha3-256, sha3-384, sha3-512, + ssdeep, imphash, telfhash, impfuzzy, authentihash, vhash, cdhash, + filename, filename|md5, filename|sha1, filename|sha224, + filename|sha256, filename|sha384, filename|sha512, + filename|sha512/224, filename|sha512/256, filename|sha3-224, + filename|sha3-256, filename|sha3-384, filename|sha3-512, + filename|authentihash, filename|vhash, filename|ssdeep, + filename|tlsh, filename|imphash, filename|impfuzzy, + filename|pehash, regkey, regkey|value, pattern-in-file, pattern- + in-memory, filename-pattern, pdb, stix2-pattern, yara, sigma, + attachment, malware-sample, named pipe, mutex, process-state, windows-scheduled-task, windows-service-name, windows-service- displayname, comment, text, hex, x509-fingerprint-sha1, x509- fingerprint-md5, x509-fingerprint-sha256, other, cookie, gene, kusto-query, mime-type, anonymised, pgp-public-key, pgp-private- key - Attribution - threat-actor, campaign-name, campaign-id, whois-registrant-phone, - whois-registrant-email, whois-registrant-name, whois-registrant- - org, whois-registrar, whois-creation-date, comment, text, x509- - fingerprint-sha1, x509-fingerprint-md5, x509-fingerprint-sha256, - other, dns-soa-email, anonymised, email + Attribution threat-actor, campaign-name, campaign-id, whois- + registrant-phone, whois-registrant-email, whois-registrant-name, + whois-registrant-org, whois-registrar, whois-creation-date, + comment, text, x509-fingerprint-sha1, x509-fingerprint-md5, x509- + fingerprint-sha256, other, dns-soa-email, anonymised, email - External analysis - - - -Dulaunoy & Iklody Expires April 24, 2021 [Page 17] - -Internet-Draft MISP core format October 2020 - - - md5, sha1, sha256, sha3-224, sha3-256, sha3-384, sha3-512, - filename, filename|md5, filename|sha1, filename|sha256, + External analysis md5, sha1, sha256, sha3-224, sha3-256, sha3-384, + sha3-512, filename, filename|md5, filename|sha1, filename|sha256, filename|sha3-224, filename|sha3-256, filename|sha3-384, filename|sha3-512, ip-src, ip-dst, ip-dst|port, ip-src|port, mac- address, mac-eui-64, hostname, domain, domain|ip, url, user-agent, @@ -963,71 +938,79 @@ Internet-Draft MISP core format October 2020 pattern-in-traffic, pattern-in-memory, filename-pattern, vulnerability, cpe, weakness, attachment, malware-sample, link, comment, text, x509-fingerprint-sha1, x509-fingerprint-md5, x509- - fingerprint-sha256, ja3-fingerprint-md5, hassh-md5, hasshserver- - md5, github-repository, other, cortex, anonymised, community-id + fingerprint-sha256, ja3-fingerprint-md5, jarm-fingerprint, hassh- + md5, hasshserver-md5, github-repository, other, cortex, + anonymised, community-id - Financial fraud - btc, dash, xmr, iban, bic, bank-account-nr, aba-rtn, bin, cc- - number, prtn, phone-number, comment, text, other, hex, anonymised + Financial fraud btc, dash, xmr, iban, bic, bank-account-nr, aba-rtn, + bin, cc-number, prtn, phone-number, comment, text, other, hex, + anonymised - Internal reference - text, link, comment, other, hex, anonymised, git-commit-id - Network activity - ip-src, ip-dst, ip-dst|port, ip-src|port, port, hostname, domain, - domain|ip, mac-address, mac-eui-64, email, email-dst, email-src, - eppn, url, uri, user-agent, http-method, AS, snort, pattern-in- - file, filename-pattern, stix2-pattern, pattern-in-traffic, - attachment, comment, text, x509-fingerprint-md5, x509-fingerprint- - sha1, x509-fingerprint-sha256, ja3-fingerprint-md5, hassh-md5, - hasshserver-md5, other, hex, cookie, hostname|port, bro, zeek, - anonymised, community-id, email-subject - Other - comment, text, other, size-in-bytes, counter, datetime, cpe, port, - float, hex, phone-number, boolean, anonymised, pgp-public-key, - pgp-private-key - Payload delivery - md5, sha1, sha224, sha256, sha384, sha512, sha512/224, sha512/256, - sha3-224, sha3-256, sha3-384, sha3-512, ssdeep, imphash, telfhash, - impfuzzy, authentihash, vhash, pehash, tlsh, cdhash, filename, - filename|md5, filename|sha1, filename|sha224, filename|sha256, - filename|sha384, filename|sha512, filename|sha512/224, - filename|sha512/256, filename|sha3-224, filename|sha3-256, - filename|sha3-384, filename|sha3-512, filename|authentihash, - filename|vhash, filename|ssdeep, filename|tlsh, filename|imphash, +Dulaunoy & Iklody Expires 1 May 2022 [Page 17] + +Internet-Draft MISP core format October 2021 + + + Internal reference text, link, comment, other, hex, anonymised, git- + commit-id + + Network activity ip-src, ip-dst, ip-dst|port, ip-src|port, port, + hostname, domain, domain|ip, mac-address, mac-eui-64, email, + email-dst, email-src, eppn, url, uri, user-agent, http-method, AS, + snort, pattern-in-file, filename-pattern, stix2-pattern, pattern- + in-traffic, attachment, comment, text, x509-fingerprint-md5, x509- + fingerprint-sha1, x509-fingerprint-sha256, ja3-fingerprint-md5, + jarm-fingerprint, hassh-md5, hasshserver-md5, other, hex, cookie, + hostname|port, bro, zeek, anonymised, community-id, email-subject, + favicon-mmh3, dkim, dkim-signature, ssh-fingerprint + + Other comment, text, other, size-in-bytes, counter, datetime, cpe, + port, float, hex, phone-number, boolean, anonymised, pgp-public- + key, pgp-private-key + + Payload delivery md5, sha1, sha224, sha256, sha384, sha512, + sha512/224, sha512/256, sha3-224, sha3-256, sha3-384, sha3-512, + ssdeep, imphash, telfhash, impfuzzy, authentihash, vhash, pehash, + tlsh, cdhash, filename, filename|md5, filename|sha1, + filename|sha224, filename|sha256, filename|sha384, + filename|sha512, filename|sha512/224, filename|sha512/256, + filename|sha3-224, filename|sha3-256, filename|sha3-384, + filename|sha3-512, filename|authentihash, filename|vhash, + filename|ssdeep, filename|tlsh, filename|imphash, filename|impfuzzy, filename|pehash, mac-address, mac-eui-64, ip- src, ip-dst, ip-dst|port, ip-src|port, hostname, domain, email, email-src, email-dst, email-subject, email-attachment, email-body, url, user-agent, AS, pattern-in-file, pattern-in-traffic, filename-pattern, stix2-pattern, yara, sigma, mime-type, - - - -Dulaunoy & Iklody Expires April 24, 2021 [Page 18] - -Internet-Draft MISP core format October 2020 - - attachment, malware-sample, link, malware-type, comment, text, hex, vulnerability, cpe, weakness, x509-fingerprint-sha1, x509- fingerprint-md5, x509-fingerprint-sha256, ja3-fingerprint-md5, - hassh-md5, hasshserver-md5, other, hostname|port, email-dst- - display-name, email-src-display-name, email-header, email-reply- - to, email-x-mailer, email-mime-boundary, email-thread-index, - email-message-id, mobile-application-id, chrome-extension-id, - whois-registrant-email, anonymised + jarm-fingerprint, hassh-md5, hasshserver-md5, other, + hostname|port, email-dst-display-name, email-src-display-name, + email-header, email-reply-to, email-x-mailer, email-mime-boundary, + email-thread-index, email-message-id, mobile-application-id, + chrome-extension-id, whois-registrant-email, anonymised - Payload installation - md5, sha1, sha224, sha256, sha384, sha512, sha512/224, sha512/256, - sha3-224, sha3-256, sha3-384, sha3-512, ssdeep, imphash, telfhash, - impfuzzy, authentihash, vhash, pehash, tlsh, cdhash, filename, - filename|md5, filename|sha1, filename|sha224, filename|sha256, - filename|sha384, filename|sha512, filename|sha512/224, - filename|sha512/256, filename|sha3-224, filename|sha3-256, - filename|sha3-384, filename|sha3-512, filename|authentihash, - filename|vhash, filename|ssdeep, filename|tlsh, filename|imphash, + Payload installation md5, sha1, sha224, sha256, sha384, sha512, + sha512/224, sha512/256, sha3-224, sha3-256, sha3-384, sha3-512, + ssdeep, imphash, telfhash, impfuzzy, authentihash, vhash, pehash, + tlsh, cdhash, filename, filename|md5, filename|sha1, + filename|sha224, filename|sha256, filename|sha384, + filename|sha512, filename|sha512/224, filename|sha512/256, + filename|sha3-224, filename|sha3-256, filename|sha3-384, + filename|sha3-512, filename|authentihash, filename|vhash, + + + +Dulaunoy & Iklody Expires 1 May 2022 [Page 18] + +Internet-Draft MISP core format October 2021 + + + filename|ssdeep, filename|tlsh, filename|imphash, filename|impfuzzy, filename|pehash, pattern-in-file, pattern-in- traffic, pattern-in-memory, filename-pattern, stix2-pattern, yara, sigma, vulnerability, cpe, weakness, attachment, malware-sample, @@ -1035,43 +1018,31 @@ Internet-Draft MISP core format October 2020 fingerprint-md5, x509-fingerprint-sha256, mobile-application-id, chrome-extension-id, other, mime-type, anonymised - Payload type - comment, text, other, anonymised + Payload type comment, text, other, anonymised - Persistence mechanism - filename, regkey, regkey|value, comment, text, other, hex, - anonymised + Persistence mechanism filename, regkey, regkey|value, comment, text, + other, hex, anonymised - Person - first-name, middle-name, last-name, date-of-birth, place-of-birth, - gender, passport-number, passport-country, passport-expiration, - redress-number, nationality, visa-number, issue-date-of-the-visa, - primary-residence, country-of-residence, special-service-request, - frequent-flyer-number, travel-details, payment-details, place- - port-of-original-embarkation, place-port-of-clearance, place-port- - of-onward-foreign-destination, passenger-name-record-locator- - number, comment, text, other, phone-number, identity-card-number, - anonymised, email, pgp-public-key, pgp-private-key - - Social network - github-username, github-repository, github-organisation, jabber- - id, twitter-id, email, email-src, email-dst, eppn, comment, text, - other, whois-registrant-email, anonymised, pgp-public-key, pgp- + Person first-name, middle-name, last-name, full-name, date-of-birth, + place-of-birth, gender, passport-number, passport-country, + passport-expiration, redress-number, nationality, visa-number, + issue-date-of-the-visa, primary-residence, country-of-residence, + special-service-request, frequent-flyer-number, travel-details, + payment-details, place-port-of-original-embarkation, place-port- + of-clearance, place-port-of-onward-foreign-destination, passenger- + name-record-locator-number, comment, text, other, phone-number, + identity-card-number, anonymised, email, pgp-public-key, pgp- private-key + Social network github-username, github-repository, github- + organisation, jabber-id, twitter-id, email, email-src, email-dst, + eppn, comment, text, other, whois-registrant-email, anonymised, + pgp-public-key, pgp-private-key + Support Tool link, text, attachment, comment, other, hex, anonymised -Dulaunoy & Iklody Expires April 24, 2021 [Page 19] - -Internet-Draft MISP core format October 2020 - - - Support Tool - link, text, attachment, comment, other, hex, anonymised - - Targeting data - target-user, target-email, target-machine, target-org, target- - location, target-external, comment, anonymised + Targeting data target-user, target-email, target-machine, target- + org, target-location, target-external, comment, anonymised Attributes are based on the usage within their different communities. Attributes can be extended on a regular basis and this reference @@ -1087,6 +1058,14 @@ Internet-Draft MISP core format October 2020 and it MUST be a valid selection for the chosen type. The list of valid category-type combinations is mentioned above. + + + +Dulaunoy & Iklody Expires 1 May 2022 [Page 19] + +Internet-Draft MISP core format October 2021 + + 2.5.2.5. to_ids to_ids represents whether the Attribute to be created if the @@ -1113,15 +1092,6 @@ Internet-Draft MISP core format October 2020 Attribute object that the ShadowAttribute belongs to. A ShadowAttribute can this way target an existing Attribute, implying that it is a proposal to modify an existing Attribute, or - - - - -Dulaunoy & Iklody Expires April 24, 2021 [Page 20] - -Internet-Draft MISP core format October 2020 - - alternatively it can be a proposal to create a new Attribute for the containing Event. @@ -1144,6 +1114,14 @@ Internet-Draft MISP core format October 2020 comment is a contextual comment field. + + + +Dulaunoy & Iklody Expires 1 May 2022 [Page 20] + +Internet-Draft MISP core format October 2021 + + comment is represented by a JSON string. comment MAY be present. 2.5.2.10. org_id @@ -1170,14 +1148,6 @@ Internet-Draft MISP core format October 2020 proposal_to_delete is a JSON boolean and it MUST be present. If proposal_to_delete is set to true, old_id MUST NOT be 0. - - - -Dulaunoy & Iklody Expires April 24, 2021 [Page 21] - -Internet-Draft MISP core format October 2020 - - 2.5.2.12. deleted deleted represents a setting that allows shadow attributes to be @@ -1196,6 +1166,18 @@ Internet-Draft MISP core format October 2020 data is represented by a JSON string in base64 encoding. data MUST be set for shadow attributes of type malware-sample and attachment. + + + + + + + +Dulaunoy & Iklody Expires 1 May 2022 [Page 21] + +Internet-Draft MISP core format October 2021 + + 2.5.2.14. first_seen first_seen represents a reference time when the attribute was first @@ -1226,14 +1208,6 @@ Internet-Draft MISP core format October 2020 instance and used as reference in the event. A human-readable identifier MUST be represented as an unsigned integer. - - - -Dulaunoy & Iklody Expires April 24, 2021 [Page 22] - -Internet-Draft MISP core format October 2020 - - uuid, name and id are represented as a JSON string. uuid, name and id MUST be present. @@ -1252,6 +1226,14 @@ Internet-Draft MISP core format October 2020 value is represented by a JSON string. value MUST be present. + + + +Dulaunoy & Iklody Expires 1 May 2022 [Page 22] + +Internet-Draft MISP core format October 2021 + + 2.6. Object Objects serve as a contextual bond between a list of attributes @@ -1285,9 +1267,27 @@ Internet-Draft MISP core format October 2020 -Dulaunoy & Iklody Expires April 24, 2021 [Page 23] + + + + + + + + + + + + + + + + + + +Dulaunoy & Iklody Expires 1 May 2022 [Page 23] -Internet-Draft MISP core format October 2020 +Internet-Draft MISP core format October 2021 "Object": { @@ -1331,8 +1331,6 @@ Internet-Draft MISP core format October 2020 ] } - Figure 1 - 2.6.2. Object Attributes @@ -1341,9 +1339,11 @@ Internet-Draft MISP core format October 2020 -Dulaunoy & Iklody Expires April 24, 2021 [Page 24] + + +Dulaunoy & Iklody Expires 1 May 2022 [Page 24] -Internet-Draft MISP core format October 2020 +Internet-Draft MISP core format October 2021 2.6.2.1. uuid @@ -1397,9 +1397,9 @@ Internet-Draft MISP core format October 2020 -Dulaunoy & Iklody Expires April 24, 2021 [Page 25] +Dulaunoy & Iklody Expires 1 May 2022 [Page 25] -Internet-Draft MISP core format October 2020 +Internet-Draft MISP core format October 2021 2.6.2.7. template_version @@ -1437,29 +1437,27 @@ Internet-Draft MISP core format October 2020 distribution is represented by a JSON string. distribution MUST be present and be one of the following options: - 0 - Your Organisation Only + 0 Your Organisation Only - 1 - This Community Only + 1 This Community Only - 2 - Connected Communities + 2 Connected Communities - 3 - All Communities + 3 All Communities - 4 + 4 Sharing Group -Dulaunoy & Iklody Expires April 24, 2021 [Page 26] + + + + +Dulaunoy & Iklody Expires 1 May 2022 [Page 26] -Internet-Draft MISP core format October 2020 +Internet-Draft MISP core format October 2021 - Sharing Group - 2.6.2.11. sharing_group_id sharing_group_id represents a human-readable identifier referencing a @@ -1502,24 +1500,20 @@ Internet-Draft MISP core format October 2020 first_seen is represented as a JSON string. first_seen MAY be present. - - - - - - - -Dulaunoy & Iklody Expires April 24, 2021 [Page 27] - -Internet-Draft MISP core format October 2020 - - 2.6.2.16. last_seen last_seen represents a reference time when the object was last seen. last_seen as an ISO 8601 datetime up to the micro-second with time zone support. + + + +Dulaunoy & Iklody Expires 1 May 2022 [Page 27] + +Internet-Draft MISP core format October 2021 + + last_seen is represented as a JSON string. last_seen MAY be present. 2.7. Object References @@ -1561,15 +1555,6 @@ Internet-Draft MISP core format October 2020 transfer of the same object reference. UUID version 4 is RECOMMENDED when assigning it to a new object reference. - - - - -Dulaunoy & Iklody Expires April 24, 2021 [Page 28] - -Internet-Draft MISP core format October 2020 - - 2.7.2.2. id id represents the human-readable identifier associated to the object @@ -1577,6 +1562,14 @@ Internet-Draft MISP core format October 2020 id is represented as a JSON string. id SHALL be present. + + + +Dulaunoy & Iklody Expires 1 May 2022 [Page 28] + +Internet-Draft MISP core format October 2021 + + 2.7.2.3. timestamp timestamp represents a reference time when the object was created or @@ -1619,19 +1612,20 @@ Internet-Draft MISP core format October 2020 referenced_type is represented as a JSON string. referenced_type MAY be present. - - -Dulaunoy & Iklody Expires April 24, 2021 [Page 29] - -Internet-Draft MISP core format October 2020 - - 2.7.2.8. relationship_type relationship_type represents the human-readable context of the relationship between an object and another object or attribute as described by the object_reference. + + + +Dulaunoy & Iklody Expires 1 May 2022 [Page 29] + +Internet-Draft MISP core format October 2021 + + referenced_type is represented as a JSON string. relationship_type MUST be present. @@ -1670,18 +1664,6 @@ Internet-Draft MISP core format October 2020 information which can be linked to Attributes, Objects, Tags or Galaxy with an extension to the Markdown marking language. - - - - - - - -Dulaunoy & Iklody Expires April 24, 2021 [Page 30] - -Internet-Draft MISP core format October 2020 - - 2.8.1. id id represents the human-readable identifier associated to the @@ -1690,6 +1672,16 @@ Internet-Draft MISP core format October 2020 id is represented as a JSON string. id SHALL be present. + + + + + +Dulaunoy & Iklody Expires 1 May 2022 [Page 30] + +Internet-Draft MISP core format October 2021 + + 2.8.2. UUID uuid represents the Universally Unique IDentifier (UUID) [RFC4122] of @@ -1727,17 +1719,6 @@ Internet-Draft MISP core format October 2020 content is represented as a JSON string. content MUST be present. - - - - - - -Dulaunoy & Iklody Expires April 24, 2021 [Page 31] - -Internet-Draft MISP core format October 2020 - - 2.8.6. distribution distribution represents the basic distribution rules of the @@ -1747,23 +1728,25 @@ Internet-Draft MISP core format October 2020 distribution is represented by a JSON string. distribution MUST be present and be one of the following options: - 0 - Your Organisation Only + 0 Your Organisation Only - 1 - This Community Only - 2 - Connected Communities - 3 - All Communities - 4 - Sharing Group +Dulaunoy & Iklody Expires 1 May 2022 [Page 31] + +Internet-Draft MISP core format October 2021 - 5 - Inherit Event + + 1 This Community Only + + 2 Connected Communities + + 3 All Communities + + 4 Sharing Group + + 5 Inherit Event 2.8.7. sharing_group_id @@ -1782,18 +1765,6 @@ Internet-Draft MISP core format October 2020 timestamp is represented as a JSON string. timestamp MUST be present. - - - - - - - -Dulaunoy & Iklody Expires April 24, 2021 [Page 32] - -Internet-Draft MISP core format October 2020 - - 2.8.9. deleted deleted represents a setting that allows EventReport to be revoked. @@ -1814,6 +1785,15 @@ Internet-Draft MISP core format October 2020 or attribute level. A tag element is described with a name, id, colour and exportable flag. + + + + +Dulaunoy & Iklody Expires 1 May 2022 [Page 32] + +Internet-Draft MISP core format October 2021 + + exportable represents a setting if the tag is kept local or exportable to other MISP instances. exportable is represented by a JSON boolean. id is a human-readable identifier that references the @@ -1841,25 +1821,19 @@ Internet-Draft MISP core format October 2020 type MUST be present. type describes the type of a sighting. MISP allows 3 default types: + +===============+==========================================+ + | Sighting type | Description | + +===============+==========================================+ + | 0 | denotes an attribute which has been seen | + +---------------+------------------------------------------+ + | 1 | denotes an attribute which has been seen | + | | and confirmed as false-positive | + +---------------+------------------------------------------+ + | 2 | denotes an attribute which will be | + | | expired at the time of the sighting | + +---------------+------------------------------------------+ - - - -Dulaunoy & Iklody Expires April 24, 2021 [Page 33] - -Internet-Draft MISP core format October 2020 - - - +------------+------------------------------------------------------+ - | Sighting | Description | - | type | | - +------------+------------------------------------------------------+ - | 0 | denotes an attribute which has been seen | - | 1 | denotes an attribute which has been seen and | - | | confirmed as false-positive | - | 2 | denotes an attribute which will be expired at the | - | | time of the sighting | - +------------+------------------------------------------------------+ + Table 1 uuid MUST be present. uuid references the uuid of the sighted attribute. @@ -1869,6 +1843,13 @@ Internet-Draft MISP core format October 2020 date_sighting represents when the referenced attribute, designated by its uuid, is sighted. + + +Dulaunoy & Iklody Expires 1 May 2022 [Page 33] + +Internet-Draft MISP core format October 2021 + + source MAY be present. source is represented as a JSON string and represents the human-readable version of the sighting source, which can be a given piece of software (e.g. SIEM), device or a specific @@ -1877,9 +1858,9 @@ Internet-Draft MISP core format October 2020 id, event_id and attribute_id MAY be present. id represents the human-readable identifier of the sighting reference - which belongs to a specific MISP instance. event_id represents the + which belongs to a specific MISP instance. event_id represents the human-readable identifier of the event referenced by the sighting and - belongs to a specific MISP instance. attribute_id represents the + belongs to a specific MISP instance. attribute_id represents the human-readable identifier of the attribute referenced by the sighting and belongs to a specific MISP instance. @@ -1901,9 +1882,28 @@ Internet-Draft MISP core format October 2020 -Dulaunoy & Iklody Expires April 24, 2021 [Page 34] + + + + + + + + + + + + + + + + + + + +Dulaunoy & Iklody Expires 1 May 2022 [Page 34] -Internet-Draft MISP core format October 2020 +Internet-Draft MISP core format October 2021 "Sighting": [ @@ -1957,9 +1957,9 @@ Internet-Draft MISP core format October 2020 -Dulaunoy & Iklody Expires April 24, 2021 [Page 35] +Dulaunoy & Iklody Expires 1 May 2022 [Page 35] -Internet-Draft MISP core format October 2020 +Internet-Draft MISP core format October 2021 "Galaxy": [ { @@ -2013,9 +2013,9 @@ Internet-Draft MISP core format October 2020 -Dulaunoy & Iklody Expires April 24, 2021 [Page 36] +Dulaunoy & Iklody Expires 1 May 2022 [Page 36] -Internet-Draft MISP core format October 2020 +Internet-Draft MISP core format October 2021 3. JSON Schema @@ -2069,9 +2069,9 @@ Internet-Draft MISP core format October 2020 -Dulaunoy & Iklody Expires April 24, 2021 [Page 37] +Dulaunoy & Iklody Expires 1 May 2022 [Page 37] -Internet-Draft MISP core format October 2020 +Internet-Draft MISP core format October 2021 "type": "object", @@ -2125,9 +2125,9 @@ Internet-Draft MISP core format October 2020 -Dulaunoy & Iklody Expires April 24, 2021 [Page 38] +Dulaunoy & Iklody Expires 1 May 2022 [Page 38] -Internet-Draft MISP core format October 2020 +Internet-Draft MISP core format October 2021 "items": { @@ -2181,9 +2181,9 @@ Internet-Draft MISP core format October 2020 -Dulaunoy & Iklody Expires April 24, 2021 [Page 39] +Dulaunoy & Iklody Expires 1 May 2022 [Page 39] -Internet-Draft MISP core format October 2020 +Internet-Draft MISP core format October 2021 "type": "string" @@ -2237,9 +2237,9 @@ Internet-Draft MISP core format October 2020 -Dulaunoy & Iklody Expires April 24, 2021 [Page 40] +Dulaunoy & Iklody Expires 1 May 2022 [Page 40] -Internet-Draft MISP core format October 2020 +Internet-Draft MISP core format October 2021 "type": "string" @@ -2293,9 +2293,9 @@ Internet-Draft MISP core format October 2020 -Dulaunoy & Iklody Expires April 24, 2021 [Page 41] +Dulaunoy & Iklody Expires 1 May 2022 [Page 41] -Internet-Draft MISP core format October 2020 +Internet-Draft MISP core format October 2021 "properties": { @@ -2349,9 +2349,9 @@ Internet-Draft MISP core format October 2020 -Dulaunoy & Iklody Expires April 24, 2021 [Page 42] +Dulaunoy & Iklody Expires 1 May 2022 [Page 42] -Internet-Draft MISP core format October 2020 +Internet-Draft MISP core format October 2021 "properties": { @@ -2405,9 +2405,9 @@ Internet-Draft MISP core format October 2020 -Dulaunoy & Iklody Expires April 24, 2021 [Page 43] +Dulaunoy & Iklody Expires 1 May 2022 [Page 43] -Internet-Draft MISP core format October 2020 +Internet-Draft MISP core format October 2021 "properties": { @@ -2461,9 +2461,9 @@ Internet-Draft MISP core format October 2020 -Dulaunoy & Iklody Expires April 24, 2021 [Page 44] +Dulaunoy & Iklody Expires 1 May 2022 [Page 44] -Internet-Draft MISP core format October 2020 +Internet-Draft MISP core format October 2021 }, @@ -2517,9 +2517,9 @@ Internet-Draft MISP core format October 2020 -Dulaunoy & Iklody Expires April 24, 2021 [Page 45] +Dulaunoy & Iklody Expires 1 May 2022 [Page 45] -Internet-Draft MISP core format October 2020 +Internet-Draft MISP core format October 2021 }, @@ -2573,9 +2573,9 @@ Internet-Draft MISP core format October 2020 -Dulaunoy & Iklody Expires April 24, 2021 [Page 46] +Dulaunoy & Iklody Expires 1 May 2022 [Page 46] -Internet-Draft MISP core format October 2020 +Internet-Draft MISP core format October 2021 "type": "string" @@ -2629,9 +2629,9 @@ Internet-Draft MISP core format October 2020 -Dulaunoy & Iklody Expires April 24, 2021 [Page 47] +Dulaunoy & Iklody Expires 1 May 2022 [Page 47] -Internet-Draft MISP core format October 2020 +Internet-Draft MISP core format October 2021 "uniqueItems": true, @@ -2685,9 +2685,9 @@ Internet-Draft MISP core format October 2020 -Dulaunoy & Iklody Expires April 24, 2021 [Page 48] +Dulaunoy & Iklody Expires 1 May 2022 [Page 48] -Internet-Draft MISP core format October 2020 +Internet-Draft MISP core format October 2021 "type": "boolean" @@ -2741,9 +2741,9 @@ Internet-Draft MISP core format October 2020 -Dulaunoy & Iklody Expires April 24, 2021 [Page 49] +Dulaunoy & Iklody Expires 1 May 2022 [Page 49] -Internet-Draft MISP core format October 2020 +Internet-Draft MISP core format October 2021 "type": "object", @@ -2797,9 +2797,9 @@ Internet-Draft MISP core format October 2020 -Dulaunoy & Iklody Expires April 24, 2021 [Page 50] +Dulaunoy & Iklody Expires 1 May 2022 [Page 50] -Internet-Draft MISP core format October 2020 +Internet-Draft MISP core format October 2021 "Event": { @@ -2831,34 +2831,34 @@ Internet-Draft MISP core format October 2020 Each uuid is composed of a JSON object with the following fields which came from the original event referenced by the same uuid: - o info (MUST) + * info (MUST) - o Orgc object (MUST) + * Orgc object (MUST) - o analysis (SHALL) + * analysis (SHALL) - o timestamp (MUST) + * timestamp (MUST) - o date (MUST) + * date (MUST) - o threat_level_id (SHALL) + * threat_level_id (SHALL) In addition to the fields originating from the event, the following fields can be added: - o integrity:sha256 represents the SHA256 value in hexadecimal + * integrity:sha256 represents the SHA256 value in hexadecimal representation of the associated MISP event file to ensure integrity of the file. (SHOULD) -Dulaunoy & Iklody Expires April 24, 2021 [Page 51] +Dulaunoy & Iklody Expires 1 May 2022 [Page 51] -Internet-Draft MISP core format October 2020 +Internet-Draft MISP core format October 2021 - o integrity:pgp represents a detached PGP signature [RFC4880] of the + * integrity:pgp represents a detached PGP signature [RFC4880] of the associated MISP event file to ensure integrity of the file. (SHOULD) @@ -2909,9 +2909,9 @@ Internet-Draft MISP core format October 2020 -Dulaunoy & Iklody Expires April 24, 2021 [Page 52] +Dulaunoy & Iklody Expires 1 May 2022 [Page 52] -Internet-Draft MISP core format October 2020 +Internet-Draft MISP core format October 2021 "name": "circl:incident-classification=\"malware\"" @@ -2956,27 +2956,20 @@ Internet-Draft MISP core format October 2020 8. References -9. References - - - - - - - - -Dulaunoy & Iklody Expires April 24, 2021 [Page 53] - -Internet-Draft MISP core format October 2020 - - -9.1. Normative References +9. Normative References [RFC2119] Bradner, S., "Key words for use in RFCs to Indicate Requirement Levels", BCP 14, RFC 2119, DOI 10.17487/RFC2119, March 1997, . + + +Dulaunoy & Iklody Expires 1 May 2022 [Page 53] + +Internet-Draft MISP core format October 2021 + + [RFC4122] Leach, P., Mealling, M., and R. Salz, "A Universally Unique IDentifier (UUID) URN Namespace", RFC 4122, DOI 10.17487/RFC4122, July 2005, @@ -2992,7 +2985,7 @@ Internet-Draft MISP core format October 2020 DOI 10.17487/RFC8259, December 2017, . -9.2. Informative References +10. Informative References [JSON-SCHEMA] Wright, A., "JSON Schema: A Media Type for Describing JSON @@ -3013,33 +3006,30 @@ Internet-Draft MISP core format October 2020 Authors' Addresses - - - - - - - - -Dulaunoy & Iklody Expires April 24, 2021 [Page 54] - -Internet-Draft MISP core format October 2020 - - Alexandre Dulaunoy Computer Incident Response Center Luxembourg 16, bd d'Avranches - Luxembourg L-1160 + L-L-1160 Luxembourg Luxembourg Phone: +352 247 88444 Email: alexandre.dulaunoy@circl.lu + + + + + +Dulaunoy & Iklody Expires 1 May 2022 [Page 54] + +Internet-Draft MISP core format October 2021 + + Andras Iklody Computer Incident Response Center Luxembourg 16, bd d'Avranches - Luxembourg L-1160 + L-L-1160 Luxembourg Luxembourg Phone: +352 247 88444 @@ -3077,4 +3067,14 @@ Internet-Draft MISP core format October 2020 -Dulaunoy & Iklody Expires April 24, 2021 [Page 55] + + + + + + + + + + +Dulaunoy & Iklody Expires 1 May 2022 [Page 55] diff --git a/rfc/misp-standard-galaxy-format.html b/rfc/misp-standard-galaxy-format.html index 2d64b23..d4921bc 100644 --- a/rfc/misp-standard-galaxy-format.html +++ b/rfc/misp-standard-galaxy-format.html @@ -1,533 +1,1403 @@ - + + + + + + +MISP galaxy format + + + + + + + + + + +*/ - - - - - - - - - - - - - - - - +/* fonts */ +@import url('https://fonts.googleapis.com/css?family=Noto+Sans'); /* Sans-serif */ +@import url('https://fonts.googleapis.com/css?family=Noto+Serif'); /* Serif (print) */ +@import url('https://fonts.googleapis.com/css?family=Roboto+Mono'); /* Monospace */ + +@viewport { + zoom: 1.0; + width: extend-to-zoom; +} +@-ms-viewport { + width: extend-to-zoom; + zoom: 1.0; +} +/* general and mobile first */ +html { +} +body { + max-width: 90%; + margin: 1.5em auto; + color: #222; + background-color: #fff; + font-size: 14px; + font-family: 'Noto Sans', Arial, Helvetica, sans-serif; + line-height: 1.6; + scroll-behavior: smooth; +} +.ears { + display: none; +} + +/* headings */ +#title, h1, h2, h3, h4, h5, h6 { + margin: 1em 0 0.5em; + font-weight: bold; + line-height: 1.3; +} +#title { + clear: both; + border-bottom: 1px solid #ddd; + margin: 0 0 0.5em 0; + padding: 1em 0 0.5em; +} +.author { + padding-bottom: 4px; +} +h1 { + font-size: 26px; + margin: 1em 0; +} +h2 { + font-size: 22px; + margin-top: -20px; /* provide offset for in-page anchors */ + padding-top: 33px; +} +h3 { + font-size: 18px; + margin-top: -36px; /* provide offset for in-page anchors */ + padding-top: 42px; +} +h4 { + font-size: 16px; + margin-top: -36px; /* provide offset for in-page anchors */ + padding-top: 42px; +} +h5, h6 { + font-size: 14px; +} +#n-copyright-notice { + border-bottom: 1px solid #ddd; + padding-bottom: 1em; + margin-bottom: 1em; +} +/* general structure */ +p { + padding: 0; + margin: 0 0 1em 0; + text-align: left; +} +div, span { + position: relative; +} +div { + margin: 0; +} +.alignRight.art-text { + background-color: #f9f9f9; + border: 1px solid #eee; + border-radius: 3px; + padding: 1em 1em 0; + margin-bottom: 1.5em; +} +.alignRight.art-text pre { + padding: 0; +} +.alignRight { + margin: 1em 0; +} +.alignRight > *:first-child { + border: none; + margin: 0; + float: right; + clear: both; +} +.alignRight > *:nth-child(2) { + clear: both; + display: block; + border: none; +} +svg { + display: block; +} +.alignCenter.art-text { + background-color: #f9f9f9; + border: 1px solid #eee; + border-radius: 3px; + padding: 1em 1em 0; + margin-bottom: 1.5em; +} +.alignCenter.art-text pre { + padding: 0; +} +.alignCenter { + margin: 1em 0; +} +.alignCenter > *:first-child { + border: none; + /* this isn't optimal, but it's an existence proof. PrinceXML doesn't + support flexbox yet. + */ + display: table; + margin: 0 auto; +} + +/* lists */ +ol, ul { + padding: 0; + margin: 0 0 1em 2em; +} +ol ol, ul ul, ol ul, ul ol { + margin-left: 1em; +} +li { + margin: 0 0 0.25em 0; +} +.ulCompact li { + margin: 0; +} +ul.empty, .ulEmpty { + list-style-type: none; +} +ul.empty li, .ulEmpty li { + margin-top: 0.5em; +} +ul.ulBare, li.ulBare { + margin-left: 0em !important; +} +ul.compact, .ulCompact, +ol.compact, .olCompact { + line-height: 100%; + margin: 0 0 0 2em; +} + +/* definition lists */ +dl { +} +dl > dt { + float: left; + margin-right: 1em; +} +/* +dl.nohang > dt { + float: none; +} +*/ +dl > dd { + margin-bottom: .8em; + min-height: 1.3em; +} +dl.compact > dd, .dlCompact > dd { + margin-bottom: 0em; +} +dl > dd > dl { + margin-top: 0.5em; + margin-bottom: 0em; +} + +/* links */ +a { + text-decoration: none; +} +a[href] { + color: #22e; /* Arlen: WCAG 2019 */ +} +a[href]:hover { + background-color: #f2f2f2; +} +figcaption a[href], +a[href].selfRef { + color: #222; +} +/* XXX probably not this: +a.selfRef:hover { + background-color: transparent; + cursor: default; +} */ + +/* Figures */ +tt, code, pre, code { + background-color: #f9f9f9; + font-family: 'Roboto Mono', monospace; +} +pre { + border: 1px solid #eee; + margin: 0; + padding: 1em; +} +img { + max-width: 100%; +} +figure { + margin: 0; +} +figure blockquote { + margin: 0.8em 0.4em 0.4em; +} +figcaption { + font-style: italic; + margin: 0 0 1em 0; +} +@media screen { + pre { + overflow-x: auto; + max-width: 100%; + max-width: calc(100% - 22px); + } +} + +/* aside, blockquote */ +aside, blockquote { + margin-left: 0; + padding: 1.2em 2em; +} +blockquote { + background-color: #f9f9f9; + color: #111; /* Arlen: WCAG 2019 */ + border: 1px solid #ddd; + border-radius: 3px; + margin: 1em 0; +} +cite { + display: block; + text-align: right; + font-style: italic; +} + +/* tables */ +table { + width: 100%; + margin: 0 0 1em; + border-collapse: collapse; + border: 1px solid #eee; +} +th, td { + text-align: left; + vertical-align: top; + padding: 0.5em 0.75em; +} +th { + text-align: left; + background-color: #e9e9e9; +} +tr:nth-child(2n+1) > td { + background-color: #f5f5f5; +} +table caption { + font-style: italic; + margin: 0; + padding: 0; + text-align: left; +} +table p { + /* XXX to avoid bottom margin on table row signifiers. If paragraphs should + be allowed within tables more generally, it would be far better to select on a class. */ + margin: 0; +} + +/* pilcrow */ +a.pilcrow { + color: #666; /* Arlen: AHDJ 2019 */ + text-decoration: none; + visibility: hidden; + user-select: none; + -ms-user-select: none; + -o-user-select:none; + -moz-user-select: none; + -khtml-user-select: none; + -webkit-user-select: none; + -webkit-touch-callout: none; +} +@media screen { + aside:hover > a.pilcrow, + p:hover > a.pilcrow, + blockquote:hover > a.pilcrow, + div:hover > a.pilcrow, + li:hover > a.pilcrow, + pre:hover > a.pilcrow { + visibility: visible; + } + a.pilcrow:hover { + background-color: transparent; + } +} + +/* misc */ +hr { + border: 0; + border-top: 1px solid #eee; +} +.bcp14 { + font-variant: small-caps; +} + +.role { + font-variant: all-small-caps; +} + +/* info block */ +#identifiers { + margin: 0; + font-size: 0.9em; +} +#identifiers dt { + width: 3em; + clear: left; +} +#identifiers dd { + float: left; + margin-bottom: 0; +} +#identifiers .authors .author { + display: inline-block; + margin-right: 1.5em; +} +#identifiers .authors .org { + font-style: italic; +} + +/* The prepared/rendered info at the very bottom of the page */ +.docInfo { + color: #666; /* Arlen: WCAG 2019 */ + font-size: 0.9em; + font-style: italic; + margin-top: 2em; +} +.docInfo .prepared { + float: left; +} +.docInfo .prepared { + float: right; +} + +/* table of contents */ +#toc { + padding: 0.75em 0 2em 0; + margin-bottom: 1em; +} +nav.toc ul { + margin: 0 0.5em 0 0; + padding: 0; + list-style: none; +} +nav.toc li { + line-height: 1.3em; + margin: 0.75em 0; + padding-left: 1.2em; + text-indent: -1.2em; +} +/* references */ +.references dt { + text-align: right; + font-weight: bold; + min-width: 7em; +} +.references dd { + margin-left: 8em; + overflow: auto; +} + +.refInstance { + margin-bottom: 1.25em; +} + +.references .ascii { + margin-bottom: 0.25em; +} + +/* index */ +.index ul { + margin: 0 0 0 1em; + padding: 0; + list-style: none; +} +.index ul ul { + margin: 0; +} +.index li { + margin: 0; + text-indent: -2em; + padding-left: 2em; + padding-bottom: 5px; +} +.indexIndex { + margin: 0.5em 0 1em; +} +.index a { + font-weight: 700; +} +/* make the index two-column on all but the smallest screens */ +@media (min-width: 600px) { + .index ul { + -moz-column-count: 2; + -moz-column-gap: 20px; + } + .index ul ul { + -moz-column-count: 1; + -moz-column-gap: 0; + } +} + +/* authors */ +address.vcard { + font-style: normal; + margin: 1em 0; +} + +address.vcard .nameRole { + font-weight: 700; + margin-left: 0; +} +address.vcard .label { + font-family: "Noto Sans",Arial,Helvetica,sans-serif; + margin: 0.5em 0; +} +address.vcard .type { + display: none; +} +.alternative-contact { + margin: 1.5em 0 1em; +} +hr.addr { + border-top: 1px dashed; + margin: 0; + color: #ddd; + max-width: calc(100% - 16px); +} + +/* temporary notes */ +.rfcEditorRemove::before { + position: absolute; + top: 0.2em; + right: 0.2em; + padding: 0.2em; + content: "The RFC Editor will remove this note"; + color: #9e2a00; /* Arlen: WCAG 2019 */ + background-color: #ffd; /* Arlen: WCAG 2019 */ +} +.rfcEditorRemove { + position: relative; + padding-top: 1.8em; + background-color: #ffd; /* Arlen: WCAG 2019 */ + border-radius: 3px; +} +.cref { + background-color: #ffd; /* Arlen: WCAG 2019 */ + padding: 2px 4px; +} +.crefSource { + font-style: italic; +} +/* alternative layout for smaller screens */ +@media screen and (max-width: 1023px) { + body { + padding-top: 2em; + } + #title { + padding: 1em 0; + } + h1 { + font-size: 24px; + } + h2 { + font-size: 20px; + margin-top: -18px; /* provide offset for in-page anchors */ + padding-top: 38px; + } + #identifiers dd { + max-width: 60%; + } + #toc { + position: fixed; + z-index: 2; + top: 0; + right: 0; + padding: 0; + margin: 0; + background-color: inherit; + border-bottom: 1px solid #ccc; + } + #toc h2 { + margin: -1px 0 0 0; + padding: 4px 0 4px 6px; + padding-right: 1em; + min-width: 190px; + font-size: 1.1em; + text-align: right; + background-color: #444; + color: white; + cursor: pointer; + } + #toc h2::before { /* css hamburger */ + float: right; + position: relative; + width: 1em; + height: 1px; + left: -164px; + margin: 6px 0 0 0; + background: white none repeat scroll 0 0; + box-shadow: 0 4px 0 0 white, 0 8px 0 0 white; + content: ""; + } + #toc nav { + display: none; + padding: 0.5em 1em 1em; + overflow: auto; + height: calc(100vh - 48px); + border-left: 1px solid #ddd; + } +} + +/* alternative layout for wide screens */ +@media screen and (min-width: 1024px) { + body { + max-width: 724px; + margin: 42px auto; + padding-left: 1.5em; + padding-right: 29em; + } + #toc { + position: fixed; + top: 42px; + right: 42px; + width: 25%; + margin: 0; + padding: 0 1em; + z-index: 1; + } + #toc h2 { + border-top: none; + border-bottom: 1px solid #ddd; + font-size: 1em; + font-weight: normal; + margin: 0; + padding: 0.25em 1em 1em 0; + } + #toc nav { + display: block; + height: calc(90vh - 84px); + bottom: 0; + padding: 0.5em 0 0; + overflow: auto; + } + img { /* future proofing */ + max-width: 100%; + height: auto; + } +} + +/* pagination */ +@media print { + body { + + width: 100%; + } + p { + orphans: 3; + widows: 3; + } + #n-copyright-notice { + border-bottom: none; + } + #toc, #n-introduction { + page-break-before: always; + } + #toc { + border-top: none; + padding-top: 0; + } + figure, pre { + page-break-inside: avoid; + } + figure { + overflow: scroll; + } + h1, h2, h3, h4, h5, h6 { + page-break-after: avoid; + } + h2+*, h3+*, h4+*, h5+*, h6+* { + page-break-before: avoid; + } + pre { + white-space: pre-wrap; + word-wrap: break-word; + font-size: 10pt; + } + table { + border: 1px solid #ddd; + } + td { + border-top: 1px solid #ddd; + } +} + +/* This is commented out here, as the string-set: doesn't + pass W3C validation currently */ +/* +.ears thead .left { + string-set: ears-top-left content(); +} + +.ears thead .center { + string-set: ears-top-center content(); +} + +.ears thead .right { + string-set: ears-top-right content(); +} + +.ears tfoot .left { + string-set: ears-bottom-left content(); +} + +.ears tfoot .center { + string-set: ears-bottom-center content(); +} + +.ears tfoot .right { + string-set: ears-bottom-right content(); +} +*/ + +@page :first { + padding-top: 0; + @top-left { + content: normal; + border: none; + } + @top-center { + content: normal; + border: none; + } + @top-right { + content: normal; + border: none; + } +} + +@page { + size: A4; + margin-bottom: 45mm; + padding-top: 20px; + /* The follwing is commented out here, but set appropriately by in code, as + the content depends on the document */ + /* + @top-left { + content: 'Internet-Draft'; + vertical-align: bottom; + border-bottom: solid 1px #ccc; + } + @top-left { + content: string(ears-top-left); + vertical-align: bottom; + border-bottom: solid 1px #ccc; + } + @top-center { + content: string(ears-top-center); + vertical-align: bottom; + border-bottom: solid 1px #ccc; + } + @top-right { + content: string(ears-top-right); + vertical-align: bottom; + border-bottom: solid 1px #ccc; + } + @bottom-left { + content: string(ears-bottom-left); + vertical-align: top; + border-top: solid 1px #ccc; + } + @bottom-center { + content: string(ears-bottom-center); + vertical-align: top; + border-top: solid 1px #ccc; + } + @bottom-right { + content: '[Page ' counter(page) ']'; + vertical-align: top; + border-top: solid 1px #ccc; + } + */ + +} + +/* Changes introduced to fix issues found during implementation */ +/* Make sure links are clickable even if overlapped by following H* */ +a { + z-index: 2; +} +/* Separate body from document info even without intervening H1 */ +section { + clear: both; +} - - +/* Top align author divs, to avoid names without organization dropping level with org names */ +.author { + vertical-align: top; +} - - - - - +/* Leave room in document info to show Internet-Draft on one line */ +#identifiers dt { + width: 8em; +} +/* Don't waste quite as much whitespace between label and value in doc info */ +#identifiers dd { + margin-left: 1em; +} + +/* Give floating toc a background color (needed when it's a div inside section */ +#toc { + background-color: white; +} + +/* Make the collapsed ToC header render white on gray also when it's a link */ +@media screen and (max-width: 1023px) { + #toc h2 a, + #toc h2 a:link, + #toc h2 a:focus, + #toc h2 a:hover, + #toc a.toplink, + #toc a.toplink:hover { + color: white; + background-color: #444; + text-decoration: none; + } +} + +/* Give the bottom of the ToC some whitespace */ +@media screen and (min-width: 1024px) { + #toc { + padding: 0 0 1em 1em; + } +} + +/* Style section numbers with more space between number and title */ +.section-number { + padding-right: 0.5em; +} + +/* prevent monospace from becoming overly large */ +tt, code, pre, code { + font-size: 95%; +} + +/* Fix the height/width aspect for ascii art*/ +pre.sourcecode, +.art-text pre { + line-height: 1.12; +} + + +/* Add styling for a link in the ToC that points to the top of the document */ +a.toplink { + float: right; + margin-right: 0.5em; +} + +/* Fix the dl styling to match the RFC 7992 attributes */ +dl > dt, +dl.dlParallel > dt { + float: left; + margin-right: 1em; +} +dl.dlNewline > dt { + float: none; +} + +/* Provide styling for table cell text alignment */ +table td.text-left, +table th.text-left { + text-align: left; +} +table td.text-center, +table th.text-center { + text-align: center; +} +table td.text-right, +table th.text-right { + text-align: right; +} + +/* Make the alternative author contact informatio look less like just another + author, and group it closer with the primary author contact information */ +.alternative-contact { + margin: 0.5em 0 0.25em 0; +} +address .non-ascii { + margin: 0 0 0 2em; +} + +/* With it being possible to set tables with alignment + left, center, and right, { width: 100%; } does not make sense */ +table { + width: auto; +} + +/* Avoid reference text that sits in a block with very wide left margin, + because of a long floating dt label.*/ +.references dd { + overflow: visible; +} + +/* Control caption placement */ +caption { + caption-side: bottom; +} + +/* Limit the width of the author address vcard, so names in right-to-left + script don't end up on the other side of the page. */ + +address.vcard { + max-width: 30em; + margin-right: auto; +} + +/* For address alignment dependent on LTR or RTL scripts */ +address div.left { + text-align: left; +} +address div.right { + text-align: right; +} + +/* Provide table alignment support. We can't use the alignX classes above + since they do unwanted things with caption and other styling. */ +table.right { + margin-left: auto; + margin-right: 0; +} +table.center { + margin-left: auto; + margin-right: auto; +} +table.left { + margin-left: 0; + margin-right: auto; +} + +/* Give the table caption label the same styling as the figcaption */ +caption a[href] { + color: #222; +} + +@media print { + .toplink { + display: none; + } + + /* avoid overwriting the top border line with the ToC header */ + #toc { + padding-top: 1px; + } + + /* Avoid page breaks inside dl and author address entries */ + .vcard { + page-break-inside: avoid; + } + +} +/* Tweak the bcp14 keyword presentation */ +.bcp14 { + font-variant: small-caps; + font-weight: bold; + font-size: 0.9em; +} +/* Tweak the invisible space above H* in order not to overlay links in text above */ + h2 { + margin-top: -18px; /* provide offset for in-page anchors */ + padding-top: 31px; + } + h3 { + margin-top: -18px; /* provide offset for in-page anchors */ + padding-top: 24px; + } + h4 { + margin-top: -18px; /* provide offset for in-page anchors */ + padding-top: 24px; + } +/* Float artwork pilcrow to the right */ +@media screen { + .artwork a.pilcrow { + display: block; + line-height: 0.7; + margin-top: 0.15em; + } +} +/* Make pilcrows on dd visible */ +@media screen { + dd:hover > a.pilcrow { + visibility: visible; + } +} +/* Make the placement of figcaption match that of a table's caption + by removing the figure's added bottom margin */ +.alignLeft.art-text, +.alignCenter.art-text, +.alignRight.art-text { + margin-bottom: 0; +} +.alignLeft, +.alignCenter, +.alignRight { + margin: 1em 0 0 0; +} +/* In print, the pilcrow won't show on hover, so prevent it from taking up space, + possibly even requiring a new line */ +@media print { + a.pilcrow { + display: none; + } +} +/* Styling for the external metadata */ +div#external-metadata { + background-color: #eee; + padding: 0.5em; + margin-bottom: 0.5em; + display: none; +} +div#internal-metadata { + padding: 0.5em; /* to match the external-metadata padding */ +} +/* Styling for title RFC Number */ +h1#rfcnum { + clear: both; + margin: 0 0 -1em; + padding: 1em 0 0 0; +} +/* Make .olPercent look the same as
    1. */ +dl.olPercent > dd { + margin-bottom: 0.25em; + min-height: initial; +} +/* Give aside some styling to set it apart */ +aside { + border-left: 1px solid #ddd; + margin: 1em 0 1em 2em; + padding: 0.2em 2em; +} +aside > dl, +aside > ol, +aside > ul, +aside > table, +aside > p { + margin-bottom: 0.5em; +} +/* Additional page break settings */ +@media print { + figcaption, table caption { + page-break-before: avoid; + } +} +/* Font size adjustments for print */ +@media print { + body { font-size: 10pt; line-height: normal; max-width: 96%; } + h1 { font-size: 1.72em; padding-top: 1.5em; } /* 1*1.2*1.2*1.2 */ + h2 { font-size: 1.44em; padding-top: 1.5em; } /* 1*1.2*1.2 */ + h3 { font-size: 1.2em; padding-top: 1.5em; } /* 1*1.2 */ + h4 { font-size: 1em; padding-top: 1.5em; } + h5, h6 { font-size: 1em; margin: initial; padding: 0.5em 0 0.3em; } +} +/* Sourcecode margin in print, when there's no pilcrow */ +@media print { + .artwork, + .sourcecode { + margin-bottom: 1em; + } +} +/* Avoid narrow tables forcing too narrow table captions, which may render badly */ +table { + min-width: 20em; +} +/* ol type a */ +ol.type-a { list-style-type: lower-alpha; } +ol.type-A { list-style-type: upper-alpha; } +ol.type-i { list-style-type: lower-roman; } +ol.type-I { list-style-type: lower-roman; } +/* Apply the print table and row borders in general, on request from the RPC, +and increase the contrast between border and odd row background sligthtly */ +table { + border: 1px solid #ddd; +} +td { + border-top: 1px solid #ddd; +} +tr:nth-child(2n+1) > td { + background-color: #f8f8f8; +} +/* Use style rules to govern display of the TOC. */ +@media screen and (max-width: 1023px) { + #toc nav { display: none; } + #toc.active nav { display: block; } +} +/* Add support for keepWithNext */ +.keepWithNext { + break-after: avoid-page; + break-after: avoid-page; +} +/* Add support for keepWithPrevious */ +.keepWithPrevious { + break-before: avoid-page; +} +/* Change the approach to avoiding breaks inside artwork etc. */ +figure, pre, table, .artwork, .sourcecode { + break-before: avoid-page; + break-after: auto; +} +/* Avoid breaks between
      and
      */ +dl { + break-before: auto; + break-inside: auto; +} +dt { + break-before: auto; + break-after: avoid-page; +} +dd { + break-before: avoid-page; + break-after: auto; + orphans: 3; + widows: 3 +} +span.break, dd.break { + margin-bottom: 0; + min-height: 0; + break-before: auto; + break-inside: auto; + break-after: auto; +} +/* Undo break-before ToC */ +@media print { + #toc { + break-before: auto; + } +} +/* Text in compact lists should not get extra bottim margin space, + since that would makes the list not compact */ +ul.compact p, .ulCompact p, +ol.compact p, .olCompact p { + margin: 0; +} +/* But the list as a whole needs the extra space at the end */ +section ul.compact, +section .ulCompact, +section ol.compact, +section .olCompact { + margin-bottom: 1em; /* same as p not within ul.compact etc. */ +} +/* The tt and code background above interferes with for instance table cell + backgrounds. Changed to something a bit more selective. */ +tt, code { + background-color: transparent; +} +p tt, p code, li tt, li code { + background-color: #f8f8f8; +} +/* Tweak the pre margin -- 0px doesn't come out well */ +pre { + margin-top: 0.5px; +} +/* Tweak the comact list text */ +ul.compact, .ulCompact, +ol.compact, .olCompact, +dl.compact, .dlCompact { + line-height: normal; +} +/* Don't add top margin for nested lists */ +li > ul, li > ol, li > dl, +dd > ul, dd > ol, dd > dl, +dl > dd > dl { + margin-top: initial; +} +/* Elements that should not be rendered on the same line as a
      */ +/* This should match the element list in writer.text.TextWriter.render_dl() */ +dd > div.artwork:first-child, +dd > aside:first-child, +dd > figure:first-child, +dd > ol:first-child, +dd > div:first-child > pre.sourcecode, +dd > table:first-child, +dd > ul:first-child { + clear: left; +} +/* fix for weird browser behaviour when
      is empty */ +dt+dd:empty::before{ + content: "\00a0"; +} +/* Make paragraph spacing inside
    2. smaller than in body text, to fit better within the list */ +li > p { + margin-bottom: 0.5em +} +/* Don't let p margin spill out from inside list items */ +li > p:last-of-type { + margin-bottom: 0; +} + + + - - - - - - - - - - + +
      Network Working GroupA. Dulaunoy
      + - - - - - - - - - - - - - - - - - -
      Internet-DraftA. Iklody
      Expires: April 6, 2020D. Servili
      CIRCL
      October 4, 2019
      - -

      MISP galaxy format
      -

      - -

      Abstract

      -

      This document describes the MISP galaxy format which describes a simple JSON format to represent galaxies and clusters that can be attached to MISP events or attributes. A public directory of MISP galaxies is available and relies on the MISP galaxy format. MISP galaxies are used to add further informations on a MISP event. MISP galaxy is a public repository [MISP-G] [MISP-G-DOC] of known malware, threats actors and various other collections of data that can be used to mark, classify or label data in threat information sharing.

      -

      Status of This Memo

      -

      This Internet-Draft is submitted in full conformance with the provisions of BCP 78 and BCP 79.

      -

      Internet-Drafts are working documents of the Internet Engineering Task Force (IETF). Note that other groups may also distribute working documents as Internet-Drafts. The list of current Internet-Drafts is at https://datatracker.ietf.org/drafts/current/.

      -

      Internet-Drafts are draft documents valid for a maximum of six months and may be updated, replaced, or obsoleted by other documents at any time. It is inappropriate to use Internet-Drafts as reference material or to cite them other than as "work in progress."

      -

      This Internet-Draft will expire on April 6, 2020.

      -

      Copyright Notice

      -

      Copyright (c) 2019 IETF Trust and the persons identified as the document authors. All rights reserved.

      -

      This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (https://trustee.ietf.org/license-info) in effect on the date of publication of this document. Please review these documents carefully, as they describe your rights and restrictions with respect to this document. Code Components extracted from this document must include Simplified BSD License text as described in Section 4.e of the Trust Legal Provisions and are provided without warranty as described in the Simplified BSD License.

      - - -
      -

      Table of Contents

      -
        - -
      • 1. Introduction +MISP galaxy format +November 2021 + + +Dulaunoy, et al. +Expires 25 May 2022 +[Page] + + +
        +
        +
        +
        Workgroup:
        +
        Network Working Group
        +
        Internet-Draft:
        +
        draft-00
        +
        Published:
        +
        + +
        +
        Intended Status:
        +
        Informational
        +
        Expires:
        +
        +
        Authors:
        +
        +
        +
        A. Dulaunoy
        +
        CIRCL
        +
        +
        +
        A. Iklody
        +
        CIRCL
        +
        +
        +
        D. Servili
        +
        CIRCL
        +
        +
        +
        +
        +

        MISP galaxy format

        +
        +

        Abstract

        +

        This document describes the MISP galaxy format which describes a simple JSON format to represent galaxies and clusters that can be attached to MISP events or attributes. A public directory of MISP galaxies is available and relies on the MISP galaxy format. MISP galaxies are used to add further informations on a MISP event. MISP galaxy is a public repository [MISP-G] [MISP-G-DOC] of known malware, threats actors and various other collections of data that can be used to mark, classify or label data in threat information sharing.

        +
        +
        +
        +

        +Status of This Memo +

        +

        + This Internet-Draft is submitted in full conformance with the + provisions of BCP 78 and BCP 79.

        +

        + Internet-Drafts are working documents of the Internet Engineering Task + Force (IETF). Note that other groups may also distribute working + documents as Internet-Drafts. The list of current Internet-Drafts is + at https://datatracker.ietf.org/drafts/current/.

        +

        + Internet-Drafts are draft documents valid for a maximum of six months + and may be updated, replaced, or obsoleted by other documents at any + time. It is inappropriate to use Internet-Drafts as reference + material or to cite them other than as "work in progress."

        +

        + This Internet-Draft will expire on 25 May 2022.

        +
        +
        + +
        +
        + ▲

        +Table of Contents +

        +
      + + + +
      +
      +

      +1. Introduction +

      +

      Sharing threat information became a fundamental requirements on the Internet, security and intelligence community at large. Threat information can include indicators of compromise, malicious file indicators, financial fraud indicators or even detailed information about a threat actor. Some of these informations, such as malware or threat actors are common to several security events. MISP galaxy is a public repository [MISP-G] of known malware, threats actors and various other collections of data that can be used to mark, classify or label data in threat information sharing.

      +

      In the MISP galaxy context, clusters help analysts to give more informations about their cybersecurity events, indicators or threats. MISP galaxies can be used for classification, filtering, triggering actions or visualisation depending on their use in threat intelligence platforms such as MISP [MISP-P].

      +
      +
      +

      +1.1. Conventions and Terminology +

      +

      The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", +"SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this +document are to be interpreted as described in RFC 2119 [RFC2119].

      +
      +
      +
      +
      +
      +
      +

      +2. Format +

      +

      A cluster is composed of a value (MUST), a description (OPTIONAL) and metadata (OPTIONAL).

      +

      Clusters are represented as a JSON [RFC8259] dictionary.

      +
      +
      +

      +2.1. Overview +

      +

      The MISP galaxy format uses the JSON [RFC8259] format. Each galaxy is represented as a JSON object with meta information including the following fields: name, uuid, description, version, type, authors, source, values, category.

      +

      name defines the name of the galaxy. The name is represented as a string and MUST be present. The uuid represents the Universally Unique IDentifier (UUID) [RFC4122] of the object reference. The uuid MUST be preserved. For any updates or transfer of the same object reference. UUID version 4 is RECOMMENDED when assigning it to a new object reference and MUST be present. The description is represented as a string and MUST be present. The uuid is represented as a string and MUST be present. The version is represented as a decimal and MUST be present. The type is represented as a string and MUST be present and MUST match the name of the galaxy file. The source is represented as a string and MUST be present. Authors are represented as an array containing one or more authors and MUST be present. The category is represented as a string and MUST be present and describes the overall category of the galaxy such as tool or actor.

      +

      Values are represented as an array containing one or more values and MUST be present. Values defines all values available in the galaxy.

      +
      +
      +
      +
      +

      +2.2. values +

      +

      The values array contains one or more JSON objects which represent all the possible values in the galaxy. The JSON object contains four fields: value, description, uuid and meta. +The value is represented as a string and MUST be present. The description is represented as a string and SHOULD be present. The meta or metadata is represented as a JSON list and SHOULD be present. +The uuid represents the Universally Unique IDentifier (UUID) [RFC4122] of the value reference. The uuid SHOULD can be present and MUST be preserved.

      +
      +
      + +
      +
      +

      +2.4. meta +

      +

      Meta contains a list of custom defined JSON key value pairs. Users SHOULD reuse commonly used keys such as complexity, effectiveness, country, possible_issues, colour, motive, impact, refs, synonyms, status, date, encryption, extensions, ransomnotes, ransomnotes-filenames, ransomnotes-refs, suspected-victims, suspected-state-sponsor, type-of-incident, target-category, cfr-suspected-victims, cfr-suspected-state-sponsor, cfr-type-of-incident, cfr-target-category, suspected-victims, suspected-state-sponsor, attribution-confidence, payment-method, price, spoken-language, official-refs wherever applicable. Additional meta field MAY be added without the need to be referenced or registered in advance.

      +

      refs, synonyms, official-refs SHALL be used to give further informations. refs is represented as an array containing one or more strings and SHALL be present. synonyms is represented as an array containing one or more strings and SHALL be present. official-refs is represented as an array containing one or more strings and SHALL be present.

      +

      date, status MAY be used to give time information about an cluster. date is represented as a string describing a time or period and SHALL be present. status is represented as a string describing the current status of the clusters. It MAY also describe a time or period and SHALL be present.

      +

      colour fields MAY be used at predicates or values level to set a specify colour that MAY be used by the implementation. The colour field is described as an RGB colour fill in hexadecimal representation.

      +

      complexity, effectiveness, impact, possibleissues MAY be used to give further information in preventive-measure galaxy. complexity is represented by an enumerated value from a fixed vocabulary and SHALL be present. effectiveness is represented by an enumerated value from a fixed vocabulary and SHALL be present. impact is represented by an enumerated value from a fixed vocabulary and SHALL be present. possibleissues is represented as a string and SHOULD be present.

      +

      Example use of the complexity, effectiveness, impact, possible_issues fields in the preventive-measure galaxy:

      +
      {
   "meta": {
     "refs": [
@@ -545,9 +1415,11 @@
   "description": "Disable Windows Script Host",
   "uuid": "e6df1619-f8b3-476c-b5cf-22b4c9e9dd7f"
 }
-
      -

      country, motive, spoken-language MAY be used to give further information in threat-actor galaxy. country is represented as a string and SHOULD be present. motive is represented as a string and SHOULD be present. spoken-language is represented as an array containing one or more strings describing a language using ISO 639-2 code and SHALL be present.

      -

      Example use of the country, motive fields in the threat-actor galaxy:

      + +
      +

      country, motive, spoken-language MAY be used to give further information in threat-actor galaxy. country is represented as a string and SHOULD be present. motive is represented as a string and SHOULD be present. spoken-language is represented as an array containing one or more strings describing a language using ISO 639-2 code and SHALL be present.

      +

      Example use of the country, motive fields in the threat-actor galaxy:

      +
      {
   "meta": {
     "country": "CN",
@@ -567,11 +1439,13 @@
   "description": "PLA Navy",
   "uuid": "c82c904f-b3b4-40a2-bf0d-008912953104"
 }
-
      -

      encryption, extensions, ransomnotes, ransomnotes-filenames, ransomnotes-refs, payment-method, price MAY be used to give further information in ransomware galaxy. encryption is represented as a string and SHALL be present. extensions is represented as an array containing one or more strings and SHALL be present. ransomnotes is represented as an array containing one or more strings ans SHALL be present. ransomnotes-filenames is represented as an array containing one or more strings ans SHALL be present. ransomnotes-refs is represented as an array containing one or more strings ans SHALL be present. payment-method is represented as a string and SHALL be present. price is represented as a string and SHALL be present.

      -

      Example use of the encryption, extensions, ransomnotes fields in the ransomware galaxy:

      + +
      +

      encryption, extensions, ransomnotes, ransomnotes-filenames, ransomnotes-refs, payment-method, price MAY be used to give further information in ransomware galaxy. encryption is represented as a string and SHALL be present. extensions is represented as an array containing one or more strings and SHALL be present. ransomnotes is represented as an array containing one or more strings ans SHALL be present. ransomnotes-filenames is represented as an array containing one or more strings ans SHALL be present. ransomnotes-refs is represented as an array containing one or more strings ans SHALL be present. payment-method is represented as a string and SHALL be present. price is represented as a string and SHALL be present.

      +

      Example use of the encryption, extensions, ransomnotes fields in the ransomware galaxy:

      +
      {
-  "description": "Similar to Samas and BitPaymer, Ryuk is specifically used to target enterprise environments. Code comparison between versions of Ryuk and Hermes ransomware indicates that Ryuk was derived from the Hermes source code and has been under steady development since its release. Hermes is commodity ransomware that has been observed for sale on forums and used by multiple threat actors. However, Ryuk is only used by GRIM SPIDER and, unlike Hermes, Ryuk has only been used to target enterprise environments. Since Ryuk’s appearance in August, the threat actors operating it have netted over 705.80 BTC across 52 transactions for a total current value of $3,701,893.98 USD.",
+  "description": "Similar to Samas and BitPaymer, Ryuk is specifically used to target enterprise environments. Code comparison between versions of Ryuk and Hermes ransomware indicates that Ryuk was derived from the Hermes source code and has been under steady development since its release. Hermes is commodity ransomware that has been observed for sale on forums and used by multiple threat actors. However, Ryuk is only used by GRIM SPIDER and, unlike Hermes, Ryuk has only been used to target enterprise environments. Since Ryuk’s appearance in August, the threat actors operating it have netted over 705.80 BTC across 52 transactions for a total current value of $3,701,893.98 USD.",
   "meta": {
     "ransomnotes-filenames": [
       "RyukReadMe.txt"
@@ -587,8 +1461,10 @@
   "uuid": "f9464c80-b776-4f37-8682-ffde0cf8f718",
   "value": "Ryuk ransomware"
 }
-
      -

      Example use of the payment-method, price fields in the ransomware galaxy:

      + +
      +

      Example use of the payment-method, price fields in the ransomware galaxy:

      +
      {
   "description": "This is most likely to affect English speaking users, since the note is written in English. English is understood worldwide, thus anyone can be harmed. The hacker spread the virus using email spam, fake updates, and harmful attachments. All your files are compromised including music, MS Office, Open Office, pictures, videos, shared online files etc..",
   "meta": {
@@ -609,9 +1485,11 @@
   "uuid": "4c76c845-c5eb-472c-93a1-4178f86c319b",
   "value": "CryptoMeister Ransomware"
 }
-
      -

      source-uuid, target-uuid SHALL be used to describe relationships. source-uuid and target-uuid represent the Universally Unique IDentifier (UUID) [RFC4122] of the value reference. source-uuid and target-uuid MUST be preserved.

      -

      Example use of the source-uuid, target-uuid fields in the mitre-enterprise-attack-relationship galaxy:

      + +
      +

      source-uuid, target-uuid SHALL be used to describe relationships. source-uuid and target-uuid represent the Universally Unique IDentifier (UUID) [RFC4122] of the value reference. source-uuid and target-uuid MUST be preserved.

      +

      Example use of the source-uuid, target-uuid fields in the mitre-enterprise-attack-relationship galaxy:

      +
      {
   "meta": {
     "source-uuid": "222fbd21-fc4f-4b7e-9f85-0e6e3a76c33f",
@@ -620,9 +1498,11 @@
   "uuid": "cfc7da70-d7c5-4508-8f50-1c3107269633",
   "value": "menuPass (G0045) uses EvilGrab (S0152)"
 }
-
      -

      cfr-suspected-victims, cfr-suspected-state-sponsor, cfr-type-of-incident and cfr-target-category MAY be used to report information gathered from CFR's (Council on Foreign Relations) [CFR] Cyber Operations Tracker. cfr-suspected-victims is represented as an array containing one or more strings and SHALL be present. cfr-suspected-state-sponsor is represented as a string and SHALL be present. cfr-type-of-incident is represented as a string or an array and SHALL be present. RECOMMENDED but not exhaustive list of possible values for cfr-type-of-incident includes "Espionage", "Denial of service", "Sabotage". cfr-target-category is represented as an array containing one or more strings ans SHALL be present. RECOMMENDED but not exhaustive list of possible values for cfr-target-category includes "Private sector", "Government", "Civil society", "Military".

      -

      Example use of the cfr-suspected-victims, cfr-suspected-state-sponsor, cfr-type-of-incident, cfr-target-category fields in the threat-actor galaxy:

      + +
      +

      cfr-suspected-victims, cfr-suspected-state-sponsor, cfr-type-of-incident and cfr-target-category MAY be used to report information gathered from CFR's (Council on Foreign Relations) [CFR] Cyber Operations Tracker. cfr-suspected-victims is represented as an array containing one or more strings and SHALL be present. cfr-suspected-state-sponsor is represented as a string and SHALL be present. cfr-type-of-incident is represented as a string or an array and SHALL be present. RECOMMENDED but not exhaustive list of possible values for cfr-type-of-incident includes "Espionage", "Denial of service", "Sabotage". cfr-target-category is represented as an array containing one or more strings ans SHALL be present. RECOMMENDED but not exhaustive list of possible values for cfr-target-category includes "Private sector", "Government", "Civil society", "Military".

      +

      Example use of the cfr-suspected-victims, cfr-suspected-state-sponsor, cfr-type-of-incident, cfr-target-category fields in the threat-actor galaxy:

      +
      {
   "meta": {
     "country": "CN",
@@ -644,22 +1524,34 @@
   "value": "APT 16",
   "uuid": "1f73e14f-b882-4032-a565-26dc653b0daf"
 },
-
      -

      attribution-confidence MAY be used to indicate the confidence about an attribution given by country or cfr-suspected-state-sponsor. attribution-confidence is represented on a scale from 0 to 100, where 50 means "no information", the values under 50 mean "probably not, almost certainly not to impossibility", the values above 50 means "from probable, almost certain to certainty" and SHALL be present if country or cfr-suspected-state-sponsor are present.

      + +
      +

      attribution-confidence MAY be used to indicate the confidence about an attribution given by country or cfr-suspected-state-sponsor. attribution-confidence is represented on a scale from 0 to 100, where 50 means "no information", the values under 50 mean "probably not, almost certainly not to impossibility", the values above 50 means "from probable, almost certain to certainty" and SHALL be present if country or cfr-suspected-state-sponsor are present.

      +
      Impossibility        no information          Certainty
                            +
                            |
        +-------------------+------------------>
 
        0                  50                100
-
      -

      -3. JSON Schema -

      -

      The JSON Schema [JSON-SCHEMA] below defines the overall MISP galaxy formats. The main format is the MISP galaxy format used for the clusters.

      -

      -3.1. MISP galaxy format - galaxy -

      + +
      +
      +
      +
      +
      +
      +
      +

      +3. JSON Schema +

      +

      The JSON Schema [JSON-SCHEMA] below defines the overall MISP galaxy formats. The main format is the MISP galaxy format used for the clusters.

      +
      +
      +

      +3.1. MISP galaxy format - galaxy +

      +
      {
   "$schema": "http://json-schema.org/schema#",
   "title": "Validator for misp-galaxies - Galaxies",
@@ -700,10 +1592,16 @@
     "uuid"
   ]
 }
-
      -

      -3.2. MISP galaxy format - clusters -

      + +
      +
      +
      +
      +
      +

      +3.2. MISP galaxy format - clusters +

      +
      {
   "$schema": "http://json-schema.org/schema#",
   "title": "Validator for misp-galaxies - Clusters",
@@ -867,140 +1765,133 @@
     "category
   ]
 }
-
      -

      -4. Acknowledgements -

      -

      The authors wish to thank all the MISP community who are supporting the creation of open standards in threat intelligence sharing.

      -

      -5. References

      -

      -5.1. Normative References

      - - - - - - - - - - - - - -
      [RFC2119] -Bradner, S., "Key words for use in RFCs to Indicate Requirement Levels", BCP 14, RFC 2119, DOI 10.17487/RFC2119, March 1997.
      [RFC4122] -Leach, P., Mealling, M. and R. Salz, "A Universally Unique IDentifier (UUID) URN Namespace", RFC 4122, DOI 10.17487/RFC4122, July 2005.
      [RFC8259] -Bray, T., "The JavaScript Object Notation (JSON) Data Interchange Format", STD 90, RFC 8259, DOI 10.17487/RFC8259, December 2017.
      -

      -5.2. Informative References

      - - - - - - - - - - - - - - - - - - - - - - - - - -
      [CFR] -Relations, C. O. F., "Cyber Operations Tracker - Council on Foreign Relations", 2018.
      [JSON-SCHEMA] -Wright, A., "JSON Schema: A Media Type for Describing JSON Documents", 2016.
      [MISP-G] -Community, M., "MISP Galaxy - Public Repository"
      [MISP-G-DOC] -Community, M., "MISP Galaxy - Documentation of the Public Repository"
      [MISP-P] -Community, M., "MISP Project - Malware Information Sharing Platform and Threat Sharing"
      [MISP-R] -Community, M., "MISP Object Relationship Types - common vocabulary of relationships"
      -

      Authors' Addresses

      -
      -
      - - Alexandre Dulaunoy - - - Computer Incident Response Center Luxembourg - - 16, bd d'Avranches - - - Luxembourg, - - L-1611 - - Luxembourg - - Phone: +352 247 88444 - -EMail: alexandre.dulaunoy@circl.lu - -
      -
      -
      - - Andras Iklody - - - Computer Incident Response Center Luxembourg - - 16, bd d'Avranches - - - Luxembourg, - - L-1611 - - Luxembourg - - Phone: +352 247 88444 - -EMail: andras.iklody@circl.lu - -
      -
      -
      - - Deborah Servili - - - Computer Incident Response Center Luxembourg - - 16, bd d'Avranches - - - Luxembourg, - - L-1611 - - Luxembourg - - Phone: +352 247 88444 - -EMail: deborah.servili@circl.lu - -
      +
      - +
      +
      +
      +
      +
      +
      +

      +4. Acknowledgements +

      +

      The authors wish to thank all the MISP community who are supporting the creation +of open standards in threat intelligence sharing.

      +
      +
      +
      +

      +5. Normative References +

      +
      +
      [RFC2119]
      +
      +Bradner, S., "Key words for use in RFCs to Indicate Requirement Levels", BCP 14, RFC 2119, DOI 10.17487/RFC2119, , <https://www.rfc-editor.org/info/rfc2119>.
      +
      +
      [RFC4122]
      +
      +Leach, P., Mealling, M., and R. Salz, "A Universally Unique IDentifier (UUID) URN Namespace", RFC 4122, DOI 10.17487/RFC4122, , <https://www.rfc-editor.org/info/rfc4122>.
      +
      +
      [RFC8259]
      +
      +Bray, T., Ed., "The JavaScript Object Notation (JSON) Data Interchange Format", STD 90, RFC 8259, DOI 10.17487/RFC8259, , <https://www.rfc-editor.org/info/rfc8259>.
      +
      +
      +
      +
      +

      +6. Informative References +

      +
      +
      [CFR]
      +
      +Relations, C. O. F., "Cyber Operations Tracker - Council on Foreign Relations", , , <https://www.cfr.org/interactive/cyber-operations>.
      +
      +
      [JSON-SCHEMA]
      +
      +Wright, A., "JSON Schema: A Media Type for Describing JSON Documents", , , <https://tools.ietf.org/html/draft-wright-json-schema>.
      +
      +
      [MISP-G]
      +
      +Community, M., "MISP Galaxy - Public Repository", , <https://github.com/MISP/misp-galaxy>.
      +
      +
      [MISP-G-DOC]
      +
      +Community, M., "MISP Galaxy - Documentation of the Public Repository", , <https://www.misp-project.org/galaxy.html>.
      +
      +
      [MISP-P]
      +
      +Community, M., "MISP Project - Malware Information Sharing Platform and Threat Sharing", , <https://github.com/MISP>.
      +
      +
      [MISP-R]
      +
      +Community, M., "MISP Object Relationship Types - common vocabulary of relationships", , <https://github.com/MISP/misp-objects/tree/master/relationships>.
      +
      +
      +
      +
      +
      +

      +Authors' Addresses +

      +
      +
      Alexandre Dulaunoy
      +
      Computer Incident Response Center Luxembourg
      +
      16, bd d'Avranches
      +
      L-L-1611 Luxembourg +
      +
      Luxembourg
      +
      +Phone: ++352 247 88444 +
      + +
      +
      +
      Andras Iklody
      +
      Computer Incident Response Center Luxembourg
      +
      16, bd d'Avranches
      +
      L-L-1611 Luxembourg +
      +
      Luxembourg
      +
      +Phone: ++352 247 88444 +
      + +
      +
      +
      Deborah Servili
      +
      Computer Incident Response Center Luxembourg
      +
      16, bd d'Avranches
      +
      L-L-1611 Luxembourg +
      +
      Luxembourg
      +
      +Phone: ++352 247 88444 +
      + +
      +
      +
      + diff --git a/rfc/misp-standard-galaxy-format.txt b/rfc/misp-standard-galaxy-format.txt index 7a09ab0..619b131 100644 --- a/rfc/misp-standard-galaxy-format.txt +++ b/rfc/misp-standard-galaxy-format.txt @@ -4,12 +4,13 @@ Network Working Group A. Dulaunoy Internet-Draft A. Iklody -Expires: April 6, 2020 D. Servili - CIRCL - October 4, 2019 +Intended status: Informational D. Servili +Expires: 25 May 2022 CIRCL + 21 November 2021 MISP galaxy format + draft-00 Abstract @@ -37,36 +38,31 @@ Status of This Memo time. It is inappropriate to use Internet-Drafts as reference material or to cite them other than as "work in progress." - This Internet-Draft will expire on April 6, 2020. + This Internet-Draft will expire on 25 May 2022. Copyright Notice - Copyright (c) 2019 IETF Trust and the persons identified as the + Copyright (c) 2021 IETF Trust and the persons identified as the document authors. All rights reserved. This document is subject to BCP 78 and the IETF Trust's Legal - Provisions Relating to IETF Documents - (https://trustee.ietf.org/license-info) in effect on the date of - publication of this document. Please review these documents - carefully, as they describe your rights and restrictions with respect - to this document. Code Components extracted from this document must + Provisions Relating to IETF Documents (https://trustee.ietf.org/ + license-info) in effect on the date of publication of this document. + Please review these documents carefully, as they describe your rights + and restrictions with respect to this document. -Dulaunoy, et al. Expires April 6, 2020 [Page 1] +Dulaunoy, et al. Expires 25 May 2022 [Page 1] -Internet-Draft MISP galaxy format October 2019 +Internet-Draft MISP galaxy format November 2021 - include Simplified BSD License text as described in Section 4.e of - the Trust Legal Provisions and are provided without warranty as - described in the Simplified BSD License. - Table of Contents 1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . 2 1.1. Conventions and Terminology . . . . . . . . . . . . . . . 2 - 2. Format . . . . . . . . . . . . . . . . . . . . . . . . . . . 3 + 2. Format . . . . . . . . . . . . . . . . . . . . . . . . . . . 2 2.1. Overview . . . . . . . . . . . . . . . . . . . . . . . . 3 2.2. values . . . . . . . . . . . . . . . . . . . . . . . . . 3 2.3. related . . . . . . . . . . . . . . . . . . . . . . . . . 3 @@ -75,9 +71,8 @@ Table of Contents 3.1. MISP galaxy format - galaxy . . . . . . . . . . . . . . . 9 3.2. MISP galaxy format - clusters . . . . . . . . . . . . . . 10 4. Acknowledgements . . . . . . . . . . . . . . . . . . . . . . 14 - 5. References . . . . . . . . . . . . . . . . . . . . . . . . . 14 - 5.1. Normative References . . . . . . . . . . . . . . . . . . 14 - 5.2. Informative References . . . . . . . . . . . . . . . . . 14 + 5. Normative References . . . . . . . . . . . . . . . . . . . . 14 + 6. Informative References . . . . . . . . . . . . . . . . . . . 14 Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . . 15 1. Introduction @@ -104,16 +99,6 @@ Table of Contents "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in RFC 2119 [RFC2119]. - - - - - -Dulaunoy, et al. Expires April 6, 2020 [Page 2] - -Internet-Draft MISP galaxy format October 2019 - - 2. Format A cluster is composed of a value (MUST), a description (OPTIONAL) and @@ -121,6 +106,14 @@ Internet-Draft MISP galaxy format October 2019 Clusters are represented as a JSON [RFC8259] dictionary. + + + +Dulaunoy, et al. Expires 25 May 2022 [Page 2] + +Internet-Draft MISP galaxy format November 2021 + + 2.1. Overview The MISP galaxy format uses the JSON [RFC8259] format. Each galaxy @@ -162,14 +155,6 @@ Internet-Draft MISP galaxy format October 2019 Related contains a list of JSON key value pairs which describe the related values in this galaxy cluster or to other galaxy clusters. The JSON object contains three fields, dest-uuid, type and tags. The - - - -Dulaunoy, et al. Expires April 6, 2020 [Page 3] - -Internet-Draft MISP galaxy format October 2019 - - dest-uuid represents the target UUID which encompasses a relation of some type. The dest-uuid is represented as a string and MUST be present. The type is represented as a string and MUST be present and @@ -177,6 +162,14 @@ Internet-Draft MISP galaxy format October 2019 objects [MISP-R]. The tags is a list of string which labels the related relationship such as the level of similarities, level of certainty, trust or confidence in the relationship, false-positive. + + + +Dulaunoy, et al. Expires 25 May 2022 [Page 3] + +Internet-Draft MISP galaxy format November 2021 + + A tag is represented in machine tag format which is a string an SHOULD be present. @@ -218,14 +211,6 @@ Internet-Draft MISP galaxy format October 2019 field is described as an RGB colour fill in hexadecimal representation. - - - -Dulaunoy, et al. Expires April 6, 2020 [Page 4] - -Internet-Draft MISP galaxy format October 2019 - - complexity, effectiveness, impact, possible_issues MAY be used to give further information in preventive-measure galaxy. complexity is represented by an enumerated value from a fixed vocabulary and SHALL @@ -234,6 +219,13 @@ Internet-Draft MISP galaxy format October 2019 enumerated value from a fixed vocabulary and SHALL be present. possible_issues is represented as a string and SHOULD be present. + + +Dulaunoy, et al. Expires 25 May 2022 [Page 4] + +Internet-Draft MISP galaxy format November 2021 + + Example use of the complexity, effectiveness, impact, possible_issues fields in the preventive-measure galaxy: @@ -277,9 +269,17 @@ Internet-Draft MISP galaxy format October 2019 -Dulaunoy, et al. Expires April 6, 2020 [Page 5] + + + + + + + + +Dulaunoy, et al. Expires 25 May 2022 [Page 5] -Internet-Draft MISP galaxy format October 2019 +Internet-Draft MISP galaxy format November 2021 { @@ -333,13 +333,13 @@ Internet-Draft MISP galaxy format October 2019 -Dulaunoy, et al. Expires April 6, 2020 [Page 6] +Dulaunoy, et al. Expires 25 May 2022 [Page 6] -Internet-Draft MISP galaxy format October 2019 +Internet-Draft MISP galaxy format November 2021 { - "description": "Similar to Samas and BitPaymer, Ryuk is specifically used to target enterprise environments. Code comparison between versions of Ryuk and Hermes ransomware indicates that Ryuk was derived from the Hermes source code and has been under steady development since its release. Hermes is commodity ransomware that has been observed for sale on forums and used by multiple threat actors. However, Ryuk is only used by GRIM SPIDER and, unlike Hermes, Ryuk has only been used to target enterprise environments. Since Ryuk's appearance in August, the threat actors operating it have netted over 705.80 BTC across 52 transactions for a total current value of $3,701,893.98 USD.", + "description": "Similar to Samas and BitPaymer, Ryuk is specifically used to target enterprise environments. Code comparison between versions of Ryuk and Hermes ransomware indicates that Ryuk was derived from the Hermes source code and has been under steady development since its release. Hermes is commodity ransomware that has been observed for sale on forums and used by multiple threat actors. However, Ryuk is only used by GRIM SPIDER and, unlike Hermes, Ryuk has only been used to target enterprise environments. Since Ryuk’s appearance in August, the threat actors operating it have netted over 705.80 BTC across 52 transactions for a total current value of $3,701,893.98 USD.", "meta": { "ransomnotes-filenames": [ "RyukReadMe.txt" @@ -389,9 +389,9 @@ Internet-Draft MISP galaxy format October 2019 -Dulaunoy, et al. Expires April 6, 2020 [Page 7] +Dulaunoy, et al. Expires 25 May 2022 [Page 7] -Internet-Draft MISP galaxy format October 2019 +Internet-Draft MISP galaxy format November 2021 Example use of the source-uuid, target-uuid fields in the mitre- @@ -445,9 +445,9 @@ Internet-Draft MISP galaxy format October 2019 -Dulaunoy, et al. Expires April 6, 2020 [Page 8] +Dulaunoy, et al. Expires 25 May 2022 [Page 8] -Internet-Draft MISP galaxy format October 2019 +Internet-Draft MISP galaxy format November 2021 { @@ -501,9 +501,9 @@ Internet-Draft MISP galaxy format October 2019 -Dulaunoy, et al. Expires April 6, 2020 [Page 9] +Dulaunoy, et al. Expires 25 May 2022 [Page 9] -Internet-Draft MISP galaxy format October 2019 +Internet-Draft MISP galaxy format November 2021 { @@ -549,19 +549,24 @@ Internet-Draft MISP galaxy format October 2019 3.2. MISP galaxy format - clusters + + + + + + + + +Dulaunoy, et al. Expires 25 May 2022 [Page 10] + +Internet-Draft MISP galaxy format November 2021 + + { "$schema": "http://json-schema.org/schema#", "title": "Validator for misp-galaxies - Clusters", "id": "https://www.github.com/MISP/misp-galaxies/schema_clusters.json", "type": "object", - - - -Dulaunoy, et al. Expires April 6, 2020 [Page 10] - -Internet-Draft MISP galaxy format October 2019 - - "additionalProperties": false, "properties": { "description": { @@ -605,19 +610,19 @@ Internet-Draft MISP galaxy format October 2019 "type": "array", "additionalProperties": false, "items": { + + + +Dulaunoy, et al. Expires 25 May 2022 [Page 11] + +Internet-Draft MISP galaxy format November 2021 + + "type": "object" }, "properties": { "dest-uuid": { "type": "string" - - - -Dulaunoy, et al. Expires April 6, 2020 [Page 11] - -Internet-Draft MISP galaxy format October 2019 - - }, "type": { "type": "string" @@ -661,19 +666,19 @@ Internet-Draft MISP galaxy format October 2019 "type": "string" }, "impact": { + + + +Dulaunoy, et al. Expires 25 May 2022 [Page 12] + +Internet-Draft MISP galaxy format November 2021 + + "type": "string" }, "refs": { "type": "array", "uniqueItems": true, - - - -Dulaunoy, et al. Expires April 6, 2020 [Page 12] - -Internet-Draft MISP galaxy format October 2019 - - "items": { "type": "string" } @@ -717,19 +722,19 @@ Internet-Draft MISP galaxy format October 2019 } }, "authors": { + + + +Dulaunoy, et al. Expires 25 May 2022 [Page 13] + +Internet-Draft MISP galaxy format November 2021 + + "type": "array", "uniqueItems": true, "items": { "type": "string" } - - - -Dulaunoy, et al. Expires April 6, 2020 [Page 13] - -Internet-Draft MISP galaxy format October 2019 - - } }, "required": [ @@ -750,9 +755,7 @@ Internet-Draft MISP galaxy format October 2019 The authors wish to thank all the MISP community who are supporting the creation of open standards in threat intelligence sharing. -5. References - -5.1. Normative References +5. Normative References [RFC2119] Bradner, S., "Key words for use in RFCs to Indicate Requirement Levels", BCP 14, RFC 2119, @@ -769,7 +772,7 @@ Internet-Draft MISP galaxy format October 2019 DOI 10.17487/RFC8259, December 2017, . -5.2. Informative References +6. Informative References [CFR] Relations, C. O. F., "Cyber Operations Tracker - Council on Foreign Relations", 2018, @@ -778,12 +781,9 @@ Internet-Draft MISP galaxy format October 2019 - - - -Dulaunoy, et al. Expires April 6, 2020 [Page 14] +Dulaunoy, et al. Expires 25 May 2022 [Page 14] -Internet-Draft MISP galaxy format October 2019 +Internet-Draft MISP galaxy format November 2021 [JSON-SCHEMA] @@ -810,7 +810,7 @@ Authors' Addresses Alexandre Dulaunoy Computer Incident Response Center Luxembourg 16, bd d'Avranches - Luxembourg L-1611 + L-L-1611 Luxembourg Luxembourg Phone: +352 247 88444 @@ -820,35 +820,28 @@ Authors' Addresses Andras Iklody Computer Incident Response Center Luxembourg 16, bd d'Avranches - Luxembourg L-1611 + L-L-1611 Luxembourg Luxembourg Phone: +352 247 88444 Email: andras.iklody@circl.lu - - - - - - - - - - -Dulaunoy, et al. Expires April 6, 2020 [Page 15] - -Internet-Draft MISP galaxy format October 2019 - - Deborah Servili Computer Incident Response Center Luxembourg 16, bd d'Avranches - Luxembourg L-1611 + L-L-1611 Luxembourg Luxembourg Phone: +352 247 88444 + + + +Dulaunoy, et al. Expires 25 May 2022 [Page 15] + +Internet-Draft MISP galaxy format November 2021 + + Email: deborah.servili@circl.lu @@ -893,4 +886,11 @@ Internet-Draft MISP galaxy format October 2019 -Dulaunoy, et al. Expires April 6, 2020 [Page 16] + + + + + + + +Dulaunoy, et al. Expires 25 May 2022 [Page 16] diff --git a/rfc/misp-standard-object-template-format.html b/rfc/misp-standard-object-template-format.html index c814517..1da2cfe 100644 --- a/rfc/misp-standard-object-template-format.html +++ b/rfc/misp-standard-object-template-format.html @@ -1,591 +1,1518 @@ - + + + + + + +MISP object template format + + + + + + + + + +*/ - - - - - - - - - - - - - - - - +/* fonts */ +@import url('https://fonts.googleapis.com/css?family=Noto+Sans'); /* Sans-serif */ +@import url('https://fonts.googleapis.com/css?family=Noto+Serif'); /* Serif (print) */ +@import url('https://fonts.googleapis.com/css?family=Roboto+Mono'); /* Monospace */ + +@viewport { + zoom: 1.0; + width: extend-to-zoom; +} +@-ms-viewport { + width: extend-to-zoom; + zoom: 1.0; +} +/* general and mobile first */ +html { +} +body { + max-width: 90%; + margin: 1.5em auto; + color: #222; + background-color: #fff; + font-size: 14px; + font-family: 'Noto Sans', Arial, Helvetica, sans-serif; + line-height: 1.6; + scroll-behavior: smooth; +} +.ears { + display: none; +} + +/* headings */ +#title, h1, h2, h3, h4, h5, h6 { + margin: 1em 0 0.5em; + font-weight: bold; + line-height: 1.3; +} +#title { + clear: both; + border-bottom: 1px solid #ddd; + margin: 0 0 0.5em 0; + padding: 1em 0 0.5em; +} +.author { + padding-bottom: 4px; +} +h1 { + font-size: 26px; + margin: 1em 0; +} +h2 { + font-size: 22px; + margin-top: -20px; /* provide offset for in-page anchors */ + padding-top: 33px; +} +h3 { + font-size: 18px; + margin-top: -36px; /* provide offset for in-page anchors */ + padding-top: 42px; +} +h4 { + font-size: 16px; + margin-top: -36px; /* provide offset for in-page anchors */ + padding-top: 42px; +} +h5, h6 { + font-size: 14px; +} +#n-copyright-notice { + border-bottom: 1px solid #ddd; + padding-bottom: 1em; + margin-bottom: 1em; +} +/* general structure */ +p { + padding: 0; + margin: 0 0 1em 0; + text-align: left; +} +div, span { + position: relative; +} +div { + margin: 0; +} +.alignRight.art-text { + background-color: #f9f9f9; + border: 1px solid #eee; + border-radius: 3px; + padding: 1em 1em 0; + margin-bottom: 1.5em; +} +.alignRight.art-text pre { + padding: 0; +} +.alignRight { + margin: 1em 0; +} +.alignRight > *:first-child { + border: none; + margin: 0; + float: right; + clear: both; +} +.alignRight > *:nth-child(2) { + clear: both; + display: block; + border: none; +} +svg { + display: block; +} +.alignCenter.art-text { + background-color: #f9f9f9; + border: 1px solid #eee; + border-radius: 3px; + padding: 1em 1em 0; + margin-bottom: 1.5em; +} +.alignCenter.art-text pre { + padding: 0; +} +.alignCenter { + margin: 1em 0; +} +.alignCenter > *:first-child { + border: none; + /* this isn't optimal, but it's an existence proof. PrinceXML doesn't + support flexbox yet. + */ + display: table; + margin: 0 auto; +} + +/* lists */ +ol, ul { + padding: 0; + margin: 0 0 1em 2em; +} +ol ol, ul ul, ol ul, ul ol { + margin-left: 1em; +} +li { + margin: 0 0 0.25em 0; +} +.ulCompact li { + margin: 0; +} +ul.empty, .ulEmpty { + list-style-type: none; +} +ul.empty li, .ulEmpty li { + margin-top: 0.5em; +} +ul.ulBare, li.ulBare { + margin-left: 0em !important; +} +ul.compact, .ulCompact, +ol.compact, .olCompact { + line-height: 100%; + margin: 0 0 0 2em; +} + +/* definition lists */ +dl { +} +dl > dt { + float: left; + margin-right: 1em; +} +/* +dl.nohang > dt { + float: none; +} +*/ +dl > dd { + margin-bottom: .8em; + min-height: 1.3em; +} +dl.compact > dd, .dlCompact > dd { + margin-bottom: 0em; +} +dl > dd > dl { + margin-top: 0.5em; + margin-bottom: 0em; +} + +/* links */ +a { + text-decoration: none; +} +a[href] { + color: #22e; /* Arlen: WCAG 2019 */ +} +a[href]:hover { + background-color: #f2f2f2; +} +figcaption a[href], +a[href].selfRef { + color: #222; +} +/* XXX probably not this: +a.selfRef:hover { + background-color: transparent; + cursor: default; +} */ + +/* Figures */ +tt, code, pre, code { + background-color: #f9f9f9; + font-family: 'Roboto Mono', monospace; +} +pre { + border: 1px solid #eee; + margin: 0; + padding: 1em; +} +img { + max-width: 100%; +} +figure { + margin: 0; +} +figure blockquote { + margin: 0.8em 0.4em 0.4em; +} +figcaption { + font-style: italic; + margin: 0 0 1em 0; +} +@media screen { + pre { + overflow-x: auto; + max-width: 100%; + max-width: calc(100% - 22px); + } +} + +/* aside, blockquote */ +aside, blockquote { + margin-left: 0; + padding: 1.2em 2em; +} +blockquote { + background-color: #f9f9f9; + color: #111; /* Arlen: WCAG 2019 */ + border: 1px solid #ddd; + border-radius: 3px; + margin: 1em 0; +} +cite { + display: block; + text-align: right; + font-style: italic; +} + +/* tables */ +table { + width: 100%; + margin: 0 0 1em; + border-collapse: collapse; + border: 1px solid #eee; +} +th, td { + text-align: left; + vertical-align: top; + padding: 0.5em 0.75em; +} +th { + text-align: left; + background-color: #e9e9e9; +} +tr:nth-child(2n+1) > td { + background-color: #f5f5f5; +} +table caption { + font-style: italic; + margin: 0; + padding: 0; + text-align: left; +} +table p { + /* XXX to avoid bottom margin on table row signifiers. If paragraphs should + be allowed within tables more generally, it would be far better to select on a class. */ + margin: 0; +} + +/* pilcrow */ +a.pilcrow { + color: #666; /* Arlen: AHDJ 2019 */ + text-decoration: none; + visibility: hidden; + user-select: none; + -ms-user-select: none; + -o-user-select:none; + -moz-user-select: none; + -khtml-user-select: none; + -webkit-user-select: none; + -webkit-touch-callout: none; +} +@media screen { + aside:hover > a.pilcrow, + p:hover > a.pilcrow, + blockquote:hover > a.pilcrow, + div:hover > a.pilcrow, + li:hover > a.pilcrow, + pre:hover > a.pilcrow { + visibility: visible; + } + a.pilcrow:hover { + background-color: transparent; + } +} + +/* misc */ +hr { + border: 0; + border-top: 1px solid #eee; +} +.bcp14 { + font-variant: small-caps; +} + +.role { + font-variant: all-small-caps; +} + +/* info block */ +#identifiers { + margin: 0; + font-size: 0.9em; +} +#identifiers dt { + width: 3em; + clear: left; +} +#identifiers dd { + float: left; + margin-bottom: 0; +} +#identifiers .authors .author { + display: inline-block; + margin-right: 1.5em; +} +#identifiers .authors .org { + font-style: italic; +} + +/* The prepared/rendered info at the very bottom of the page */ +.docInfo { + color: #666; /* Arlen: WCAG 2019 */ + font-size: 0.9em; + font-style: italic; + margin-top: 2em; +} +.docInfo .prepared { + float: left; +} +.docInfo .prepared { + float: right; +} + +/* table of contents */ +#toc { + padding: 0.75em 0 2em 0; + margin-bottom: 1em; +} +nav.toc ul { + margin: 0 0.5em 0 0; + padding: 0; + list-style: none; +} +nav.toc li { + line-height: 1.3em; + margin: 0.75em 0; + padding-left: 1.2em; + text-indent: -1.2em; +} +/* references */ +.references dt { + text-align: right; + font-weight: bold; + min-width: 7em; +} +.references dd { + margin-left: 8em; + overflow: auto; +} + +.refInstance { + margin-bottom: 1.25em; +} + +.references .ascii { + margin-bottom: 0.25em; +} + +/* index */ +.index ul { + margin: 0 0 0 1em; + padding: 0; + list-style: none; +} +.index ul ul { + margin: 0; +} +.index li { + margin: 0; + text-indent: -2em; + padding-left: 2em; + padding-bottom: 5px; +} +.indexIndex { + margin: 0.5em 0 1em; +} +.index a { + font-weight: 700; +} +/* make the index two-column on all but the smallest screens */ +@media (min-width: 600px) { + .index ul { + -moz-column-count: 2; + -moz-column-gap: 20px; + } + .index ul ul { + -moz-column-count: 1; + -moz-column-gap: 0; + } +} + +/* authors */ +address.vcard { + font-style: normal; + margin: 1em 0; +} + +address.vcard .nameRole { + font-weight: 700; + margin-left: 0; +} +address.vcard .label { + font-family: "Noto Sans",Arial,Helvetica,sans-serif; + margin: 0.5em 0; +} +address.vcard .type { + display: none; +} +.alternative-contact { + margin: 1.5em 0 1em; +} +hr.addr { + border-top: 1px dashed; + margin: 0; + color: #ddd; + max-width: calc(100% - 16px); +} + +/* temporary notes */ +.rfcEditorRemove::before { + position: absolute; + top: 0.2em; + right: 0.2em; + padding: 0.2em; + content: "The RFC Editor will remove this note"; + color: #9e2a00; /* Arlen: WCAG 2019 */ + background-color: #ffd; /* Arlen: WCAG 2019 */ +} +.rfcEditorRemove { + position: relative; + padding-top: 1.8em; + background-color: #ffd; /* Arlen: WCAG 2019 */ + border-radius: 3px; +} +.cref { + background-color: #ffd; /* Arlen: WCAG 2019 */ + padding: 2px 4px; +} +.crefSource { + font-style: italic; +} +/* alternative layout for smaller screens */ +@media screen and (max-width: 1023px) { + body { + padding-top: 2em; + } + #title { + padding: 1em 0; + } + h1 { + font-size: 24px; + } + h2 { + font-size: 20px; + margin-top: -18px; /* provide offset for in-page anchors */ + padding-top: 38px; + } + #identifiers dd { + max-width: 60%; + } + #toc { + position: fixed; + z-index: 2; + top: 0; + right: 0; + padding: 0; + margin: 0; + background-color: inherit; + border-bottom: 1px solid #ccc; + } + #toc h2 { + margin: -1px 0 0 0; + padding: 4px 0 4px 6px; + padding-right: 1em; + min-width: 190px; + font-size: 1.1em; + text-align: right; + background-color: #444; + color: white; + cursor: pointer; + } + #toc h2::before { /* css hamburger */ + float: right; + position: relative; + width: 1em; + height: 1px; + left: -164px; + margin: 6px 0 0 0; + background: white none repeat scroll 0 0; + box-shadow: 0 4px 0 0 white, 0 8px 0 0 white; + content: ""; + } + #toc nav { + display: none; + padding: 0.5em 1em 1em; + overflow: auto; + height: calc(100vh - 48px); + border-left: 1px solid #ddd; + } +} + +/* alternative layout for wide screens */ +@media screen and (min-width: 1024px) { + body { + max-width: 724px; + margin: 42px auto; + padding-left: 1.5em; + padding-right: 29em; + } + #toc { + position: fixed; + top: 42px; + right: 42px; + width: 25%; + margin: 0; + padding: 0 1em; + z-index: 1; + } + #toc h2 { + border-top: none; + border-bottom: 1px solid #ddd; + font-size: 1em; + font-weight: normal; + margin: 0; + padding: 0.25em 1em 1em 0; + } + #toc nav { + display: block; + height: calc(90vh - 84px); + bottom: 0; + padding: 0.5em 0 0; + overflow: auto; + } + img { /* future proofing */ + max-width: 100%; + height: auto; + } +} + +/* pagination */ +@media print { + body { + + width: 100%; + } + p { + orphans: 3; + widows: 3; + } + #n-copyright-notice { + border-bottom: none; + } + #toc, #n-introduction { + page-break-before: always; + } + #toc { + border-top: none; + padding-top: 0; + } + figure, pre { + page-break-inside: avoid; + } + figure { + overflow: scroll; + } + h1, h2, h3, h4, h5, h6 { + page-break-after: avoid; + } + h2+*, h3+*, h4+*, h5+*, h6+* { + page-break-before: avoid; + } + pre { + white-space: pre-wrap; + word-wrap: break-word; + font-size: 10pt; + } + table { + border: 1px solid #ddd; + } + td { + border-top: 1px solid #ddd; + } +} + +/* This is commented out here, as the string-set: doesn't + pass W3C validation currently */ +/* +.ears thead .left { + string-set: ears-top-left content(); +} + +.ears thead .center { + string-set: ears-top-center content(); +} + +.ears thead .right { + string-set: ears-top-right content(); +} + +.ears tfoot .left { + string-set: ears-bottom-left content(); +} + +.ears tfoot .center { + string-set: ears-bottom-center content(); +} + +.ears tfoot .right { + string-set: ears-bottom-right content(); +} +*/ + +@page :first { + padding-top: 0; + @top-left { + content: normal; + border: none; + } + @top-center { + content: normal; + border: none; + } + @top-right { + content: normal; + border: none; + } +} + +@page { + size: A4; + margin-bottom: 45mm; + padding-top: 20px; + /* The follwing is commented out here, but set appropriately by in code, as + the content depends on the document */ + /* + @top-left { + content: 'Internet-Draft'; + vertical-align: bottom; + border-bottom: solid 1px #ccc; + } + @top-left { + content: string(ears-top-left); + vertical-align: bottom; + border-bottom: solid 1px #ccc; + } + @top-center { + content: string(ears-top-center); + vertical-align: bottom; + border-bottom: solid 1px #ccc; + } + @top-right { + content: string(ears-top-right); + vertical-align: bottom; + border-bottom: solid 1px #ccc; + } + @bottom-left { + content: string(ears-bottom-left); + vertical-align: top; + border-top: solid 1px #ccc; + } + @bottom-center { + content: string(ears-bottom-center); + vertical-align: top; + border-top: solid 1px #ccc; + } + @bottom-right { + content: '[Page ' counter(page) ']'; + vertical-align: top; + border-top: solid 1px #ccc; + } + */ + +} + +/* Changes introduced to fix issues found during implementation */ +/* Make sure links are clickable even if overlapped by following H* */ +a { + z-index: 2; +} +/* Separate body from document info even without intervening H1 */ +section { + clear: both; +} - - +/* Top align author divs, to avoid names without organization dropping level with org names */ +.author { + vertical-align: top; +} - - - - - +/* Leave room in document info to show Internet-Draft on one line */ +#identifiers dt { + width: 8em; +} +/* Don't waste quite as much whitespace between label and value in doc info */ +#identifiers dd { + margin-left: 1em; +} + +/* Give floating toc a background color (needed when it's a div inside section */ +#toc { + background-color: white; +} + +/* Make the collapsed ToC header render white on gray also when it's a link */ +@media screen and (max-width: 1023px) { + #toc h2 a, + #toc h2 a:link, + #toc h2 a:focus, + #toc h2 a:hover, + #toc a.toplink, + #toc a.toplink:hover { + color: white; + background-color: #444; + text-decoration: none; + } +} + +/* Give the bottom of the ToC some whitespace */ +@media screen and (min-width: 1024px) { + #toc { + padding: 0 0 1em 1em; + } +} + +/* Style section numbers with more space between number and title */ +.section-number { + padding-right: 0.5em; +} + +/* prevent monospace from becoming overly large */ +tt, code, pre, code { + font-size: 95%; +} + +/* Fix the height/width aspect for ascii art*/ +pre.sourcecode, +.art-text pre { + line-height: 1.12; +} + + +/* Add styling for a link in the ToC that points to the top of the document */ +a.toplink { + float: right; + margin-right: 0.5em; +} + +/* Fix the dl styling to match the RFC 7992 attributes */ +dl > dt, +dl.dlParallel > dt { + float: left; + margin-right: 1em; +} +dl.dlNewline > dt { + float: none; +} + +/* Provide styling for table cell text alignment */ +table td.text-left, +table th.text-left { + text-align: left; +} +table td.text-center, +table th.text-center { + text-align: center; +} +table td.text-right, +table th.text-right { + text-align: right; +} + +/* Make the alternative author contact informatio look less like just another + author, and group it closer with the primary author contact information */ +.alternative-contact { + margin: 0.5em 0 0.25em 0; +} +address .non-ascii { + margin: 0 0 0 2em; +} + +/* With it being possible to set tables with alignment + left, center, and right, { width: 100%; } does not make sense */ +table { + width: auto; +} + +/* Avoid reference text that sits in a block with very wide left margin, + because of a long floating dt label.*/ +.references dd { + overflow: visible; +} + +/* Control caption placement */ +caption { + caption-side: bottom; +} + +/* Limit the width of the author address vcard, so names in right-to-left + script don't end up on the other side of the page. */ + +address.vcard { + max-width: 30em; + margin-right: auto; +} + +/* For address alignment dependent on LTR or RTL scripts */ +address div.left { + text-align: left; +} +address div.right { + text-align: right; +} + +/* Provide table alignment support. We can't use the alignX classes above + since they do unwanted things with caption and other styling. */ +table.right { + margin-left: auto; + margin-right: 0; +} +table.center { + margin-left: auto; + margin-right: auto; +} +table.left { + margin-left: 0; + margin-right: auto; +} + +/* Give the table caption label the same styling as the figcaption */ +caption a[href] { + color: #222; +} + +@media print { + .toplink { + display: none; + } + + /* avoid overwriting the top border line with the ToC header */ + #toc { + padding-top: 1px; + } + + /* Avoid page breaks inside dl and author address entries */ + .vcard { + page-break-inside: avoid; + } + +} +/* Tweak the bcp14 keyword presentation */ +.bcp14 { + font-variant: small-caps; + font-weight: bold; + font-size: 0.9em; +} +/* Tweak the invisible space above H* in order not to overlay links in text above */ + h2 { + margin-top: -18px; /* provide offset for in-page anchors */ + padding-top: 31px; + } + h3 { + margin-top: -18px; /* provide offset for in-page anchors */ + padding-top: 24px; + } + h4 { + margin-top: -18px; /* provide offset for in-page anchors */ + padding-top: 24px; + } +/* Float artwork pilcrow to the right */ +@media screen { + .artwork a.pilcrow { + display: block; + line-height: 0.7; + margin-top: 0.15em; + } +} +/* Make pilcrows on dd visible */ +@media screen { + dd:hover > a.pilcrow { + visibility: visible; + } +} +/* Make the placement of figcaption match that of a table's caption + by removing the figure's added bottom margin */ +.alignLeft.art-text, +.alignCenter.art-text, +.alignRight.art-text { + margin-bottom: 0; +} +.alignLeft, +.alignCenter, +.alignRight { + margin: 1em 0 0 0; +} +/* In print, the pilcrow won't show on hover, so prevent it from taking up space, + possibly even requiring a new line */ +@media print { + a.pilcrow { + display: none; + } +} +/* Styling for the external metadata */ +div#external-metadata { + background-color: #eee; + padding: 0.5em; + margin-bottom: 0.5em; + display: none; +} +div#internal-metadata { + padding: 0.5em; /* to match the external-metadata padding */ +} +/* Styling for title RFC Number */ +h1#rfcnum { + clear: both; + margin: 0 0 -1em; + padding: 1em 0 0 0; +} +/* Make .olPercent look the same as
      1. */ +dl.olPercent > dd { + margin-bottom: 0.25em; + min-height: initial; +} +/* Give aside some styling to set it apart */ +aside { + border-left: 1px solid #ddd; + margin: 1em 0 1em 2em; + padding: 0.2em 2em; +} +aside > dl, +aside > ol, +aside > ul, +aside > table, +aside > p { + margin-bottom: 0.5em; +} +/* Additional page break settings */ +@media print { + figcaption, table caption { + page-break-before: avoid; + } +} +/* Font size adjustments for print */ +@media print { + body { font-size: 10pt; line-height: normal; max-width: 96%; } + h1 { font-size: 1.72em; padding-top: 1.5em; } /* 1*1.2*1.2*1.2 */ + h2 { font-size: 1.44em; padding-top: 1.5em; } /* 1*1.2*1.2 */ + h3 { font-size: 1.2em; padding-top: 1.5em; } /* 1*1.2 */ + h4 { font-size: 1em; padding-top: 1.5em; } + h5, h6 { font-size: 1em; margin: initial; padding: 0.5em 0 0.3em; } +} +/* Sourcecode margin in print, when there's no pilcrow */ +@media print { + .artwork, + .sourcecode { + margin-bottom: 1em; + } +} +/* Avoid narrow tables forcing too narrow table captions, which may render badly */ +table { + min-width: 20em; +} +/* ol type a */ +ol.type-a { list-style-type: lower-alpha; } +ol.type-A { list-style-type: upper-alpha; } +ol.type-i { list-style-type: lower-roman; } +ol.type-I { list-style-type: lower-roman; } +/* Apply the print table and row borders in general, on request from the RPC, +and increase the contrast between border and odd row background sligthtly */ +table { + border: 1px solid #ddd; +} +td { + border-top: 1px solid #ddd; +} +tr:nth-child(2n+1) > td { + background-color: #f8f8f8; +} +/* Use style rules to govern display of the TOC. */ +@media screen and (max-width: 1023px) { + #toc nav { display: none; } + #toc.active nav { display: block; } +} +/* Add support for keepWithNext */ +.keepWithNext { + break-after: avoid-page; + break-after: avoid-page; +} +/* Add support for keepWithPrevious */ +.keepWithPrevious { + break-before: avoid-page; +} +/* Change the approach to avoiding breaks inside artwork etc. */ +figure, pre, table, .artwork, .sourcecode { + break-before: avoid-page; + break-after: auto; +} +/* Avoid breaks between
        and
        */ +dl { + break-before: auto; + break-inside: auto; +} +dt { + break-before: auto; + break-after: avoid-page; +} +dd { + break-before: avoid-page; + break-after: auto; + orphans: 3; + widows: 3 +} +span.break, dd.break { + margin-bottom: 0; + min-height: 0; + break-before: auto; + break-inside: auto; + break-after: auto; +} +/* Undo break-before ToC */ +@media print { + #toc { + break-before: auto; + } +} +/* Text in compact lists should not get extra bottim margin space, + since that would makes the list not compact */ +ul.compact p, .ulCompact p, +ol.compact p, .olCompact p { + margin: 0; +} +/* But the list as a whole needs the extra space at the end */ +section ul.compact, +section .ulCompact, +section ol.compact, +section .olCompact { + margin-bottom: 1em; /* same as p not within ul.compact etc. */ +} +/* The tt and code background above interferes with for instance table cell + backgrounds. Changed to something a bit more selective. */ +tt, code { + background-color: transparent; +} +p tt, p code, li tt, li code { + background-color: #f8f8f8; +} +/* Tweak the pre margin -- 0px doesn't come out well */ +pre { + margin-top: 0.5px; +} +/* Tweak the comact list text */ +ul.compact, .ulCompact, +ol.compact, .olCompact, +dl.compact, .dlCompact { + line-height: normal; +} +/* Don't add top margin for nested lists */ +li > ul, li > ol, li > dl, +dd > ul, dd > ol, dd > dl, +dl > dd > dl { + margin-top: initial; +} +/* Elements that should not be rendered on the same line as a
        */ +/* This should match the element list in writer.text.TextWriter.render_dl() */ +dd > div.artwork:first-child, +dd > aside:first-child, +dd > figure:first-child, +dd > ol:first-child, +dd > div:first-child > pre.sourcecode, +dd > table:first-child, +dd > ul:first-child { + clear: left; +} +/* fix for weird browser behaviour when
        is empty */ +dt+dd:empty::before{ + content: "\00a0"; +} +/* Make paragraph spacing inside
      2. smaller than in body text, to fit better within the list */ +li > p { + margin-bottom: 0.5em +} +/* Don't let p margin spill out from inside list items */ +li > p:last-of-type { + margin-bottom: 0; +} + + + - - - - - - - - - - + +
        Network Working GroupA. Dulaunoy
        + - - - - - - - - - - - - - -
        Internet-DraftA. Iklody
        Expires: October 12, 2018CIRCL
        April 10, 2018
        - -

        MISP object template format
        -

        - -

        Abstract

        -

        This document describes the MISP object template format which describes a simple JSON format to represent the various templates used to construct MISP objects. A public directory of common vocabularies MISP object templates [MISP-O] is available and relies on the MISP object reference format.

        -

        Status of This Memo

        -

        This Internet-Draft is submitted in full conformance with the provisions of BCP 78 and BCP 79.

        -

        Internet-Drafts are working documents of the Internet Engineering Task Force (IETF). Note that other groups may also distribute working documents as Internet-Drafts. The list of current Internet-Drafts is at https://datatracker.ietf.org/drafts/current/.

        -

        Internet-Drafts are draft documents valid for a maximum of six months and may be updated, replaced, or obsoleted by other documents at any time. It is inappropriate to use Internet-Drafts as reference material or to cite them other than as "work in progress."

        -

        This Internet-Draft will expire on October 12, 2018.

        -

        Copyright Notice

        -

        Copyright (c) 2018 IETF Trust and the persons identified as the document authors. All rights reserved.

        -

        This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (https://trustee.ietf.org/license-info) in effect on the date of publication of this document. Please review these documents carefully, as they describe your rights and restrictions with respect to this document. Code Components extracted from this document must include Simplified BSD License text as described in Section 4.e of the Trust Legal Provisions and are provided without warranty as described in the Simplified BSD License.

        - - -
        -

        Table of Contents

        -
          - -
        • 1. Introduction +MISP object template format +November 2021 + + +Dulaunoy & Iklody +Expires 25 May 2022 +[Page] + + +
          +
          +
          +
          Workgroup:
          +
          Network Working Group
          +
          Internet-Draft:
          +
          draft-00
          +
          Published:
          +
          + +
          +
          Intended Status:
          +
          Informational
          +
          Expires:
          +
          +
          Authors:
          +
          +
          +
          A. Dulaunoy
          +
          CIRCL
          +
          +
          +
          A. Iklody
          +
          CIRCL
          +
          +
          +
          +
          +

          MISP object template format

          +
          +

          Abstract

          +

          This document describes the MISP object template format which describes a simple JSON format to represent the various templates used to construct MISP objects. A public directory of common vocabularies MISP object templates [MISP-O] is available and relies on the MISP object reference format.

          +
          +
          +
          +

          +Status of This Memo +

          +

          + This Internet-Draft is submitted in full conformance with the + provisions of BCP 78 and BCP 79.

          +

          + Internet-Drafts are working documents of the Internet Engineering Task + Force (IETF). Note that other groups may also distribute working + documents as Internet-Drafts. The list of current Internet-Drafts is + at https://datatracker.ietf.org/drafts/current/.

          +

          + Internet-Drafts are draft documents valid for a maximum of six months + and may be updated, replaced, or obsoleted by other documents at any + time. It is inappropriate to use Internet-Drafts as reference + material or to cite them other than as "work in progress."

          +

          + This Internet-Draft will expire on 25 May 2022.

          +
          +
          + +
          +
          + ▲

          +Table of Contents +

          +
        + + + +
        +
        +

        +1. Introduction +

        +

        Due to the increased maturity of threat information sharing, the need arose for more complex and exhaustive data-points to be shared across the various sharing communities. MISP's information sharing in general relied on a flat structure of attributes contained within an event, where attributes served as atomic secluded data-points with some commonalities as defined by the encapsulating event. However, this flat structure restricted the use of more diverse and complex data-points described by a list of atomic values, a problem solved by the MISP object structure.

        +

        MISP objects combine a list of attributes to represent a singular object with various facets. In order to bootstrap the object creation process and to maintain uniformity among objects describing similar data-points, the MISP object template format serves as a reusable and share-able blueprint format.

        +

        MISP object templates also include a vocabulary to describe the various inter object and object to attribute relationships and are leveraged by MISP object references.

        +
        +
        +

        +1.1. Conventions and Terminology +

        +

        The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", +"SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this +document are to be interpreted as described in RFC 2119 [RFC2119].

        +
        +
        +
        +
        +
        +
        +

        +2. Format +

        +

        MISP object templates are composed of the MISP object template (MUST) structure itself and a list of MISP object template elements (SHOULD) describing the list of possible attributes belonging to the resulting object, along with their context and settings.

        +

        MISP object templates themselves consist of a name (MUST), a meta-category (MUST) and a description (SHOULD). They are identified by a uuid (MUST) and a version (MUST). For any updates or transfer of the same object reference. UUID version 4 is RECOMMENDED when assigning it to a new object reference. The list of requirements when it comes to the contained MISP object template elements is defined in the requirements field (OPTIONAL).

        +

        MISP object template elements consist of an object_relation (MUST), a type (MUST), an object_template_id (SHOULD), a ui_priority (SHOULD), a list of categories (MAY), a list of sane_default values (MAY) or a values_list (MAY).

        +
        +
        +

        +2.1. Overview +

        +

        The MISP object template format uses the JSON [RFC8259] format. Each template is represented as a JSON object with meta information including the following fields: uuid, requiredOneOf, description, version, meta-category, name.

        +
        +
        +

        +2.1.1. Object Template +

        +
        +
        +
        +2.1.1.1. uuid +
        +

        uuid represents the Universally Unique IDentifier (UUID) [RFC4122] of the object template. The uuid MUST be preserved for to keep consistency of the templates across instances. UUID version 4 is RECOMMENDED when assigning it to a new object template.

        +

        uuid is represented as a JSON string. uuid MUST be present.

        +
        +
        +
        +
        +
        +2.1.1.2. requiredOneOf +
        +

        requiredOneOf is represented as a JSON list and contains a list of attribute relationships of which one must be present in the object to be created based on the given template. The requiredOneOf field MAY be present.

        +
        +
        +
        +
        +
        +2.1.1.3. required +
        +

        required is represented as a JSON list and contains a list of attribute relationships of which all must be present in the object to be created based on the given template. The required field MAY be present.

        +
        +
        +
        +
        +
        +2.1.1.4. description +
        +

        description is represented as a JSON string and contains the assigned meaning given to objects created using this template. The description field MUST be present.

        +
        +
        +
        +
        +
        +2.1.1.5. version +
        +

        version represents a numeric incrementing version of the object template. It is used to associate the object to the correct version of the template and together with the uuid field forms an association to the correct template type and version.

        +

        version is represented as a JSON string. version MUST be present.

        +
        +
        +
        +
        +
        +2.1.1.6. meta-category +
        +

        meta-category represents the sub-category of objects that the given object template belongs to. meta-categories are not tied to a fixed list of options but can be created on the fly.

        +

        meta-category is represented as a JSON string. meta-category MUST be present.

        +
        +
        +
        +
        +
        +2.1.1.7. name +
        +

        name represents the human-readable name of the objects created using the given template, describing the intent of the object package.

        +

        name is represented as a JSON string. name MUST be present

        +
        +
        +
        +
        +
        +
        +

        +2.1.2. attributes +

        +

        attributes is represented as a JSON list and contains a list of template elements used as a template for creating the individual attributes within the object that is to be created with the object.

        +

        attributes is represented as a JSON list. attributes MUST be present.

        +
        +
        +
        +2.1.2.1. description +
        +

        description is represented as a JSON string and contains the description of the given attribute in the context of the object with the given relationship. The description field MUST be present.

        +
        +
        +
        +
        +
        +2.1.2.2. ui-priority +
        +

        ui-priority is represented by a numeric values in JSON string format and is meant to provide a priority for the given element in the object template visualisation. The ui-priority MAY be present.

        +
        +
        +
        +
        +
        +2.1.2.3. misp-attribute +
        +

        misp-attribute is represented by a JSON string or a JSON object with a list of values. The value(s) are taken from the pool of types defined by the MISP core format's Attribute Object's type list. type can contain a JSON object with a list of suggested value alternatives encapsulated in a list within a sane_default key or a list of enforced value alternatives encapsulated in a list_values key.

        +

        The misp-attribute field MUST be present.

        +
        +
        +
        +
        +
        +2.1.2.4. disable_correlation +
        +

        disable_correlation is represented by a JSON boolean. The disable_correlation field flags the attribute(s) created by the given object template element to be marked as non correlating.

        +

        The misp-attribute field MAY be present.

        +
        +
        +
        +
        +
        +2.1.2.5. categories +
        +

        categories is represented by a JSON list containing one or several valid options from the list of verbs valid for the category field in the Attribute object within the MISP core format.

        +

        The categories field MAY be present.

        +
        +
        +
        +
        +
        +2.1.2.6. multiple +
        +

        multiple is represented by a JSON boolean value. It marks the MISP object template element as a multiple input field, allowing for several attributes to be created by the element within the same object.

        +

        The multiple field MAY be present.

        +
        +
        +
        +
        +
        +2.1.2.7. sane_default +
        +

        sane_default is represented by a JSON list containing one or several recommended/sane values for an attribute. sane_default is mutually exclusive with values_list.

        +

        The sane_default field MAY be present.

        +
        +
        +
        +
        +
        +2.1.2.8. values_list +
        +

        values_list is represented by a JSON List containing one or several of fixed values for an attribute. values_list is mutually exclusive with sane_default.

        +

        The value_list field MAY be present.

        +
        +
        +
        +
        +
        +
        +

        +2.1.3. Sample Object Template object +

        +

        The MISP object template directory is publicly available [MISP-O] in a git repository and contains more than 60 object templates. As illustration, two sample objects templates are included.

        +
        +
        +
        +2.1.3.1. credit-card object template +
        +
        {
   "requiredOneOf": [
     "cc-number"
@@ -633,10 +1560,16 @@
   "uuid": "2b9c57aa-daba-4330-a738-56f18743b0c7",
   "name": "credit-card"
 }
-
        -

        -2.1.3.2. credential object template -

        + +
        +
        +
        +
        +
        +
        +2.1.3.2. credential object template +
        +
        {
   "requiredOneOf": [
     "password"
@@ -712,253 +1645,918 @@
   "uuid": "a27e98c9-9b0e-414c-8076-d201e039ca09",
   "name": "credential"
 }
-
        -

        -2.1.4. Object Relationships -

        -

        -2.1.4.1. name -

        -

        name represents the human-readable relationship type which can be used when creating MISP object relations.

        -

        name is represented as a JSON string. name MUST be present.

        -

        -2.1.4.2. description -

        -

        description is represented as a JSON string and contains the description of the object relationship type. The description field MUST be present.

        -

        -2.1.4.3. format -

        -

        format is represented by a JSON list containing a list of formats that the relationship type is valid for and can be mapped to. The format field MUST be present.

        -

        -3. Directory -

        -

        The MISP object template directory is publicly available [MISP-O] in a git repository. The repository contains an objects directory, which contains a directory per object type, containing a file named definition.json which contains the definition of the object template in the above described format.

        -

        A relationships directory is also included, containing a definition.json file which contains a list of MISP object relation definitions. There are more than 125 existing templates object documented in [MISP-O-DOC].

        -

        -3.1. Existing and public MISP object templates -

        -

        - -
          -
        • tsk-chats - An Object Template to gather information from evidential or interesting exchange of messages identified during a digital forensic investigation.
          • -
        • tsk-web-bookmark - An Object Template to add evidential bookmarks identified during a digital forensic investigation.
          • -
        • tsk-web-cookie - An TSK-Autopsy Object Template to represent cookies identified during a forensic investigation.
          • -
        • tsk-web-downloads - An Object Template to add web-downloads.
          • -
        • tsk-web-history - An Object Template to share web history information.
          • -
        • tsk-web-search-query - An Object Template to share web search query information.
          • -
        • ail-leak - An information leak as defined by the AIL Analysis Information Leak framework.
          • -
        • ais-info - Automated Indicator Sharing (AIS) Information Source Markings.
          • -
        • android-permission - A set of android permissions - one or more permission(s) which can be linked to other objects (e.g. malware, app).
          • -
        • annotation - An annotation object allowing analysts to add annotations, comments, executive summary to a MISP event, objects or attributes.
          • -
        • anonymisation - Anonymisation object describing an anonymisation technique used to encode MISP attribute values. Reference: https://www.caida.org/tools/taxonomy/anonymization.xml.
          • -
        • asn - Autonomous system object describing an autonomous system which can include one or more network operators management an entity (e.g. ISP) along with their routing policy, routing prefixes or alike.
          • -
        • authenticode-signerinfo - Authenticode Signer Info.
          • -
        • av-signature - Antivirus detection signature.
          • -
        • bank-account - An object describing bank account information based on account description from goAML 4.0.
          • -
        • bgp-hijack - Object encapsulating BGP Hijack description as specified, for example, by bgpstream.com.
          • -
        • cap-alert - Common Alerting Protocol Version (CAP) alert object.
          • -
        • cap-info - Common Alerting Protocol Version (CAP) info object.
          • -
        • cap-resource - Common Alerting Protocol Version (CAP) resource object.
          • -
        • coin-address - An address used in a cryptocurrency.
          • -
        • cookie - An HTTP cookie (web cookie, browser cookie) is a small piece of data that a server sends to the user's web browser. The browser may store it and send it back with the next request to the same server. Typically, it's used to tell if two requests came from the same browser — keeping a user logged-in, for example. It remembers stateful information for the stateless HTTP protocol. (as defined by the Mozilla foundation.
          • -
        • cortex - Cortex object describing a complete cortex analysis. Observables would be attribute with a relationship from this object.
          • -
        • cortex-taxonomy - Cortex object describing an Cortex Taxonomy (or mini report).
          • -
        • course-of-action - An object describing a specific measure taken to prevent or respond to an attack.
          • -
        • cowrie - Cowrie honeypot object template.
          • -
        • credential - Credential describes one or more credential(s) including password(s), api key(s) or decryption key(s).
          • -
        • credit-card - A payment card like credit card, debit card or any similar cards which can be used for financial transactions.
          • -
        • ddos - DDoS object describes a current DDoS activity from a specific or/and to a specific target. Type of DDoS can be attached to the object as a taxonomy.
          • -
        • device - An object to define a device.
          • -
        • diameter-attack - Attack as seen on diameter authentication against a GSM, UMTS or LTE network.
          • -
        • domain-ip - A domain and IP address seen as a tuple in a specific time frame.
          • -
        • elf - Object describing a Executable and Linkable Format.
          • -
        • elf-section - Object describing a section of an Executable and Linkable Format.
          • -
        • email - Email object describing an email with meta-information.
          • -
        • exploit-poc - Exploit-poc object describing a proof of concept or exploit of a vulnerability. This object has often a relationship with a vulnerability object.
          • -
        • facial-composite - An object which describes a facial composite.
          • -
        • fail2ban - Fail2ban event.
          • -
        • file - File object describing a file with meta-information.
          • -
        • forensic-case - An object template to describe a digital forensic case.
          • -
        • forensic-evidence - An object template to describe a digital forensic evidence.
          • -
        • geolocation - An object to describe a geographic location.
          • -
        • gtp-attack - GTP attack object as seen on a GSM, UMTS or LTE network.
          • -
        • http-request - A single HTTP request header.
          • -
        • ilr-impact - Institut Luxembourgeois de Regulation - Impact.
          • -
        • ilr-notification-incident - Institut Luxembourgeois de Regulation - Notification d'incident.
          • -
        • internal-reference - Internal reference.
          • -
        • interpol-notice - An object which describes a Interpol notice.
          • -
        • ip-api-address - IP Address information. Useful if you are pulling your ip information from ip-api.com.
          • -
        • ip-port - An IP address (or domain or hostname) and a port seen as a tuple (or as a triple) in a specific time frame.
          • -
        • irc - An IRC object to describe an IRC server and the associated channels.
          • -
        • ja3 - JA3 is a new technique for creating SSL client fingerprints that are easy to produce and can be easily shared for threat intelligence. Fingerprints are composed of Client Hello packet; SSL Version, Accepted Ciphers, List of Extensions, Elliptic Curves, and Elliptic Curve Formats. https://github.com/salesforce/ja3.
          • -
        • legal-entity - An object to describe a legal entity.
          • -
        • lnk - LNK object describing a Windows LNK binary file (aka Windows shortcut).
          • -
        • macho - Object describing a file in Mach-O format.
          • -
        • macho-section - Object describing a section of a file in Mach-O format.
          • -
        • mactime-timeline-analysis - Mactime template, used in forensic investigations to describe the timeline of a file activity.
          • -
        • malware-config - Malware configuration recovered or extracted from a malicious binary.
          • -
        • microblog - Microblog post like a Twitter tweet or a post on a Facebook wall.
          • -
        • mutex - Object to describe mutual exclusion locks (mutex) as seen in memory or computer program.
          • -
        • netflow - Netflow object describes an network object based on the Netflowv5/v9 minimal definition.
          • -
        • network-connection - A local or remote network connection.
          • -
        • network-socket - Network socket object describes a local or remote network connections based on the socket data structure.
          • -
        • misc - An object which describes an organization.
          • -
        • original-imported-file - Object describing the original file used to import data in MISP.
          • -
        • passive-dns - Passive DNS records as expressed in draft-dulaunoy-dnsop-passive-dns-cof-01.
          • -
        • paste - Paste or similar post from a website allowing to share privately or publicly posts.
          • -
        • pcap-metadata - Network packet capture metadata.
          • -
        • pe - Object describing a Portable Executable.
          • -
        • pe-section - Object describing a section of a Portable Executable.
          • -
        • person - An object which describes a person or an identity.
          • -
        • phishing - Phishing template to describe a phishing website and its analysis.
          • -
        • phishing-kit - Object to describe a phishing-kit.
          • -
        • phone - A phone or mobile phone object which describe a phone.
          • -
        • process - Object describing a system process.
          • -
        • python-etvx-event-log - Event log object template to share information of the activities conducted on a system. .
          • -
        • r2graphity - Indicators extracted from files using radare2 and graphml.
          • -
        • regexp - An object describing a regular expression (regex or regexp). The object can be linked via a relationship to other attributes or objects to describe how it can be represented as a regular expression.
          • -
        • registry-key - Registry key object describing a Windows registry key with value and last-modified timestamp.
          • -
        • regripper-NTUser - Regripper Object template designed to present user specific configuration details extracted from the NTUSER.dat hive.
          • -
        • regripper-sam-hive-single-user - Regripper Object template designed to present user profile details extracted from the SAM hive.
          • -
        • regripper-sam-hive-user-group - Regripper Object template designed to present group profile details extracted from the SAM hive.
          • -
        • regripper-software-hive-BHO - Regripper Object template designed to gather information of the browser helper objects installed on the system.
          • -
        • regripper-software-hive-appInit-DLLS - Regripper Object template designed to gather information of the DLL files installed on the system.
          • -
        • regripper-software-hive-application-paths - Regripper Object template designed to gather information of the application paths.
          • -
        • regripper-software-hive-applications-installed - Regripper Object template designed to gather information of the applications installed on the system.
          • -
        • regripper-software-hive-command-shell - Regripper Object template designed to gather information of the shell commands executed on the system.
          • -
        • regripper-software-hive-windows-general-info - Regripper Object template designed to gather general windows information extracted from the software-hive.
          • -
        • regripper-software-hive-software-run - Regripper Object template designed to gather information of the applications set to run on the system.
          • -
        • regripper-software-hive-userprofile-winlogon - Regripper Object template designed to gather user profile information when the user logs onto the system, gathered from the software hive.
          • -
        • regripper-system-hive-firewall-configuration - Regripper Object template designed to present firewall configuration information extracted from the system-hive.
          • -
        • regripper-system-hive-general-configuration - Regripper Object template designed to present general system properties extracted from the system-hive.
          • -
        • regripper-system-hive-network-information. - Regripper object template designed to gather network information from the system-hive.
          • -
        • regripper-system-hive-services-drivers - Regripper Object template designed to gather information regarding the services/drivers from the system-hive.
          • -
        • report - Metadata used to generate an executive level report.
          • -
        • research-scanner - Information related to known scanning activity (e.g. from research projects).
          • -
        • rogue-dns - Rogue DNS as defined by CERT.br.
          • -
        • rtir - RTIR - Request Tracker for Incident Response.
          • -
        • sandbox-report - Sandbox report.
          • -
        • sb-signature - Sandbox detection signature.
          • -
        • script - Object describing a computer program written to be run in a special run-time environment. The script or shell script can be used for malicious activities but also as support tools for threat analysts.
          • -
        • shell-commands - Object describing a series of shell commands executed. This object can be linked with malicious files in order to describe a specific execution of shell commands.
          • -
        • short-message-service - Short Message Service (SMS) object template describing one or more SMS message. Restriction of the initial format 3GPP 23.038 GSM character set doesn't apply.
          • -
        • shortened-link - Shortened link and its redirect target.
          • -
        • splunk - Splunk / Splunk ES object.
          • -
        • ss7-attack - SS7 object of an attack seen on a GSM, UMTS or LTE network via SS7 logging.
          • -
        • ssh-authorized-keys - An object to store ssh authorized keys file.
          • -
        • stix2-pattern - An object describing a STIX pattern. The object can be linked via a relationship to other attributes or objects to describe how it can be represented as a STIX pattern.
          • -
        • suricata - An object describing one or more Suricata rule(s) along with version and contextual information.
          • -
        • target-system - Description about an targeted system, this could potentially be a compromissed internal system.
          • -
        • threatgrid-report - ThreatGrid report.
          • -
        • timecode - Timecode object to describe a start of video sequence (e.g. CCTV evidence) and the end of the video sequence.
          • -
        • timesketch-timeline - A timesketch timeline object based on mandatory field in timesketch to describe a log entry.
          • -
        • timesketch_message - A timesketch message entry.
          • -
        • timestamp - A generic timestamp object to represent time including first time and last time seen. Relationship will then define the kind of time relationship.
          • -
        • tor-hiddenservice - Tor hidden service (onion service) object.
          • -
        • tor-node - Tor node (which protects your privacy on the internet by hiding the connection between users Internet address and the services used by the users) description which are part of the Tor network at a time.
          • -
        • tracking-id - Analytics and tracking ID such as used in Google Analytics or other analytic platform.
          • -
        • transaction - An object to describe a financial transaction.
          • -
        • url - url object describes an url along with its normalized field (like extracted using faup parsing library) and its metadata.
          • -
        • vehicle - Vehicle object template to describe a vehicle information and registration.
          • -
        • victim - Victim object describes the target of an attack or abuse.
          • -
        • virustotal-report - VirusTotal report.
          • -
        • vulnerability - Vulnerability object describing a common vulnerability enumeration which can describe published, unpublished, under review or embargo vulnerability for software, equipments or hardware.
          • -
        • whois - Whois records information for a domain name or an IP address.
          • -
        • x509 - x509 object describing a X.509 certificate.
          • -
        • yabin - yabin.py generates Yara rules from function prologs, for matching and hunting binaries. ref: https://github.com/AlienVault-OTX/yabin.
          • -
        • yara - An object describing a YARA rule along with its version.
          • -
        - -

        -

        -4. Acknowledgements -

        -

        The authors wish to thank all the MISP community who are supporting the creation of open standards in threat intelligence sharing.

        -

        -5. References

        -

        -5.1. Normative References

        - - - - - - - - - - - - - -
        [RFC2119] -Bradner, S., "Key words for use in RFCs to Indicate Requirement Levels", BCP 14, RFC 2119, DOI 10.17487/RFC2119, March 1997.
        [RFC4122] -Leach, P., Mealling, M. and R. Salz, "A Universally Unique IDentifier (UUID) URN Namespace", RFC 4122, DOI 10.17487/RFC4122, July 2005.
        [RFC8259] -Bray, T., "The JavaScript Object Notation (JSON) Data Interchange Format", STD 90, RFC 8259, DOI 10.17487/RFC8259, December 2017.
        -

        -5.2. Informative References

        - - - - - - - - - -
        [MISP-O] -Community, M., "MISP Objects - shared and common object templates"
        [MISP-O-DOC] -community, M., "MISP objects directory", 2018.
        -

        Authors' Addresses

        -
        -
        - - Alexandre Dulaunoy - - - Computer Incident Response Center Luxembourg - - 16, bd d'Avranches - - - Luxembourg, - - L-1611 - - Luxembourg - - Phone: +352 247 88444 - -EMail: alexandre.dulaunoy@circl.lu - -
        -
        -
        - - Andras Iklody - - - Computer Incident Response Center Luxembourg - - 16, bd d'Avranches - - - Luxembourg, - - L-1611 - - Luxembourg - - Phone: +352 247 88444 - -EMail: andras.iklody@circl.lu - -
        +
        - +
        +
        +
        +
        +
        +
        +

        +2.1.4. Object Relationships +

        +
        +
        +
        +2.1.4.1. name +
        +

        name represents the human-readable relationship type which can be used when creating MISP object relations.

        +

        name is represented as a JSON string. name MUST be present.

        +
        +
        +
        +
        +
        +2.1.4.2. description +
        +

        description is represented as a JSON string and contains the description of the object relationship type. The description field MUST be present.

        +
        +
        +
        +
        +
        +2.1.4.3. format +
        +

        format is represented by a JSON list containing a list of formats that the relationship type is valid for and can be mapped to. The format field MUST be present.

        +
        +
        +
        +
        +
        +
        +
        +
        +
        +
        +

        +3. Directory +

        +

        The MISP object template directory is publicly available [MISP-O] in a git repository. The repository contains an objects directory, which contains a directory per object type, containing a file named definition.json which contains the definition of the object template in the above described format.

        +

        A relationships directory is also included, containing a definition.json file which contains a list of MISP object relation definitions. There are more than 125 existing templates object documented in [MISP-O-DOC].

        +
        +
        +

        +3.1. Existing and public MISP object templates +

        + +
        +
        +
        +
        +
        +
        +

        +4. Acknowledgements +

        +

        The authors wish to thank all the MISP community who are supporting the creation +of open standards in threat intelligence sharing.

        +
        +
        +
        +

        +5. Normative References +

        +
        +
        [RFC2119]
        +
        +Bradner, S., "Key words for use in RFCs to Indicate Requirement Levels", BCP 14, RFC 2119, DOI 10.17487/RFC2119, , <https://www.rfc-editor.org/info/rfc2119>.
        +
        +
        [RFC4122]
        +
        +Leach, P., Mealling, M., and R. Salz, "A Universally Unique IDentifier (UUID) URN Namespace", RFC 4122, DOI 10.17487/RFC4122, , <https://www.rfc-editor.org/info/rfc4122>.
        +
        +
        [RFC8259]
        +
        +Bray, T., Ed., "The JavaScript Object Notation (JSON) Data Interchange Format", STD 90, RFC 8259, DOI 10.17487/RFC8259, , <https://www.rfc-editor.org/info/rfc8259>.
        +
        +
        +
        +
        +

        +6. Informative References +

        +
        +
        [MISP-O]
        +
        +Community, M., "MISP Objects - shared and common object templates", , <https://github.com/MISP/misp-objects>.
        +
        +
        [MISP-O-DOC]
        +
        +community, M., "MISP objects directory", , , <https://www.misp-project.org/objects.html>.
        +
        +
        +
        +
        +
        +

        +Authors' Addresses +

        +
        +
        Alexandre Dulaunoy
        +
        Computer Incident Response Center Luxembourg
        +
        16, bd d'Avranches
        +
        L-L-1611 Luxembourg +
        +
        Luxembourg
        +
        +Phone: ++352 247 88444 +
        + +
        +
        +
        Andras Iklody
        +
        Computer Incident Response Center Luxembourg
        +
        16, bd d'Avranches
        +
        L-L-1611 Luxembourg +
        +
        Luxembourg
        +
        +Phone: ++352 247 88444 +
        + +
        +
        +
        + diff --git a/rfc/misp-standard-object-template-format.txt b/rfc/misp-standard-object-template-format.txt index 09b1cfb..09f4bd0 100644 --- a/rfc/misp-standard-object-template-format.txt +++ b/rfc/misp-standard-object-template-format.txt @@ -4,11 +4,12 @@ Network Working Group A. Dulaunoy Internet-Draft A. Iklody -Expires: October 12, 2018 CIRCL - April 10, 2018 +Intended status: Informational CIRCL +Expires: 25 May 2022 21 November 2021 MISP object template format + draft-00 Abstract @@ -33,29 +34,28 @@ Status of This Memo time. It is inappropriate to use Internet-Drafts as reference material or to cite them other than as "work in progress." - This Internet-Draft will expire on October 12, 2018. + This Internet-Draft will expire on 25 May 2022. Copyright Notice - Copyright (c) 2018 IETF Trust and the persons identified as the + Copyright (c) 2021 IETF Trust and the persons identified as the document authors. All rights reserved. This document is subject to BCP 78 and the IETF Trust's Legal - Provisions Relating to IETF Documents - (https://trustee.ietf.org/license-info) in effect on the date of - publication of this document. Please review these documents - carefully, as they describe your rights and restrictions with respect - to this document. Code Components extracted from this document must - include Simplified BSD License text as described in Section 4.e of - the Trust Legal Provisions and are provided without warranty as - described in the Simplified BSD License. + Provisions Relating to IETF Documents (https://trustee.ietf.org/ + license-info) in effect on the date of publication of this document. + Please review these documents carefully, as they describe your rights + and restrictions with respect to this document. -Dulaunoy & Iklody Expires October 12, 2018 [Page 1] + + + +Dulaunoy & Iklody Expires 25 May 2022 [Page 1] -Internet-Draft MISP object template format April 2018 +Internet-Draft MISP object template format November 2021 Table of Contents @@ -70,12 +70,10 @@ Table of Contents 2.1.4. Object Relationships . . . . . . . . . . . . . . . . 9 3. Directory . . . . . . . . . . . . . . . . . . . . . . . . . . 10 3.1. Existing and public MISP object templates . . . . . . . . 10 - 4. Acknowledgements . . . . . . . . . . . . . . . . . . . . . . 18 - 5. References . . . . . . . . . . . . . . . . . . . . . . . . . 18 - 5.1. Normative References . . . . . . . . . . . . . . . . . . 18 - 5.2. Informative References . . . . . . . . . . . . . . . . . 18 - 5.3. URIs . . . . . . . . . . . . . . . . . . . . . . . . . . 19 - Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . . 19 + 4. Acknowledgements . . . . . . . . . . . . . . . . . . . . . . 34 + 5. Normative References . . . . . . . . . . . . . . . . . . . . 34 + 6. Informative References . . . . . . . . . . . . . . . . . . . 34 + Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . . 34 1. Introduction @@ -109,9 +107,11 @@ Table of Contents -Dulaunoy & Iklody Expires October 12, 2018 [Page 2] + + +Dulaunoy & Iklody Expires 25 May 2022 [Page 2] -Internet-Draft MISP object template format April 2018 +Internet-Draft MISP object template format November 2021 2. Format @@ -165,9 +165,9 @@ Internet-Draft MISP object template format April 2018 -Dulaunoy & Iklody Expires October 12, 2018 [Page 3] +Dulaunoy & Iklody Expires 25 May 2022 [Page 3] -Internet-Draft MISP object template format April 2018 +Internet-Draft MISP object template format November 2021 2.1.1.3. required @@ -221,9 +221,9 @@ Internet-Draft MISP object template format April 2018 -Dulaunoy & Iklody Expires October 12, 2018 [Page 4] +Dulaunoy & Iklody Expires 25 May 2022 [Page 4] -Internet-Draft MISP object template format April 2018 +Internet-Draft MISP object template format November 2021 2.1.2.1. description @@ -277,9 +277,9 @@ Internet-Draft MISP object template format April 2018 -Dulaunoy & Iklody Expires October 12, 2018 [Page 5] +Dulaunoy & Iklody Expires 25 May 2022 [Page 5] -Internet-Draft MISP object template format April 2018 +Internet-Draft MISP object template format November 2021 2.1.2.7. sane_default @@ -333,9 +333,9 @@ Internet-Draft MISP object template format April 2018 -Dulaunoy & Iklody Expires October 12, 2018 [Page 6] +Dulaunoy & Iklody Expires 25 May 2022 [Page 6] -Internet-Draft MISP object template format April 2018 +Internet-Draft MISP object template format November 2021 { @@ -389,9 +389,9 @@ Internet-Draft MISP object template format April 2018 -Dulaunoy & Iklody Expires October 12, 2018 [Page 7] +Dulaunoy & Iklody Expires 25 May 2022 [Page 7] -Internet-Draft MISP object template format April 2018 +Internet-Draft MISP object template format November 2021 2.1.3.2. credential object template @@ -445,9 +445,9 @@ Internet-Draft MISP object template format April 2018 -Dulaunoy & Iklody Expires October 12, 2018 [Page 8] +Dulaunoy & Iklody Expires 25 May 2022 [Page 8] -Internet-Draft MISP object template format April 2018 +Internet-Draft MISP object template format November 2021 "format": { @@ -501,9 +501,9 @@ Internet-Draft MISP object template format April 2018 -Dulaunoy & Iklody Expires October 12, 2018 [Page 9] +Dulaunoy & Iklody Expires 25 May 2022 [Page 9] -Internet-Draft MISP object template format April 2018 +Internet-Draft MISP object template format November 2021 2.1.4.3. format @@ -527,457 +527,1343 @@ Internet-Draft MISP object template format April 2018 3.1. Existing and public MISP object templates - o tsk-chats - An Object Template to gather information from - evidential or interesting exchange of messages identified during a - digital forensic investigation. + * objects/ail-leak (https://github.com/MISP/misp- + objects/blob/main/objects/ail-leak/definition.json) - An + information leak as defined by the AIL Analysis Information Leak + framework. - o tsk-web-bookmark - An Object Template to add evidential bookmarks - identified during a digital forensic investigation. + * objects/ais-info (https://github.com/MISP/misp- + objects/blob/main/objects/ais-info/definition.json) - Automated + Indicator Sharing (AIS) Information Source Markings. - o tsk-web-cookie - An TSK-Autopsy Object Template to represent - cookies identified during a forensic investigation. + * objects/android-app (https://github.com/MISP/misp- + objects/blob/main/objects/android-app/definition.json) - + Indicators related to an Android app. - o tsk-web-downloads - An Object Template to add web-downloads. + * objects/android-permission (https://github.com/MISP/misp- + objects/blob/main/objects/android-permission/definition.json) - A + set of android permissions - one or more permission(s) which can + be linked to other objects (e.g. malware, app). - o tsk-web-history - An Object Template to share web history - information. - - o tsk-web-search-query - An Object Template to share web search - query information. - - o ail-leak - An information leak as defined by the AIL Analysis - Information Leak framework. - - o ais-info - Automated Indicator Sharing (AIS) Information Source - Markings. - - o android-permission - A set of android permissions - one or more - permission(s) which can be linked to other objects (e.g. malware, - app). + * objects/annotation (https://github.com/MISP/misp- + objects/blob/main/objects/annotation/definition.json) - An + annotation object allowing analysts to add annotations, comments, + executive summary to a MISP event, objects or attributes. -Dulaunoy & Iklody Expires October 12, 2018 [Page 10] + + + + + +Dulaunoy & Iklody Expires 25 May 2022 [Page 10] -Internet-Draft MISP object template format April 2018 +Internet-Draft MISP object template format November 2021 - o annotation - An annotation object allowing analysts to add - annotations, comments, executive summary to a MISP event, objects - or attributes. + * objects/anonymisation (https://github.com/MISP/misp- + objects/blob/main/objects/anonymisation/definition.json) - + Anonymisation object describing an anonymisation technique used to + encode MISP attribute values. Reference: + https://www.caida.org/tools/taxonomy/anonymization.xml + (https://www.caida.org/tools/taxonomy/anonymization.xml). - o anonymisation - Anonymisation object describing an anonymisation - technique used to encode MISP attribute values. Reference: - https://www.caida.org/tools/taxonomy/anonymization.xml [1]. + * objects/asn (https://github.com/MISP/misp- + objects/blob/main/objects/asn/definition.json) - Autonomous system + object describing an autonomous system which can include one or + more network operators management an entity (e.g. ISP) along with + their routing policy, routing prefixes or alike. - o asn - Autonomous system object describing an autonomous system - which can include one or more network operators management an - entity (e.g. ISP) along with their routing policy, routing - prefixes or alike. + * objects/attack-pattern (https://github.com/MISP/misp- + objects/blob/main/objects/attack-pattern/definition.json) - Attack + pattern describing a common attack pattern enumeration and + classification. - o authenticode-signerinfo - Authenticode Signer Info. + * objects/authentication-failure-report (https://github.com/MISP/ + misp-objects/blob/main/objects/authentication-failure-report/ + definition.json) - Authentication Failure Report. - o av-signature - Antivirus detection signature. + * objects/authenticode-signerinfo (https://github.com/MISP/misp- + objects/blob/main/objects/authenticode-signerinfo/definition.json) + - Authenticode Signer Info. - o bank-account - An object describing bank account information based - on account description from goAML 4.0. + * objects/av-signature (https://github.com/MISP/misp- + objects/blob/main/objects/av-signature/definition.json) - + Antivirus detection signature. - o bgp-hijack - Object encapsulating BGP Hijack description as - specified, for example, by bgpstream.com. + * objects/bank-account (https://github.com/MISP/misp- + objects/blob/main/objects/bank-account/definition.json) - An + object describing bank account information based on account + description from goAML 4.0. - o cap-alert - Common Alerting Protocol Version (CAP) alert object. + * objects/bgp-hijack (https://github.com/MISP/misp- + objects/blob/main/objects/bgp-hijack/definition.json) - Object + encapsulating BGP Hijack description as specified, for example, by + bgpstream.com. - o cap-info - Common Alerting Protocol Version (CAP) info object. + * objects/bgp-ranking (https://github.com/MISP/misp- + objects/blob/main/objects/bgp-ranking/definition.json) - BGP + Ranking object describing the ranking of an ASN for a given day, + along with its position, 1 being the most malicious ASN of the + day, with the highest ranking. This object is meant to have a + relationship with the corresponding ASN object and represents its + ranking for a specific date. - o cap-resource - Common Alerting Protocol Version (CAP) resource - object. - o coin-address - An address used in a cryptocurrency. - o cookie - An HTTP cookie (web cookie, browser cookie) is a small - piece of data that a server sends to the user's web browser. The - browser may store it and send it back with the next request to the - same server. Typically, it's used to tell if two requests came - from the same browser -- keeping a user logged-in, for example. - It remembers stateful information for the stateless HTTP protocol. + +Dulaunoy & Iklody Expires 25 May 2022 [Page 11] + +Internet-Draft MISP object template format November 2021 + + + * objects/blog (https://github.com/MISP/misp- + objects/blob/main/objects/blog/definition.json) - Blog post like + Medium or WordPress. + + * objects/boleto (https://github.com/MISP/misp- + objects/blob/main/objects/boleto/definition.json) - A common form + of payment used in Brazil. + + * objects/btc-transaction (https://github.com/MISP/misp- + objects/blob/main/objects/btc-transaction/definition.json) - An + object to describe a Bitcoin transaction. Best to be used with + bitcoin-wallet. + + * objects/btc-wallet (https://github.com/MISP/misp- + objects/blob/main/objects/btc-wallet/definition.json) - An object + to describe a Bitcoin wallet. Best to be used with bitcoin- + transactions. + + * objects/cap-alert (https://github.com/MISP/misp- + objects/blob/main/objects/cap-alert/definition.json) - Common + Alerting Protocol Version (CAP) alert object. + + * objects/cap-info (https://github.com/MISP/misp- + objects/blob/main/objects/cap-info/definition.json) - Common + Alerting Protocol Version (CAP) info object. + + * objects/cap-resource (https://github.com/MISP/misp- + objects/blob/main/objects/cap-resource/definition.json) - Common + Alerting Protocol Version (CAP) resource object. + + * objects/coin-address (https://github.com/MISP/misp- + objects/blob/main/objects/coin-address/definition.json) - An + address used in a cryptocurrency. + + * objects/command (https://github.com/MISP/misp- + objects/blob/main/objects/command/definition.json) - Command + functionalities related to specific commands executed by a + program, whether it is malicious or not. Command-line are + attached to this object for the related commands. + + * objects/command-line (https://github.com/MISP/misp- + objects/blob/main/objects/command-line/definition.json) - Command + line and options related to a specific command executed by a + program, whether it is malicious or not. + + * objects/cookie (https://github.com/MISP/misp- + objects/blob/main/objects/cookie/definition.json) - An HTTP cookie + (web cookie, browser cookie) is a small piece of data that a + + + +Dulaunoy & Iklody Expires 25 May 2022 [Page 12] + +Internet-Draft MISP object template format November 2021 + + + server sends to the user's web browser. The browser may store it + and send it back with the next request to the same server. + Typically, it's used to tell if two requests came from the same + browser — (U+2014) keeping a user logged-in, for example. It + remembers stateful information for the stateless HTTP protocol. (as defined by the Mozilla foundation. - o cortex - Cortex object describing a complete cortex analysis. - Observables would be attribute with a relationship from this - object. + * objects/cortex (https://github.com/MISP/misp- + objects/blob/main/objects/cortex/definition.json) - Cortex object + describing a complete cortex analysis. Observables would be + attribute with a relationship from this object. - o cortex-taxonomy - Cortex object describing an Cortex Taxonomy (or - mini report). + * objects/cortex-taxonomy (https://github.com/MISP/misp- + objects/blob/main/objects/cortex-taxonomy/definition.json) - + Cortex object describing an Cortex Taxonomy (or mini report). + + * objects/course-of-action (https://github.com/MISP/misp- + objects/blob/main/objects/course-of-action/definition.json) - An + object describing a specific measure taken to prevent or respond + to an attack. + + * objects/covid19-csse-daily-report (https://github.com/MISP/misp- + objects/blob/main/objects/covid19-csse-daily-report/ + definition.json) - CSSE COVID-19 Daily report. + + * objects/covid19-dxy-live-city (https://github.com/MISP/misp- + objects/blob/main/objects/covid19-dxy-live-city/definition.json) - + COVID 19 from dxy.cn - Aggregation by city. + + * objects/covid19-dxy-live-province (https://github.com/MISP/misp- + objects/blob/main/objects/covid19-dxy-live-province/ + definition.json) - COVID 19 from dxy.cn - Aggregation by province. + + * objects/cowrie (https://github.com/MISP/misp- + objects/blob/main/objects/cowrie/definition.json) - Cowrie + honeypot object template. + + * objects/cpe-asset (https://github.com/MISP/misp- + objects/blob/main/objects/cpe-asset/definition.json) - An asset + which can be defined by a CPE. This can be a generic asset. CPE + is a structured naming scheme for information technology systems, + software, and packages. + + * objects/credential (https://github.com/MISP/misp- + objects/blob/main/objects/credential/definition.json) - Credential + describes one or more credential(s) including password(s), api + key(s) or decryption key(s). - -Dulaunoy & Iklody Expires October 12, 2018 [Page 11] +Dulaunoy & Iklody Expires 25 May 2022 [Page 13] -Internet-Draft MISP object template format April 2018 +Internet-Draft MISP object template format November 2021 - o course-of-action - An object describing a specific measure taken - to prevent or respond to an attack. + * objects/credit-card (https://github.com/MISP/misp- + objects/blob/main/objects/credit-card/definition.json) - A payment + card like credit card, debit card or any similar cards which can + be used for financial transactions. - o cowrie - Cowrie honeypot object template. + * objects/crypto-material (https://github.com/MISP/misp- + objects/blob/main/objects/crypto-material/definition.json) - + Cryptographic materials such as public or/and private keys. - o credential - Credential describes one or more credential(s) - including password(s), api key(s) or decryption key(s). + * objects/cytomic-orion-file (https://github.com/MISP/misp- + objects/blob/main/objects/cytomic-orion-file/definition.json) - + Cytomic Orion File Detection. - o credit-card - A payment card like credit card, debit card or any - similar cards which can be used for financial transactions. + * objects/cytomic-orion-machine (https://github.com/MISP/misp- + objects/blob/main/objects/cytomic-orion-machine/definition.json) - + Cytomic Orion File at Machine Detection. - o ddos - DDoS object describes a current DDoS activity from a - specific or/and to a specific target. Type of DDoS can be - attached to the object as a taxonomy. + * objects/dark-pattern-item (https://github.com/MISP/misp- + objects/blob/main/objects/dark-pattern-item/definition.json) - An + Item whose User Interface implements a dark pattern. - o device - An object to define a device. + * objects/ddos (https://github.com/MISP/misp- + objects/blob/main/objects/ddos/definition.json) - DDoS object + describes a current DDoS activity from a specific or/and to a + specific target. Type of DDoS can be attached to the object as a + taxonomy. - o diameter-attack - Attack as seen on diameter authentication - against a GSM, UMTS or LTE network. + * objects/device (https://github.com/MISP/misp- + objects/blob/main/objects/device/definition.json) - An object to + define a device. - o domain-ip - A domain and IP address seen as a tuple in a specific - time frame. + * objects/diameter-attack (https://github.com/MISP/misp- + objects/blob/main/objects/diameter-attack/definition.json) - + Attack as seen on diameter authentication against a GSM, UMTS or + LTE network. - o elf - Object describing a Executable and Linkable Format. + * objects/dns-record (https://github.com/MISP/misp- + objects/blob/main/objects/dns-record/definition.json) - A set of + DNS records observed for a specific domain. - o elf-section - Object describing a section of an Executable and - Linkable Format. + * objects/domain-crawled (https://github.com/MISP/misp- + objects/blob/main/objects/domain-crawled/definition.json) - A + domain crawled over time. - o email - Email object describing an email with meta-information. - - o exploit-poc - Exploit-poc object describing a proof of concept or - exploit of a vulnerability. This object has often a relationship - with a vulnerability object. - - o facial-composite - An object which describes a facial composite. - - o fail2ban - Fail2ban event. - - o file - File object describing a file with meta-information. - - o forensic-case - An object template to describe a digital forensic - case. - - o forensic-evidence - An object template to describe a digital - forensic evidence. - - o geolocation - An object to describe a geographic location. + * objects/domain-ip (https://github.com/MISP/misp- + objects/blob/main/objects/domain-ip/definition.json) - A domain/ + hostname and IP address seen as a tuple in a specific time frame. -Dulaunoy & Iklody Expires October 12, 2018 [Page 12] +Dulaunoy & Iklody Expires 25 May 2022 [Page 14] -Internet-Draft MISP object template format April 2018 +Internet-Draft MISP object template format November 2021 - o gtp-attack - GTP attack object as seen on a GSM, UMTS or LTE - network. + * objects/elf (https://github.com/MISP/misp- + objects/blob/main/objects/elf/definition.json) - Object describing + a Executable and Linkable Format. - o http-request - A single HTTP request header. + * objects/elf-section (https://github.com/MISP/misp- + objects/blob/main/objects/elf-section/definition.json) - Object + describing a section of an Executable and Linkable Format. - o ilr-impact - Institut Luxembourgeois de Regulation - Impact. + * objects/email (https://github.com/MISP/misp- + objects/blob/main/objects/email/definition.json) - Email object + describing an email with meta-information. - o ilr-notification-incident - Institut Luxembourgeois de Regulation - - Notification d'incident. + * objects/employee (https://github.com/MISP/misp- + objects/blob/main/objects/employee/definition.json) - An employee + and related data points. - o internal-reference - Internal reference. + * objects/exploit-poc (https://github.com/MISP/misp- + objects/blob/main/objects/exploit-poc/definition.json) - Exploit- + poc object describing a proof of concept or exploit of a + vulnerability. This object has often a relationship with a + vulnerability object. - o interpol-notice - An object which describes a Interpol notice. + * objects/facebook-account (https://github.com/MISP/misp- + objects/blob/main/objects/facebook-account/definition.json) - + Facebook account. - o ip-api-address - IP Address information. Useful if you are - pulling your ip information from ip-api.com. + * objects/facebook-group (https://github.com/MISP/misp- + objects/blob/main/objects/facebook-group/definition.json) - Public + or private facebook group. - o ip-port - An IP address (or domain or hostname) and a port seen as - a tuple (or as a triple) in a specific time frame. + * objects/facebook-page (https://github.com/MISP/misp- + objects/blob/main/objects/facebook-page/definition.json) - + Facebook page. - o irc - An IRC object to describe an IRC server and the associated - channels. + * objects/facebook-post (https://github.com/MISP/misp- + objects/blob/main/objects/facebook-post/definition.json) - Post on + a Facebook wall. - o ja3 - JA3 is a new technique for creating SSL client fingerprints - that are easy to produce and can be easily shared for threat - intelligence. Fingerprints are composed of Client Hello packet; - SSL Version, Accepted Ciphers, List of Extensions, Elliptic - Curves, and Elliptic Curve Formats. https://github.com/salesforce/ - ja3 [2]. + * objects/facial-composite (https://github.com/MISP/misp- + objects/blob/main/objects/facial-composite/definition.json) - An + object which describes a facial composite. - o legal-entity - An object to describe a legal entity. + * objects/fail2ban (https://github.com/MISP/misp- + objects/blob/main/objects/fail2ban/definition.json) - Fail2ban + event. - o lnk - LNK object describing a Windows LNK binary file (aka Windows - shortcut). - o macho - Object describing a file in Mach-O format. - o macho-section - Object describing a section of a file in Mach-O - format. - o mactime-timeline-analysis - Mactime template, used in forensic + + +Dulaunoy & Iklody Expires 25 May 2022 [Page 15] + +Internet-Draft MISP object template format November 2021 + + + * objects/favicon (https://github.com/MISP/misp- + objects/blob/main/objects/favicon/definition.json) - A favicon, + also known as a shortcut icon, website icon, tab icon, URL icon, + or bookmark icon, is a file containing one or more small icons, + associated with a particular website or web page. The object + template can include the murmur3 hash of the favicon to facilitate + correlation. + + * objects/file (https://github.com/MISP/misp- + objects/blob/main/objects/file/definition.json) - File object + describing a file with meta-information. + + * objects/forensic-case (https://github.com/MISP/misp- + objects/blob/main/objects/forensic-case/definition.json) - An + object template to describe a digital forensic case. + + * objects/forensic-evidence (https://github.com/MISP/misp- + objects/blob/main/objects/forensic-evidence/definition.json) - An + object template to describe a digital forensic evidence. + + * objects/forged-document (https://github.com/MISP/misp- + objects/blob/main/objects/forged-document/definition.json) - + Object describing a forged document. + + * objects/ftm-Airplane (https://github.com/MISP/misp- + objects/blob/main/objects/ftm-Airplane/definition.json) - . + + * objects/ftm-Assessment (https://github.com/MISP/misp- + objects/blob/main/objects/ftm-Assessment/definition.json) - . + + * objects/ftm-Asset (https://github.com/MISP/misp- + objects/blob/main/objects/ftm-Asset/definition.json) - . + + * objects/ftm-Associate (https://github.com/MISP/misp- + objects/blob/main/objects/ftm-Associate/definition.json) - Non- + family association between two people. + + * objects/ftm-Audio (https://github.com/MISP/misp- + objects/blob/main/objects/ftm-Audio/definition.json) - . + + * objects/ftm-BankAccount (https://github.com/MISP/misp- + objects/blob/main/objects/ftm-BankAccount/definition.json) - . + + * objects/ftm-Call (https://github.com/MISP/misp- + objects/blob/main/objects/ftm-Call/definition.json) - . + + * objects/ftm-Company (https://github.com/MISP/misp- + objects/blob/main/objects/ftm-Company/definition.json) - . + + + +Dulaunoy & Iklody Expires 25 May 2022 [Page 16] + +Internet-Draft MISP object template format November 2021 + + + * objects/ftm-Contract (https://github.com/MISP/misp- + objects/blob/main/objects/ftm-Contract/definition.json) - An + contract or contract lot issued by an authority. Multiple lots + may be awarded to different suppliers (see ContractAward). . + + * objects/ftm-ContractAward (https://github.com/MISP/misp- + objects/blob/main/objects/ftm-ContractAward/definition.json) - A + contract or contract lot as awarded to a supplier. + + * objects/ftm-CourtCase (https://github.com/MISP/misp- + objects/blob/main/objects/ftm-CourtCase/definition.json) - . + + * objects/ftm-CourtCaseParty (https://github.com/MISP/misp- + objects/blob/main/objects/ftm-CourtCaseParty/definition.json) - . + + * objects/ftm-Debt (https://github.com/MISP/misp- + objects/blob/main/objects/ftm-Debt/definition.json) - A monetary + debt between two parties. + + * objects/ftm-Directorship (https://github.com/MISP/misp- + objects/blob/main/objects/ftm-Directorship/definition.json) - . + + * objects/ftm-Document (https://github.com/MISP/misp- + objects/blob/main/objects/ftm-Document/definition.json) - . + + * objects/ftm-Documentation (https://github.com/MISP/misp- + objects/blob/main/objects/ftm-Documentation/definition.json) - . + + * objects/ftm-EconomicActivity (https://github.com/MISP/misp- + objects/blob/main/objects/ftm-EconomicActivity/definition.json) - + A foreign economic activity. + + * objects/ftm-Email (https://github.com/MISP/misp- + objects/blob/main/objects/ftm-Email/definition.json) - . + + * objects/ftm-Event (https://github.com/MISP/misp- + objects/blob/main/objects/ftm-Event/definition.json) - . + + * objects/ftm-Family (https://github.com/MISP/misp- + objects/blob/main/objects/ftm-Family/definition.json) - Family + relationship between two people. + + * objects/ftm-Folder (https://github.com/MISP/misp- + objects/blob/main/objects/ftm-Folder/definition.json) - . + + * objects/ftm-HyperText (https://github.com/MISP/misp- + objects/blob/main/objects/ftm-HyperText/definition.json) - . + + + + +Dulaunoy & Iklody Expires 25 May 2022 [Page 17] + +Internet-Draft MISP object template format November 2021 + + + * objects/ftm-Image (https://github.com/MISP/misp- + objects/blob/main/objects/ftm-Image/definition.json) - . + + * objects/ftm-Land (https://github.com/MISP/misp- + objects/blob/main/objects/ftm-Land/definition.json) - . + + * objects/ftm-LegalEntity (https://github.com/MISP/misp- + objects/blob/main/objects/ftm-LegalEntity/definition.json) - A + legal entity may be a person or a company. + + * objects/ftm-License (https://github.com/MISP/misp- + objects/blob/main/objects/ftm-License/definition.json) - A grant + of land, rights or property. A type of Contract. + + * objects/ftm-Membership (https://github.com/MISP/misp- + objects/blob/main/objects/ftm-Membership/definition.json) - . + + * objects/ftm-Message (https://github.com/MISP/misp- + objects/blob/main/objects/ftm-Message/definition.json) - . + + * objects/ftm-Organization (https://github.com/MISP/misp- + objects/blob/main/objects/ftm-Organization/definition.json) - . + + * objects/ftm-Ownership (https://github.com/MISP/misp- + objects/blob/main/objects/ftm-Ownership/definition.json) - . + + * objects/ftm-Package (https://github.com/MISP/misp- + objects/blob/main/objects/ftm-Package/definition.json) - . + + * objects/ftm-Page (https://github.com/MISP/misp- + objects/blob/main/objects/ftm-Page/definition.json) - . + + * objects/ftm-Pages (https://github.com/MISP/misp- + objects/blob/main/objects/ftm-Pages/definition.json) - . + + * objects/ftm-Passport (https://github.com/MISP/misp- + objects/blob/main/objects/ftm-Passport/definition.json) - + Passport. + + * objects/ftm-Payment (https://github.com/MISP/misp- + objects/blob/main/objects/ftm-Payment/definition.json) - A + monetary payment between two parties. + + * objects/ftm-Person (https://github.com/MISP/misp- + objects/blob/main/objects/ftm-Person/definition.json) - An + individual. + + + + + +Dulaunoy & Iklody Expires 25 May 2022 [Page 18] + +Internet-Draft MISP object template format November 2021 + + + * objects/ftm-PlainText (https://github.com/MISP/misp- + objects/blob/main/objects/ftm-PlainText/definition.json) - . + + * objects/ftm-PublicBody (https://github.com/MISP/misp- + objects/blob/main/objects/ftm-PublicBody/definition.json) - A + public body, such as a ministry, department or state company. + + * objects/ftm-RealEstate (https://github.com/MISP/misp- + objects/blob/main/objects/ftm-RealEstate/definition.json) - A + piece of land or property. + + * objects/ftm-Representation (https://github.com/MISP/misp- + objects/blob/main/objects/ftm-Representation/definition.json) - A + mediatory, intermediary, middleman, or broker acting on behalf of + a legal entity. + + * objects/ftm-Row (https://github.com/MISP/misp- + objects/blob/main/objects/ftm-Row/definition.json) - . + + * objects/ftm-Sanction (https://github.com/MISP/misp- + objects/blob/main/objects/ftm-Sanction/definition.json) - A + sanction designation. + + * objects/ftm-Succession (https://github.com/MISP/misp- + objects/blob/main/objects/ftm-Succession/definition.json) - Two + entities that legally succeed each other. + + * objects/ftm-Table (https://github.com/MISP/misp- + objects/blob/main/objects/ftm-Table/definition.json) - . + + * objects/ftm-TaxRoll (https://github.com/MISP/misp- + objects/blob/main/objects/ftm-TaxRoll/definition.json) - A tax + declaration of an individual. + + * objects/ftm-UnknownLink (https://github.com/MISP/misp- + objects/blob/main/objects/ftm-UnknownLink/definition.json) - . + + * objects/ftm-UserAccount (https://github.com/MISP/misp- + objects/blob/main/objects/ftm-UserAccount/definition.json) - . + + * objects/ftm-Vehicle (https://github.com/MISP/misp- + objects/blob/main/objects/ftm-Vehicle/definition.json) - . + + * objects/ftm-Vessel (https://github.com/MISP/misp- + objects/blob/main/objects/ftm-Vessel/definition.json) - A boat or + ship. + + + + + +Dulaunoy & Iklody Expires 25 May 2022 [Page 19] + +Internet-Draft MISP object template format November 2021 + + + * objects/ftm-Video (https://github.com/MISP/misp- + objects/blob/main/objects/ftm-Video/definition.json) - . + + * objects/ftm-Workbook (https://github.com/MISP/misp- + objects/blob/main/objects/ftm-Workbook/definition.json) - . + + * objects/geolocation (https://github.com/MISP/misp- + objects/blob/main/objects/geolocation/definition.json) - An object + to describe a geographic location. + + * objects/git-vuln-finder (https://github.com/MISP/misp- + objects/blob/main/objects/git-vuln-finder/definition.json) - + Export from git-vuln-finder. + + * objects/github-user (https://github.com/MISP/misp- + objects/blob/main/objects/github-user/definition.json) - GitHub + user. + + * objects/gitlab-user (https://github.com/MISP/misp- + objects/blob/main/objects/gitlab-user/definition.json) - GitLab + user. Gitlab.com user or self-hosted GitLab instance. + + * objects/gtp-attack (https://github.com/MISP/misp- + objects/blob/main/objects/gtp-attack/definition.json) - GTP attack + object as seen on a GSM, UMTS or LTE network. + + * objects/http-request (https://github.com/MISP/misp- + objects/blob/main/objects/http-request/definition.json) - A single + HTTP request header. + + * objects/ilr-impact (https://github.com/MISP/misp- + objects/blob/main/objects/ilr-impact/definition.json) - Institut + Luxembourgeois de Regulation - Impact. + + * objects/ilr-notification-incident (https://github.com/MISP/misp- + objects/blob/main/objects/ilr-notification-incident/ + definition.json) - Institut Luxembourgeois de Regulation - + Notification d'incident. + + * objects/image (https://github.com/MISP/misp- + objects/blob/main/objects/image/definition.json) - Object + describing an image file. + + * objects/impersonation (https://github.com/MISP/misp- + objects/blob/main/objects/impersonation/definition.json) - + Represent an impersonating account. + + + + + +Dulaunoy & Iklody Expires 25 May 2022 [Page 20] + +Internet-Draft MISP object template format November 2021 + + + * objects/imsi-catcher (https://github.com/MISP/misp- + objects/blob/main/objects/imsi-catcher/definition.json) - IMSI + Catcher entry object based on the open source IMSI cather. + + * objects/instant-message (https://github.com/MISP/misp- + objects/blob/main/objects/instant-message/definition.json) - + Instant Message (IM) object template describing one or more IM + message. + + * objects/instant-message-group (https://github.com/MISP/misp- + objects/blob/main/objects/instant-message-group/definition.json) - + Instant Message (IM) group object template describing a public or + private IM group, channel or conversation. + + * objects/intel471-vulnerability-intelligence + (https://github.com/MISP/misp-objects/blob/main/objects/intel471- + vulnerability-intelligence/definition.json) - Intel 471 + vulnerability intelligence object. + + * objects/intelmq_event (https://github.com/MISP/misp- + objects/blob/main/objects/intelmq_event/definition.json) - IntelMQ + Event. + + * objects/intelmq_report (https://github.com/MISP/misp- + objects/blob/main/objects/intelmq_report/definition.json) - + IntelMQ Report. + + * objects/internal-reference (https://github.com/MISP/misp- + objects/blob/main/objects/internal-reference/definition.json) - + Internal reference. + + * objects/interpol-notice (https://github.com/MISP/misp- + objects/blob/main/objects/interpol-notice/definition.json) - An + object which describes a Interpol notice. + + * objects/iot-device (https://github.com/MISP/misp- + objects/blob/main/objects/iot-device/definition.json) - An IoT + device. + + * objects/iot-firmware (https://github.com/MISP/misp- + objects/blob/main/objects/iot-firmware/definition.json) - A + firmware for an IoT device. + + * objects/ip-api-address (https://github.com/MISP/misp- + objects/blob/main/objects/ip-api-address/definition.json) - IP + Address information. Useful if you are pulling your ip + information from ip-api.com. + + + + +Dulaunoy & Iklody Expires 25 May 2022 [Page 21] + +Internet-Draft MISP object template format November 2021 + + + * objects/ip-port (https://github.com/MISP/misp- + objects/blob/main/objects/ip-port/definition.json) - An IP address + (or domain or hostname) and a port seen as a tuple (or as a + triple) in a specific time frame. + + * objects/irc (https://github.com/MISP/misp- + objects/blob/main/objects/irc/definition.json) - An IRC object to + describe an IRC server and the associated channels. + + * objects/ja3 (https://github.com/MISP/misp- + objects/blob/main/objects/ja3/definition.json) - JA3 is a new + technique for creating SSL client fingerprints that are easy to + produce and can be easily shared for threat intelligence. + Fingerprints are composed of Client Hello packet; SSL Version, + Accepted Ciphers, List of Extensions, Elliptic Curves, and + Elliptic Curve Formats. https://github.com/salesforce/ja3 + (https://github.com/salesforce/ja3). + + * objects/keybase-account (https://github.com/MISP/misp- + objects/blob/main/objects/keybase-account/definition.json) - + Information related to a keybase account, from API Users Object. + + * objects/leaked-document (https://github.com/MISP/misp- + objects/blob/main/objects/leaked-document/definition.json) - + Object describing a leaked document. + + * objects/legal-entity (https://github.com/MISP/misp- + objects/blob/main/objects/legal-entity/definition.json) - An + object to describe a legal entity. + + * objects/lnk (https://github.com/MISP/misp- + objects/blob/main/objects/lnk/definition.json) - LNK object + describing a Windows LNK binary file (aka Windows shortcut). + + * objects/macho (https://github.com/MISP/misp- + objects/blob/main/objects/macho/definition.json) - Object + describing a file in Mach-O format. + + * objects/macho-section (https://github.com/MISP/misp- + objects/blob/main/objects/macho-section/definition.json) - Object + describing a section of a file in Mach-O format. + + * objects/mactime-timeline-analysis (https://github.com/MISP/misp- + objects/blob/main/objects/mactime-timeline-analysis/ + definition.json) - Mactime template, used in forensic investigations to describe the timeline of a file activity. - o malware-config - Malware configuration recovered or extracted from - a malicious binary. - - o microblog - Microblog post like a Twitter tweet or a post on a - Facebook wall. -Dulaunoy & Iklody Expires October 12, 2018 [Page 13] + +Dulaunoy & Iklody Expires 25 May 2022 [Page 22] -Internet-Draft MISP object template format April 2018 +Internet-Draft MISP object template format November 2021 - o mutex - Object to describe mutual exclusion locks (mutex) as seen - in memory or computer program. + * objects/malware-config (https://github.com/MISP/misp- + objects/blob/main/objects/malware-config/definition.json) - + Malware configuration recovered or extracted from a malicious + binary. - o netflow - Netflow object describes an network object based on the - Netflowv5/v9 minimal definition. + * objects/meme-image (https://github.com/MISP/misp- + objects/blob/main/objects/meme-image/definition.json) - Object + describing a meme (image). - o network-connection - A local or remote network connection. + * objects/microblog (https://github.com/MISP/misp- + objects/blob/main/objects/microblog/definition.json) - Microblog + post like a Twitter tweet or a post on a Facebook wall. - o network-socket - Network socket object describes a local or remote - network connections based on the socket data structure. + * objects/mutex (https://github.com/MISP/misp- + objects/blob/main/objects/mutex/definition.json) - Object to + describe mutual exclusion locks (mutex) as seen in memory or + computer program. - o misc - An object which describes an organization. + * objects/narrative (https://github.com/MISP/misp- + objects/blob/main/objects/narrative/definition.json) - Object + describing a narrative. - o original-imported-file - Object describing the original file used - to import data in MISP. + * objects/netflow (https://github.com/MISP/misp- + objects/blob/main/objects/netflow/definition.json) - Netflow + object describes an network object based on the Netflowv5/v9 + minimal definition. - o passive-dns - Passive DNS records as expressed in draft-dulaunoy- - dnsop-passive-dns-cof-01. + * objects/network-connection (https://github.com/MISP/misp- + objects/blob/main/objects/network-connection/definition.json) - A + local or remote network connection. - o paste - Paste or similar post from a website allowing to share - privately or publicly posts. + * objects/network-socket (https://github.com/MISP/misp- + objects/blob/main/objects/network-socket/definition.json) - + Network socket object describes a local or remote network + connections based on the socket data structure. - o pcap-metadata - Network packet capture metadata. + * objects/news-agency (https://github.com/MISP/misp- + objects/blob/main/objects/news-agency/definition.json) - News + agencies compile news and disseminate news in bulk. - o pe - Object describing a Portable Executable. + * objects/news-media (https://github.com/MISP/misp- + objects/blob/main/objects/news-media/definition.json) - News media + are forms of mass media delivering news to the general public. - o pe-section - Object describing a section of a Portable Executable. - - o person - An object which describes a person or an identity. - - o phishing - Phishing template to describe a phishing website and - its analysis. - - o phishing-kit - Object to describe a phishing-kit. - - o phone - A phone or mobile phone object which describe a phone. - - o process - Object describing a system process. - - o python-etvx-event-log - Event log object template to share - information of the activities conducted on a system. . - - o r2graphity - Indicators extracted from files using radare2 and - graphml. - - o regexp - An object describing a regular expression (regex or - regexp). The object can be linked via a relationship to other + * objects/organization (https://github.com/MISP/misp- + objects/blob/main/objects/organization/definition.json) - An + object which describes an organization. -Dulaunoy & Iklody Expires October 12, 2018 [Page 14] +Dulaunoy & Iklody Expires 25 May 2022 [Page 23] -Internet-Draft MISP object template format April 2018 +Internet-Draft MISP object template format November 2021 - attributes or objects to describe how it can be represented as a - regular expression. + * objects/original-imported-file (https://github.com/MISP/misp- + objects/blob/main/objects/original-imported-file/definition.json) + - Object describing the original file used to import data in MISP. - o registry-key - Registry key object describing a Windows registry - key with value and last-modified timestamp. + * objects/parler-account (https://github.com/MISP/misp- + objects/blob/main/objects/parler-account/definition.json) - Parler + account. - o regripper-NTUser - Regripper Object template designed to present - user specific configuration details extracted from the NTUSER.dat - hive. + * objects/parler-comment (https://github.com/MISP/misp- + objects/blob/main/objects/parler-comment/definition.json) - Parler + comment. - o regripper-sam-hive-single-user - Regripper Object template - designed to present user profile details extracted from the SAM - hive. + * objects/parler-post (https://github.com/MISP/misp- + objects/blob/main/objects/parler-post/definition.json) - Parler + post (parley). - o regripper-sam-hive-user-group - Regripper Object template designed - to present group profile details extracted from the SAM hive. + * objects/passive-dns (https://github.com/MISP/misp- + objects/blob/main/objects/passive-dns/definition.json) - Passive + DNS records as expressed in draft-dulaunoy-dnsop-passive-dns-cof- + 01. - o regripper-software-hive-BHO - Regripper Object template designed - to gather information of the browser helper objects installed on - the system. + * objects/paste (https://github.com/MISP/misp- + objects/blob/main/objects/paste/definition.json) - Paste or + similar post from a website allowing to share privately or + publicly posts. - o regripper-software-hive-appInit-DLLS - Regripper Object template - designed to gather information of the DLL files installed on the - system. + * objects/pcap-metadata (https://github.com/MISP/misp- + objects/blob/main/objects/pcap-metadata/definition.json) - Network + packet capture metadata. - o regripper-software-hive-application-paths - Regripper Object - template designed to gather information of the application paths. + * objects/pe (https://github.com/MISP/misp- + objects/blob/main/objects/pe/definition.json) - Object describing + a Portable Executable. - o regripper-software-hive-applications-installed - Regripper Object - template designed to gather information of the applications + * objects/pe-section (https://github.com/MISP/misp- + objects/blob/main/objects/pe-section/definition.json) - Object + describing a section of a Portable Executable. + + * objects/person (https://github.com/MISP/misp- + objects/blob/main/objects/person/definition.json) - An object + which describes a person or an identity. + + * objects/pgp-meta (https://github.com/MISP/misp- + objects/blob/main/objects/pgp-meta/definition.json) - Metadata + extracted from a PGP keyblock, message or signature. + + + + + + +Dulaunoy & Iklody Expires 25 May 2022 [Page 24] + +Internet-Draft MISP object template format November 2021 + + + * objects/phishing (https://github.com/MISP/misp- + objects/blob/main/objects/phishing/definition.json) - Phishing + template to describe a phishing website and its analysis. + + * objects/phishing-kit (https://github.com/MISP/misp- + objects/blob/main/objects/phishing-kit/definition.json) - Object + to describe a phishing-kit. + + * objects/phone (https://github.com/MISP/misp- + objects/blob/main/objects/phone/definition.json) - A phone or + mobile phone object which describe a phone. + + * objects/process (https://github.com/MISP/misp- + objects/blob/main/objects/process/definition.json) - Object + describing a system process. + + * objects/publication (https://github.com/MISP/misp- + objects/blob/main/objects/publication/definition.json) - An object + to describe a book, journal, or academic publication. + + * objects/python-etvx-event-log (https://github.com/MISP/misp- + objects/blob/main/objects/python-etvx-event-log/definition.json) - + Event log object template to share information of the activities + conducted on a system. . + + * objects/r2graphity (https://github.com/MISP/misp- + objects/blob/main/objects/r2graphity/definition.json) - Indicators + extracted from files using radare2 and graphml. + + * objects/reddit-account (https://github.com/MISP/misp- + objects/blob/main/objects/reddit-account/definition.json) - Reddit + account. + + * objects/reddit-comment (https://github.com/MISP/misp- + objects/blob/main/objects/reddit-comment/definition.json) - A + Reddit post comment. + + * objects/reddit-post (https://github.com/MISP/misp- + objects/blob/main/objects/reddit-post/definition.json) - A Reddit + post. + + * objects/reddit-subreddit (https://github.com/MISP/misp- + objects/blob/main/objects/reddit-subreddit/definition.json) - + Public or private subreddit. + + + + + + + +Dulaunoy & Iklody Expires 25 May 2022 [Page 25] + +Internet-Draft MISP object template format November 2021 + + + * objects/regexp (https://github.com/MISP/misp- + objects/blob/main/objects/regexp/definition.json) - An object + describing a regular expression (regex or regexp). The object can + be linked via a relationship to other attributes or objects to + describe how it can be represented as a regular expression. + + * objects/registry-key (https://github.com/MISP/misp- + objects/blob/main/objects/registry-key/definition.json) - Registry + key object describing a Windows registry key with value and last- + modified timestamp. + + * objects/regripper-NTUser (https://github.com/MISP/misp- + objects/blob/main/objects/regripper-NTUser/definition.json) - + Regripper Object template designed to present user specific + configuration details extracted from the NTUSER.dat hive. + + * objects/regripper-sam-hive-single-user (https://github.com/MISP/ + misp-objects/blob/main/objects/regripper-sam-hive-single-user/ + definition.json) - Regripper Object template designed to present + user profile details extracted from the SAM hive. + + * objects/regripper-sam-hive-user-group (https://github.com/MISP/ + misp-objects/blob/main/objects/regripper-sam-hive-user-group/ + definition.json) - Regripper Object template designed to present + group profile details extracted from the SAM hive. + + * objects/regripper-software-hive-BHO (https://github.com/MISP/misp- + objects/blob/main/objects/regripper-software-hive-BHO/ + definition.json) - Regripper Object template designed to gather + information of the browser helper objects installed on the system. + + * objects/regripper-software-hive-appInit-DLLS + (https://github.com/MISP/misp-objects/blob/main/objects/regripper- + software-hive-appInit-DLLS/definition.json) - Regripper Object + template designed to gather information of the DLL files installed + on the system. + + * objects/regripper-software-hive-application-paths + (https://github.com/MISP/misp-objects/blob/main/objects/regripper- + software-hive-application-paths/definition.json) - Regripper + Object template designed to gather information of the application + paths. + + * objects/regripper-software-hive-applications-installed + (https://github.com/MISP/misp-objects/blob/main/objects/regripper- + software-hive-applications-installed/definition.json) - Regripper + Object template designed to gather information of the applications installed on the system. - o regripper-software-hive-command-shell - Regripper Object template - designed to gather information of the shell commands executed on - the system. - - o regripper-software-hive-windows-general-info - Regripper Object - template designed to gather general windows information extracted - from the software-hive. - - o regripper-software-hive-software-run - Regripper Object template - designed to gather information of the applications set to run on - the system. - - o regripper-software-hive-userprofile-winlogon - Regripper Object - template designed to gather user profile information when the user - logs onto the system, gathered from the software hive. - - -Dulaunoy & Iklody Expires October 12, 2018 [Page 15] +Dulaunoy & Iklody Expires 25 May 2022 [Page 26] -Internet-Draft MISP object template format April 2018 +Internet-Draft MISP object template format November 2021 - o regripper-system-hive-firewall-configuration - Regripper Object - template designed to present firewall configuration information + * objects/regripper-software-hive-command-shell + (https://github.com/MISP/misp-objects/blob/main/objects/regripper- + software-hive-command-shell/definition.json) - Regripper Object + template designed to gather information of the shell commands + executed on the system. + + * objects/regripper-software-hive-software-run + (https://github.com/MISP/misp-objects/blob/main/objects/regripper- + software-hive-software-run/definition.json) - Regripper Object + template designed to gather information of the applications set to + run on the system. + + * objects/regripper-software-hive-userprofile-winlogon + (https://github.com/MISP/misp-objects/blob/main/objects/regripper- + software-hive-userprofile-winlogon/definition.json) - Regripper + Object template designed to gather user profile information when + the user logs onto the system, gathered from the software hive. + + * objects/regripper-software-hive-windows-general-info + (https://github.com/MISP/misp-objects/blob/main/objects/regripper- + software-hive-windows-general-info/definition.json) - Regripper + Object template designed to gather general windows information + extracted from the software-hive. + + * objects/regripper-system-hive-firewall-configuration + (https://github.com/MISP/misp-objects/blob/main/objects/regripper- + system-hive-firewall-configuration/definition.json) - Regripper + Object template designed to present firewall configuration + information extracted from the system-hive. + + * objects/regripper-system-hive-general-configuration + (https://github.com/MISP/misp-objects/blob/main/objects/regripper- + system-hive-general-configuration/definition.json) - Regripper + Object template designed to present general system properties extracted from the system-hive. - o regripper-system-hive-general-configuration - Regripper Object - template designed to present general system properties extracted - from the system-hive. + * objects/regripper-system-hive-network-information + (https://github.com/MISP/misp-objects/blob/main/objects/regripper- + system-hive-network-information/definition.json) - Regripper + object template designed to gather network information from the + system-hive. - o regripper-system-hive-network-information. - Regripper object - template designed to gather network information from the system- - hive. + * objects/regripper-system-hive-services-drivers + (https://github.com/MISP/misp-objects/blob/main/objects/regripper- + system-hive-services-drivers/definition.json) - Regripper Object + template designed to gather information regarding the services/ + drivers from the system-hive. - o regripper-system-hive-services-drivers - Regripper Object template - designed to gather information regarding the services/drivers from - the system-hive. - o report - Metadata used to generate an executive level report. - o research-scanner - Information related to known scanning activity - (e.g. from research projects). - o rogue-dns - Rogue DNS as defined by CERT.br. +Dulaunoy & Iklody Expires 25 May 2022 [Page 27] + +Internet-Draft MISP object template format November 2021 - o rtir - RTIR - Request Tracker for Incident Response. - o sandbox-report - Sandbox report. + * objects/report (https://github.com/MISP/misp- + objects/blob/main/objects/report/definition.json) - Metadata used + to generate an executive level report. - o sb-signature - Sandbox detection signature. + * objects/research-scanner (https://github.com/MISP/misp- + objects/blob/main/objects/research-scanner/definition.json) - + Information related to known scanning activity (e.g. from research + projects). - o script - Object describing a computer program written to be run in - a special run-time environment. The script or shell script can be - used for malicious activities but also as support tools for threat + * objects/rogue-dns (https://github.com/MISP/misp- + objects/blob/main/objects/rogue-dns/definition.json) - Rogue DNS + as defined by CERT.br. + + * objects/rtir (https://github.com/MISP/misp- + objects/blob/main/objects/rtir/definition.json) - RTIR - Request + Tracker for Incident Response. + + * objects/sandbox-report (https://github.com/MISP/misp- + objects/blob/main/objects/sandbox-report/definition.json) - + Sandbox report. + + * objects/sb-signature (https://github.com/MISP/misp- + objects/blob/main/objects/sb-signature/definition.json) - Sandbox + detection signature. + + * objects/scheduled-event (https://github.com/MISP/misp- + objects/blob/main/objects/scheduled-event/definition.json) - Event + object template describing a gathering of individuals in + meatspace. + + * objects/scrippsco2-c13-daily (https://github.com/MISP/misp- + objects/blob/main/objects/scrippsco2-c13-daily/definition.json) - + Daily average C13 concentrations (ppm) derived from flask air + samples. + + * objects/scrippsco2-c13-monthly (https://github.com/MISP/misp- + objects/blob/main/objects/scrippsco2-c13-monthly/definition.json) + - Monthly average C13 concentrations (ppm) derived from flask air + samples. + + * objects/scrippsco2-co2-daily (https://github.com/MISP/misp- + objects/blob/main/objects/scrippsco2-co2-daily/definition.json) - + Daily average CO2 concentrations (ppm) derived from flask air + samples. + + + + + + + +Dulaunoy & Iklody Expires 25 May 2022 [Page 28] + +Internet-Draft MISP object template format November 2021 + + + * objects/scrippsco2-co2-monthly (https://github.com/MISP/misp- + objects/blob/main/objects/scrippsco2-co2-monthly/definition.json) + - Monthly average CO2 concentrations (ppm) derived from flask air + samples. + + * objects/scrippsco2-o18-daily (https://github.com/MISP/misp- + objects/blob/main/objects/scrippsco2-o18-daily/definition.json) - + Daily average O18 concentrations (ppm) derived from flask air + samples. + + * objects/scrippsco2-o18-monthly (https://github.com/MISP/misp- + objects/blob/main/objects/scrippsco2-o18-monthly/definition.json) + - Monthly average O18 concentrations (ppm) derived from flask air + samples. + + * objects/script (https://github.com/MISP/misp- + objects/blob/main/objects/script/definition.json) - Object + describing a computer program written to be run in a special run- + time environment. The script or shell script can be used for + malicious activities but also as support tools for threat analysts. - o shell-commands - Object describing a series of shell commands - executed. This object can be linked with malicious files in order - to describe a specific execution of shell commands. + * objects/shell-commands (https://github.com/MISP/misp- + objects/blob/main/objects/shell-commands/definition.json) - Object + describing a series of shell commands executed. This object can + be linked with malicious files in order to describe a specific + execution of shell commands. - o short-message-service - Short Message Service (SMS) object - template describing one or more SMS message. Restriction of the - initial format 3GPP 23.038 GSM character set doesn't apply. + * objects/shodan-report (https://github.com/MISP/misp- + objects/blob/main/objects/shodan-report/definition.json) - Shodan + Report for a given IP. - o shortened-link - Shortened link and its redirect target. + * objects/short-message-service (https://github.com/MISP/misp- + objects/blob/main/objects/short-message-service/definition.json) - + Short Message Service (SMS) object template describing one or more + SMS message. Restriction of the initial format 3GPP 23.038 GSM + character set doesn't apply. - o splunk - Splunk / Splunk ES object. + * objects/shortened-link (https://github.com/MISP/misp- + objects/blob/main/objects/shortened-link/definition.json) - + Shortened link and its redirect target. - o ss7-attack - SS7 object of an attack seen on a GSM, UMTS or LTE - network via SS7 logging. + * objects/social-media-group (https://github.com/MISP/misp- + objects/blob/main/objects/social-media-group/definition.json) - + Social media group object template describing a public or private + group or channel. -Dulaunoy & Iklody Expires October 12, 2018 [Page 16] + + +Dulaunoy & Iklody Expires 25 May 2022 [Page 29] -Internet-Draft MISP object template format April 2018 +Internet-Draft MISP object template format November 2021 - o ssh-authorized-keys - An object to store ssh authorized keys file. + * objects/splunk (https://github.com/MISP/misp- + objects/blob/main/objects/splunk/definition.json) - Splunk / + Splunk ES object. - o stix2-pattern - An object describing a STIX pattern. The object - can be linked via a relationship to other attributes or objects to - describe how it can be represented as a STIX pattern. + * objects/ss7-attack (https://github.com/MISP/misp- + objects/blob/main/objects/ss7-attack/definition.json) - SS7 object + of an attack seen on a GSM, UMTS or LTE network via SS7 logging. - o suricata - An object describing one or more Suricata rule(s) along - with version and contextual information. + * objects/ssh-authorized-keys (https://github.com/MISP/misp- + objects/blob/main/objects/ssh-authorized-keys/definition.json) - + An object to store ssh authorized keys file. - o target-system - Description about an targeted system, this could - potentially be a compromissed internal system. + * objects/stix2-pattern (https://github.com/MISP/misp- + objects/blob/main/objects/stix2-pattern/definition.json) - An + object describing a STIX pattern. The object can be linked via a + relationship to other attributes or objects to describe how it can + be represented as a STIX pattern. - o threatgrid-report - ThreatGrid report. + * objects/suricata (https://github.com/MISP/misp- + objects/blob/main/objects/suricata/definition.json) - An object + describing one or more Suricata rule(s) along with version and + contextual information. - o timecode - Timecode object to describe a start of video sequence - (e.g. CCTV evidence) and the end of the video sequence. + * objects/target-system (https://github.com/MISP/misp- + objects/blob/main/objects/target-system/definition.json) - + Description about an targeted system, this could potentially be a + compromissed internal system. - o timesketch-timeline - A timesketch timeline object based on - mandatory field in timesketch to describe a log entry. + * objects/threatgrid-report (https://github.com/MISP/misp- + objects/blob/main/objects/threatgrid-report/definition.json) - + ThreatGrid report. - o timesketch_message - A timesketch message entry. + * objects/timecode (https://github.com/MISP/misp- + objects/blob/main/objects/timecode/definition.json) - Timecode + object to describe a start of video sequence (e.g. CCTV evidence) + and the end of the video sequence. - o timestamp - A generic timestamp object to represent time including - first time and last time seen. Relationship will then define the - kind of time relationship. + * objects/timesketch-timeline (https://github.com/MISP/misp- + objects/blob/main/objects/timesketch-timeline/definition.json) - A + timesketch timeline object based on mandatory field in timesketch + to describe a log entry. - o tor-hiddenservice - Tor hidden service (onion service) object. - - o tor-node - Tor node (which protects your privacy on the internet - by hiding the connection between users Internet address and the - services used by the users) description which are part of the Tor - network at a time. - - o tracking-id - Analytics and tracking ID such as used in Google - Analytics or other analytic platform. - - o transaction - An object to describe a financial transaction. - - o url - url object describes an url along with its normalized field - (like extracted using faup parsing library) and its metadata. - - o vehicle - Vehicle object template to describe a vehicle - information and registration. - - o victim - Victim object describes the target of an attack or abuse. - - o virustotal-report - VirusTotal report. + * objects/timesketch_message (https://github.com/MISP/misp- + objects/blob/main/objects/timesketch_message/definition.json) - A + timesketch message entry. -Dulaunoy & Iklody Expires October 12, 2018 [Page 17] + + +Dulaunoy & Iklody Expires 25 May 2022 [Page 30] -Internet-Draft MISP object template format April 2018 +Internet-Draft MISP object template format November 2021 - o vulnerability - Vulnerability object describing a common - vulnerability enumeration which can describe published, - unpublished, under review or embargo vulnerability for software, - equipments or hardware. + * objects/timestamp (https://github.com/MISP/misp- + objects/blob/main/objects/timestamp/definition.json) - A generic + timestamp object to represent time including first time and last + time seen. Relationship will then define the kind of time + relationship. - o whois - Whois records information for a domain name or an IP - address. + * objects/tor-hiddenservice (https://github.com/MISP/misp- + objects/blob/main/objects/tor-hiddenservice/definition.json) - Tor + hidden service (onion service) object. - o x509 - x509 object describing a X.509 certificate. + * objects/tor-node (https://github.com/MISP/misp- + objects/blob/main/objects/tor-node/definition.json) - Tor node + (which protects your privacy on the internet by hiding the + connection between users Internet address and the services used by + the users) description which are part of the Tor network at a + time. - o yabin - yabin.py generates Yara rules from function prologs, for - matching and hunting binaries. ref: https://github.com/AlienVault- - OTX/yabin [3]. + * objects/tracking-id (https://github.com/MISP/misp- + objects/blob/main/objects/tracking-id/definition.json) - Analytics + and tracking ID such as used in Google Analytics or other analytic + platform. - o yara - An object describing a YARA rule along with its version. + * objects/transaction (https://github.com/MISP/misp- + objects/blob/main/objects/transaction/definition.json) - An object + to describe a financial transaction. + + * objects/translation (https://github.com/MISP/misp- + objects/blob/main/objects/translation/definition.json) - Used to + keep a text and its translation. + + * objects/trustar_report (https://github.com/MISP/misp- + objects/blob/main/objects/trustar_report/definition.json) - + TruStar Report. + + * objects/tsk-chats (https://github.com/MISP/misp- + objects/blob/main/objects/tsk-chats/definition.json) - An Object + Template to gather information from evidential or interesting + exchange of messages identified during a digital forensic + investigation. + + * objects/tsk-web-bookmark (https://github.com/MISP/misp- + objects/blob/main/objects/tsk-web-bookmark/definition.json) - An + Object Template to add evidential bookmarks identified during a + digital forensic investigation. + + + + + + + +Dulaunoy & Iklody Expires 25 May 2022 [Page 31] + +Internet-Draft MISP object template format November 2021 + + + * objects/tsk-web-cookie (https://github.com/MISP/misp- + objects/blob/main/objects/tsk-web-cookie/definition.json) - An + TSK-Autopsy Object Template to represent cookies identified during + a forensic investigation. + + * objects/tsk-web-downloads (https://github.com/MISP/misp- + objects/blob/main/objects/tsk-web-downloads/definition.json) - An + Object Template to add web-downloads. + + * objects/tsk-web-history (https://github.com/MISP/misp- + objects/blob/main/objects/tsk-web-history/definition.json) - An + Object Template to share web history information. + + * objects/tsk-web-search-query (https://github.com/MISP/misp- + objects/blob/main/objects/tsk-web-search-query/definition.json) - + An Object Template to share web search query information. + + * objects/twitter-account (https://github.com/MISP/misp- + objects/blob/main/objects/twitter-account/definition.json) - + Twitter account. + + * objects/twitter-list (https://github.com/MISP/misp- + objects/blob/main/objects/twitter-list/definition.json) - Twitter + list. + + * objects/twitter-post (https://github.com/MISP/misp- + objects/blob/main/objects/twitter-post/definition.json) - Twitter + post (tweet). + + * objects/url (https://github.com/MISP/misp- + objects/blob/main/objects/url/definition.json) - url object + describes an url along with its normalized field (like extracted + using faup parsing library) and its metadata. + + * objects/user-account (https://github.com/MISP/misp- + objects/blob/main/objects/user-account/definition.json) - . + + * objects/vehicle (https://github.com/MISP/misp- + objects/blob/main/objects/vehicle/definition.json) - Vehicle + object template to describe a vehicle information and + registration. + + * objects/victim (https://github.com/MISP/misp- + objects/blob/main/objects/victim/definition.json) - Victim object + describes the target of an attack or abuse. + + + + + + +Dulaunoy & Iklody Expires 25 May 2022 [Page 32] + +Internet-Draft MISP object template format November 2021 + + + * objects/virustotal-graph (https://github.com/MISP/misp- + objects/blob/main/objects/virustotal-graph/definition.json) - + VirusTotal graph. + + * objects/virustotal-report (https://github.com/MISP/misp- + objects/blob/main/objects/virustotal-report/definition.json) - + VirusTotal report. + + * objects/vulnerability (https://github.com/MISP/misp- + objects/blob/main/objects/vulnerability/definition.json) - + Vulnerability object describing a common vulnerability enumeration + which can describe published, unpublished, under review or embargo + vulnerability for software, equipments or hardware. + + * objects/weakness (https://github.com/MISP/misp- + objects/blob/main/objects/weakness/definition.json) - Weakness + object describing a common weakness enumeration which can describe + usable, incomplete, draft or deprecated weakness for software, + equipment of hardware. + + * objects/whois (https://github.com/MISP/misp- + objects/blob/main/objects/whois/definition.json) - Whois records + information for a domain name or an IP address. + + * objects/x509 (https://github.com/MISP/misp- + objects/blob/main/objects/x509/definition.json) - x509 object + describing a X.509 certificate. + + * objects/yabin (https://github.com/MISP/misp- + objects/blob/main/objects/yabin/definition.json) - yabin.py + generates Yara rules from function prologs, for matching and + hunting binaries. ref: https://github.com/AlienVault-OTX/yabin + (https://github.com/AlienVault-OTX/yabin). + + * objects/yara (https://github.com/MISP/misp- + objects/blob/main/objects/yara/definition.json) - An object + describing a YARA rule (or a YARA rule name) along with its + version. + + * objects/youtube-channel (https://github.com/MISP/misp- + objects/blob/main/objects/youtube-channel/definition.json) - A + YouTube channel. + + * objects/youtube-comment (https://github.com/MISP/misp- + objects/blob/main/objects/youtube-comment/definition.json) - A + YouTube video comment. + + + + + +Dulaunoy & Iklody Expires 25 May 2022 [Page 33] + +Internet-Draft MISP object template format November 2021 + + + * objects/youtube-playlist (https://github.com/MISP/misp- + objects/blob/main/objects/youtube-playlist/definition.json) - A + YouTube playlist. + + * objects/youtube-video (https://github.com/MISP/misp- + objects/blob/main/objects/youtube-video/definition.json) - A + YouTube video. 4. Acknowledgements The authors wish to thank all the MISP community who are supporting the creation of open standards in threat intelligence sharing. -5. References - -5.1. Normative References +5. Normative References [RFC2119] Bradner, S., "Key words for use in RFCs to Indicate Requirement Levels", BCP 14, RFC 2119, @@ -994,7 +1880,7 @@ Internet-Draft MISP object template format April 2018 DOI 10.17487/RFC8259, December 2017, . -5.2. Informative References +6. Informative References [MISP-O] Community, M., "MISP Objects - shared and common object templates", . @@ -1003,37 +1889,30 @@ Internet-Draft MISP object template format April 2018 community, M., "MISP objects directory", 2018, . - - -Dulaunoy & Iklody Expires October 12, 2018 [Page 18] - -Internet-Draft MISP object template format April 2018 - - -5.3. URIs - - [1] https://www.caida.org/tools/taxonomy/anonymization.xml - - [2] https://github.com/salesforce/ja3 - - [3] https://github.com/AlienVault-OTX/yabin - Authors' Addresses Alexandre Dulaunoy Computer Incident Response Center Luxembourg 16, bd d'Avranches - Luxembourg L-1611 + L-L-1611 Luxembourg Luxembourg Phone: +352 247 88444 + + + +Dulaunoy & Iklody Expires 25 May 2022 [Page 34] + +Internet-Draft MISP object template format November 2021 + + Email: alexandre.dulaunoy@circl.lu Andras Iklody Computer Incident Response Center Luxembourg 16, bd d'Avranches - Luxembourg L-1611 + L-L-1611 Luxembourg Luxembourg Phone: +352 247 88444 @@ -1061,4 +1940,21 @@ Authors' Addresses -Dulaunoy & Iklody Expires October 12, 2018 [Page 19] + + + + + + + + + + + + + + + + + +Dulaunoy & Iklody Expires 25 May 2022 [Page 35] diff --git a/rfc/misp-standard-taxonomy-format.html b/rfc/misp-standard-taxonomy-format.html index a8b99ee..d819b3c 100644 --- a/rfc/misp-standard-taxonomy-format.html +++ b/rfc/misp-standard-taxonomy-format.html @@ -1,550 +1,1436 @@ - + + + + + + +MISP taxonomy format + + + + + + + + + +*/ - - - - - - - - - - - - - - - - - - - - - - - +/* fonts */ +@import url('https://fonts.googleapis.com/css?family=Noto+Sans'); /* Sans-serif */ +@import url('https://fonts.googleapis.com/css?family=Noto+Serif'); /* Serif (print) */ +@import url('https://fonts.googleapis.com/css?family=Roboto+Mono'); /* Monospace */ + +@viewport { + zoom: 1.0; + width: extend-to-zoom; +} +@-ms-viewport { + width: extend-to-zoom; + zoom: 1.0; +} +/* general and mobile first */ +html { +} +body { + max-width: 90%; + margin: 1.5em auto; + color: #222; + background-color: #fff; + font-size: 14px; + font-family: 'Noto Sans', Arial, Helvetica, sans-serif; + line-height: 1.6; + scroll-behavior: smooth; +} +.ears { + display: none; +} + +/* headings */ +#title, h1, h2, h3, h4, h5, h6 { + margin: 1em 0 0.5em; + font-weight: bold; + line-height: 1.3; +} +#title { + clear: both; + border-bottom: 1px solid #ddd; + margin: 0 0 0.5em 0; + padding: 1em 0 0.5em; +} +.author { + padding-bottom: 4px; +} +h1 { + font-size: 26px; + margin: 1em 0; +} +h2 { + font-size: 22px; + margin-top: -20px; /* provide offset for in-page anchors */ + padding-top: 33px; +} +h3 { + font-size: 18px; + margin-top: -36px; /* provide offset for in-page anchors */ + padding-top: 42px; +} +h4 { + font-size: 16px; + margin-top: -36px; /* provide offset for in-page anchors */ + padding-top: 42px; +} +h5, h6 { + font-size: 14px; +} +#n-copyright-notice { + border-bottom: 1px solid #ddd; + padding-bottom: 1em; + margin-bottom: 1em; +} +/* general structure */ +p { + padding: 0; + margin: 0 0 1em 0; + text-align: left; +} +div, span { + position: relative; +} +div { + margin: 0; +} +.alignRight.art-text { + background-color: #f9f9f9; + border: 1px solid #eee; + border-radius: 3px; + padding: 1em 1em 0; + margin-bottom: 1.5em; +} +.alignRight.art-text pre { + padding: 0; +} +.alignRight { + margin: 1em 0; +} +.alignRight > *:first-child { + border: none; + margin: 0; + float: right; + clear: both; +} +.alignRight > *:nth-child(2) { + clear: both; + display: block; + border: none; +} +svg { + display: block; +} +.alignCenter.art-text { + background-color: #f9f9f9; + border: 1px solid #eee; + border-radius: 3px; + padding: 1em 1em 0; + margin-bottom: 1.5em; +} +.alignCenter.art-text pre { + padding: 0; +} +.alignCenter { + margin: 1em 0; +} +.alignCenter > *:first-child { + border: none; + /* this isn't optimal, but it's an existence proof. PrinceXML doesn't + support flexbox yet. + */ + display: table; + margin: 0 auto; +} + +/* lists */ +ol, ul { + padding: 0; + margin: 0 0 1em 2em; +} +ol ol, ul ul, ol ul, ul ol { + margin-left: 1em; +} +li { + margin: 0 0 0.25em 0; +} +.ulCompact li { + margin: 0; +} +ul.empty, .ulEmpty { + list-style-type: none; +} +ul.empty li, .ulEmpty li { + margin-top: 0.5em; +} +ul.ulBare, li.ulBare { + margin-left: 0em !important; +} +ul.compact, .ulCompact, +ol.compact, .olCompact { + line-height: 100%; + margin: 0 0 0 2em; +} + +/* definition lists */ +dl { +} +dl > dt { + float: left; + margin-right: 1em; +} +/* +dl.nohang > dt { + float: none; +} +*/ +dl > dd { + margin-bottom: .8em; + min-height: 1.3em; +} +dl.compact > dd, .dlCompact > dd { + margin-bottom: 0em; +} +dl > dd > dl { + margin-top: 0.5em; + margin-bottom: 0em; +} + +/* links */ +a { + text-decoration: none; +} +a[href] { + color: #22e; /* Arlen: WCAG 2019 */ +} +a[href]:hover { + background-color: #f2f2f2; +} +figcaption a[href], +a[href].selfRef { + color: #222; +} +/* XXX probably not this: +a.selfRef:hover { + background-color: transparent; + cursor: default; +} */ + +/* Figures */ +tt, code, pre, code { + background-color: #f9f9f9; + font-family: 'Roboto Mono', monospace; +} +pre { + border: 1px solid #eee; + margin: 0; + padding: 1em; +} +img { + max-width: 100%; +} +figure { + margin: 0; +} +figure blockquote { + margin: 0.8em 0.4em 0.4em; +} +figcaption { + font-style: italic; + margin: 0 0 1em 0; +} +@media screen { + pre { + overflow-x: auto; + max-width: 100%; + max-width: calc(100% - 22px); + } +} + +/* aside, blockquote */ +aside, blockquote { + margin-left: 0; + padding: 1.2em 2em; +} +blockquote { + background-color: #f9f9f9; + color: #111; /* Arlen: WCAG 2019 */ + border: 1px solid #ddd; + border-radius: 3px; + margin: 1em 0; +} +cite { + display: block; + text-align: right; + font-style: italic; +} + +/* tables */ +table { + width: 100%; + margin: 0 0 1em; + border-collapse: collapse; + border: 1px solid #eee; +} +th, td { + text-align: left; + vertical-align: top; + padding: 0.5em 0.75em; +} +th { + text-align: left; + background-color: #e9e9e9; +} +tr:nth-child(2n+1) > td { + background-color: #f5f5f5; +} +table caption { + font-style: italic; + margin: 0; + padding: 0; + text-align: left; +} +table p { + /* XXX to avoid bottom margin on table row signifiers. If paragraphs should + be allowed within tables more generally, it would be far better to select on a class. */ + margin: 0; +} + +/* pilcrow */ +a.pilcrow { + color: #666; /* Arlen: AHDJ 2019 */ + text-decoration: none; + visibility: hidden; + user-select: none; + -ms-user-select: none; + -o-user-select:none; + -moz-user-select: none; + -khtml-user-select: none; + -webkit-user-select: none; + -webkit-touch-callout: none; +} +@media screen { + aside:hover > a.pilcrow, + p:hover > a.pilcrow, + blockquote:hover > a.pilcrow, + div:hover > a.pilcrow, + li:hover > a.pilcrow, + pre:hover > a.pilcrow { + visibility: visible; + } + a.pilcrow:hover { + background-color: transparent; + } +} + +/* misc */ +hr { + border: 0; + border-top: 1px solid #eee; +} +.bcp14 { + font-variant: small-caps; +} + +.role { + font-variant: all-small-caps; +} + +/* info block */ +#identifiers { + margin: 0; + font-size: 0.9em; +} +#identifiers dt { + width: 3em; + clear: left; +} +#identifiers dd { + float: left; + margin-bottom: 0; +} +#identifiers .authors .author { + display: inline-block; + margin-right: 1.5em; +} +#identifiers .authors .org { + font-style: italic; +} + +/* The prepared/rendered info at the very bottom of the page */ +.docInfo { + color: #666; /* Arlen: WCAG 2019 */ + font-size: 0.9em; + font-style: italic; + margin-top: 2em; +} +.docInfo .prepared { + float: left; +} +.docInfo .prepared { + float: right; +} + +/* table of contents */ +#toc { + padding: 0.75em 0 2em 0; + margin-bottom: 1em; +} +nav.toc ul { + margin: 0 0.5em 0 0; + padding: 0; + list-style: none; +} +nav.toc li { + line-height: 1.3em; + margin: 0.75em 0; + padding-left: 1.2em; + text-indent: -1.2em; +} +/* references */ +.references dt { + text-align: right; + font-weight: bold; + min-width: 7em; +} +.references dd { + margin-left: 8em; + overflow: auto; +} + +.refInstance { + margin-bottom: 1.25em; +} + +.references .ascii { + margin-bottom: 0.25em; +} + +/* index */ +.index ul { + margin: 0 0 0 1em; + padding: 0; + list-style: none; +} +.index ul ul { + margin: 0; +} +.index li { + margin: 0; + text-indent: -2em; + padding-left: 2em; + padding-bottom: 5px; +} +.indexIndex { + margin: 0.5em 0 1em; +} +.index a { + font-weight: 700; +} +/* make the index two-column on all but the smallest screens */ +@media (min-width: 600px) { + .index ul { + -moz-column-count: 2; + -moz-column-gap: 20px; + } + .index ul ul { + -moz-column-count: 1; + -moz-column-gap: 0; + } +} + +/* authors */ +address.vcard { + font-style: normal; + margin: 1em 0; +} + +address.vcard .nameRole { + font-weight: 700; + margin-left: 0; +} +address.vcard .label { + font-family: "Noto Sans",Arial,Helvetica,sans-serif; + margin: 0.5em 0; +} +address.vcard .type { + display: none; +} +.alternative-contact { + margin: 1.5em 0 1em; +} +hr.addr { + border-top: 1px dashed; + margin: 0; + color: #ddd; + max-width: calc(100% - 16px); +} + +/* temporary notes */ +.rfcEditorRemove::before { + position: absolute; + top: 0.2em; + right: 0.2em; + padding: 0.2em; + content: "The RFC Editor will remove this note"; + color: #9e2a00; /* Arlen: WCAG 2019 */ + background-color: #ffd; /* Arlen: WCAG 2019 */ +} +.rfcEditorRemove { + position: relative; + padding-top: 1.8em; + background-color: #ffd; /* Arlen: WCAG 2019 */ + border-radius: 3px; +} +.cref { + background-color: #ffd; /* Arlen: WCAG 2019 */ + padding: 2px 4px; +} +.crefSource { + font-style: italic; +} +/* alternative layout for smaller screens */ +@media screen and (max-width: 1023px) { + body { + padding-top: 2em; + } + #title { + padding: 1em 0; + } + h1 { + font-size: 24px; + } + h2 { + font-size: 20px; + margin-top: -18px; /* provide offset for in-page anchors */ + padding-top: 38px; + } + #identifiers dd { + max-width: 60%; + } + #toc { + position: fixed; + z-index: 2; + top: 0; + right: 0; + padding: 0; + margin: 0; + background-color: inherit; + border-bottom: 1px solid #ccc; + } + #toc h2 { + margin: -1px 0 0 0; + padding: 4px 0 4px 6px; + padding-right: 1em; + min-width: 190px; + font-size: 1.1em; + text-align: right; + background-color: #444; + color: white; + cursor: pointer; + } + #toc h2::before { /* css hamburger */ + float: right; + position: relative; + width: 1em; + height: 1px; + left: -164px; + margin: 6px 0 0 0; + background: white none repeat scroll 0 0; + box-shadow: 0 4px 0 0 white, 0 8px 0 0 white; + content: ""; + } + #toc nav { + display: none; + padding: 0.5em 1em 1em; + overflow: auto; + height: calc(100vh - 48px); + border-left: 1px solid #ddd; + } +} + +/* alternative layout for wide screens */ +@media screen and (min-width: 1024px) { + body { + max-width: 724px; + margin: 42px auto; + padding-left: 1.5em; + padding-right: 29em; + } + #toc { + position: fixed; + top: 42px; + right: 42px; + width: 25%; + margin: 0; + padding: 0 1em; + z-index: 1; + } + #toc h2 { + border-top: none; + border-bottom: 1px solid #ddd; + font-size: 1em; + font-weight: normal; + margin: 0; + padding: 0.25em 1em 1em 0; + } + #toc nav { + display: block; + height: calc(90vh - 84px); + bottom: 0; + padding: 0.5em 0 0; + overflow: auto; + } + img { /* future proofing */ + max-width: 100%; + height: auto; + } +} + +/* pagination */ +@media print { + body { + + width: 100%; + } + p { + orphans: 3; + widows: 3; + } + #n-copyright-notice { + border-bottom: none; + } + #toc, #n-introduction { + page-break-before: always; + } + #toc { + border-top: none; + padding-top: 0; + } + figure, pre { + page-break-inside: avoid; + } + figure { + overflow: scroll; + } + h1, h2, h3, h4, h5, h6 { + page-break-after: avoid; + } + h2+*, h3+*, h4+*, h5+*, h6+* { + page-break-before: avoid; + } + pre { + white-space: pre-wrap; + word-wrap: break-word; + font-size: 10pt; + } + table { + border: 1px solid #ddd; + } + td { + border-top: 1px solid #ddd; + } +} + +/* This is commented out here, as the string-set: doesn't + pass W3C validation currently */ +/* +.ears thead .left { + string-set: ears-top-left content(); +} + +.ears thead .center { + string-set: ears-top-center content(); +} + +.ears thead .right { + string-set: ears-top-right content(); +} + +.ears tfoot .left { + string-set: ears-bottom-left content(); +} + +.ears tfoot .center { + string-set: ears-bottom-center content(); +} + +.ears tfoot .right { + string-set: ears-bottom-right content(); +} +*/ + +@page :first { + padding-top: 0; + @top-left { + content: normal; + border: none; + } + @top-center { + content: normal; + border: none; + } + @top-right { + content: normal; + border: none; + } +} + +@page { + size: A4; + margin-bottom: 45mm; + padding-top: 20px; + /* The follwing is commented out here, but set appropriately by in code, as + the content depends on the document */ + /* + @top-left { + content: 'Internet-Draft'; + vertical-align: bottom; + border-bottom: solid 1px #ccc; + } + @top-left { + content: string(ears-top-left); + vertical-align: bottom; + border-bottom: solid 1px #ccc; + } + @top-center { + content: string(ears-top-center); + vertical-align: bottom; + border-bottom: solid 1px #ccc; + } + @top-right { + content: string(ears-top-right); + vertical-align: bottom; + border-bottom: solid 1px #ccc; + } + @bottom-left { + content: string(ears-bottom-left); + vertical-align: top; + border-top: solid 1px #ccc; + } + @bottom-center { + content: string(ears-bottom-center); + vertical-align: top; + border-top: solid 1px #ccc; + } + @bottom-right { + content: '[Page ' counter(page) ']'; + vertical-align: top; + border-top: solid 1px #ccc; + } + */ + +} + +/* Changes introduced to fix issues found during implementation */ +/* Make sure links are clickable even if overlapped by following H* */ +a { + z-index: 2; +} +/* Separate body from document info even without intervening H1 */ +section { + clear: both; +} - - +/* Top align author divs, to avoid names without organization dropping level with org names */ +.author { + vertical-align: top; +} - - - - - +/* Leave room in document info to show Internet-Draft on one line */ +#identifiers dt { + width: 8em; +} +/* Don't waste quite as much whitespace between label and value in doc info */ +#identifiers dd { + margin-left: 1em; +} + +/* Give floating toc a background color (needed when it's a div inside section */ +#toc { + background-color: white; +} + +/* Make the collapsed ToC header render white on gray also when it's a link */ +@media screen and (max-width: 1023px) { + #toc h2 a, + #toc h2 a:link, + #toc h2 a:focus, + #toc h2 a:hover, + #toc a.toplink, + #toc a.toplink:hover { + color: white; + background-color: #444; + text-decoration: none; + } +} + +/* Give the bottom of the ToC some whitespace */ +@media screen and (min-width: 1024px) { + #toc { + padding: 0 0 1em 1em; + } +} + +/* Style section numbers with more space between number and title */ +.section-number { + padding-right: 0.5em; +} + +/* prevent monospace from becoming overly large */ +tt, code, pre, code { + font-size: 95%; +} + +/* Fix the height/width aspect for ascii art*/ +pre.sourcecode, +.art-text pre { + line-height: 1.12; +} + + +/* Add styling for a link in the ToC that points to the top of the document */ +a.toplink { + float: right; + margin-right: 0.5em; +} + +/* Fix the dl styling to match the RFC 7992 attributes */ +dl > dt, +dl.dlParallel > dt { + float: left; + margin-right: 1em; +} +dl.dlNewline > dt { + float: none; +} + +/* Provide styling for table cell text alignment */ +table td.text-left, +table th.text-left { + text-align: left; +} +table td.text-center, +table th.text-center { + text-align: center; +} +table td.text-right, +table th.text-right { + text-align: right; +} + +/* Make the alternative author contact informatio look less like just another + author, and group it closer with the primary author contact information */ +.alternative-contact { + margin: 0.5em 0 0.25em 0; +} +address .non-ascii { + margin: 0 0 0 2em; +} + +/* With it being possible to set tables with alignment + left, center, and right, { width: 100%; } does not make sense */ +table { + width: auto; +} + +/* Avoid reference text that sits in a block with very wide left margin, + because of a long floating dt label.*/ +.references dd { + overflow: visible; +} + +/* Control caption placement */ +caption { + caption-side: bottom; +} + +/* Limit the width of the author address vcard, so names in right-to-left + script don't end up on the other side of the page. */ + +address.vcard { + max-width: 30em; + margin-right: auto; +} + +/* For address alignment dependent on LTR or RTL scripts */ +address div.left { + text-align: left; +} +address div.right { + text-align: right; +} + +/* Provide table alignment support. We can't use the alignX classes above + since they do unwanted things with caption and other styling. */ +table.right { + margin-left: auto; + margin-right: 0; +} +table.center { + margin-left: auto; + margin-right: auto; +} +table.left { + margin-left: 0; + margin-right: auto; +} + +/* Give the table caption label the same styling as the figcaption */ +caption a[href] { + color: #222; +} + +@media print { + .toplink { + display: none; + } + + /* avoid overwriting the top border line with the ToC header */ + #toc { + padding-top: 1px; + } + + /* Avoid page breaks inside dl and author address entries */ + .vcard { + page-break-inside: avoid; + } + +} +/* Tweak the bcp14 keyword presentation */ +.bcp14 { + font-variant: small-caps; + font-weight: bold; + font-size: 0.9em; +} +/* Tweak the invisible space above H* in order not to overlay links in text above */ + h2 { + margin-top: -18px; /* provide offset for in-page anchors */ + padding-top: 31px; + } + h3 { + margin-top: -18px; /* provide offset for in-page anchors */ + padding-top: 24px; + } + h4 { + margin-top: -18px; /* provide offset for in-page anchors */ + padding-top: 24px; + } +/* Float artwork pilcrow to the right */ +@media screen { + .artwork a.pilcrow { + display: block; + line-height: 0.7; + margin-top: 0.15em; + } +} +/* Make pilcrows on dd visible */ +@media screen { + dd:hover > a.pilcrow { + visibility: visible; + } +} +/* Make the placement of figcaption match that of a table's caption + by removing the figure's added bottom margin */ +.alignLeft.art-text, +.alignCenter.art-text, +.alignRight.art-text { + margin-bottom: 0; +} +.alignLeft, +.alignCenter, +.alignRight { + margin: 1em 0 0 0; +} +/* In print, the pilcrow won't show on hover, so prevent it from taking up space, + possibly even requiring a new line */ +@media print { + a.pilcrow { + display: none; + } +} +/* Styling for the external metadata */ +div#external-metadata { + background-color: #eee; + padding: 0.5em; + margin-bottom: 0.5em; + display: none; +} +div#internal-metadata { + padding: 0.5em; /* to match the external-metadata padding */ +} +/* Styling for title RFC Number */ +h1#rfcnum { + clear: both; + margin: 0 0 -1em; + padding: 1em 0 0 0; +} +/* Make .olPercent look the same as
        1. */ +dl.olPercent > dd { + margin-bottom: 0.25em; + min-height: initial; +} +/* Give aside some styling to set it apart */ +aside { + border-left: 1px solid #ddd; + margin: 1em 0 1em 2em; + padding: 0.2em 2em; +} +aside > dl, +aside > ol, +aside > ul, +aside > table, +aside > p { + margin-bottom: 0.5em; +} +/* Additional page break settings */ +@media print { + figcaption, table caption { + page-break-before: avoid; + } +} +/* Font size adjustments for print */ +@media print { + body { font-size: 10pt; line-height: normal; max-width: 96%; } + h1 { font-size: 1.72em; padding-top: 1.5em; } /* 1*1.2*1.2*1.2 */ + h2 { font-size: 1.44em; padding-top: 1.5em; } /* 1*1.2*1.2 */ + h3 { font-size: 1.2em; padding-top: 1.5em; } /* 1*1.2 */ + h4 { font-size: 1em; padding-top: 1.5em; } + h5, h6 { font-size: 1em; margin: initial; padding: 0.5em 0 0.3em; } +} +/* Sourcecode margin in print, when there's no pilcrow */ +@media print { + .artwork, + .sourcecode { + margin-bottom: 1em; + } +} +/* Avoid narrow tables forcing too narrow table captions, which may render badly */ +table { + min-width: 20em; +} +/* ol type a */ +ol.type-a { list-style-type: lower-alpha; } +ol.type-A { list-style-type: upper-alpha; } +ol.type-i { list-style-type: lower-roman; } +ol.type-I { list-style-type: lower-roman; } +/* Apply the print table and row borders in general, on request from the RPC, +and increase the contrast between border and odd row background sligthtly */ +table { + border: 1px solid #ddd; +} +td { + border-top: 1px solid #ddd; +} +tr:nth-child(2n+1) > td { + background-color: #f8f8f8; +} +/* Use style rules to govern display of the TOC. */ +@media screen and (max-width: 1023px) { + #toc nav { display: none; } + #toc.active nav { display: block; } +} +/* Add support for keepWithNext */ +.keepWithNext { + break-after: avoid-page; + break-after: avoid-page; +} +/* Add support for keepWithPrevious */ +.keepWithPrevious { + break-before: avoid-page; +} +/* Change the approach to avoiding breaks inside artwork etc. */ +figure, pre, table, .artwork, .sourcecode { + break-before: avoid-page; + break-after: auto; +} +/* Avoid breaks between
          and
          */ +dl { + break-before: auto; + break-inside: auto; +} +dt { + break-before: auto; + break-after: avoid-page; +} +dd { + break-before: avoid-page; + break-after: auto; + orphans: 3; + widows: 3 +} +span.break, dd.break { + margin-bottom: 0; + min-height: 0; + break-before: auto; + break-inside: auto; + break-after: auto; +} +/* Undo break-before ToC */ +@media print { + #toc { + break-before: auto; + } +} +/* Text in compact lists should not get extra bottim margin space, + since that would makes the list not compact */ +ul.compact p, .ulCompact p, +ol.compact p, .olCompact p { + margin: 0; +} +/* But the list as a whole needs the extra space at the end */ +section ul.compact, +section .ulCompact, +section ol.compact, +section .olCompact { + margin-bottom: 1em; /* same as p not within ul.compact etc. */ +} +/* The tt and code background above interferes with for instance table cell + backgrounds. Changed to something a bit more selective. */ +tt, code { + background-color: transparent; +} +p tt, p code, li tt, li code { + background-color: #f8f8f8; +} +/* Tweak the pre margin -- 0px doesn't come out well */ +pre { + margin-top: 0.5px; +} +/* Tweak the comact list text */ +ul.compact, .ulCompact, +ol.compact, .olCompact, +dl.compact, .dlCompact { + line-height: normal; +} +/* Don't add top margin for nested lists */ +li > ul, li > ol, li > dl, +dd > ul, dd > ol, dd > dl, +dl > dd > dl { + margin-top: initial; +} +/* Elements that should not be rendered on the same line as a
          */ +/* This should match the element list in writer.text.TextWriter.render_dl() */ +dd > div.artwork:first-child, +dd > aside:first-child, +dd > figure:first-child, +dd > ol:first-child, +dd > div:first-child > pre.sourcecode, +dd > table:first-child, +dd > ul:first-child { + clear: left; +} +/* fix for weird browser behaviour when
          is empty */ +dt+dd:empty::before{ + content: "\00a0"; +} +/* Make paragraph spacing inside
        2. smaller than in body text, to fit better within the list */ +li > p { + margin-bottom: 0.5em +} +/* Don't let p margin spill out from inside list items */ +li > p:last-of-type { + margin-bottom: 0; +} + + + - - - - - - - - - - + +
          Network Working GroupA. Dulaunoy
          + - - - - - - - - - - - - - -
          Internet-DraftA. Iklody
          Expires: June 2, 2018CIRCL
          November 29, 2017
          - -

          MISP taxonomy format
          -

          - -

          Abstract

          -

          This document describes the MISP taxonomy format which describes a simple JSON format to represent machine tags (also called triple tags) vocabularies. A public directory of common vocabularies called MISP taxonomies is available and relies on the MISP taxonomy format. MISP taxonomies are used to classify cyber security events, threats, suspicious events, or indicators.

          -

          Status of This Memo

          -

          This Internet-Draft is submitted in full conformance with the provisions of BCP 78 and BCP 79.

          -

          Internet-Drafts are working documents of the Internet Engineering Task Force (IETF). Note that other groups may also distribute working documents as Internet-Drafts. The list of current Internet-Drafts is at https://datatracker.ietf.org/drafts/current/.

          -

          Internet-Drafts are draft documents valid for a maximum of six months and may be updated, replaced, or obsoleted by other documents at any time. It is inappropriate to use Internet-Drafts as reference material or to cite them other than as "work in progress."

          -

          This Internet-Draft will expire on June 2, 2018.

          -

          Copyright Notice

          -

          Copyright (c) 2017 IETF Trust and the persons identified as the document authors. All rights reserved.

          -

          This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (https://trustee.ietf.org/license-info) in effect on the date of publication of this document. Please review these documents carefully, as they describe your rights and restrictions with respect to this document. Code Components extracted from this document must include Simplified BSD License text as described in Section 4.e of the Trust Legal Provisions and are provided without warranty as described in the Simplified BSD License.

          - - -
          -

          Table of Contents

          - + + + +
          +
          +

          +1. Introduction +

          +

          Sharing threat information became a fundamental requirements on the Internet, security and intelligence community at large. Threat +information can include indicators of compromise, malicious file indicators, financial fraud indicators +or even detailed information about a threat actor. While sharing such indicators or information, classification plays an important role +to ensure adequate distribution, understanding, validation or action of the shared information. MISP taxonomies is a public repository +of known vocabularies that can be used in threat information sharing.

          +

          Machine tags were introduced in 2007 [machine-tags] to allow users to be more precise when tagging their pictures with geolocation. +So a machine tag is a tag which uses a special syntax to provide more information to users and machines. Machine tags are also known +as triple tags due to their format.

          +

          In the MISP taxonomy context, machine tags help analysts to classify their cybersecurity events, indicators or threats. MISP taxonomies can be used for classification, filtering, triggering actions or visualisation depending on their use in threat intelligence platforms such as MISP [MISP-P].

          +
          +
          +

          +1.1. Conventions and Terminology +

          +

          The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", +"SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this +document are to be interpreted as described in RFC 2119 [RFC2119].

          +
          +
          +
          +
          +
          +
          +

          +2. Format +

          +

          A machine tag is composed of a namespace (MUST), a predicate (MUST) and an optional value (OPTIONAL).

          +

          Machine tags are represented as a string. Below listed are a set of sample machine tags for different namespaces such as tlp, admiralty-scale and osint.

          +
          tlp:amber
 admiralty-scale:information-credibility="1"
 osint:source-type="blog-post"
-
          -

          The MISP taxonomy format describes how to define a machine tag namespace in a parseable format. The objective is to provide a simple format to describe machine tag (aka triple tag) vocabularies.

          -

          -2.1. Overview -

          -

          The MISP taxonomy format uses the JSON [RFC8259] format. Each namespace is represented as a JSON object with meta information including the following fields: namespace, description, version, type.

          -

          namespace defines the overall namespace of the machine tag. The namespace is represented as a string and MUST be present. The description is represented as a string and MUST be present. A version is represented as a unsigned integer MUST be present. A type defines where a specific taxonomy is applicable and a type can be applicable at event, user or org level. The type is represented as an array containing one or more type and SHOULD be present. If a type is not mentioned, by default, the taxonomy is applicable at event level only. An exclusive boolean property MAY be present and defines at namespace level if the predicates are mutually exclusive.

          -

          predicates defines all the predicates available in the namespace defined. predicates is represented as an array of JSON objects. predicates MUST be present and MUST at least content one element.

          -

          values defines all the values for each predicate in the namespace defined. values SHOULD be present.

          -

          -2.2. predicates -

          -

          The predicates array contains one or more JSON objects which lists all the possible predicates. The JSON object contains two fields: value and expanded. value MUST be present. expanded SHOULD be present. value is represented as a string and describes the predicate value. The predicate value MUST not contain spaces or colons. expanded is represented as a string and describes the human-readable version of the predicate value. An exclusive property MAY be present and defines at namespace level if the values are mutually exclusive.

          -

          -2.3. values -

          -

          The values array contain one or more JSON objects which lists all the possible values of a predicate. The JSON object contains two fields: predicate and entry. predicate is represented as a string and describes the predicate value. entry is an array with one or more JSON objects. The JSON object contains two fields: value and expanded. value MUST be present. expanded SHOULD be present. value is represented as a string and describes the machine parsable value. expanded is represented as a string and describes the human-readable version of the value.

          -

          -2.4. optional fields -

          -

          -2.4.1. colour -

          -

          colour fields MAY be used at predicates or values level to set a specify colour that MAY be used by the implementation. The colour field is described as an RGB colour fill in hexadecimal representation.

          -

          Example use of the colour field in the Traffic Light Protocol (TLP):

          + +
          +

          The MISP taxonomy format describes how to define a machine tag namespace in a parseable format. The objective is to provide a simple format +to describe machine tag (aka triple tag) vocabularies.

          +
          +
          +

          +2.1. Overview +

          +

          The MISP taxonomy format uses the JSON [RFC8259] format. Each namespace is represented as a JSON object with meta information including the following fields: namespace, description, version, type.

          +

          namespace defines the overall namespace of the machine tag. The namespace is represented as a string and MUST be present. The description is represented as a string and MUST be present. A version is represented as a unsigned integer MUST be present. A type defines where a specific taxonomy is applicable and a type can be applicable at event, user or org level. The type is represented as an array containing one or more type and SHOULD be present. If a type is not mentioned, by default, the taxonomy is applicable at event level only. An exclusive boolean property MAY be present and defines at namespace level if the predicates are mutually exclusive.

          +

          predicates defines all the predicates available in the namespace defined. predicates is represented as an array of JSON objects. predicates MUST be present and MUST at least content one element.

          +

          values defines all the values for each predicate in the namespace defined. values SHOULD be present.

          +
          +
          +
          +
          +

          +2.2. predicates +

          +

          The predicates array contains one or more JSON objects which lists all the possible predicates. The JSON object contains two fields: value and expanded. value MUST be present. expanded SHOULD be present. value is represented as a string and describes the predicate value. The predicate value MUST not contain spaces or colons. expanded is represented as a string and describes the human-readable version of the predicate value. An exclusive property MAY be present and defines at namespace level if the values are mutually exclusive.

          +
          +
          +
          +
          +

          +2.3. values +

          +

          The values array contain one or more JSON objects which lists all the possible values of a predicate. The JSON object contains two fields: predicate and entry. predicate is represented as a string and describes the predicate value. entry is an array with one or more JSON objects. The JSON object contains two fields: value and expanded. value MUST be present. expanded SHOULD be present. value is represented as a string and describes the machine parsable value. expanded is represented as a string and describes the human-readable version of the value.

          +
          +
          +
          +
          +

          +2.4. optional fields +

          +
          +
          +

          +2.4.1. colour +

          +

          colour fields MAY be used at predicates or values level to set a specify colour that MAY be used by the implementation. The colour field is described as an RGB colour fill in hexadecimal representation.

          +

          Example use of the colour field in the Traffic Light Protocol (TLP):

          +
          "predicates": [
     {
       "colour": "#CC0033",
@@ -560,17 +1446,29 @@ osint:source-type="blog-post"
                    the organization to be effectively acted upon.",
       "value": "amber"
     }...]
-
          -

          -2.4.2. description -

          -

          description fields MAY be used at predicates or values level to add a descriptive and human-readable information about the specific predicate or value. The field is represented as a string. Implementations MAY use the description field to improve more contextual information. The description at the namespace level is a MUST as described above.

          -

          -2.4.3. numerical_value -

          -

          numerical_value fields MAY be used at a predicate or value level to add a machine-readable numeric value to a specific predicate or value. The field is represented as a JSON number. Implementations SHOULD use the decimal value provided to support scoring or filtering.

          -

          The decimal range for numerical_value SHOULD use a range from 0 up to 100. The range is recommended to support common mathematical properties among taxonomies.

          -

          Example use of the numerical_value in the MISP confidence level:

          + +
          +
          +
          +
          +
          +

          +2.4.2. description +

          +

          description fields MAY be used at predicates or values level to add a descriptive and human-readable information about the specific predicate or value. The field is represented as a string. Implementations MAY use the description field to improve more contextual information. The description at the namespace level is a MUST as described above.

          +
          +
          +
          +
          +

          +2.4.3. numerical_value +

          +

          numerical_value fields MAY be used at a predicate or value level to add a machine-readable numeric value to a specific predicate or value. +The field is represented as a JSON number. Implementations SHOULD use the decimal value provided to support scoring or filtering.

          +

          The decimal range for numerical_value SHOULD use a range from 0 up to 100. The range is recommended to support common mathematical properties +among taxonomies.

          +

          Example use of the numerical_value in the MISP confidence level:

          +
              {
      "predicate": "confidence-level",
      "entry": [
@@ -605,15 +1503,31 @@ osint:source-type="blog-post"
         }
      ]
      }
-
          -

          -3. Directory -

          -

          The MISP taxonomies directory is publicly available [MISP-T] in a git repository. The repository contains a directory per namespace then a file machinetag.json which contains the taxonomy as described in the format above. In the root of the repository, a MANIFEST.json exists containing a list of all the taxonomies.

          -

          The MANIFEST.json file is composed of an JSON object with metadata like version, license, description, url and path. A taxonomies array describes the taxonomy available with the description, name and version field.

          -

          -3.1. Sample Manifest -

          + +
          +
          +
          +
          +
          +
          +
          +
          +
          +

          +3. Directory +

          +

          The MISP taxonomies directory is publicly available [MISP-T] in a git repository. The repository +contains a directory per namespace then a file machinetag.json which contains the taxonomy as +described in the format above. In the root of the repository, a MANIFEST.json exists containing +a list of all the taxonomies.

          +

          The MANIFEST.json file is composed of an JSON object with metadata like version, license, description, url and path. +A taxonomies array describes the taxonomy available with the description, name and version field.

          +
          +
          +

          +3.1. Sample Manifest +

          +
          {
   "version": "20161009",
   "license": "CC-0",
@@ -635,13 +1549,23 @@ osint:source-type="blog-post"
       "version": 2
     }]
 }
-
          -

          -4. Sample Taxonomy in MISP taxonomy format -

          -

          -4.1. Admiralty Scale Taxonomy -

          + +
          +
          +
          +
          +
          +
          +
          +

          +4. Sample Taxonomy in MISP taxonomy format +

          +
          +
          +

          +4.1. Admiralty Scale Taxonomy +

          +
            "namespace": "admiralty-scale",
   "description": "The Admiralty Scale (also called the NATO System)
                   is used to rank the reliability of a source and
@@ -718,10 +1642,16 @@ osint:source-type="blog-post"
     }
   ]
 }
-
          -

          -4.2. Open Source Intelligence - Classification -

          + +
          +
          +
          +
          +
          +

          +4.2. Open Source Intelligence - Classification +

          +
          {
   "values": [
     {
@@ -845,296 +1775,391 @@ osint:source-type="blog-post"
   ]
 }
 
-
          -

          -4.3. Available taxonomies in the public directory -

          -

          The public directory of MISP taxonomies [MISP-T] contains a variety of taxonomy in various fields such as:

          -

          - -
          -
          CERT-XLM:
          -
          -
          CERT-XLM Security Incident Classification.
          -
          DML:
          -
          -
          The Detection Maturity Level (DML) model is a capability maturity model for referencing ones maturity in detecting cyber attacks. It's designed for organizations who perform intel-driven detection and response and who put an emphasis on having a mature detection program.
          -
          PAP:
          -
          -
          The Permissible Actions Protocol - or short: PAP - was designed to indicate how the received information can be used.
          -
          access-method:
          -
          -
          The access method used to remotely access a system.
          -
          accessnow:
          -
          -
          Access Now classification to classify an issue (such as security, human rights, youth rights).
          -
          action-taken:
          -
          -
          Action taken in the case of a security incident (CSIRT perspective).
          -
          admiralty-scale:
          -
          -
          The Admiralty Scale (also called the NATO System) is used to rank the reliability of a source and the credibility of an information.
          -
          adversary:
          -
          -
          An overview and description of the adversary infrastructure.
          -
          ais-marking:
          -
          -
          AIS Marking Schema implementation is maintained by the National Cybersecurity and Communication Integration Center (NCCIC) of the U.S. Department of Homeland Security (DHS)
          -
          analyst-assessment:
          -
          -
          A series of assessment predicates describing the analyst capabilities to perform analysis. These assessment can be assigned by the analyst him/herself or by another party evaluating the analyst.
          -
          approved-category-of-action:
          -
          -
          A pre-approved category of action for indicators being shared with partners (MIMIC).
          -
          binary-class:
          -
          -
          Custom taxonomy for types of binary file.
          -
          cccs:
          -
          -
          Internal taxonomy for CCCS.
          -
          circl:
          -
          -
          CIRCL Taxonomy is a simple scheme for incident classification and area topic where the incident took place.
          -
          collaborative-intelligence:
          -
          -
          Collaborative intelligence support language is a common language to support analysts to perform their analysis to get crowdsourced support when using threat intelligence sharing platform like MISP.
          -
          common-taxonomy:
          -
          -
          The Common Taxonomy for Law Enforcement and The National Network of CSIRTs bridges the gap between the CSIRTs and international Law Enforcement communities by adding a legislative framework to facilitate the harmonisation of incident reporting to competent authorities, the development of useful statistics and sharing information within the entire cybercrime ecosystem.
          -
          copine-scale:
          -
          -
          The COPINE Scale is a rating system created in Ireland and used in the United Kingdom to categorise the severity of images of child sex abuse.
          -
          cryptocurrency-threat:
          -
          -
          Threats targetting cryptocurrency, based on CipherTrace report.
          -
          csirtcaseclassification:
          -
          -
          FIRST CSIRT Case Classification.
          -
          cssa:
          -
          -
          The CSSA agreed sharing taxonomy.
          -
          cyber-threat-framework:
          -
          -
          Cyber Threat Framework was developed by the US Government to enable consistent characterization and categorization of cyber threat events, and to identify trends or changes in the activities of cyber adversaries. https://www.dni.gov/index.php/cyber-threat-framework + +
          +
          +
          +
          +
          +

          +4.3. Available taxonomies in the public directory +

          +

          The public directory of MISP taxonomies [MISP-T] contains a variety of taxonomy in various fields such as:

          +
          +
          CERT-XLM:
          +
          CERT-XLM Security Incident Classification.
          -
          data-classification:
          -
          -
          Data classification for data potentially at risk of exfiltration based on table 2.1 of Solving Cyber Risk book.
          -
          dcso-sharing:
          -
          -
          DCSO Sharing Taxonomy to classify certain types of MISP events using the DCSO Event Guide
          -
          ddos:
          -
          -
          Distributed Denial of Service - or short: DDoS - taxonomy supports the description of Denial of Service attacks and especially the types they belong too.
          -
          de-vs:
          -
          -
          Taxonomy for the handling of protectively marked information in MISP with German (DE) Government classification markings (VS)
          -
          dhs-ciip-sectors:
          -
          -
          DHS critical sectors as described in https://www.dhs.gov/critical-infrastructure-sectors.
          -
          diamond-model:
          -
          -
          The Diamond Model for Intrusion Analysis, a phase-based model developed by Lockheed Martin, aims to help categorise and identify the stage of an attack.
          -
          dni-ism:
          -
          -
          ISM (Information Security Marking Metadata) V13 as described by DNI.gov (Director of National Intelligence - US).
          -
          domain-abuse:
          -
          -
          Taxonomy to tag domain names used for cybercrime.
          -
          drugs:
          -
          -
          A taxonomy based on the superclass and class of drugs, based on https://www.drugbank.ca/releases/latest +
          +
          DML:
          +
          The Detection Maturity Level (DML) model is a capability maturity model for referencing ones maturity in detecting cyber attacks. It's designed for organizations who perform intel-driven detection and response and who put an emphasis on having a mature detection program.
          -
          economical-impact:
          -
          -
          Economical impact is a taxonomy to describe the financial impact as positive or negative gain to the tagged information.
          -
          ecsirt:
          -
          -
          eCSIRT incident classification Appendix C of the eCSIRT EU project including IntelMQ updates.
          -
          enisa:
          -
          -
          ENISA Threat Taxonomy - A tool for structuring threat information as published in https://www.enisa.europa.eu/topics/threat-risk-management/threats-and-trends/enisa-threat-landscape/etl2015/enisa-threat-taxonomy-a-tool-for-structuring-threat-information +
          +
          PAP:
          +
          The Permissible Actions Protocol - or short: PAP - was designed to indicate how the received information can be used.
          -
          estimative-language:
          -
          -
          Estimative language - including likelihood or probability of event based on the Intelligence Community Directive 203 (ICD 203) (6.2.(a)) and JP 2-0, Joint Intelligence.
          -
          eu-marketop-and-publicadmin:
          -
          -
          Market operators and public administrations that must comply to some notifications requirements under EU NIS directive.
          -
          eu-nis-sector-and-subsectors:
          -
          -
          Sectors and sub sectors as identified by the NIS Directive.
          -
          euci:
          -
          -
          EU classified information (EUCI) means any information or material designated by a EU security classification, the unauthorised disclosure of which could cause varying degrees of prejudice to the interests of the European Union or of one or more of the Member States as described in COUNCIL DECISION of 23 September 2013 on the security rules for protecting EU classified information
          -
          europol-event:
          -
          -
          EUROPOL type of events taxonomy.
          -
          europol-incident:
          -
          -
          EUROPOL class of incident taxonomy.
          -
          event-assessment:
          -
          -
          A series of assessment predicates describing the event assessment performed to make judgement(s) under a certain level of uncertainty.
          -
          event-classification:
          -
          -
          Event Classification.
          -
          exercise:
          -
          -
          Exercise is a taxonomy to describe if the information is part of one or more cyber or crisis exercise.
          -
          false-positive:
          -
          -
          This taxonomy aims to ballpark the expected amount of false positives.
          -
          file-type:
          -
          -
          List of known file types.
          -
          flesch-reading-ease:
          -
          -
          Flesch Reading Ease is a revised system for determining the comprehension difficulty of written material. The scoring of the flesh score can have a maximum of 121.22 and there is no limit on how low a score can be (negative score are valid).
          -
          fpf:
          -
          -
          The Future of Privacy Forum (FPF) visual guide to practical de-identification taxonomy is used to evaluate the degree of identifiability of personal data and the types of pseudonymous data, de-identified data and anonymous data. The work of FPF is licensed under a creative commons attribution 4.0 international license.
          -
          fr-classif:
          -
          -
          French gov information classification system.
          -
          gdpr:
          -
          -
          Taxonomy related to the REGULATION (EU) 2016/679 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation)
          -
          gsma-attack-category:
          -
          -
          Taxonomy used by GSMA for their information sharing program with telco describing the attack categories
          -
          gsma-fraud:
          -
          -
          Taxonomy used by GSMA for their information sharing program with telco describing the various aspects of fraud
          -
          gsma-network-technology:
          -
          -
          Taxonomy used by GSMA for their information sharing program with telco describing the types of infrastructure. WiP
          -
          honeypot-basic:
          -
          -
          Christian Seifert, Ian Welch, Peter Komisarczuk, ‘Taxonomy of Honeypots’, Technical Report CS-TR-06/12, VICTORIA UNIVERSITY OF WELLINGTON, School of Mathematical and Computing Sciences, June 2006, http://www.mcs.vuw.ac.nz/comp/Publications/archive/CS-TR-06/CS-TR-06-12.pdf +
          +
          access-method:
          +
          The access method used to remotely access a system.
          -
          iep:
          -
          -
          Forum of Incident Response and Security Teams (FIRST) Information Exchange Policy (IEP) framework.
          -
          ifx-vetting:
          -
          -
          The IFX taxonomy is used to categorise information (MISP events and attributes) to aid in the intelligence vetting process
          -
          incident-disposition:
          -
          -
          How an incident is classified in its process to be resolved. The taxonomy is inspired from NASA Incident Response and Management Handbook.
          -
          infoleak:
          -
          -
          A taxonomy describing information leaks and especially information classified as being potentially leaked.
          -
          information-security-data-source:
          -
          -
          Taxonomy to classify the information security data sources
          -
          information-security-indicators:
          -
          -
          Information security indicators have been standardized by the ETSI Industrial Specification Group (ISG) ISI. These indicators provide the basis to switch from a qualitative to a quantitative culture in IT Security Scope of measurements: External and internal threats (attempt and success), user's deviant behaviours, nonconformities and/or vulnerabilities (software, configuration, behavioural, general security framework). ETSI GS ISI 001-1 (V1.1.2): ISI Indicators
          -
          interception-method:
          -
          -
          The interception method used to intercept traffic.
          -
          kill-chain:
          -
          -
          Cyber Kill Chain from Lockheed Martin as described in Intelligence-Driven Computer Network Defense Informed by Analysis of Adversary Campaigns and Intrusion Kill Chains.
          -
          maec-delivery-vectors:
          -
          -
          Vectors used to deliver malware based on MAEC 5.0
          -
          maec-malware-behavior:
          -
          -
          Malware behaviours based on MAEC 5.0
          -
          maec-malware-capabilities:
          -
          -
          Malware Capabilities based on MAEC 5.0
          -
          maec-malware-obfuscation-methods:
          -
          -
          Obfuscation methods used by malware based on MAEC 5.0
          -
          malware_classification:
          -
          -
          Malware classification based on a SANS whitepaper about malware.
          -
          misp:
          -
          -
          Internal MISP taxonomy.
          -
          monarc-threat:
          -
          -
          MONARC threat taxonomy.
          -
          ms-caro-malware:
          -
          -
          Malware Type and Platform classification based on Microsoft's implementation of the Computer Antivirus Research Organization (CARO) Naming Scheme and Malware Terminology.
          -
          ms-caro-malware-full:
          -
          -
          Malware Type and Platform classification based on Microsoft's implementation of the Computer Antivirus Research Organization (CARO) Naming Scheme and Malware Terminology.
          -
          nato:
          -
          -
          Marking of Classified and Unclassified materials as described by the North Atlantic Treaty Organization, NATO.
          -
          nis:
          -
          -
          NIS Cybersecurity Incident Taxonomy.
          -
          open_threat:
          -
          -
          Open Threat Taxonomy v1.1 base on James Tarala of SANS ref. - http://www.auditscripts.com/resources/open_threat_taxonomy_v1.1a.pdf +
          +
          accessnow:
          +
          Access Now classification to classify an issue (such as security, human rights, youth rights).
          -
          osint:
          -
          -
          Open Source Intelligence - Classification (MISP taxonomies).
          -
          passivetotal:
          -
          -
          Tags for RiskIQ's passivetotal service
          -
          pentest:
          -
          -
          Penetration test (pentest) classification.
          -
          priority-level:
          -
          -
          After an incident is scored, it is assigned a priority level. The six levels listed below are aligned with NCCIC, DHS, and the CISS to help provide a common lexicon when discussing incidents. This priority assignment drives NCCIC urgency, pre-approved incident response offerings, reporting requirements, and recommendations for leadership escalation. Generally, incident priority distribution should follow a similar pattern to the graph below. Based on https://www.us-cert.gov/NCCIC-Cyber-Incident-Scoring-System.
          -
          rsit:
          -
          -
          Reference Security Incident Classification Taxonomy.
          -
          rteventstatus:
          -
          -
          Status of events used in Request Tracker.
          -
          runtime-packer:
          -
          -
          Runtime or software packer used to combine compressed data with the decompression code. The decompression code can add additional obfuscations mechanisms including polymorphic-packer or other obfuscation techniques. This taxonomy lists all the known or official packer used for legitimate use or for packing malicious binaries.
          -
          smart-airports-threats:
          -
          -
          Threat taxonomy in the scope of securing smart airports by ENISA.
          -
          stealth_malware:
          -
          -
          Classification based on malware stealth techniques.
          -
          stix-ttp:
          -
          -
          Representation of the behavior or modus operandi of cyber adversaries (a.k.a TTP) as normalized in STIX
          -
          targeted-threat-index:
          -
          -
          The Targeted Threat Index is a metric for assigning an overall threat ranking score to email messages that deliver malware to a victim’s computer. The TTI metric was first introduced at SecTor 2013 by Seth Hardy as part of the talk “RATastrophe: Monitoring a Malware Menagerie” along with Katie Kleemola and Greg Wiseman.
          -
          tlp:
          -
          -
          The Traffic Light Protocol - or short: TLP - was designed with the objective to create a favorable classification scheme for sharing sensitive information while keeping the control over its distribution at the same time. Extended with TLP:EX:CHR.
          -
          tor:
          -
          -
          Taxonomy to describe Tor network infrastructure
          -
          type:
          -
          -
          Taxonomy to describe different types of intelligence gathering discipline which can be described the origin of intelligence.
          -
          use-case-applicability:
          -
          -
          The Use Case Applicability categories reflect standard resolution categories, to clearly display alerting rule configuration problems.
          -
          veris:
          -
          -
          Vocabulary for Event Recording and Incident Sharing (VERIS).
          -
          vocabulaire-des-probabilites-estimatives:
          -
          -
          Vocabulaire des probabilités estimatives
          -
          workflow:
          -
          -
          Workflow support language is a common language to support intelligence analysts to perform their analysis on data and information.
          +
          +
          action-taken:
          +
          Action taken in the case of a security incident (CSIRT perspective). +
          +
          +
          admiralty-scale:
          +
          The Admiralty Scale (also called the NATO System) is used to rank the reliability of a source and the credibility of an information. +
          +
          +
          adversary:
          +
          An overview and description of the adversary infrastructure. +
          +
          +
          ais-marking:
          +
          AIS Marking Schema implementation is maintained by the National Cybersecurity and Communication Integration Center (NCCIC) of the U.S. Department of Homeland Security (DHS) +
          +
          +
          analyst-assessment:
          +
          A series of assessment predicates describing the analyst capabilities to perform analysis. These assessment can be assigned by the analyst him/herself or by another party evaluating the analyst. +
          +
          +
          approved-category-of-action:
          +
          A pre-approved category of action for indicators being shared with partners (MIMIC). +
          +
          +
          binary-class:
          +
          Custom taxonomy for types of binary file. +
          +
          +
          cccs:
          +
          Internal taxonomy for CCCS. +
          +
          +
          circl:
          +
          CIRCL Taxonomy is a simple scheme for incident classification and area topic where the incident took place. +
          +
          +
          collaborative-intelligence:
          +
          Collaborative intelligence support language is a common language to support analysts to perform their analysis to get crowdsourced support when using threat intelligence sharing platform like MISP. +
          +
          +
          common-taxonomy:
          +
          The Common Taxonomy for Law Enforcement and The National Network of CSIRTs bridges the gap between the CSIRTs and international Law Enforcement communities by adding a legislative framework to facilitate the harmonisation of incident reporting to competent authorities, the development of useful statistics and sharing information within the entire cybercrime ecosystem. +
          +
          +
          copine-scale:
          +
          The COPINE Scale is a rating system created in Ireland and used in the United Kingdom to categorise the severity of images of child sex abuse. +
          +
          +
          cryptocurrency-threat:
          +
          Threats targetting cryptocurrency, based on CipherTrace report. +
          +
          +
          csirtcaseclassification:
          +
          FIRST CSIRT Case Classification. +
          +
          +
          cssa:
          +
          The CSSA agreed sharing taxonomy. +
          +
          +
          cyber-threat-framework:
          +
          Cyber Threat Framework was developed by the US Government to enable consistent characterization and categorization of cyber threat events, and to identify trends or changes in the activities of cyber adversaries. https://www.dni.gov/index.php/cyber-threat-framework +
          +
          +
          data-classification:
          +
          Data classification for data potentially at risk of exfiltration based on table 2.1 of Solving Cyber Risk book. +
          +
          +
          dcso-sharing:
          +
          DCSO Sharing Taxonomy to classify certain types of MISP events using the DCSO Event Guide +
          +
          +
          ddos:
          +
          Distributed Denial of Service - or short: DDoS - taxonomy supports the description of Denial of Service attacks and especially the types they belong too. +
          +
          +
          de-vs:
          +
          Taxonomy for the handling of protectively marked information in MISP with German (DE) Government classification markings (VS) +
          +
          +
          dhs-ciip-sectors:
          +
          DHS critical sectors as described in https://www.dhs.gov/critical-infrastructure-sectors. +
          +
          +
          diamond-model:
          +
          The Diamond Model for Intrusion Analysis, a phase-based model developed by Lockheed Martin, aims to help categorise and identify the stage of an attack. +
          +
          +
          dni-ism:
          +
          ISM (Information Security Marking Metadata) V13 as described by DNI.gov (Director of National Intelligence - US). +
          +
          +
          domain-abuse:
          +
          Taxonomy to tag domain names used for cybercrime. +
          +
          +
          drugs:
          +
          A taxonomy based on the superclass and class of drugs, based on https://www.drugbank.ca/releases/latest +
          +
          +
          economical-impact:
          +
          Economical impact is a taxonomy to describe the financial impact as positive or negative gain to the tagged information. +
          +
          +
          ecsirt:
          +
          eCSIRT incident classification Appendix C of the eCSIRT EU project including IntelMQ updates. +
          +
          +
          enisa:
          +
          ENISA Threat Taxonomy - A tool for structuring threat information as published in https://www.enisa.europa.eu/topics/threat-risk-management/threats-and-trends/enisa-threat-landscape/etl2015/enisa-threat-taxonomy-a-tool-for-structuring-threat-information +
          +
          +
          estimative-language:
          +
          Estimative language - including likelihood or probability of event based on the Intelligence Community Directive 203 (ICD 203) (6.2.(a)) and JP 2-0, Joint Intelligence. +
          +
          +
          eu-marketop-and-publicadmin:
          +
          Market operators and public administrations that must comply to some notifications requirements under EU NIS directive. +
          +
          +
          eu-nis-sector-and-subsectors:
          +
          Sectors and sub sectors as identified by the NIS Directive. +
          +
          +
          euci:
          +
          EU classified information (EUCI) means any information or material designated by a EU security classification, the unauthorised disclosure of which could cause varying degrees of prejudice to the interests of the European Union or of one or more of the Member States as described in COUNCIL DECISION of 23 September 2013 on the security rules for protecting EU classified information +
          +
          +
          europol-event:
          +
          EUROPOL type of events taxonomy. +
          +
          +
          europol-incident:
          +
          EUROPOL class of incident taxonomy. +
          +
          +
          event-assessment:
          +
          A series of assessment predicates describing the event assessment performed to make judgement(s) under a certain level of uncertainty. +
          +
          +
          event-classification:
          +
          Event Classification. +
          +
          +
          exercise:
          +
          Exercise is a taxonomy to describe if the information is part of one or more cyber or crisis exercise. +
          +
          +
          false-positive:
          +
          This taxonomy aims to ballpark the expected amount of false positives. +
          +
          +
          file-type:
          +
          List of known file types. +
          +
          +
          flesch-reading-ease:
          +
          Flesch Reading Ease is a revised system for determining the comprehension difficulty of written material. The scoring of the flesh score can have a maximum of 121.22 and there is no limit on how low a score can be (negative score are valid). +
          +
          +
          fpf:
          +
          The Future of Privacy Forum (FPF) visual guide to practical de-identification taxonomy is used to evaluate the degree of identifiability of personal data and the types of pseudonymous data, de-identified data and anonymous data. The work of FPF is licensed under a creative commons attribution 4.0 international license. +
          +
          +
          fr-classif:
          +
          French gov information classification system. +
          +
          +
          gdpr:
          +
          Taxonomy related to the REGULATION (EU) 2016/679 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) +
          +
          +
          gsma-attack-category:
          +
          Taxonomy used by GSMA for their information sharing program with telco describing the attack categories +
          +
          +
          gsma-fraud:
          +
          Taxonomy used by GSMA for their information sharing program with telco describing the various aspects of fraud +
          +
          +
          gsma-network-technology:
          +
          Taxonomy used by GSMA for their information sharing program with telco describing the types of infrastructure. WiP +
          +
          +
          honeypot-basic:
          +
          Christian Seifert, Ian Welch, Peter Komisarczuk, ‘ (U+2018)Taxonomy of Honeypots’ (U+2019), Technical Report CS-TR-06/12, VICTORIA UNIVERSITY OF WELLINGTON, School of Mathematical and Computing Sciences, June 2006, http://www.mcs.vuw.ac.nz/comp/Publications/archive/CS-TR-06/CS-TR-06-12.pdf +
          +
          +
          iep:
          +
          Forum of Incident Response and Security Teams (FIRST) Information Exchange Policy (IEP) framework. +
          +
          +
          ifx-vetting:
          +
          The IFX taxonomy is used to categorise information (MISP events and attributes) to aid in the intelligence vetting process +
          +
          +
          incident-disposition:
          +
          How an incident is classified in its process to be resolved. The taxonomy is inspired from NASA Incident Response and Management Handbook. +
          +
          +
          infoleak:
          +
          A taxonomy describing information leaks and especially information classified as being potentially leaked. +
          +
          +
          information-security-data-source:
          +
          Taxonomy to classify the information security data sources +
          +
          +
          information-security-indicators:
          +
          Information security indicators have been standardized by the ETSI Industrial Specification Group (ISG) ISI. These indicators provide the basis to switch from a qualitative to a quantitative culture in IT Security Scope of measurements: External and internal threats (attempt and success), user's deviant behaviours, nonconformities and/or vulnerabilities (software, configuration, behavioural, general security framework). ETSI GS ISI 001-1 (V1.1.2): ISI Indicators +
          +
          +
          interception-method:
          +
          The interception method used to intercept traffic. +
          +
          +
          kill-chain:
          +
          Cyber Kill Chain from Lockheed Martin as described in Intelligence-Driven Computer Network Defense Informed by Analysis of Adversary Campaigns and Intrusion Kill Chains. +
          +
          +
          maec-delivery-vectors:
          +
          Vectors used to deliver malware based on MAEC 5.0 +
          +
          +
          maec-malware-behavior:
          +
          Malware behaviours based on MAEC 5.0 +
          +
          +
          maec-malware-capabilities:
          +
          Malware Capabilities based on MAEC 5.0 +
          +
          +
          maec-malware-obfuscation-methods:
          +
          Obfuscation methods used by malware based on MAEC 5.0 +
          +
          +
          malware_classification:
          +
          Malware classification based on a SANS whitepaper about malware. +
          +
          +
          misp:
          +
          Internal MISP taxonomy. +
          +
          +
          monarc-threat:
          +
          MONARC threat taxonomy. +
          +
          +
          ms-caro-malware:
          +
          Malware Type and Platform classification based on Microsoft's implementation of the Computer Antivirus Research Organization (CARO) Naming Scheme and Malware Terminology. +
          +
          +
          ms-caro-malware-full:
          +
          Malware Type and Platform classification based on Microsoft's implementation of the Computer Antivirus Research Organization (CARO) Naming Scheme and Malware Terminology. +
          +
          +
          nato:
          +
          Marking of Classified and Unclassified materials as described by the North Atlantic Treaty Organization, NATO. +
          +
          +
          nis:
          +
          NIS Cybersecurity Incident Taxonomy. +
          +
          +
          open_threat:
          +
          Open Threat Taxonomy v1.1 base on James Tarala of SANS ref. - http://www.auditscripts.com/resources/open_threat_taxonomy_v1.1a.pdf +
          +
          +
          osint:
          +
          Open Source Intelligence - Classification (MISP taxonomies). +
          +
          +
          passivetotal:
          +
          Tags for RiskIQ's passivetotal service +
          +
          +
          pentest:
          +
          Penetration test (pentest) classification. +
          +
          +
          priority-level:
          +
          After an incident is scored, it is assigned a priority level. The six levels listed below are aligned with NCCIC, DHS, and the CISS to help provide a common lexicon when discussing incidents. This priority assignment drives NCCIC urgency, pre-approved incident response offerings, reporting requirements, and recommendations for leadership escalation. Generally, incident priority distribution should follow a similar pattern to the graph below. Based on https://www.us-cert.gov/NCCIC-Cyber-Incident-Scoring-System. +
          +
          +
          rsit:
          +
          Reference Security Incident Classification Taxonomy. +
          +
          +
          rteventstatus:
          +
          Status of events used in Request Tracker. +
          +
          +
          runtime-packer:
          +
          Runtime or software packer used to combine compressed data with the decompression code. The decompression code can add additional obfuscations mechanisms including polymorphic-packer or other obfuscation techniques. This taxonomy lists all the known or official packer used for legitimate use or for packing malicious binaries. +
          +
          +
          smart-airports-threats:
          +
          Threat taxonomy in the scope of securing smart airports by ENISA. +
          +
          +
          stealth_malware:
          +
          Classification based on malware stealth techniques. +
          +
          +
          stix-ttp:
          +
          Representation of the behavior or modus operandi of cyber adversaries (a.k.a TTP) as normalized in STIX +
          +
          +
          targeted-threat-index:
          +
          The Targeted Threat Index is a metric for assigning an overall threat ranking score to email messages that deliver malware to a victim’ (U+2019)s computer. The TTI metric was first introduced at SecTor 2013 by Seth Hardy as part of the talk “ (U+201C)RATastrophe: Monitoring a Malware Menagerie” (U+201D) along with Katie Kleemola and Greg Wiseman. +
          +
          +
          tlp:
          +
          The Traffic Light Protocol - or short: TLP - was designed with the objective to create a favorable classification scheme for sharing sensitive information while keeping the control over its distribution at the same time. Extended with TLP:EX:CHR. +
          +
          +
          tor:
          +
          Taxonomy to describe Tor network infrastructure +
          +
          +
          type:
          +
          Taxonomy to describe different types of intelligence gathering discipline which can be described the origin of intelligence. +
          +
          +
          use-case-applicability:
          +
          The Use Case Applicability categories reflect standard resolution categories, to clearly display alerting rule configuration problems. +
          +
          +
          veris:
          +
          Vocabulary for Event Recording and Incident Sharing (VERIS). +
          +
          +
          vocabulaire-des-probabilites-estimatives:
          +
          Vocabulaire des probabilité (U+00E9)s estimatives +
          +
          +
          workflow:
          +
          Workflow support language is a common language to support intelligence analysts to perform their analysis on data and information. +
          +
          - -

          -

          -5. JSON Schema -

          -

          The JSON Schema [JSON-SCHEMA] below defines the structure of the MISP taxonomy document as literally described before. The JSON Schema is used validating a MISP taxonomy. The validation is a MUST if the taxonomy is included in the MISP taxonomies directory.

          +
          +
          +
          +
          +
          +
          +

          +5. JSON Schema +

          +

          The JSON Schema [JSON-SCHEMA] below defines the structure of the MISP taxonomy document +as literally described before. The JSON Schema is used validating a MISP taxonomy. The validation +is a MUST if the taxonomy is included in the MISP taxonomies directory.

          +
          {
   "$schema": "http://json-schema.org/schema#",
   "title": "Validator for misp-taxonomies",
@@ -1271,101 +2296,103 @@ osint:source-type="blog-post"
     "predicates"
   ]
 }
-
          -

          -6. Acknowledgements -

          -

          The authors wish to thank all the MISP community who are supporting the creation of open standards in threat intelligence sharing.

          -

          -7. References

          -

          -7.1. Normative References

          - - - - - - - - - -
          [RFC2119] -Bradner, S., "Key words for use in RFCs to Indicate Requirement Levels", BCP 14, RFC 2119, DOI 10.17487/RFC2119, March 1997.
          [RFC8259] -Bray, T., "The JavaScript Object Notation (JSON) Data Interchange Format", STD 90, RFC 8259, DOI 10.17487/RFC8259, December 2017.
          -

          -7.2. Informative References

          - - - - - - - - - - - - - - - - - -
          [JSON-SCHEMA] -Wright, A., "JSON Schema: A Media Type for Describing JSON Documents", 2016.
          [machine-tags] -Cope, A. S., "Machine tags", 2007.
          [MISP-P] -Community, M., "MISP Project - Malware Information Sharing Platform and Threat Sharing"
          [MISP-T] -Community, M., "MISP Taxonomies - shared and common vocabularies of tags"
          -

          Authors' Addresses

          -
          -
          - - Alexandre Dulaunoy - - - Computer Incident Response Center Luxembourg - - 16, bd d'Avranches - - - Luxembourg, - - L-1611 - - Luxembourg - - Phone: +352 247 88444 - -EMail: alexandre.dulaunoy@circl.lu - -
          -
          -
          - - Andras Iklody - - - Computer Incident Response Center Luxembourg - - 16, bd d'Avranches - - - Luxembourg, - - L-1611 - - Luxembourg - - Phone: +352 247 88444 - -EMail: andras.iklody@circl.lu - -
          +
          - +
          +
          +
          +
          +

          +6. Acknowledgements +

          +

          The authors wish to thank all the MISP community who are supporting the creation +of open standards in threat intelligence sharing.

          +
          +
          +
          +

          +7. Normative References +

          +
          +
          [RFC2119]
          +
          +Bradner, S., "Key words for use in RFCs to Indicate Requirement Levels", BCP 14, RFC 2119, DOI 10.17487/RFC2119, , <https://www.rfc-editor.org/info/rfc2119>.
          +
          +
          [RFC8259]
          +
          +Bray, T., Ed., "The JavaScript Object Notation (JSON) Data Interchange Format", STD 90, RFC 8259, DOI 10.17487/RFC8259, , <https://www.rfc-editor.org/info/rfc8259>.
          +
          +
          +
          +
          +

          +8. Informative References +

          +
          +
          [JSON-SCHEMA]
          +
          +Wright, A., "JSON Schema: A Media Type for Describing JSON Documents", , , <https://tools.ietf.org/html/draft-wright-json-schema>.
          +
          +
          [MISP-P]
          +
          +Community, M., "MISP Project - Malware Information Sharing Platform and Threat Sharing", , <https://github.com/MISP>.
          +
          +
          [MISP-T]
          +
          +Community, M., "MISP Taxonomies - shared and common vocabularies of tags", , <https://github.com/MISP/misp-taxonomies>.
          +
          +
          [machine-tags]
          +
          +Cope, A. S., "Machine tags", , , <https://www.flickr.com/groups/51035612836@N01/discuss/72157594497877875/>.
          +
          +
          +
          +
          +
          +

          +Authors' Addresses +

          +
          +
          Alexandre Dulaunoy
          +
          Computer Incident Response Center Luxembourg
          +
          16, bd d'Avranches
          +
          L-L-1611 Luxembourg +
          +
          Luxembourg
          +
          +Phone: ++352 247 88444 +
          + +
          +
          +
          Andras Iklody
          +
          Computer Incident Response Center Luxembourg
          +
          16, bd d'Avranches
          +
          L-L-1611 Luxembourg +
          +
          Luxembourg
          +
          +Phone: ++352 247 88444 +
          + +
          +
          +
          + diff --git a/rfc/misp-standard-taxonomy-format.txt b/rfc/misp-standard-taxonomy-format.txt index 2c89d5d..a632c51 100644 --- a/rfc/misp-standard-taxonomy-format.txt +++ b/rfc/misp-standard-taxonomy-format.txt @@ -4,11 +4,12 @@ Network Working Group A. Dulaunoy Internet-Draft A. Iklody -Expires: June 2, 2018 CIRCL - November 29, 2017 +Intended status: Informational CIRCL +Expires: 25 May 2022 21 November 2021 MISP taxonomy format + draft-00 Abstract @@ -34,28 +35,27 @@ Status of This Memo time. It is inappropriate to use Internet-Drafts as reference material or to cite them other than as "work in progress." - This Internet-Draft will expire on June 2, 2018. + This Internet-Draft will expire on 25 May 2022. Copyright Notice - Copyright (c) 2017 IETF Trust and the persons identified as the + Copyright (c) 2021 IETF Trust and the persons identified as the document authors. All rights reserved. This document is subject to BCP 78 and the IETF Trust's Legal - Provisions Relating to IETF Documents - (https://trustee.ietf.org/license-info) in effect on the date of - publication of this document. Please review these documents - carefully, as they describe your rights and restrictions with respect - to this document. Code Components extracted from this document must - include Simplified BSD License text as described in Section 4.e of - the Trust Legal Provisions and are provided without warranty as - described in the Simplified BSD License. + Provisions Relating to IETF Documents (https://trustee.ietf.org/ + license-info) in effect on the date of publication of this document. + Please review these documents carefully, as they describe your rights + and restrictions with respect to this document. -Dulaunoy & Iklody Expires June 2, 2018 [Page 1] + + + +Dulaunoy & Iklody Expires 25 May 2022 [Page 1] -Internet-Draft MISP taxonomy format November 2017 +Internet-Draft MISP taxonomy format November 2021 Table of Contents @@ -76,13 +76,11 @@ Table of Contents 4.1. Admiralty Scale Taxonomy . . . . . . . . . . . . . . . . 7 4.2. Open Source Intelligence - Classification . . . . . . . . 9 4.3. Available taxonomies in the public directory . . . . . . 11 - 5. JSON Schema . . . . . . . . . . . . . . . . . . . . . . . . . 20 - 6. Acknowledgements . . . . . . . . . . . . . . . . . . . . . . 23 - 7. References . . . . . . . . . . . . . . . . . . . . . . . . . 23 - 7.1. Normative References . . . . . . . . . . . . . . . . . . 23 - 7.2. Informative References . . . . . . . . . . . . . . . . . 23 - 7.3. URIs . . . . . . . . . . . . . . . . . . . . . . . . . . 23 - Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . . 24 + 5. JSON Schema . . . . . . . . . . . . . . . . . . . . . . . . . 18 + 6. Acknowledgements . . . . . . . . . . . . . . . . . . . . . . 21 + 7. Normative References . . . . . . . . . . . . . . . . . . . . 21 + 8. Informative References . . . . . . . . . . . . . . . . . . . 22 + Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . . 22 1. Introduction @@ -105,18 +103,17 @@ Table of Contents In the MISP taxonomy context, machine tags help analysts to classify their cybersecurity events, indicators or threats. MISP taxonomies can be used for classification, filtering, triggering actions or - - - - -Dulaunoy & Iklody Expires June 2, 2018 [Page 2] - -Internet-Draft MISP taxonomy format November 2017 - - visualisation depending on their use in threat intelligence platforms such as MISP [MISP-P]. + + + +Dulaunoy & Iklody Expires 25 May 2022 [Page 2] + +Internet-Draft MISP taxonomy format November 2021 + + 1.1. Conventions and Terminology The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", @@ -162,17 +159,17 @@ Internet-Draft MISP taxonomy format November 2017 defined. predicates is represented as an array of JSON objects. predicates MUST be present and MUST at least content one element. - - - -Dulaunoy & Iklody Expires June 2, 2018 [Page 3] - -Internet-Draft MISP taxonomy format November 2017 - - values defines all the values for each predicate in the namespace defined. values SHOULD be present. + + + +Dulaunoy & Iklody Expires 25 May 2022 [Page 3] + +Internet-Draft MISP taxonomy format November 2021 + + 2.2. predicates The predicates array contains one or more JSON objects which lists @@ -221,9 +218,12 @@ Internet-Draft MISP taxonomy format November 2017 -Dulaunoy & Iklody Expires June 2, 2018 [Page 4] + + + +Dulaunoy & Iklody Expires 25 May 2022 [Page 4] -Internet-Draft MISP taxonomy format November 2017 +Internet-Draft MISP taxonomy format November 2021 "predicates": [ @@ -277,9 +277,9 @@ Internet-Draft MISP taxonomy format November 2017 -Dulaunoy & Iklody Expires June 2, 2018 [Page 5] +Dulaunoy & Iklody Expires 25 May 2022 [Page 5] -Internet-Draft MISP taxonomy format November 2017 +Internet-Draft MISP taxonomy format November 2021 { @@ -333,9 +333,9 @@ Internet-Draft MISP taxonomy format November 2017 -Dulaunoy & Iklody Expires June 2, 2018 [Page 6] +Dulaunoy & Iklody Expires 25 May 2022 [Page 6] -Internet-Draft MISP taxonomy format November 2017 +Internet-Draft MISP taxonomy format November 2021 3.1. Sample Manifest @@ -389,9 +389,9 @@ Internet-Draft MISP taxonomy format November 2017 -Dulaunoy & Iklody Expires June 2, 2018 [Page 7] +Dulaunoy & Iklody Expires 25 May 2022 [Page 7] -Internet-Draft MISP taxonomy format November 2017 +Internet-Draft MISP taxonomy format November 2021 "value": "a", @@ -445,9 +445,9 @@ Internet-Draft MISP taxonomy format November 2017 -Dulaunoy & Iklody Expires June 2, 2018 [Page 8] +Dulaunoy & Iklody Expires 25 May 2022 [Page 8] -Internet-Draft MISP taxonomy format November 2017 +Internet-Draft MISP taxonomy format November 2021 { @@ -501,9 +501,9 @@ Internet-Draft MISP taxonomy format November 2017 -Dulaunoy & Iklody Expires June 2, 2018 [Page 9] +Dulaunoy & Iklody Expires 25 May 2022 [Page 9] -Internet-Draft MISP taxonomy format November 2017 +Internet-Draft MISP taxonomy format November 2021 "predicate": "source-type" @@ -557,9 +557,9 @@ Internet-Draft MISP taxonomy format November 2017 -Dulaunoy & Iklody Expires June 2, 2018 [Page 10] +Dulaunoy & Iklody Expires 25 May 2022 [Page 10] -Internet-Draft MISP taxonomy format November 2017 +Internet-Draft MISP taxonomy format November 2021 "description": "30% Probably not" @@ -600,474 +600,395 @@ Internet-Draft MISP taxonomy format November 2017 ] } - 4.3. Available taxonomies in the public directory The public directory of MISP taxonomies [MISP-T] contains a variety of taxonomy in various fields such as: - CERT-XLM: - CERT-XLM Security Incident Classification. + CERT-XLM: CERT-XLM Security Incident Classification. - DML: + DML: The Detection Maturity Level (DML) model is a capability -Dulaunoy & Iklody Expires June 2, 2018 [Page 11] + + +Dulaunoy & Iklody Expires 25 May 2022 [Page 11] -Internet-Draft MISP taxonomy format November 2017 +Internet-Draft MISP taxonomy format November 2021 - The Detection Maturity Level (DML) model is a capability maturity - model for referencing ones maturity in detecting cyber attacks. - It's designed for organizations who perform intel-driven detection - and response and who put an emphasis on having a mature detection - program. + maturity model for referencing ones maturity in detecting cyber + attacks. It's designed for organizations who perform intel-driven + detection and response and who put an emphasis on having a mature + detection program. - PAP: - The Permissible Actions Protocol - or short: PAP - was designed to - indicate how the received information can be used. + PAP: The Permissible Actions Protocol - or short: PAP - was designed + to indicate how the received information can be used. - access-method: - The access method used to remotely access a system. + access-method: The access method used to remotely access a system. - accessnow: - Access Now classification to classify an issue (such as security, - human rights, youth rights). + accessnow: Access Now classification to classify an issue (such as + security, human rights, youth rights). - action-taken: - Action taken in the case of a security incident (CSIRT + action-taken: Action taken in the case of a security incident (CSIRT perspective). - admiralty-scale: - The Admiralty Scale (also called the NATO System) is used to rank - the reliability of a source and the credibility of an information. + admiralty-scale: The Admiralty Scale (also called the NATO System) + is used to rank the reliability of a source and the credibility of + an information. - adversary: - An overview and description of the adversary infrastructure. + adversary: An overview and description of the adversary + infrastructure. - ais-marking: - AIS Marking Schema implementation is maintained by the National - Cybersecurity and Communication Integration Center (NCCIC) of the - U.S. Department of Homeland Security (DHS) + ais-marking: AIS Marking Schema implementation is maintained by the + National Cybersecurity and Communication Integration Center + (NCCIC) of the U.S. Department of Homeland Security (DHS) - analyst-assessment: - A series of assessment predicates describing the analyst - capabilities to perform analysis. These assessment can be + analyst-assessment: A series of assessment predicates describing the + analyst capabilities to perform analysis. These assessment can be assigned by the analyst him/herself or by another party evaluating the analyst. - approved-category-of-action: - A pre-approved category of action for indicators being shared with - partners (MIMIC). + approved-category-of-action: A pre-approved category of action for + indicators being shared with partners (MIMIC). - binary-class: - Custom taxonomy for types of binary file. + binary-class: Custom taxonomy for types of binary file. - cccs: - Internal taxonomy for CCCS. + cccs: Internal taxonomy for CCCS. + + circl: CIRCL Taxonomy is a simple scheme for incident classification + and area topic where the incident took place. + + collaborative-intelligence: Collaborative intelligence support + language is a common language to support analysts to perform their + analysis to get crowdsourced support when using threat + intelligence sharing platform like MISP. + + common-taxonomy: The Common Taxonomy for Law Enforcement and The -Dulaunoy & Iklody Expires June 2, 2018 [Page 12] +Dulaunoy & Iklody Expires 25 May 2022 [Page 12] -Internet-Draft MISP taxonomy format November 2017 +Internet-Draft MISP taxonomy format November 2021 - circl: - CIRCL Taxonomy is a simple scheme for incident classification and - area topic where the incident took place. + National Network of CSIRTs bridges the gap between the CSIRTs and + international Law Enforcement communities by adding a legislative + framework to facilitate the harmonisation of incident reporting to + competent authorities, the development of useful statistics and + sharing information within the entire cybercrime ecosystem. - collaborative-intelligence: - Collaborative intelligence support language is a common language - to support analysts to perform their analysis to get crowdsourced - support when using threat intelligence sharing platform like MISP. + copine-scale: The COPINE Scale is a rating system created in Ireland + and used in the United Kingdom to categorise the severity of + images of child sex abuse. - common-taxonomy: - The Common Taxonomy for Law Enforcement and The National Network - of CSIRTs bridges the gap between the CSIRTs and international Law - Enforcement communities by adding a legislative framework to - facilitate the harmonisation of incident reporting to competent - authorities, the development of useful statistics and sharing - information within the entire cybercrime ecosystem. + cryptocurrency-threat: Threats targetting cryptocurrency, based on + CipherTrace report. - copine-scale: - The COPINE Scale is a rating system created in Ireland and used in - the United Kingdom to categorise the severity of images of child - sex abuse. + csirt_case_classification: FIRST CSIRT Case Classification. - cryptocurrency-threat: - Threats targetting cryptocurrency, based on CipherTrace report. + cssa: The CSSA agreed sharing taxonomy. - csirtcaseclassification: - FIRST CSIRT Case Classification. + cyber-threat-framework: Cyber Threat Framework was developed by the + US Government to enable consistent characterization and + categorization of cyber threat events, and to identify trends or + changes in the activities of cyber adversaries. + https://www.dni.gov/index.php/cyber-threat-framework + (https://www.dni.gov/index.php/cyber-threat-framework) - cssa: - The CSSA agreed sharing taxonomy. + data-classification: Data classification for data potentially at + risk of exfiltration based on table 2.1 of Solving Cyber Risk + book. - cyber-threat-framework: - Cyber Threat Framework was developed by the US Government to - enable consistent characterization and categorization of cyber - threat events, and to identify trends or changes in the activities - of cyber adversaries. https://www.dni.gov/index.php/cyber-threat- - framework [1] + dcso-sharing: DCSO Sharing Taxonomy to classify certain types of + MISP events using the DCSO Event Guide - data-classification: - Data classification for data potentially at risk of exfiltration - based on table 2.1 of Solving Cyber Risk book. + ddos: Distributed Denial of Service - or short: DDoS - taxonomy + supports the description of Denial of Service attacks and + especially the types they belong too. - dcso-sharing: - DCSO Sharing Taxonomy to classify certain types of MISP events - using the DCSO Event Guide + de-vs: Taxonomy for the handling of protectively marked information + in MISP with German (DE) Government classification markings (VS) - ddos: + dhs-ciip-sectors: DHS critical sectors as described in + https://www.dhs.gov/critical-infrastructure-sectors + (https://www.dhs.gov/critical-infrastructure-sectors). + + diamond-model: The Diamond Model for Intrusion Analysis, a phase- + based model developed by Lockheed Martin, aims to help categorise + and identify the stage of an attack. + + dni-ism: ISM (Information Security Marking Metadata) V13 as + described by DNI.gov (Director of National Intelligence - US). - -Dulaunoy & Iklody Expires June 2, 2018 [Page 13] +Dulaunoy & Iklody Expires 25 May 2022 [Page 13] -Internet-Draft MISP taxonomy format November 2017 +Internet-Draft MISP taxonomy format November 2021 - Distributed Denial of Service - or short: DDoS - taxonomy supports - the description of Denial of Service attacks and especially the - types they belong too. + domain-abuse: Taxonomy to tag domain names used for cybercrime. - de-vs: - Taxonomy for the handling of protectively marked information in - MISP with German (DE) Government classification markings (VS) + drugs: A taxonomy based on the superclass and class of drugs, based + on https://www.drugbank.ca/releases/latest + (https://www.drugbank.ca/releases/latest) - dhs-ciip-sectors: - DHS critical sectors as described in https://www.dhs.gov/critical- - infrastructure-sectors [2]. + economical-impact: Economical impact is a taxonomy to describe the + financial impact as positive or negative gain to the tagged + information. - diamond-model: - The Diamond Model for Intrusion Analysis, a phase-based model - developed by Lockheed Martin, aims to help categorise and identify - the stage of an attack. + ecsirt: eCSIRT incident classification Appendix C of the eCSIRT EU + project including IntelMQ updates. - dni-ism: - ISM (Information Security Marking Metadata) V13 as described by - DNI.gov (Director of National Intelligence - US). + enisa: ENISA Threat Taxonomy - A tool for structuring threat + information as published in https://www.enisa.europa.eu/topics/ + threat-risk-management/threats-and-trends/enisa-threat- + landscape/etl2015/enisa-threat-taxonomy-a-tool-for-structuring- + threat-information (https://www.enisa.europa.eu/topics/threat- + risk-management/threats-and-trends/enisa-threat-landscape/etl2015/ + enisa-threat-taxonomy-a-tool-for-structuring-threat-information) - domain-abuse: - Taxonomy to tag domain names used for cybercrime. + estimative-language: Estimative language - including likelihood or + probability of event based on the Intelligence Community Directive + 203 (ICD 203) (6.2.(a)) and JP 2-0, Joint Intelligence. - drugs: - A taxonomy based on the superclass and class of drugs, based on - https://www.drugbank.ca/releases/latest [3] + eu-marketop-and-publicadmin: Market operators and public + administrations that must comply to some notifications + requirements under EU NIS directive. - economical-impact: - Economical impact is a taxonomy to describe the financial impact - as positive or negative gain to the tagged information. + eu-nis-sector-and-subsectors: Sectors and sub sectors as identified + by the NIS Directive. - ecsirt: - eCSIRT incident classification Appendix C of the eCSIRT EU project - including IntelMQ updates. - - enisa: - ENISA Threat Taxonomy - A tool for structuring threat information - as published in https://www.enisa.europa.eu/topics/threat-risk- - management/threats-and-trends/enisa-threat-landscape/etl2015/ - enisa-threat-taxonomy-a-tool-for-structuring-threat-information - [4] - - estimative-language: - Estimative language - including likelihood or probability of event - based on the Intelligence Community Directive 203 (ICD 203) - (6.2.(a)) and JP 2-0, Joint Intelligence. - - - - -Dulaunoy & Iklody Expires June 2, 2018 [Page 14] - -Internet-Draft MISP taxonomy format November 2017 - - - eu-marketop-and-publicadmin: - Market operators and public administrations that must comply to - some notifications requirements under EU NIS directive. - - eu-nis-sector-and-subsectors: - Sectors and sub sectors as identified by the NIS Directive. - - euci: - EU classified information (EUCI) means any information or material - designated by a EU security classification, the unauthorised - disclosure of which could cause varying degrees of prejudice to - the interests of the European Union or of one or more of the - Member States as described in COUNCIL DECISION of 23 September - 2013 on the security rules for protecting EU classified + euci: EU classified information (EUCI) means any information or + material designated by a EU security classification, the + unauthorised disclosure of which could cause varying degrees of + prejudice to the interests of the European Union or of one or more + of the Member States as described in COUNCIL DECISION of 23 + September 2013 on the security rules for protecting EU classified information - europol-event: - EUROPOL type of events taxonomy. + europol-event: EUROPOL type of events taxonomy. - europol-incident: - EUROPOL class of incident taxonomy. + europol-incident: EUROPOL class of incident taxonomy. - event-assessment: - A series of assessment predicates describing the event assessment - performed to make judgement(s) under a certain level of - uncertainty. - - event-classification: - Event Classification. - - exercise: - Exercise is a taxonomy to describe if the information is part of - one or more cyber or crisis exercise. - - false-positive: - This taxonomy aims to ballpark the expected amount of false - positives. - - file-type: - List of known file types. - - flesch-reading-ease: - Flesch Reading Ease is a revised system for determining the - comprehension difficulty of written material. The scoring of the - flesh score can have a maximum of 121.22 and there is no limit on - how low a score can be (negative score are valid). - - fpf: + event-assessment: A series of assessment predicates describing the + event assessment performed to make judgement(s) under a certain + level of uncertainty. -Dulaunoy & Iklody Expires June 2, 2018 [Page 15] + +Dulaunoy & Iklody Expires 25 May 2022 [Page 14] -Internet-Draft MISP taxonomy format November 2017 +Internet-Draft MISP taxonomy format November 2021 - The Future of Privacy Forum (FPF) visual guide to practical de- - identification [5] taxonomy is used to evaluate the degree of - identifiability of personal data and the types of pseudonymous - data, de-identified data and anonymous data. The work of FPF is - licensed under a creative commons attribution 4.0 international - license. + event-classification: Event Classification. - fr-classif: - French gov information classification system. + exercise: Exercise is a taxonomy to describe if the information is + part of one or more cyber or crisis exercise. - gdpr: - Taxonomy related to the REGULATION (EU) 2016/679 OF THE EUROPEAN - PARLIAMENT AND OF THE COUNCIL on the protection of natural persons - with regard to the processing of personal data and on the free - movement of such data, and repealing Directive 95/46/EC (General - Data Protection Regulation) + false-positive: This taxonomy aims to ballpark the expected amount + of false positives. - gsma-attack-category: - Taxonomy used by GSMA for their information sharing program with - telco describing the attack categories + file-type: List of known file types. - gsma-fraud: - Taxonomy used by GSMA for their information sharing program with - telco describing the various aspects of fraud + flesch-reading-ease: Flesch Reading Ease is a revised system for + determining the comprehension difficulty of written material. The + scoring of the flesh score can have a maximum of 121.22 and there + is no limit on how low a score can be (negative score are valid). - gsma-network-technology: - Taxonomy used by GSMA for their information sharing program with - telco describing the types of infrastructure. WiP + fpf: The Future of Privacy Forum (FPF) visual guide to practical de- + identification (https://fpf.org/2016/04/25/a-visual-guide-to- + practical-data-de-identification/) taxonomy is used to evaluate + the degree of identifiability of personal data and the types of + pseudonymous data, de-identified data and anonymous data. The + work of FPF is licensed under a creative commons attribution 4.0 + international license. - honeypot-basic: - Christian Seifert, Ian Welch, Peter Komisarczuk, 'Taxonomy of - Honeypots', Technical Report CS-TR-06/12, VICTORIA UNIVERSITY OF - WELLINGTON, School of Mathematical and Computing Sciences, June - 2006, http://www.mcs.vuw.ac.nz/comp/Publications/archive/CS-TR-06/ - CS-TR-06-12.pdf [6] + fr-classif: French gov information classification system. - iep: - Forum of Incident Response and Security Teams (FIRST) Information - Exchange Policy (IEP) framework. + gdpr: Taxonomy related to the REGULATION (EU) 2016/679 OF THE + EUROPEAN PARLIAMENT AND OF THE COUNCIL on the protection of + natural persons with regard to the processing of personal data and + on the free movement of such data, and repealing Directive 95/46/ + EC (General Data Protection Regulation) - ifx-vetting: - The IFX taxonomy is used to categorise information (MISP events - and attributes) to aid in the intelligence vetting process + gsma-attack-category: Taxonomy used by GSMA for their information + sharing program with telco describing the attack categories - incident-disposition: - How an incident is classified in its process to be resolved. The - taxonomy is inspired from NASA Incident Response and Management - Handbook. + gsma-fraud: Taxonomy used by GSMA for their information sharing + program with telco describing the various aspects of fraud + + gsma-network-technology: Taxonomy used by GSMA for their information + sharing program with telco describing the types of infrastructure. + WiP + + honeypot-basic: Christian Seifert, Ian Welch, Peter Komisarczuk, ‘ + (U+2018)Taxonomy of Honeypots’ (U+2019), Technical Report CS-TR- + 06/12, VICTORIA UNIVERSITY OF WELLINGTON, School of Mathematical + and Computing Sciences, June 2006, + http://www.mcs.vuw.ac.nz/comp/Publications/archive/CS-TR-06/CS-TR- + 06-12.pdf (http://www.mcs.vuw.ac.nz/comp/Publications/archive/CS- + TR-06/CS-TR-06-12.pdf) -Dulaunoy & Iklody Expires June 2, 2018 [Page 16] +Dulaunoy & Iklody Expires 25 May 2022 [Page 15] -Internet-Draft MISP taxonomy format November 2017 +Internet-Draft MISP taxonomy format November 2021 - infoleak: - A taxonomy describing information leaks and especially information - classified as being potentially leaked. + iep: Forum of Incident Response and Security Teams (FIRST) + Information Exchange Policy (IEP) framework. - information-security-data-source: - Taxonomy to classify the information security data sources + ifx-vetting: The IFX taxonomy is used to categorise information + (MISP events and attributes) to aid in the intelligence vetting + process - information-security-indicators: - Information security indicators have been standardized by the ETSI - Industrial Specification Group (ISG) ISI. These indicators - provide the basis to switch from a qualitative to a quantitative - culture in IT Security Scope of measurements: External and - internal threats (attempt and success), user's deviant behaviours, - nonconformities and/or vulnerabilities (software, configuration, - behavioural, general security framework). ETSI GS ISI 001-1 - (V1.1.2): ISI Indicators + incident-disposition: How an incident is classified in its process + to be resolved. The taxonomy is inspired from NASA Incident + Response and Management Handbook. - interception-method: - The interception method used to intercept traffic. + infoleak: A taxonomy describing information leaks and especially + information classified as being potentially leaked. - kill-chain: - Cyber Kill Chain from Lockheed Martin as described in + information-security-data-source: Taxonomy to classify the + information security data sources + + information-security-indicators: Information security indicators + have been standardized by the ETSI Industrial Specification Group + (ISG) ISI. These indicators provide the basis to switch from a + qualitative to a quantitative culture in IT Security Scope of + measurements: External and internal threats (attempt and success), + user's deviant behaviours, nonconformities and/or vulnerabilities + (software, configuration, behavioural, general security + framework). ETSI GS ISI 001-1 (V1.1.2): ISI Indicators + + interception-method: The interception method used to intercept + traffic. + + kill-chain: Cyber Kill Chain from Lockheed Martin as described in Intelligence-Driven Computer Network Defense Informed by Analysis of Adversary Campaigns and Intrusion Kill Chains. - maec-delivery-vectors: - Vectors used to deliver malware based on MAEC 5.0 + maec-delivery-vectors: Vectors used to deliver malware based on MAEC + 5.0 - maec-malware-behavior: - Malware behaviours based on MAEC 5.0 + maec-malware-behavior: Malware behaviours based on MAEC 5.0 - maec-malware-capabilities: - Malware Capabilities based on MAEC 5.0 + maec-malware-capabilities: Malware Capabilities based on MAEC 5.0 - maec-malware-obfuscation-methods: - Obfuscation methods used by malware based on MAEC 5.0 + maec-malware-obfuscation-methods: Obfuscation methods used by + malware based on MAEC 5.0 - malware_classification: - Malware classification based on a SANS whitepaper about malware. + malware_classification: Malware classification based on a SANS + whitepaper about malware. - misp: - Internal MISP taxonomy. - - monarc-threat: - MONARC threat taxonomy. - - ms-caro-malware: + misp: Internal MISP taxonomy. -Dulaunoy & Iklody Expires June 2, 2018 [Page 17] +Dulaunoy & Iklody Expires 25 May 2022 [Page 16] -Internet-Draft MISP taxonomy format November 2017 +Internet-Draft MISP taxonomy format November 2021 - Malware Type and Platform classification based on Microsoft's - implementation of the Computer Antivirus Research Organization - (CARO) Naming Scheme and Malware Terminology. + monarc-threat: MONARC threat taxonomy. - ms-caro-malware-full: - Malware Type and Platform classification based on Microsoft's - implementation of the Computer Antivirus Research Organization - (CARO) Naming Scheme and Malware Terminology. + ms-caro-malware: Malware Type and Platform classification based on + Microsoft's implementation of the Computer Antivirus Research + Organization (CARO) Naming Scheme and Malware Terminology. - nato: - Marking of Classified and Unclassified materials as described by - the North Atlantic Treaty Organization, NATO. + ms-caro-malware-full: Malware Type and Platform classification based + on Microsoft's implementation of the Computer Antivirus Research + Organization (CARO) Naming Scheme and Malware Terminology. - nis: - NIS Cybersecurity Incident Taxonomy. + nato: Marking of Classified and Unclassified materials as described + by the North Atlantic Treaty Organization, NATO. - open_threat: - Open Threat Taxonomy v1.1 base on James Tarala of SANS ref. - - http://www.auditscripts.com/resources/ - open_threat_taxonomy_v1.1a.pdf [7] + nis: NIS Cybersecurity Incident Taxonomy. - osint: - Open Source Intelligence - Classification (MISP taxonomies). + open_threat: Open Threat Taxonomy v1.1 base on James Tarala of SANS + ref. - http://www.auditscripts.com/resources/ + open_threat_taxonomy_v1.1a.pdf + (http://www.auditscripts.com/resources/ + open_threat_taxonomy_v1.1a.pdf) - passivetotal: - Tags for RiskIQ's passivetotal service + osint: Open Source Intelligence - Classification (MISP taxonomies). - pentest: - Penetration test (pentest) classification. + passivetotal: Tags for RiskIQ's passivetotal service - priority-level: - After an incident is scored, it is assigned a priority level. The - six levels listed below are aligned with NCCIC, DHS, and the CISS - to help provide a common lexicon when discussing incidents. This - priority assignment drives NCCIC urgency, pre-approved incident - response offerings, reporting requirements, and recommendations - for leadership escalation. Generally, incident priority - distribution should follow a similar pattern to the graph below. - Based on https://www.us-cert.gov/NCCIC-Cyber-Incident-Scoring- - System [8]. + pentest: Penetration test (pentest) classification. - rsit: - Reference Security Incident Classification Taxonomy. + priority-level: After an incident is scored, it is assigned a + priority level. The six levels listed below are aligned with + NCCIC, DHS, and the CISS to help provide a common lexicon when + discussing incidents. This priority assignment drives NCCIC + urgency, pre-approved incident response offerings, reporting + requirements, and recommendations for leadership escalation. + Generally, incident priority distribution should follow a similar + pattern to the graph below. Based on https://www.us-cert.gov/ + NCCIC-Cyber-Incident-Scoring-System (https://www.us-cert.gov/ + NCCIC-Cyber-Incident-Scoring-System). - rteventstatus: - Status of events used in Request Tracker. + rsit: Reference Security Incident Classification Taxonomy. - runtime-packer: + rt_event_status: Status of events used in Request Tracker. + + runtime-packer: Runtime or software packer used to combine + compressed data with the decompression code. The decompression + code can add additional obfuscations mechanisms including + polymorphic-packer or other obfuscation techniques. This taxonomy + lists all the known or official packer used for legitimate use or + for packing malicious binaries. -Dulaunoy & Iklody Expires June 2, 2018 [Page 18] +Dulaunoy & Iklody Expires 25 May 2022 [Page 17] -Internet-Draft MISP taxonomy format November 2017 +Internet-Draft MISP taxonomy format November 2021 - Runtime or software packer used to combine compressed data with - the decompression code. The decompression code can add additional - obfuscations mechanisms including polymorphic-packer or other - obfuscation techniques. This taxonomy lists all the known or - official packer used for legitimate use or for packing malicious - binaries. + smart-airports-threats: Threat taxonomy in the scope of securing + smart airports by ENISA. - smart-airports-threats: - Threat taxonomy in the scope of securing smart airports by ENISA. + stealth_malware: Classification based on malware stealth techniques. - stealth_malware: - Classification based on malware stealth techniques. - - stix-ttp: - Representation of the behavior or modus operandi of cyber + stix-ttp: Representation of the behavior or modus operandi of cyber adversaries (a.k.a TTP) as normalized in STIX - targeted-threat-index: - The Targeted Threat Index is a metric for assigning an overall - threat ranking score to email messages that deliver malware to a - victim's computer. The TTI metric was first introduced at SecTor - 2013 by Seth Hardy as part of the talk "RATastrophe: Monitoring a - Malware Menagerie" along with Katie Kleemola and Greg Wiseman. + targeted-threat-index: The Targeted Threat Index is a metric for + assigning an overall threat ranking score to email messages that + deliver malware to a victim’ (U+2019)s computer. The TTI metric + was first introduced at SecTor 2013 by Seth Hardy as part of the + talk “ (U+201C)RATastrophe: Monitoring a Malware Menagerie” + (U+201D) along with Katie Kleemola and Greg Wiseman. - tlp: - The Traffic Light Protocol - or short: TLP - was designed with the - objective to create a favorable classification scheme for sharing - sensitive information while keeping the control over its + tlp: The Traffic Light Protocol - or short: TLP - was designed with + the objective to create a favorable classification scheme for + sharing sensitive information while keeping the control over its distribution at the same time. Extended with TLP:EX:CHR. - tor: - Taxonomy to describe Tor network infrastructure + tor: Taxonomy to describe Tor network infrastructure - type: - Taxonomy to describe different types of intelligence gathering + type: Taxonomy to describe different types of intelligence gathering discipline which can be described the origin of intelligence. - use-case-applicability: - The Use Case Applicability categories reflect standard resolution - categories, to clearly display alerting rule configuration - problems. + use-case-applicability: The Use Case Applicability categories + reflect standard resolution categories, to clearly display + alerting rule configuration problems. - veris: - Vocabulary for Event Recording and Incident Sharing (VERIS). + veris: Vocabulary for Event Recording and Incident Sharing (VERIS). - vocabulaire-des-probabilites-estimatives: - Vocabulaire des probabilites estimatives + vocabulaire-des-probabilites-estimatives: Vocabulaire des + probabilité (U+00E9)s estimatives - - - -Dulaunoy & Iklody Expires June 2, 2018 [Page 19] - -Internet-Draft MISP taxonomy format November 2017 - - - workflow: - Workflow support language is a common language to support + workflow: Workflow support language is a common language to support intelligence analysts to perform their analysis on data and information. @@ -1078,6 +999,17 @@ Internet-Draft MISP taxonomy format November 2017 used validating a MISP taxonomy. The validation is a _MUST_ if the taxonomy is included in the MISP taxonomies directory. + + + + + + +Dulaunoy & Iklody Expires 25 May 2022 [Page 18] + +Internet-Draft MISP taxonomy format November 2021 + + { "$schema": "http://json-schema.org/schema#", "title": "Validator for misp-taxonomies", @@ -1114,14 +1046,6 @@ Internet-Draft MISP taxonomy format November 2017 "values": { "type": "array", "uniqueItems": true, - - - -Dulaunoy & Iklody Expires June 2, 2018 [Page 20] - -Internet-Draft MISP taxonomy format November 2017 - - "items": { "type": "object", "additionalProperties": false, @@ -1134,6 +1058,14 @@ Internet-Draft MISP taxonomy format November 2017 } }, "required": [ + + + +Dulaunoy & Iklody Expires 25 May 2022 [Page 19] + +Internet-Draft MISP taxonomy format November 2021 + + "predicate" ] } @@ -1170,14 +1102,6 @@ Internet-Draft MISP taxonomy format November 2017 } } }, - - - -Dulaunoy & Iklody Expires June 2, 2018 [Page 21] - -Internet-Draft MISP taxonomy format November 2017 - - "type": "object", "additionalProperties": false, "properties": { @@ -1190,6 +1114,14 @@ Internet-Draft MISP taxonomy format November 2017 "expanded": { "type": "string" }, + + + +Dulaunoy & Iklody Expires 25 May 2022 [Page 20] + +Internet-Draft MISP taxonomy format November 2021 + + "namespace": { "type": "string" }, @@ -1226,14 +1158,6 @@ Internet-Draft MISP taxonomy format November 2017 "required": [ "namespace", "description", - - - -Dulaunoy & Iklody Expires June 2, 2018 [Page 22] - -Internet-Draft MISP taxonomy format November 2017 - - "version", "predicates" ] @@ -1244,9 +1168,15 @@ Internet-Draft MISP taxonomy format November 2017 The authors wish to thank all the MISP community who are supporting the creation of open standards in threat intelligence sharing. -7. References +7. Normative References + + + + +Dulaunoy & Iklody Expires 25 May 2022 [Page 21] + +Internet-Draft MISP taxonomy format November 2021 -7.1. Normative References [RFC2119] Bradner, S., "Key words for use in RFCs to Indicate Requirement Levels", BCP 14, RFC 2119, @@ -1258,18 +1188,13 @@ Internet-Draft MISP taxonomy format November 2017 DOI 10.17487/RFC8259, December 2017, . -7.2. Informative References +8. Informative References [JSON-SCHEMA] Wright, A., "JSON Schema: A Media Type for Describing JSON Documents", 2016, . - [machine-tags] - Cope, A. S., "Machine tags", 2007, - . - [MISP-P] Community, M., "MISP Project - Malware Information Sharing Platform and Threat Sharing", . @@ -1277,42 +1202,17 @@ Internet-Draft MISP taxonomy format November 2017 vocabularies of tags", . -7.3. URIs - - [1] https://www.dni.gov/index.php/cyber-threat-framework - - [2] https://www.dhs.gov/critical-infrastructure-sectors - - - -Dulaunoy & Iklody Expires June 2, 2018 [Page 23] - -Internet-Draft MISP taxonomy format November 2017 - - - [3] https://www.drugbank.ca/releases/latest - - [4] https://www.enisa.europa.eu/topics/threat-risk-management/ - threats-and-trends/enisa-threat-landscape/etl2015/enisa-threat- - taxonomy-a-tool-for-structuring-threat-information - - [5] https://fpf.org/2016/04/25/a-visual-guide-to-practical-data-de- - identification/ - - [6] http://www.mcs.vuw.ac.nz/comp/Publications/archive/CS-TR-06/CS- - TR-06-12.pdf - - [7] http://www.auditscripts.com/resources/ - open_threat_taxonomy_v1.1a.pdf - - [8] https://www.us-cert.gov/NCCIC-Cyber-Incident-Scoring-System + [machine-tags] + Cope, A. S., "Machine tags", 2007, + . Authors' Addresses Alexandre Dulaunoy Computer Incident Response Center Luxembourg 16, bd d'Avranches - Luxembourg L-1611 + L-L-1611 Luxembourg Luxembourg Phone: +352 247 88444 @@ -1322,10 +1222,18 @@ Authors' Addresses Andras Iklody Computer Incident Response Center Luxembourg 16, bd d'Avranches - Luxembourg L-1611 + L-L-1611 Luxembourg Luxembourg Phone: +352 247 88444 + + + +Dulaunoy & Iklody Expires 25 May 2022 [Page 22] + +Internet-Draft MISP taxonomy format November 2021 + + Email: andras.iklody@circl.lu @@ -1341,4 +1249,40 @@ Authors' Addresses -Dulaunoy & Iklody Expires June 2, 2018 [Page 24] + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +Dulaunoy & Iklody Expires 25 May 2022 [Page 23]