misp-taxonomies/cycat/machinetag.json

120 lines
3.9 KiB
JSON
Raw Normal View History

{
"namespace": "cycat",
2021-01-03 16:10:07 +01:00
"expanded": " Universal Cybersecurity Resource Catalogue",
2021-01-15 11:20:17 +01:00
"description": "Taxonomy used by CyCAT, the Universal Cybersecurity Resource Catalogue, to categorize the namespaces it supports and uses.",
"version": 1,
"refs": [
"https://www.cycat.org/"
],
"values": [
{
"predicate": "type",
"entry": [
{
"value": "tool",
"expanded": "Tool",
2021-01-15 11:20:17 +01:00
"description": "Open source or proprietary tool used in cybersecurity."
},
{
"value": "playbook",
"expanded": "Playbook",
2021-01-15 11:20:17 +01:00
"description": "Playbook, such as a defined set of rules with one or more actions triggered by different events to respond to, orchestrate or automate cybersecurity related actions."
},
{
"value": "taxonomy",
"expanded": "Taxonomy",
2021-01-03 16:10:07 +01:00
"description": "Cybersecurity taxonomy is a set of labels used to classify (in both terms - arrange in classes or/and design to national classification) cybersecurity related information."
},
{
2021-01-30 06:51:09 +01:00
"value": "rule",
"expanded": "Rule",
"description": "Detection rule or set of detection rules used in the cybersecurity field. Rulesets can be in different formats for (N/L)IDS/SIEM (such as Snort, Suricata, Zeek, SIGMA or YARA) or any other tool capable of parsing them."
},
{
"value": "notebook",
"expanded": "Notebook",
2021-01-15 11:20:17 +01:00
"description": "Interactive document to code, experiment, train or visualize cybersecurity-related information. A notebook can be transcribed in a format such as Jupyter Notebooks, Apache Zeppelin, Pluton or Google Colab."
},
{
"value": "vulnerability",
"expanded": "Vulnerability",
2021-01-15 11:20:17 +01:00
"description": "Public or non-public information about a security vulnerability in a specific software, hardware or service."
},
{
"value": "proof-of-concept",
"expanded": "Proof-of-concept",
2021-01-15 11:20:17 +01:00
"description": "Code to validate a known vulnerability."
},
{
"value": "fingerprint",
"expanded": "Fingerprint",
2021-01-15 11:20:17 +01:00
"description": "Code to uniquely identify specific cybersecurity-relevant patterns. Fingerprints can be expressed in different formats such as ja3, ja3s, hassh, jarm or favicon-mmh3."
2021-01-23 14:44:30 +01:00
},
{
2021-01-30 06:56:18 +01:00
"value": "mitigation",
"expanded": "Mitigation",
"description": "Mitigating control to prevent unwanted activity from happening, like a specific configuration of the operating system/tools or an implementation policy."
2021-02-06 14:32:24 +01:00
},
{
"value": "dataset",
"expanded": "Dataset",
"description": "Dataset for validation of detections and tool stacks,"
}
]
},
{
"predicate": "scope",
"entry": [
2021-01-03 16:13:03 +01:00
{
"value": "identify",
"expanded": "Identify"
},
{
2021-01-15 11:20:17 +01:00
"value": "protect",
"expanded": "Protect"
},
{
2021-01-15 11:20:17 +01:00
"value": "detect",
"expanded": "Detect"
},
2021-01-03 16:13:03 +01:00
{
2021-01-15 11:20:17 +01:00
"value": "respond",
"expanded": "Respond"
2021-01-03 16:13:03 +01:00
},
{
"value": "recover",
"expanded": "Recover"
},
{
2021-01-15 11:20:17 +01:00
"value": "exploit",
"expanded": "Exploit"
},
{
2021-01-15 11:20:17 +01:00
"value": "investigate",
"expanded": "Investigate"
},
{
2021-01-15 11:20:17 +01:00
"value": "train",
"expanded": "Train"
2021-02-06 14:32:24 +01:00
},
{
"value": "test",
"expanded": "Test"
}
]
}
],
"predicates": [
{
"value": "type",
"expanded": "Type",
"description": "Type of entry in the catalogue."
},
{
"value": "scope",
"expanded": "Scope",
"description": "Scope of usage for the entry in the catalogue."
}
]
}