90 lines
2.1 KiB
JSON
90 lines
2.1 KiB
JSON
|
{
|
||
|
|
"version": 1,
|
||
|
|
"description": "The Indicator of Trust provides insight about data on what can be trusted and known as a good actor. Similar to a whitelist but on steroids, reusing features one would use with Indicators of Compromise, but to filter out what is known to be good.",
|
||
|
|
"expanded": "Indicators of Trust",
|
||
|
|
"namespace": "trust",
|
||
|
|
"exclusive": true,
|
||
|
|
"predicates": [
|
||
|
|
{
|
||
|
|
"value": "trust",
|
||
|
|
"expanded": "How much trust the analyst has with this indicator."
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"value": "frequency",
|
||
|
|
"expanded": "Recency/count of occurence at which the indicator occurs in data."
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"value": "valid",
|
||
|
|
"expanded": "Whether this indicator was pushed as trusted but cannot be trusted (ie. MD5 cannot be valid because it is cryptographically broken)."
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"values": [
|
||
|
|
{
|
||
|
|
"predicate": "trust",
|
||
|
|
"entry": [
|
||
|
|
{
|
||
|
|
"value": "unknown",
|
||
|
|
"expanded": "Unknown Confidence State"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"value": "none",
|
||
|
|
"expanded": "Cannot Trust, no confidence"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"value": "partial",
|
||
|
|
"expanded": "Low confidence"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"value": "relationship",
|
||
|
|
"expanded": "Inherited Full Trust by a third party that we trust"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"value": "full",
|
||
|
|
"expanded": "We fully trust it"
|
||
|
|
}
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"predicate": "frequency",
|
||
|
|
"entry": [
|
||
|
|
{
|
||
|
|
"value": "hourly",
|
||
|
|
"expanded": "This attribute is likely to happen at an hourly interval"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"value": "daily",
|
||
|
|
"expanded": "This attribute is likely to happen at a daily interval"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"value": "weekly",
|
||
|
|
"expanded": "This attribute is likely to happen at a weekly interval"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"value": "monthly",
|
||
|
|
"expanded": "This attribute is likely to happen at a monthly interval"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"value": "yearly",
|
||
|
|
"expanded": "Thie attribute is likely to happen at a yearly interval"
|
||
|
|
}
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"predicate": "valid",
|
||
|
|
"entry": [
|
||
|
|
{
|
||
|
|
"value": "true",
|
||
|
|
"expanded": "This Trust is valid"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"value": "false",
|
||
|
|
"expanded": "This trust is invalid. Such as a MD5 Hash etc."
|
||
|
|
}
|
||
|
|
]
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"refs": [
|
||
|
|
"https://trust.fyi/"
|
||
|
|
]
|
||
|
|
}
|