From 0c53aa893a725b8c81a3fbee8dabd27dbf94ee26 Mon Sep 17 00:00:00 2001
From: Alexandre Dulaunoy <a@foo.be>
Date: Sun, 18 Sep 2022 10:22:25 +0200
Subject: [PATCH] new: [financial] a new financial taxonomy to better financial
 entity in MISP

---
 MANIFEST.json             | 13 +++++---
 financial/machinetag.json | 65 +++++++++++++++++++++++++++++++++++++++
 2 files changed, 74 insertions(+), 4 deletions(-)
 create mode 100644 financial/machinetag.json

diff --git a/MANIFEST.json b/MANIFEST.json
index 99a1447..66e46bf 100644
--- a/MANIFEST.json
+++ b/MANIFEST.json
@@ -306,13 +306,18 @@
     {
       "description": "This taxonomy aims to ballpark the expected amount of false positives.",
       "name": "false-positive",
-      "version": 5
+      "version": 7
     },
     {
       "description": "List of known file types.",
       "name": "file-type",
       "version": 1
     },
+    {
+      "description": "Financial taxonomy to describe financial services, infrastructure and financial scope.",
+      "name": "financial",
+      "version": 1
+    },
     {
       "description": "Flesch Reading Ease is a revised system for determining the comprehension difficulty of written material. The scoring of the flesh score can have a maximum of 121.22 and there is no limit on how low a score can be (negative score are valid).",
       "name": "flesch-reading-ease",
@@ -664,9 +669,9 @@
       "version": 1
     },
     {
-      "description": "The Traffic Light Protocol (TLP) (v2.0) was created to facilitate greater sharing of potentially sensitive information and more effective collaboration. Information sharing happens from an information source, towards one or more recipients. TLP is a set of four labels used to indicate the sharing boundaries to be applied by the recipients. Only labels listed in this standard are considered valid by FIRST. This taxonomy includes additional labels for backward compatibility which are no more validated by FIRST.",
+      "description": "The Traffic Light Protocol (TLP) (v2.0) was created to facilitate greater sharing of potentially sensitive information and more effective collaboration. Information sharing happens from an information source, towards one or more recipients. TLP is a set of four standard labels (a fifth label is included in amber to limit the diffusion) used to indicate the sharing boundaries to be applied by the recipients. Only labels listed in this standard are considered valid by FIRST. This taxonomy includes additional labels for backward compatibility which are no more validated by FIRST SIG.",
       "name": "tlp",
-      "version": 6
+      "version": 7
     },
     {
       "description": "Taxonomy to describe Tor network infrastructure",
@@ -715,5 +720,5 @@
     }
   ],
   "url": "https://raw.githubusercontent.com/MISP/misp-taxonomies/main/",
-  "version": "20220803"
+  "version": "20220918"
 }
diff --git a/financial/machinetag.json b/financial/machinetag.json
new file mode 100644
index 0000000..7e3043d
--- /dev/null
+++ b/financial/machinetag.json
@@ -0,0 +1,65 @@
+{
+  "predicates": [
+    {
+      "description": "Categories and types of services in the financial scope. An entity can be tag with one or more categories or types of services.",
+      "expanded": "Categories and types of services",
+      "value": "categories-and-types-of-services"
+    }
+  ],
+  "values": [
+    {
+      "predicate": "categories-and-types-of-services",
+      "entry": [
+        {
+          "value": "banking",
+          "expanded": "Bamking",
+          "description": "Financial entity described or/and regulated as banking."
+        },
+        {
+          "value": "private",
+          "expanded": "Private",
+          "description": "Financial entity engaged in private banking."
+        },
+        {
+          "value": "retail",
+          "expanded": "Retail",
+          "description": "Financial entity engaged in retail banking."
+        },
+        {
+          "value": "custodian-banking",
+          "expanded": "Custodian banking",
+          "description": "Financial entity having physical possessions of clients financial assets or instruments."
+        },
+        {
+          "value": "stock-exchange",
+          "expanded": "Stock exchange",
+          "description": "Financial entity having a stock exchange where securities are exchanged."
+        },
+        {
+          "value": "fund-management",
+          "expanded": "Fund management",
+          "description": "Financial entity managing financial assets on behalf of others."
+        },
+        {
+          "value": "it-provider",
+          "expanded": "IT provider",
+          "description": "IT provider supporting financial entities and regulated in the financial legal framework (such as support PFS in Luxembourg)."
+        },
+        {
+          "value": "e-money-and-payment",
+          "expanded": "e-money and payment",
+          "description": "Financial entity managing electronic money as alternative to cash payment. (EU directive - Directive 2009/110/EC)"
+        },
+        {
+          "value": "other",
+          "expanded": "Other",
+          "description": "Other entity classified as financial entity with other activities not defined in this taxonomy."
+        }
+      ]
+    }
+  ],
+  "version": 1,
+  "description": "Financial taxonomy to describe financial services, infrastructure and financial scope.",
+  "expanded": "Financial",
+  "namespace": "financial"
+}