MISP
/
misp-taxonomies
mirror of https://github.com/MISP/misp-taxonomies
2
0
Fork 0
Code Issues Releases Wiki Activity

Initial support for ISM (Information Security Marking Metadata) 

as described by DNI.gov
pull/8/head
Alexandre Dulaunoy 2015-11-28 17:56:23 +01:00
parent ab98df342f
commit 121b7e83f9
2 changed files with 222 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

222
dni-ism/machinetag.json
View File

@ -46,6 +46,67 @@
],
"predicate": "classification:us"
},
{
"entry": [
{
"expanded": "ENDSEAL",
"value": "EL"
},
{
"expanded": "ECRU",
"value": "EL-EU"
},
{
"expanded": "NONBOOK",
"value": "EL-NK"
},
{
"expanded": "HCS",
"value": "HCS"
},
{
"expanded": "HCS-O",
"value": "HCS-O"
},
{
"expanded": "HCS-P",
"value": "HCS-P"
},
{
"expanded": "KLONDIKE",
"value": "KDK"
},
{
"expanded": "KDK BLUEFISH",
"value": "KDK-BLFH"
},
{
"expanded": "KDK IDITAROD",
"value": "KDK-IDIT"
},
{
"expanded": "KDK KANDIK",
"value": "KDK-KAND"
},
{
"expanded": "RESERVE",
"value": "RSV"
},
{
"expanded": "SPECIAL INTELLIGENCE",
"value": "SI"
},
{
"expanded": "SI-GAMMA",
"value": "SI-G"
},
{
"expanded": "TALENT KEYHOLE",
"value": "TK"
}
],
"predicate": "scicontrols"
},
{
"entry": [
{
@ -67,6 +128,149 @@
],
"predicate": "complies:with"
},
{
"predicate": "notice",
"entry": [
{
"value": "FISA",
"expanded": "FISA Warning statement"
},
{
"value": "IMC",
"expanded": "IMCON Warning statement"
},
{
"value": "CNWDI",
"expanded": "Controled Nuclear Weapon Design Information Warning statement"
},
{
"value": "RD",
"expanded": "RD Warning statement"
},
{
"value": "FRD",
"expanded": "FRD Warning statement"
},
{
"value": "DS",
"expanded": "LIMDIS caveat"
},
{
"value": "LES",
"expanded": "LES Notice"
},
{
"value": "LES-NF",
"expanded": "LES-NF Notice"
},
{
"value": "DSEN",
"expanded": "DSEN Notice"
},
{
"value": "DoD-Dist-A",
"expanded": "DoD Distribution statement A from DoD Directive 5230.24"
},
{
"value": "DoD-Dist-B",
"expanded": "DoD Distribution statement B from DoD Directive 5230.24"
},
{
"value": "DoD-Dist-C",
"expanded": "DoD Distribution statement C from DoD Directive 5230.24"
},
{
"value": "DoD-Dist-D",
"expanded": "DoD Distribution statement D from DoD Directive 5230.24"
},
{
"value": "DoD-Dist-E",
"expanded": "DoD Distribution statement E from DoD Directive 5230.24"
},
{
"value": "DoD-Dist-F",
"expanded": "DoD Distribution statement F from DoD Directive 5230.24"
},
{
"value": "DoD-Dist-X",
"expanded": "DoD Distribution statement X from DoD Directive 5230.24"
},
{
"value": "US-Person",
"expanded": "US Person info Notice"
},
{
"value": "pre13526ORCON",
"expanded": "Indicates that an instance document must abide by rules pertaining to ORIGINATOR CONTROLLED data issued prior to Executive Order 13526."
},
{
"value": "POC",
"expanded": "Indicates that the contents of this notice specify the contact information for a required point-of-contact."
},
{
"value": "COMSEC",
"expanded": "COMSEC Notice"
}
]
},
{
"predicate": "nonic",
"entry": [
{
"value": "NNPI",
"expanded": "NAVAL NUCLEAR PROPULSION INFORMATION"
},
{
"value": "DS",
"expanded": "LIMITED DISTRIBUTION"
},
{
"value": "XD",
"expanded": "EXCLUSIVE DISTRIBUTION"
},
{
"value": "ND",
"expanded": "NO DISTRIBUTION"
},
{
"value": "SBU",
"expanded": "SENSITIVE BUT UNCLASSIFIED"
},
{
"value": "SBU-NF",
"expanded": "SENSITIVE BUT UNCLASSIFIED NOFORN"
},
{
"value": "LES",
"expanded": "LAW ENFORCEMENT SENSITIVE"
},
{
"value": "LES-NF",
"expanded": "LAW ENFORCEMENT SENSITIVE NOFORN"
},
{
"value": "SSI",
"expanded": "SENSITIVE SECURITY INFORMATION"
}
]
},
{
"entry": [
{
"expanded": "NATO Atomal mark",
"value": "ATOMAL"
},
{
"expanded": "NATO Bohemia mark",
"value": "BOHEMIA"
},
{
"expanded": "NATO Balk mark",
"value": "BALK"
}
],
"predicate": "nonuscontrols"
},
{
"entry": [
{
@ -137,9 +341,25 @@
{
"expanded": "Dissem",
"value": "dissem"
},
{
"expanded": "NonIC",
"value": "nonic"
},
{
"expanded": "NonUSControls",
"value": "nonuscontrols"
},
{
"expanded": "Notice",
"value": "notice"
},
{
"expanded": "SCIControls",
"value": "scicontrols"
}
],
"version": 1,
"version": 2,
"description": "A subset of Information Security Marking Metadata ISM as required by Executive Order (EO) 13526. As described by DNI.gov as Data Encoding Specifications for Information Security Marking Metadata in Controlled Vocabulary Enumeration Values for ISM",
"namespace": "dni-ism"
}

2
tools/machinetag.py
View File

@ -30,7 +30,7 @@ import json
import os.path
import argparse
taxonomies = ['admiralty-scale','tlp', 'circl', 'veris', 'ecsirt']
taxonomies = ['admiralty-scale','tlp', 'circl', 'veris', 'ecsirt', 'dni-ism']
argParser = argparse.ArgumentParser(description='Dump Machine Tags (Triple Tags) from MISP taxonomies')
argParser.add_argument('-e', action='store_true', help='Including expanded tags')