MISP
/
misp-taxonomies
mirror of https://github.com/MISP/misp-taxonomies
2
0
Fork 0
Code Issues Releases Wiki Activity

JQ all the things

pull/60/head
Raphaël Vinot 2017-02-13 12:02:51 +01:00
parent 94290cfaa9
commit 3099290e4c
15 changed files with 1141 additions and 1090 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
MANIFEST.json
View File

@ -40,7 +40,7 @@
"name": "dni-ism", "name": "dni-ism",
"version": 3 "version": 3
}, },
{ {
"description": "Taxonomy to tag domain names used for cybercrime.", "description": "Taxonomy to tag domain names used for cybercrime.",
"name": "domain-abuse", "name": "domain-abuse",
"version": 1 "version": 1
@ -166,9 +166,9 @@
"version": 1 "version": 1
}, },
{ {
"description" : "Tags for RiskIQ's passivetotal service", "description": "Tags for RiskIQ's passivetotal service",
"name" : "passivetotal", "name": "passivetotal",
"version" : 1 "version": 1
} }
] ]
} }

16
adversary/machinetag.json
View File

@ -38,9 +38,9 @@
} }
] ]
}, },
{ {
"predicate": "infrastructure-action", "predicate": "infrastructure-action",
"entry": [ "entry": [
{ {
"value": "passive-only", "value": "passive-only",
"expanded": "Only passive requests shall be performed to avoid detection by the adversary" "expanded": "Only passive requests shall be performed to avoid detection by the adversary"
@ -57,11 +57,11 @@
"value": "pending-law-enforcement-request", "value": "pending-law-enforcement-request",
"expanded": "Law enforcement requests are ongoing on the adversary infrastructure" "expanded": "Law enforcement requests are ongoing on the adversary infrastructure"
} }
] ]
}, },
{ {
"predicate": "infrastructure-state", "predicate": "infrastructure-state",
"entry": [ "entry": [
{ {
"value": "unknown", "value": "unknown",
"expanded": "Infrastructure state is unknown or cannot be evaluated" "expanded": "Infrastructure state is unknown or cannot be evaluated"
@ -74,7 +74,7 @@
"value": "down", "value": "down",
"expanded": "Infrastructure state is known to be down" "expanded": "Infrastructure state is known to be down"
} }
] ]
}, },
{ {
"predicate": "infrastructure-type", "predicate": "infrastructure-type",

1
csirt_case_classification/machinetag.json
View File

@ -102,4 +102,3 @@
} }
] ]
} }

146
dhs-ciip-sectors/machinetag.json
View File

@ -1,64 +1,86 @@
{ {
"namespace": "dhs-ciip-sectors", "namespace": "dhs-ciip-sectors",
"description": "DHS critical sectors as in https://www.dhs.gov/critical-infrastructure-sectors", "description": "DHS critical sectors as in https://www.dhs.gov/critical-infrastructure-sectors",
"version": 2, "version": 2,
"predicates": [{ "predicates": [
"value": "DHS-critical-sectors", {
"expanded": "DHS critical sectors" "value": "DHS-critical-sectors",
}, { "expanded": "DHS critical sectors"
"value": "sector", },
"expanded": "Sector" {
}], "value": "sector",
"values": [{ "expanded": "Sector"
"predicate": "DHS-critical-sectors", }
"entry": [{ ],
"value": "chemical", "values": [
"expanded": "Chemical" {
}, { "predicate": "DHS-critical-sectors",
"value": "commercial-facilities", "entry": [
"expanded": "Commercial Facilities" {
}, { "value": "chemical",
"value": "communications", "expanded": "Chemical"
"expanded": "Communications" },
}, { {
"value": "critical-manufacturing", "value": "commercial-facilities",
"expanded": "Critical Manufacturing" "expanded": "Commercial Facilities"
}, { },
"value": "dams", {
"expanded": "Dams" "value": "communications",
}, { "expanded": "Communications"
"value": "dib", },
"expanded": "Defense Industrial Base" {
}, { "value": "critical-manufacturing",
"value": "emergency-services", "expanded": "Critical Manufacturing"
"expanded": "Emergency services" },
}, { {
"value": "energy", "value": "dams",
"expanded": "energy" "expanded": "Dams"
}, { },
"value": "financial-services", {
"expanded": "Financial Services" "value": "dib",
}, { "expanded": "Defense Industrial Base"
"value": "food-agriculture", },
"expanded": "Food and Agriculture" {
}, { "value": "emergency-services",
"value": "government-facilities", "expanded": "Emergency services"
"expanded": "Government Facilities" },
}, { {
"value": "healthcare-public", "value": "energy",
"expanded": "Healthcare and Public Health" "expanded": "energy"
}, { },
"value": "it", {
"expanded": "Information Technology" "value": "financial-services",
}, { "expanded": "Financial Services"
"value": "nuclear", },
"expanded": "Nuclear" {
}, { "value": "food-agriculture",
"value": "transport", "expanded": "Food and Agriculture"
"expanded": "Transportation Systems" },
}, { {
"value": "water", "value": "government-facilities",
"expanded": "Water and water systems" "expanded": "Government Facilities"
}] },
}] {
"value": "healthcare-public",
"expanded": "Healthcare and Public Health"
},
{
"value": "it",
"expanded": "Information Technology"
},
{
"value": "nuclear",
"expanded": "Nuclear"
},
{
"value": "transport",
"expanded": "Transportation Systems"
},
{
"value": "water",
"expanded": "Water and water systems"
}
]
}
]
} }

4
diamond-model/machinetag.json
View File

@ -3,7 +3,9 @@
"expanded": "Diamond Model for Intrusion Analysis", "expanded": "Diamond Model for Intrusion Analysis",
"description": "The Diamond Model for Intrusion Analysis, a phase-based model developed by Lockheed Martin, aims to help categorise and identify the stage of an attack.", "description": "The Diamond Model for Intrusion Analysis, a phase-based model developed by Lockheed Martin, aims to help categorise and identify the stage of an attack.",
"version": 1, "version": 1,
"ref": ["http://www.activeresponse.org/wp-content/uploads/2013/07/diamond.pdf"], "ref": [
"http://www.activeresponse.org/wp-content/uploads/2013/07/diamond.pdf"
],
"predicates": [ "predicates": [
{ {
"value": "Adversary", "value": "Adversary",

8
domain-abuse/machinetag.json
View File

@ -24,7 +24,7 @@
"expanded": "Registered & active", "expanded": "Registered & active",
"description": "Domain name is registered and DNS is delegated" "description": "Domain name is registered and DNS is delegated"
}, },
{ {
"value": "inactive", "value": "inactive",
"expanded": "Registered & inactive", "expanded": "Registered & inactive",
"description": "Domain name is registered and DNS is not delegated" "description": "Domain name is registered and DNS is not delegated"
@ -34,17 +34,17 @@
"expanded": "Registered & suspended", "expanded": "Registered & suspended",
"description": "Domain name is registered & DNS delegation is temporarily removed by the registry" "description": "Domain name is registered & DNS delegation is temporarily removed by the registry"
}, },
{ {
"value": "not-registered", "value": "not-registered",
"expanded": "Not registered", "expanded": "Not registered",
"description": "Domain name is not registered and open for registration" "description": "Domain name is not registered and open for registration"
}, },
{ {
"value": "not-registrable", "value": "not-registrable",
"expanded": "Not registrable", "expanded": "Not registrable",
"description": "Domain is not registered and cannot be registered" "description": "Domain is not registered and cannot be registered"
}, },
{ {
"value": "grace-period", "value": "grace-period",
"expanded": "Grace period", "expanded": "Grace period",
"description": "Domain is deleted and still reserved for previous owner" "description": "Domain is deleted and still reserved for previous owner"

1067
enisa/machinetag.json
View File

File diff suppressed because it is too large Load Diff

142
eu-marketop-and-publicadmin/machinetag.json
View File

@ -1,62 +1,84 @@
{ {
"namespace": "eu-marketop-and-publicadmin", "namespace": "eu-marketop-and-publicadmin",
"description": "Market operators and public administrations that must comply to some notifications requirements under EU NIS directive", "description": "Market operators and public administrations that must comply to some notifications requirements under EU NIS directive",
"version": 1, "version": 1,
"predicates": [{ "predicates": [
"value": "critical-infra-operators", {
"expanded": "Critical Infrastructure Operators" "value": "critical-infra-operators",
}, { "expanded": "Critical Infrastructure Operators"
"value": "info-services", },
"expanded": "Information Society services enablers" {
}, { "value": "info-services",
"value": "public-admin", "expanded": "Information Society services enablers"
"expanded": "Public administration" },
}], {
"values": [{ "value": "public-admin",
"predicate": "critical-infra-operators", "expanded": "Public administration"
"entry": [{ }
"value": "transport", ],
"expanded": "Transport" "values": [
}, { {
"value": "energy", "predicate": "critical-infra-operators",
"expanded": "Energy" "entry": [
}, { {
"value": "health", "value": "transport",
"expanded": "Health" "expanded": "Transport"
}, { },
"value": "financial", {
"expanded": "Financial market operators" "value": "energy",
}, { "expanded": "Energy"
"value": "banking", },
"expanded": "Banking" {
}] "value": "health",
}, { "expanded": "Health"
"predicate": "info-services", },
"entry": [{ {
"value": "e-commerce", "value": "financial",
"expanded": "e-commerce platforms" "expanded": "Financial market operators"
}, { },
"value": "internet-payment", {
"expanded": "Internet payment" "value": "banking",
}, { "expanded": "Banking"
"value": "cloud", }
"expanded": "cloud computing" ]
}, { },
"value": "search-engines", {
"expanded": "search engines" "predicate": "info-services",
}, { "entry": [
"value": "socnet", {
"expanded": "social networks" "value": "e-commerce",
}, { "expanded": "e-commerce platforms"
"value": "app-stores", },
"expanded": "application stores" {
}] "value": "internet-payment",
}, { "expanded": "Internet payment"
"predicate": "public-admin", },
"entry": [{ {
"value": "public-admin", "value": "cloud",
"expanded": "Public Administrations" "expanded": "cloud computing"
}] },
}] {
"value": "search-engines",
"expanded": "search engines"
},
{
"value": "socnet",
"expanded": "social networks"
},
{
"value": "app-stores",
"expanded": "application stores"
}
]
},
{
"predicate": "public-admin",
"entry": [
{
"value": "public-admin",
"expanded": "Public Administrations"
}
]
}
]
} }

362
europol-incident/machinetag.json
View File

@ -1,195 +1,195 @@
{ {
"version": 1, "version": 1,
"description": "This taxonomy was designed to describe the type of incidents by class.", "description": "This taxonomy was designed to describe the type of incidents by class.",
"expanded": "Europol class of incidents taxonomy", "expanded": "Europol class of incidents taxonomy",
"namespace": "europol-incident", "namespace": "europol-incident",
"predicates": [ "predicates": [
{
"value": "malware",
"expanded": "Malware"
},
{
"value": "availability",
"expanded": "Availability"
},
{
"value": "information-gathering",
"expanded": "Gathering of information"
},
{
"value": "intrusion-attempt",
"expanded": "Intrusion attempt"
},
{
"value": "intrusion",
"expanded": "Intrusion"
},
{
"value": "information-security",
"expanded": "Information security"
},
{
"value": "fraud",
"expanded": "Fraud"
},
{
"value": "abusive-content",
"expanded": "Abusive content"
},
{
"value": "other",
"expanded": "Other"
}
],
"values": [
{
"predicate": "malware",
"entry": [
{ {
"value": "malware", "value": "infection",
"expanded": "Malware" "expanded": "Infection",
"description": "Infecting one or various systems with a specific type of malware."
}, },
{ {
"value": "availability", "value": "distribution",
"expanded": "Availability" "expanded": "Distribution",
"description": "Infecting one or various systems with a specific type of malware."
}, },
{ {
"value": "information-gathering", "value": "c&c",
"expanded": "Gathering of information" "expanded": "C&C",
"description": "Infecting one or various systems with a specific type of malware."
}, },
{ {
"value": "intrusion-attempt", "value": "undetermined",
"expanded": "Intrusion attempt" "expanded": "Undetermined"
},
{
"value": "intrusion",
"expanded": "Intrusion"
},
{
"value": "information-security",
"expanded": "Information security"
},
{
"value": "fraud",
"expanded": "Fraud"
},
{
"value": "abusive-content",
"expanded": "Abusive content"
},
{
"value": "other",
"expanded": "Other"
} }
], ]
"values": [ },
{
"predicate": "availability",
"entry": [
{ {
"predicate": "malware", "value": "dos-ddos",
"entry": [ "expanded": "DoS/DDoS",
{ "description": "Disruption of the processing and response capacity of systems and networks in order to render them inoperative."
"value": "infection",
"expanded": "Infection",
"description": "Infecting one or various systems with a specific type of malware."
},
{
"value": "distribution",
"expanded": "Distribution",
"description": "Infecting one or various systems with a specific type of malware."
},
{
"value": "c&c",
"expanded": "C&C",
"description": "Infecting one or various systems with a specific type of malware."
},
{
"value": "undetermined",
"expanded": "Undetermined"
}
]
}, },
{ {
"predicate": "availability", "value": "sabotage",
"entry": [ "expanded": "Sabotage",
{ "description": "Premeditated action to damage a system, interrupt a process, change or delete information, etc."
"value": "dos-ddos",
"expanded": "DoS/DDoS",
"description": "Disruption of the processing and response capacity of systems and networks in order to render them inoperative."
},
{
"value": "sabotage",
"expanded": "Sabotage",
"description": "Premeditated action to damage a system, interrupt a process, change or delete information, etc."
}
]
},
{
"predicate": "information-gathering",
"entry": [
{
"value": "scanning",
"expanded": "Scanning",
"description": "Active and passive gathering of information on systems or networks."
},
{
"value": "sniffing",
"expanded": "Sniffing",
"description": "Unauthorised monitoring and reading of network traffic."
},
{
"value": "phishing",
"expanded": "Phishing",
"description": "Attempt to gather information on a user or a system through phishing methods."
}
]
},
{
"predicate": "intrusion-attempt",
"entry": [
{
"value": "exploitation-vulnerability",
"expanded": "Exploitation of vulnerability",
"description": "Attempt to intrude by exploiting a vulnerability in a system, component or network."
},
{
"value": "login-attempt",
"expanded": "Login attempt",
"description": "Attempt to log in to services or authentication / access control mechanisms."
}
]
},
{
"predicate": "intrusion",
"entry": [
{
"value": "exploitation-vulnerability",
"expanded": "Exploitation of vulnerability",
"description": "Actual intrusion by exploiting a vulnerability in the system, component or network."
},
{
"value": "compromising-account",
"expanded": "Compromising an account",
"description": "Actual intrusion in a system, component or network by compromising a user or administrator account."
}
]
},
{
"predicate": "information-security",
"entry": [
{
"value": "unauthorized-access",
"expanded": "Unauthorised access",
"description": "Unauthorised access to a particular set of information"
},
{
"value": "unauthorized-modification",
"expanded": "Unauthorised modification/deletion",
"description": "Unauthorised change or elimination of a particular set of information"
}
]
},
{
"predicate": "fraud",
"entry": [
{
"value": "illegitimate-use-resources",
"expanded": "Misuse or unauthorised use of resources",
"description": "Use of institutional resources for purposes other than those intended."
},
{
"value": "illegitimate-use-name",
"expanded": "Illegitimate use of the name of a third party",
"description": "Use of the name of an institution without permission to do so."
}
]
},
{
"predicate": "abusive-content",
"entry": [
{
"value": "spam",
"expanded": "SPAM",
"description": " Sending SPAM messages."
},
{
"value": "copyright",
"expanded": "Copyright",
"description": "Distribution and sharing of copyright protected content."
},
{
"value": "content-forbidden-by-law",
"expanded": "Dissemination of content forbidden by law.",
"description": "Child pornography, racism and apology of violence."
}
]
},
{
"predicate": "other",
"entry": [
{
"value": "other",
"expanded": "Other",
"description": " Other type of unspecified incident"
}
]
} }
] ]
},
{
"predicate": "information-gathering",
"entry": [
{
"value": "scanning",
"expanded": "Scanning",
"description": "Active and passive gathering of information on systems or networks."
},
{
"value": "sniffing",
"expanded": "Sniffing",
"description": "Unauthorised monitoring and reading of network traffic."
},
{
"value": "phishing",
"expanded": "Phishing",
"description": "Attempt to gather information on a user or a system through phishing methods."
}
]
},
{
"predicate": "intrusion-attempt",
"entry": [
{
"value": "exploitation-vulnerability",
"expanded": "Exploitation of vulnerability",
"description": "Attempt to intrude by exploiting a vulnerability in a system, component or network."
},
{
"value": "login-attempt",
"expanded": "Login attempt",
"description": "Attempt to log in to services or authentication / access control mechanisms."
}
]
},
{
"predicate": "intrusion",
"entry": [
{
"value": "exploitation-vulnerability",
"expanded": "Exploitation of vulnerability",
"description": "Actual intrusion by exploiting a vulnerability in the system, component or network."
},
{
"value": "compromising-account",
"expanded": "Compromising an account",
"description": "Actual intrusion in a system, component or network by compromising a user or administrator account."
}
]
},
{
"predicate": "information-security",
"entry": [
{
"value": "unauthorized-access",
"expanded": "Unauthorised access",
"description": "Unauthorised access to a particular set of information"
},
{
"value": "unauthorized-modification",
"expanded": "Unauthorised modification/deletion",
"description": "Unauthorised change or elimination of a particular set of information"
}
]
},
{
"predicate": "fraud",
"entry": [
{
"value": "illegitimate-use-resources",
"expanded": "Misuse or unauthorised use of resources",
"description": "Use of institutional resources for purposes other than those intended."
},
{
"value": "illegitimate-use-name",
"expanded": "Illegitimate use of the name of a third party",
"description": "Use of the name of an institution without permission to do so."
}
]
},
{
"predicate": "abusive-content",
"entry": [
{
"value": "spam",
"expanded": "SPAM",
"description": " Sending SPAM messages."
},
{
"value": "copyright",
"expanded": "Copyright",
"description": "Distribution and sharing of copyright protected content."
},
{
"value": "content-forbidden-by-law",
"expanded": "Dissemination of content forbidden by law.",
"description": "Child pornography, racism and apology of violence."
}
]
},
{
"predicate": "other",
"entry": [
{
"value": "other",
"expanded": "Other",
"description": " Other type of unspecified incident"
}
]
}
]
} }

27
information-security-indicators/machinetag.json
View File

@ -139,7 +139,8 @@
"description": "This indicator measures illicit entrance of individuals into security perimeter." "description": "This indicator measures illicit entrance of individuals into security perimeter."
} }
] ]
},{ },
{
"predicate": "IMF", "predicate": "IMF",
"entry": [ "entry": [
{ {
@ -188,7 +189,8 @@
"description": "This indicator primarily relates to Personal Identifiable Information (PII) protected by privacy laws, to information falling under the PCI-DSS regulation, to information falling under European regulation in the area of breach notification (Telcos and ISPs to begin with), and to information about electronic exchanges between employees and the exterior (electronic messaging and Internet connection). This indicator does not include possible difficulties pertaining to proof forwarding from field operations to governance (state-of-the-art unavailable). This indicator is a sub-set of indicator IMF_LOG.1, but can be identical to this one in advanced organizations." "description": "This indicator primarily relates to Personal Identifiable Information (PII) protected by privacy laws, to information falling under the PCI-DSS regulation, to information falling under European regulation in the area of breach notification (Telcos and ISPs to begin with), and to information about electronic exchanges between employees and the exterior (electronic messaging and Internet connection). This indicator does not include possible difficulties pertaining to proof forwarding from field operations to governance (state-of-the-art unavailable). This indicator is a sub-set of indicator IMF_LOG.1, but can be identical to this one in advanced organizations."
} }
] ]
},{ },
{
"predicate": "IDB", "predicate": "IDB",
"entry": [ "entry": [
{ {
@ -247,7 +249,8 @@
"description": "This event is generally decided and deployed by an administrator in order to improve performance of the system under his/her responsibility (illicit voluntary stoppage). This indicator is a reduced subset of indicator IUS_RGH.5" "description": "This event is generally decided and deployed by an administrator in order to improve performance of the system under his/her responsibility (illicit voluntary stoppage). This indicator is a reduced subset of indicator IUS_RGH.5"
} }
] ]
},{ },
{
"predicate": "IWH", "predicate": "IWH",
"entry": [ "entry": [
{ {
@ -281,7 +284,8 @@
"description": "This indicator measures security incidents tied to assets (on servers) non-inventoried and not managed by appointed teams. It is a key indicator insofar as a high percentage of incidents corresponds with this indicator on average in the profession (according to some public surveys)." "description": "This indicator measures security incidents tied to assets (on servers) non-inventoried and not managed by appointed teams. It is a key indicator insofar as a high percentage of incidents corresponds with this indicator on average in the profession (according to some public surveys)."
} }
] ]
},{ },
{
"predicate": "VBH", "predicate": "VBH",
"entry": [ "entry": [
{ {
@ -400,7 +404,8 @@
"description": "This vulnerability applies to discussions through on-line media leading to leakage of personal identifiable information (PII) or various business details to be used later (notably for identity usurpation) " "description": "This vulnerability applies to discussions through on-line media leading to leakage of personal identifiable information (PII) or various business details to be used later (notably for identity usurpation) "
} }
] ]
},{ },
{
"predicate": "VSW", "predicate": "VSW",
"entry": [ "entry": [
{ {
@ -419,7 +424,8 @@
"description": "This indicators measures software vulnerabilities detected in Web browsers running on workstations." "description": "This indicators measures software vulnerabilities detected in Web browsers running on workstations."
} }
] ]
},{ },
{
"predicate": "VCF", "predicate": "VCF",
"entry": [ "entry": [
{ {
@ -473,7 +479,8 @@
"description": "This indicator measures accounts inactive for at least 2 months that have not been disabled. These accounts are not used by their users due to prolonged but not definitive absence (long term illness, maternity, etc.), with the exclusion of messaging accounts (which should remain accessible to users from their home)." "description": "This indicator measures accounts inactive for at least 2 months that have not been disabled. These accounts are not used by their users due to prolonged but not definitive absence (long term illness, maternity, etc.), with the exclusion of messaging accounts (which should remain accessible to users from their home)."
} }
] ]
},{ },
{
"predicate": "VTC", "predicate": "VTC",
"entry": [ "entry": [
{ {
@ -507,7 +514,8 @@
"description": "This indicator includes access to protected internal areas. The 1st cause is the lack of effective control of users at software level. The 2nd cause is hardware breakdown of a component in the chain." "description": "This indicator includes access to protected internal areas. The 1st cause is the lack of effective control of users at software level. The 2nd cause is hardware breakdown of a component in the chain."
} }
] ]
},{ },
{
"predicate": "VOR", "predicate": "VOR",
"entry": [ "entry": [
{ {
@ -556,7 +564,8 @@
"description": "This indicator measures the launch of new IT projects of a standard type without identification of vulnerabilities and threats and of related security measures. For these IT projects, potential implementation of a simplified risk analysis method or of pre-defined security profiles can be applied." "description": "This indicator measures the launch of new IT projects of a standard type without identification of vulnerabilities and threats and of related security measures. For these IT projects, potential implementation of a simplified risk analysis method or of pre-defined security profiles can be applied."
} }
] ]
},{ },
{
"predicate": "IMP", "predicate": "IMP",
"entry": [ "entry": [
{ {

2
jq_all_the_things.sh
View File

@ -5,7 +5,7 @@ set -x
# Seeds sponge, from moreutils # Seeds sponge, from moreutils
for dir in ./*/list.json for dir in ./*/machinetag.json
do do
cat ${dir} | jq . | sponge ${dir} cat ${dir} | jq . | sponge ${dir}
done done

5
malware_classification/machinetag.json
View File

@ -57,8 +57,8 @@
"expanded": "Spyware" "expanded": "Spyware"
}, },
{ {
"value": "Botnet", "value": "Botnet",
"expanded": "Botnet" "expanded": "Botnet"
} }
] ]
}, },
@ -163,4 +163,3 @@
} }
] ]
} }

50
misp/machinetag.json
View File

@ -19,17 +19,17 @@
"predicate": "api" "predicate": "api"
}, },
{ {
"predicate": "contributor", "predicate": "contributor",
"entry": [ "entry": [
{ {
"expanded": "OpenPGP Fingerprint", "expanded": "OpenPGP Fingerprint",
"value": "pgpfingerprint" "value": "pgpfingerprint"
} }
] ]
}, },
{ {
"predicate": "confidence-level", "predicate": "confidence-level",
"entry": [ "entry": [
{ {
"expanded": "Completely confident", "expanded": "Completely confident",
"value": "completely-confident", "value": "completely-confident",
@ -59,36 +59,36 @@
"expanded": "Confidence cannot be evaluated", "expanded": "Confidence cannot be evaluated",
"value": "confidence-cannot-be-evalued" "value": "confidence-cannot-be-evalued"
} }
] ]
}, },
{ {
"predicate": "threat-level", "predicate": "threat-level",
"entry": [ "entry": [
{ {
"expanded": "No risk", "expanded": "No risk",
"value": "no-risk", "value": "no-risk",
"numerical_value": 0, "numerical_value": 0,
"description": "Harmless information. (CEUS threat level)" "description": "Harmless information. (CEUS threat level)"
}, },
{ {
"expanded": "Low risk", "expanded": "Low risk",
"value": "low-risk", "value": "low-risk",
"numerical_value": 25, "numerical_value": 25,
"description": "Low risk which can include mass-malware. (CEUS threat level)" "description": "Low risk which can include mass-malware. (CEUS threat level)"
}, },
{ {
"expanded": "Medium risk", "expanded": "Medium risk",
"value": "medium-risk", "value": "medium-risk",
"numerical_value": 50, "numerical_value": 50,
"description": "Medium risk which can include targeted attacks (e.g. APT). (CEUS threat level)" "description": "Medium risk which can include targeted attacks (e.g. APT). (CEUS threat level)"
}, },
{ {
"expanded": "High risk", "expanded": "High risk",
"value": "high-risk", "value": "high-risk",
"numerical_value": 100, "numerical_value": 100,
"description": "High risk which can include highly sophisticated attacks or 0-day attack. (CEUS threat level)" "description": "High risk which can include highly sophisticated attacks or 0-day attack. (CEUS threat level)"
} }
] ]
} }
], ],
"predicates": [ "predicates": [

152
passivetotal/machinetag.json
View File

@ -1,86 +1,86 @@
{ {
"namespace" : "passivetotal", "namespace": "passivetotal",
"expanded" : "PassiveTotal", "expanded": "PassiveTotal",
"description": "Tags from RiskIQ's PassiveTotal service", "description": "Tags from RiskIQ's PassiveTotal service",
"version" : 1, "version": 1,
"predicates": [ "predicates": [
{
"value": "sinkholed",
"expanded": "Sinkhole Status"
},
{
"value": "ever-comprimised",
"expanded": "Ever Comprimised?"
},
{
"value": "class",
"expanded": "Classification"
},
{
"value": "dynamic-dns",
"expanded": "Dynamic DNS"
}
],
"values": [
{
"predicate": "sinkholed",
"entry": [
{ {
"value" : "sinkholed", "value": "yes",
"expanded": "Sinkhole Status" "expanded": "Yes"
}, },
{ {
"value" : "ever-comprimised", "value": "no",
"expanded" : "Ever Comprimised?" "expanded": "No"
},
{
"value" : "class",
"expanded" : "Classification"
},
{
"value" : "dynamic-dns",
"expanded": "Dynamic DNS"
} }
], ]
"values" : [ },
{
"predicate": "ever-comprimised",
"entry": [
{ {
"predicate" : "sinkholed", "value": "yes",
"entry" : [ "expanded": "Yes"
{
"value" : "yes",
"expanded": "Yes"
},
{
"value" : "no",
"expanded" : "No"
}
]
}, },
{ {
"predicate" : "ever-comprimised", "value": "no",
"entry" : [ "expanded": "No"
{
"value" : "yes",
"expanded": "Yes"
},
{
"value" : "no",
"expanded" : "No"
}
]
},
{
"predicate" : "dynamic-dns",
"entry" : [
{
"value" : "yes",
"expanded": "Yes"
},
{
"value" : "no",
"expanded" : "No"
}
]
},
{
"predicate" : "class",
"entry" : [
{
"value" : "malicious",
"expanded" : "Malicious"
},
{
"value" : "suspicious",
"expanded": "Malicious"
},
{
"value": "non-malicious",
"expanded": "Non Malicious"
},
{
"value" : "unknown",
"expanded" : "Unknown"
}
]
} }
] ]
},
{
"predicate": "dynamic-dns",
"entry": [
{
"value": "yes",
"expanded": "Yes"
},
{
"value": "no",
"expanded": "No"
}
]
},
{
"predicate": "class",
"entry": [
{
"value": "malicious",
"expanded": "Malicious"
},
{
"value": "suspicious",
"expanded": "Malicious"
},
{
"value": "non-malicious",
"expanded": "Non Malicious"
},
{
"value": "unknown",
"expanded": "Unknown"
}
]
}
]
} }

225
stix-ttp/machinetag.json
View File

@ -1,115 +1,114 @@
{ {
"namespace": "stix-ttp", "namespace": "stix-ttp",
"expanded": "STIX TTP", "expanded": "STIX TTP",
"version": 1, "version": 1,
"description": "TTPs are representations of the behavior or modus operandi of cyber adversaries.", "description": "TTPs are representations of the behavior or modus operandi of cyber adversaries.",
"refs": [ "refs": [
"http://stixproject.github.io/documentation/idioms/industry-sector/" "http://stixproject.github.io/documentation/idioms/industry-sector/"
], ],
"predicates": [ "predicates": [
{ {
"value": "victim-targeting", "value": "victim-targeting",
"expanded": "Victim Targeting" "expanded": "Victim Targeting"
} }
], ],
"values": [ "values": [
{ {
"predicate": "victim-targeting", "predicate": "victim-targeting",
"entry": [ "entry": [
{ {
"value": "business-professional-sector", "value": "business-professional-sector",
"expanded": "Business & Professional Services Sector" "expanded": "Business & Professional Services Sector"
}, },
{ {
"value": "retail-sector", "value": "retail-sector",
"expanded": "Retail Sector" "expanded": "Retail Sector"
}, },
{ {
"value": "financial-sector", "value": "financial-sector",
"expanded": "Financial Services Sector" "expanded": "Financial Services Sector"
}, },
{ {
"value": "media-entertainment-sector", "value": "media-entertainment-sector",
"expanded": "Media & Entertainment Sector" "expanded": "Media & Entertainment Sector"
}, },
{ {
"value": "construction-engineering-sector", "value": "construction-engineering-sector",
"expanded": "Construction & Engineering Sector" "expanded": "Construction & Engineering Sector"
}, },
{ {
"value": "government-international-organizations-sector", "value": "government-international-organizations-sector",
"expanded": "Goverment & International Organizations" "expanded": "Goverment & International Organizations"
}, },
{ {
"value": "legal-sector", "value": "legal-sector",
"expanded": "Legal Services" "expanded": "Legal Services"
}, },
{ {
"value": "hightech-it-sector", "value": "hightech-it-sector",
"expanded": "High-Tech & IT Sector" "expanded": "High-Tech & IT Sector"
}, },
{ {
"value": "healthcare-sector", "value": "healthcare-sector",
"expanded": "Healthcare Sector" "expanded": "Healthcare Sector"
}, },
{ {
"value": "transportation-sector", "value": "transportation-sector",
"expanded": "Transportation Sector" "expanded": "Transportation Sector"
}, },
{ {
"value": "aerospace-defence-sector", "value": "aerospace-defence-sector",
"expanded": "Aerospace & Defense Sector" "expanded": "Aerospace & Defense Sector"
}, },
{ {
"value": "energy-sector", "value": "energy-sector",
"expanded": "Energy Sector" "expanded": "Energy Sector"
}, },
{ {
"value": "food-sector", "value": "food-sector",
"expanded": "Food Sector" "expanded": "Food Sector"
}, },
{ {
"value": "natural-resources-sector", "value": "natural-resources-sector",
"expanded": "Natural Resources Sector" "expanded": "Natural Resources Sector"
}, },
{ {
"value": "other-sector", "value": "other-sector",
"expanded": "Other Sector" "expanded": "Other Sector"
}, },
{
{ "value": "corporate-employee-information",
"value": "corporate-employee-information", "expanded": "Corporate Employee Information"
"expanded": "Corporate Employee Information" },
}, {
{ "value": "customer-pii",
"value": "customer-pii", "expanded": "Customer PII"
"expanded": "Customer PII" },
}, {
{ "value": "email-lists-archives",
"value": "email-lists-archives", "expanded": "Email Lists/Archives"
"expanded": "Email Lists/Archives" },
}, {
{ "value": "financial-data",
"value": "financial-data", "expanded": "Financial Data"
"expanded": "Financial Data" },
}, {
{ "value": "intellectual-property",
"value": "intellectual-property", "expanded": "Intellectual Property"
"expanded": "Intellectual Property" },
}, {
{ "value": "mobile-phone-contacts",
"value": "mobile-phone-contacts", "expanded": "Mobile Phone Contacts"
"expanded": "Mobile Phone Contacts" },
}, {
{ "value": "user-credentials",
"value": "user-credentials", "expanded": "User Credentials"
"expanded": "User Credentials" },
}, {
{ "value": "authentification-cookies",
"value": "authentification-cookies", "expanded": "Authentication Cookies"
"expanded": "Authentication Cookies" }
} ]
] }
} ]
]
} }