MISP
/
misp-taxonomies
mirror of https://github.com/MISP/misp-taxonomies
2
0
Fork 0
Code Issues Releases Wiki Activity

JQ all the things

pull/60/head
Raphaël Vinot 2017-02-13 12:02:51 +01:00
parent 94290cfaa9
commit 3099290e4c
15 changed files with 1141 additions and 1090 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
MANIFEST.json
View File

@ -166,9 +166,9 @@
"version": 1
},
{
"description" : "Tags for RiskIQ's passivetotal service",
"name" : "passivetotal",
"version" : 1
"description": "Tags for RiskIQ's passivetotal service",
"name": "passivetotal",
"version": 1
}
]
}

1
csirt_case_classification/machinetag.json
View File

@ -102,4 +102,3 @@
}
]
}

66
dhs-ciip-sectors/machinetag.json
View File

@ -2,63 +2,85 @@
"namespace": "dhs-ciip-sectors",
"description": "DHS critical sectors as in https://www.dhs.gov/critical-infrastructure-sectors",
"version": 2,
"predicates": [{
"predicates": [
{
"value": "DHS-critical-sectors",
"expanded": "DHS critical sectors"
}, {
},
{
"value": "sector",
"expanded": "Sector"
}],
"values": [{
}
],
"values": [
{
"predicate": "DHS-critical-sectors",
"entry": [{
"entry": [
{
"value": "chemical",
"expanded": "Chemical"
}, {
},
{
"value": "commercial-facilities",
"expanded": "Commercial Facilities"
}, {
},
{
"value": "communications",
"expanded": "Communications"
}, {
},
{
"value": "critical-manufacturing",
"expanded": "Critical Manufacturing"
}, {
},
{
"value": "dams",
"expanded": "Dams"
}, {
},
{
"value": "dib",
"expanded": "Defense Industrial Base"
}, {
},
{
"value": "emergency-services",
"expanded": "Emergency services"
}, {
},
{
"value": "energy",
"expanded": "energy"
}, {
},
{
"value": "financial-services",
"expanded": "Financial Services"
}, {
},
{
"value": "food-agriculture",
"expanded": "Food and Agriculture"
}, {
},
{
"value": "government-facilities",
"expanded": "Government Facilities"
}, {
},
{
"value": "healthcare-public",
"expanded": "Healthcare and Public Health"
}, {
},
{
"value": "it",
"expanded": "Information Technology"
}, {
},
{
"value": "nuclear",
"expanded": "Nuclear"
}, {
},
{
"value": "transport",
"expanded": "Transportation Systems"
}, {
},
{
"value": "water",
"expanded": "Water and water systems"
}]
}]
}
]
}
]
}

4
diamond-model/machinetag.json
View File

@ -3,7 +3,9 @@
"expanded": "Diamond Model for Intrusion Analysis",
"description": "The Diamond Model for Intrusion Analysis, a phase-based model developed by Lockheed Martin, aims to help categorise and identify the stage of an attack.",
"version": 1,
"ref": ["http://www.activeresponse.org/wp-content/uploads/2013/07/diamond.pdf"],
"ref": [
"http://www.activeresponse.org/wp-content/uploads/2013/07/diamond.pdf"
],
"predicates": [
{
"value": "Adversary",

1
enisa/machinetag.json
View File

@ -307,7 +307,6 @@
"value": "failure-or-disruption-of-communication-links-communication networks",
"expanded": "Failure or disruption of communication links (communication networks)",
"description": "Threat of failure or malfunction of communications links."
},
{
"value": "failure-of-cable-networks",

70
eu-marketop-and-publicadmin/machinetag.json
View File

@ -2,61 +2,83 @@
"namespace": "eu-marketop-and-publicadmin",
"description": "Market operators and public administrations that must comply to some notifications requirements under EU NIS directive",
"version": 1,
"predicates": [{
"predicates": [
{
"value": "critical-infra-operators",
"expanded": "Critical Infrastructure Operators"
}, {
},
{
"value": "info-services",
"expanded": "Information Society services enablers"
}, {
},
{
"value": "public-admin",
"expanded": "Public administration"
}],
"values": [{
}
],
"values": [
{
"predicate": "critical-infra-operators",
"entry": [{
"entry": [
{
"value": "transport",
"expanded": "Transport"
}, {
},
{
"value": "energy",
"expanded": "Energy"
}, {
},
{
"value": "health",
"expanded": "Health"
}, {
},
{
"value": "financial",
"expanded": "Financial market operators"
}, {
},
{
"value": "banking",
"expanded": "Banking"
}]
}, {
}
]
},
{
"predicate": "info-services",
"entry": [{
"entry": [
{
"value": "e-commerce",
"expanded": "e-commerce platforms"
}, {
},
{
"value": "internet-payment",
"expanded": "Internet payment"
}, {
},
{
"value": "cloud",
"expanded": "cloud computing"
}, {
},
{
"value": "search-engines",
"expanded": "search engines"
}, {
},
{
"value": "socnet",
"expanded": "social networks"
}, {
},
{
"value": "app-stores",
"expanded": "application stores"
}]
}, {
}
]
},
{
"predicate": "public-admin",
"entry": [{
"entry": [
{
"value": "public-admin",
"expanded": "Public Administrations"
}]
}]
}
]
}
]
}

27
information-security-indicators/machinetag.json
View File

@ -139,7 +139,8 @@
"description": "This indicator measures illicit entrance of individuals into security perimeter."
}
]
},{
},
{
"predicate": "IMF",
"entry": [
{
@ -188,7 +189,8 @@
"description": "This indicator primarily relates to Personal Identifiable Information (PII) protected by privacy laws, to information falling under the PCI-DSS regulation, to information falling under European regulation in the area of breach notification (Telcos and ISPs to begin with), and to information about electronic exchanges between employees and the exterior (electronic messaging and Internet connection). This indicator does not include possible difficulties pertaining to proof forwarding from field operations to governance (state-of-the-art unavailable). This indicator is a sub-set of indicator IMF_LOG.1, but can be identical to this one in advanced organizations."
}
]
},{
},
{
"predicate": "IDB",
"entry": [
{
@ -247,7 +249,8 @@
"description": "This event is generally decided and deployed by an administrator in order to improve performance of the system under his/her responsibility (illicit voluntary stoppage). This indicator is a reduced subset of indicator IUS_RGH.5"
}
]
},{
},
{
"predicate": "IWH",
"entry": [
{
@ -281,7 +284,8 @@
"description": "This indicator measures security incidents tied to assets (on servers) non-inventoried and not managed by appointed teams. It is a key indicator insofar as a high percentage of incidents corresponds with this indicator on average in the profession (according to some public surveys)."
}
]
},{
},
{
"predicate": "VBH",
"entry": [
{
@ -400,7 +404,8 @@
"description": "This vulnerability applies to discussions through on-line media leading to leakage of personal identifiable information (PII) or various business details to be used later (notably for identity usurpation) "
}
]
},{
},
{
"predicate": "VSW",
"entry": [
{
@ -419,7 +424,8 @@
"description": "This indicators measures software vulnerabilities detected in Web browsers running on workstations."
}
]
},{
},
{
"predicate": "VCF",
"entry": [
{
@ -473,7 +479,8 @@
"description": "This indicator measures accounts inactive for at least 2 months that have not been disabled. These accounts are not used by their users due to prolonged but not definitive absence (long term illness, maternity, etc.), with the exclusion of messaging accounts (which should remain accessible to users from their home)."
}
]
},{
},
{
"predicate": "VTC",
"entry": [
{
@ -507,7 +514,8 @@
"description": "This indicator includes access to protected internal areas. The 1st cause is the lack of effective control of users at software level. The 2nd cause is hardware breakdown of a component in the chain."
}
]
},{
},
{
"predicate": "VOR",
"entry": [
{
@ -556,7 +564,8 @@
"description": "This indicator measures the launch of new IT projects of a standard type without identification of vulnerabilities and threats and of related security measures. For these IT projects, potential implementation of a simplified risk analysis method or of pre-defined security profiles can be applied."
}
]
},{
},
{
"predicate": "IMP",
"entry": [
{

2
jq_all_the_things.sh
View File

@ -5,7 +5,7 @@ set -x
# Seeds sponge, from moreutils
for dir in ./*/list.json
for dir in ./*/machinetag.json
do
cat ${dir} | jq . | sponge ${dir}
done

1
malware_classification/machinetag.json
View File

@ -163,4 +163,3 @@
}
]
}

64
passivetotal/machinetag.json
View File

@ -1,75 +1,75 @@
{
"namespace" : "passivetotal",
"expanded" : "PassiveTotal",
"namespace": "passivetotal",
"expanded": "PassiveTotal",
"description": "Tags from RiskIQ's PassiveTotal service",
"version" : 1,
"version": 1,
"predicates": [
{
"value" : "sinkholed",
"value": "sinkholed",
"expanded": "Sinkhole Status"
},
{
"value" : "ever-comprimised",
"expanded" : "Ever Comprimised?"
"value": "ever-comprimised",
"expanded": "Ever Comprimised?"
},
{
"value" : "class",
"expanded" : "Classification"
"value": "class",
"expanded": "Classification"
},
{
"value" : "dynamic-dns",
"value": "dynamic-dns",
"expanded": "Dynamic DNS"
}
],
"values" : [
"values": [
{
"predicate" : "sinkholed",
"entry" : [
"predicate": "sinkholed",
"entry": [
{
"value" : "yes",
"value": "yes",
"expanded": "Yes"
},
{
"value" : "no",
"expanded" : "No"
"value": "no",
"expanded": "No"
}
]
},
{
"predicate" : "ever-comprimised",
"entry" : [
"predicate": "ever-comprimised",
"entry": [
{
"value" : "yes",
"value": "yes",
"expanded": "Yes"
},
{
"value" : "no",
"expanded" : "No"
"value": "no",
"expanded": "No"
}
]
},
{
"predicate" : "dynamic-dns",
"entry" : [
"predicate": "dynamic-dns",
"entry": [
{
"value" : "yes",
"value": "yes",
"expanded": "Yes"
},
{
"value" : "no",
"expanded" : "No"
"value": "no",
"expanded": "No"
}
]
},
{
"predicate" : "class",
"entry" : [
"predicate": "class",
"entry": [
{
"value" : "malicious",
"expanded" : "Malicious"
"value": "malicious",
"expanded": "Malicious"
},
{
"value" : "suspicious",
"value": "suspicious",
"expanded": "Malicious"
},
{
@ -77,8 +77,8 @@
"expanded": "Non Malicious"
},
{
"value" : "unknown",
"expanded" : "Unknown"
"value": "unknown",
"expanded": "Unknown"
}
]
}

1
stix-ttp/machinetag.json
View File

@ -76,7 +76,6 @@
"value": "other-sector",
"expanded": "Other Sector"
},
{
"value": "corporate-employee-information",
"expanded": "Corporate Employee Information"