From 4a36d1b78f7ab79b21bfd64b59e2412d1eace9f4 Mon Sep 17 00:00:00 2001
From: Michael Hamm <michael.hamm@smile.public.lu>
Date: Wed, 3 Jan 2018 10:25:36 +0100
Subject: [PATCH] Honeypot basic taxonomy

---
 honeypot_basic/machinetag.json | 54 ++++++++++++++++++++++++++++++++++
 1 file changed, 54 insertions(+)
 create mode 100644 honeypot_basic/machinetag.json

diff --git a/honeypot_basic/machinetag.json b/honeypot_basic/machinetag.json
new file mode 100644
index 0000000..0197668
--- /dev/null
+++ b/honeypot_basic/machinetag.json
@@ -0,0 +1,54 @@
+{
+  "namespace": "honeypot_basic",
+  "description": "Christian Seifert, Ian Welch, Peter Komisarczuk, ‘Taxonomy of Honeypots’, Technical Report CS-TR-06/12, VICTORIA UNIVERSITY OF WELLINGTON, School of Mathematical and Computing Sciences, June 2006, http://www.mcs.vuw.ac.nz/comp/Publications/archive/CS-TR-06/CS-TR-06-12.pdf",
+  "version": 1,
+  "predicates": [
+    {
+      "value": "interaction-level",
+      "expanded": "Interaction Level",
+      "description": "Describes whether the exposed functionality of a honeypot is limited in some way, which is usually the case for honeypots that simulate services."
+    },
+    {
+      "value": "interaction-level",
+      "expanded": "Interaction Level",
+      "description": "Describes whether the exposed functionality of a honeypot is limited in some way, which is usually the case for honeypots that simulate services."
+    },
+    {
+      "value": "interaction-level",
+      "expanded": "Interaction Level",
+      "description": "Describes whether the exposed functionality of a honeypot is limited in some way, which is usually the case for honeypots that simulate services."
+    },
+    {
+      "value": "interaction-level",
+      "expanded": "Interaction Level",
+      "description": "Describes whether the exposed functionality of a honeypot is limited in some way, which is usually the case for honeypots that simulate services."
+    },
+    {
+      "value": "interaction-level",
+      "expanded": "Interaction Level",
+      "description": "Describes whether the exposed functionality of a honeypot is limited in some way, which is usually the case for honeypots that simulate services."
+    },
+    {
+      "value": "interaction-level",
+      "expanded": "Interaction Level",
+      "description": "Describes whether the exposed functionality of a honeypot is limited in some way, which is usually the case for honeypots that simulate services."
+    }
+  ],
+  "values": [
+    {
+      "predicate": "interaction-level",
+      "entry": [
+        {
+          "value": "high",
+          "expanded": "High Interaction Level",
+          "description": "Exposed functionality of the honeypot is not limited."
+        },
+        {
+          "value": "low",
+          "expanded": "low Interaction Level",
+          "description": "Exposed functionality being limited. For example, a simulated SSH server of a honeypot is not able to authenticate against a valid login/password combination"
+        }
+      ]
+    }
+  ]
+}