From 4bc5cbaab7385c9b9ce03469394a63164386f0db Mon Sep 17 00:00:00 2001
From: Alexandre Dulaunoy <a@foo.be>
Date: Thu, 2 Mar 2017 22:00:56 +0100
Subject: [PATCH] Proposal for blocking module expansion

---
 misp/machinetag.json | 16 +++++++++++++++-
 1 file changed, 15 insertions(+), 1 deletion(-)

diff --git a/misp/machinetag.json b/misp/machinetag.json
index 1788c17..07d970a 100644
--- a/misp/machinetag.json
+++ b/misp/machinetag.json
@@ -18,6 +18,15 @@
       ],
       "predicate": "api"
     },
+    {
+      "entry": [
+       {
+          "expanded": "block",
+          "value": "block"
+       }
+      ],
+      "predicate": "expansion"
+    },
     {
       "predicate": "contributor",
       "entry": [
@@ -116,9 +125,14 @@
       "description": "Event with this tag should not be synced to other MISP instances",
       "expanded": "Should not sync",
       "value": "should-not-sync"
+    },
+    {
+      "description": "Expansion tag incluencing the MISP behavior using expansion modules",
+      "expanded": "Expansion",
+      "value": "expansion"
     }
   ],
-  "version": 3,
+  "version": 4,
   "description": "MISP taxonomy to infer with MISP behavior or operation.",
   "expanded": "MISP",
   "namespace": "misp"