MISP
/
misp-taxonomies
mirror of https://github.com/MISP/misp-taxonomies
2
0
Fork 0
Code Issues Releases Wiki Activity

chg: [all] Sami request to have "numerical values" for the decaying indicators project

pull/154/head
Alexandre Dulaunoy 2019-06-25 12:38:47 +02:00
parent 02f8456192
commit 94ec6b6bfa
No known key found for this signature in database
GPG Key ID: 09E2CD4944E6CBCD
4 changed files with 59 additions and 33 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
MANIFEST.json
View File

@ -191,7 +191,7 @@
"description": "Malware classification based on a SANS whitepaper about malware."
},
{
"version": 5,
"version": 9,
"name": "misp",
"description": "Internal MISP taxonomy."
},
@ -271,7 +271,7 @@
"description": "Vocabulary for Event Recording and Incident Sharing (VERIS)."
},
{
"version": 1,
"version": 2,
"name": "vocabulaire-des-probabilites-estimatives",
"description": "Vocabulaire des probabilités estimatives"
},
@ -311,7 +311,7 @@
"description": "Sectors and sub sectors as identified by the NIS Directive."
},
{
"version": 2,
"version": 3,
"name": "economical-impact",
"description": "Economical impact is a taxonomy to describe the financial impact as positive or negative gain to the tagged information."
},
@ -475,5 +475,5 @@
"url": "https://raw.githubusercontent.com/MISP/misp-taxonomies/master/",
"description": "Manifest file of MISP taxonomies available.",
"license": "CC-0",
"version": "20190621"
"version": "20190625"
}

56
economical-impact/machinetag.json
View File

@ -2,7 +2,7 @@
"namespace": "economical-impact",
"expanded": " Economical Impact",
"description": "Economical impact is a taxonomy to describe the financial impact as positive or negative gain to the tagged information (e.g. data exfiltration loss, a positive gain for an adversary).",
"version": 2,
"version": 3,
"refs": [
"https://www.misp-project.org/"
],
@ -12,39 +12,48 @@
"entry": [
{
"value": "none",
"expanded": "No loss"
"expanded": "No loss",
"numerical_value": 0
},
{
"value": "less-than-25k-eur",
"expanded": "Less than 25K EUR"
"expanded": "Less than 25K EUR",
"numerical_value": 10
},
{
"value": "less-than-50k-euro",
"expanded": "Less than 50K EUR"
"expanded": "Less than 50K EUR",
"numerical_value": 20
},
{
"value": "less-than-100k-euro",
"expanded": "Less than 100K EUR"
"expanded": "Less than 100K EUR",
"numerical_value": 30
},
{
"value": "less-than-1M-euro",
"expanded": "Less than 1 million EUR"
"expanded": "Less than 1 million EUR",
"numerical_value": 40
},
{
"value": "less-than-10M-euro",
"expanded": "Less than 10 million EUR"
"expanded": "Less than 10 million EUR",
"numerical_value": 50
},
{
"value": "less-than-100M-euro",
"expanded": "Less than 100 million EUR"
"expanded": "Less than 100 million EUR",
"numerical_value": 60
},
{
"value": "less-than-1B-euro",
"expanded": "Less than 1 billion EUR"
"expanded": "Less than 1 billion EUR",
"numerical_value": 70
},
{
"value": "more-than-1B-euro",
"expanded": "More than 1 billion EUR"
"expanded": "More than 1 billion EUR",
"numerical_value": 80
}
]
},
@ -53,39 +62,48 @@
"entry": [
{
"value": "none",
"expanded": "No gain"
"expanded": "No gain",
"numerical_value": 0
},
{
"value": "less-than-25k-eur",
"expanded": "Less than 25K EUR"
"expanded": "Less than 25K EUR",
"numerical_value": 10
},
{
"value": "less-than-50k-euro",
"expanded": "Less than 50K EUR"
"expanded": "Less than 50K EUR",
"numerical_value": 20
},
{
"value": "less-than-100k-euro",
"expanded": "Less than 100K EUR"
"expanded": "Less than 100K EUR",
"numerical_value": 30
},
{
"value": "less-than-1M-euro",
"expanded": "Less than 1 million EUR"
"expanded": "Less than 1 million EUR",
"numerical_value": 40
},
{
"value": "less-than-10M-euro",
"expanded": "Less than 10 million EUR"
"expanded": "Less than 10 million EUR",
"numerical_value": 50
},
{
"value": "less-than-100M-euro",
"expanded": "Less than 100 million EUR"
"expanded": "Less than 100 million EUR",
"numerical_value": 60
},
{
"value": "less-than-1B-euro",
"expanded": "Less than 1 billion EUR"
"expanded": "Less than 1 billion EUR",
"numerical_value": 70
},
{
"value": "more-than-1B-euro",
"expanded": "More than 1 billion EUR"
"expanded": "More than 1 billion EUR",
"numerical_value": 80
}
]
}

11
estimative-language/machinetag.json
View File

@ -2,7 +2,7 @@
"namespace": "estimative-language",
"expanded": "Estimative languages",
"description": "Estimative language to describe quality and credibility of underlying sources, data, and methodologies based Intelligence Community Directive 203 (ICD 203) and JP 2-0, Joint Intelligence",
"version": 3,
"version": 4,
"predicates": [
{
"value": "likelihood-probability",
@ -62,17 +62,20 @@
{
"value": "low",
"expanded": "Low",
"description": "Uncorroborated information from good or marginal sources. Many assumptions. Mostly weak logical inferences, minimal methods application. Glaring intelligence gaps exist. Terms or expressions used: 'Possible', 'Could, may, might', 'Cannot judge, unclear.'"
"description": "Uncorroborated information from good or marginal sources. Many assumptions. Mostly weak logical inferences, minimal methods application. Glaring intelligence gaps exist. Terms or expressions used: 'Possible', 'Could, may, might', 'Cannot judge, unclear.'",
"numerical_value": 0
},
{
"value": "moderate",
"expanded": "Moderate",
"description": "Partially corroborated information from good sources. Several assumptions. Mix of strong and weak inferences and methods. Minimum intelligence gaps exist. Terms or expressions used: 'Likely, unlikely', 'Probable, improbable' 'Anticipate, appear'."
"description": "Partially corroborated information from good sources. Several assumptions. Mix of strong and weak inferences and methods. Minimum intelligence gaps exist. Terms or expressions used: 'Likely, unlikely', 'Probable, improbable' 'Anticipate, appear'.",
"numerical_value": 55
},
{
"value": "high",
"expanded": "High",
"description": "Well-corroborated information from proven sources. Minimal assumptions. Strong logical inferences and methods. No or minor intelligence gaps exist. Terms or expressions used: 'Will, will not', 'Almost certainly, remote', 'Highly likely, highly unlikely', 'Expect, assert, affirm'."
"description": "Well-corroborated information from proven sources. Minimal assumptions. Strong logical inferences and methods. No or minor intelligence gaps exist. Terms or expressions used: 'Will, will not', 'Almost certainly, remote', 'Highly likely, highly unlikely', 'Expect, assert, affirm'.",
"numerical_value": 95
}
]
}

17
vocabulaire-des-probabilites-estimatives/machinetag.json
View File

@ -4,23 +4,28 @@
"entry": [
{
"expanded": "Presque aucune chance - Quasi impossible Presque impossible Minces chances Très douteux Très peu probable Très improbable Improbable Peu de chances - 7 % (marge d’erreur d’environ 5 %)",
"value": "presque-aucune-chance"
"value": "presque-aucune-chance",
"numerical_value": 7
},
{
"expanded": "Probablement pas - Invraisemblable Peu probable - 30 % (marge d’erreur d’environ 10 %)",
"value": "probablement-pas"
"value": "probablement-pas",
"numerical_value": 30
},
{
"expanded": "Chances à peu près égales - une chance sur deux - 50% (marge d’erreur d’environ 10 %)",
"value": "chances-à-peu-près-egales"
"value": "chances-à-peu-près-egales",
"numerical_value": 50
},
{
"expanded": "Probable - Vraisemblable Probable - 75 % (marge d’erreur d’environ 12 %)",
"value": "probable"
"value": "probable",
"numerical_value": 75
},
{
"expanded": "Quasi certaine - Certain Presque certain Très probable - 93% (marge d’erreur d’environ 6 %)",
"value": "quasi-certaine"
"value": "quasi-certaine",
"numerical_value": 93
}
],
"predicate": "degré-de-probabilité"
@ -33,7 +38,7 @@
"value": "degré-de-probabilité"
}
],
"version": 1,
"version": 2,
"description": "Ce vocabulaire attribue des valeurs en pourcentage à certains énoncés de probabilité",
"expanded": "Vocabulaire des probabilités estimatives",
"namespace": "vocabulaire-des-probabilites-estimatives",