After running ./jq_all_the_things.sh
Sebastien Tricaud
parent
3dd06b302e
commit
9dbd12eccb
|
|
@ -1,89 +1,89 @@
|
|||
{
|
||||
"version": 1,
|
||||
"description": "The Indicator of Trust provides insight about data on what can be trusted and known as a good actor. Similar to a whitelist but on steroids, reusing features one would use with Indicators of Compromise, but to filter out what is known to be good.",
|
||||
"expanded": "Indicators of Trust",
|
||||
"namespace": "trust",
|
||||
"exclusive": true,
|
||||
"predicates": [
|
||||
{
|
||||
"value": "trust",
|
||||
"expanded": "How much trust the analyst has with this indicator."
|
||||
},
|
||||
{
|
||||
"value": "frequency",
|
||||
"expanded": "Recency/count of occurence at which the indicator occurs in data."
|
||||
},
|
||||
{
|
||||
"value": "valid",
|
||||
"expanded": "Whether this indicator was pushed as trusted but cannot be trusted (ie. MD5 cannot be valid because it is cryptographically broken)."
|
||||
}
|
||||
],
|
||||
"values": [
|
||||
{
|
||||
"predicate": "trust",
|
||||
"entry": [
|
||||
{
|
||||
"value": "unknown",
|
||||
"expanded": "Unknown Confidence State"
|
||||
},
|
||||
{
|
||||
"value": "none",
|
||||
"expanded": "Cannot Trust, no confidence"
|
||||
},
|
||||
{
|
||||
"value": "partial",
|
||||
"expanded": "Low confidence"
|
||||
},
|
||||
{
|
||||
"value": "relationship",
|
||||
"expanded": "Inherited Full Trust by a third party that we trust"
|
||||
},
|
||||
{
|
||||
"value": "full",
|
||||
"expanded": "We fully trust it"
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"predicate": "frequency",
|
||||
"entry": [
|
||||
{
|
||||
"value": "hourly",
|
||||
"expanded": "This attribute is likely to happen at an hourly interval"
|
||||
},
|
||||
{
|
||||
"value": "daily",
|
||||
"expanded": "This attribute is likely to happen at a daily interval"
|
||||
},
|
||||
{
|
||||
"value": "weekly",
|
||||
"expanded": "This attribute is likely to happen at a weekly interval"
|
||||
},
|
||||
{
|
||||
"value": "monthly",
|
||||
"expanded": "This attribute is likely to happen at a monthly interval"
|
||||
},
|
||||
{
|
||||
"value": "yearly",
|
||||
"expanded": "Thie attribute is likely to happen at a yearly interval"
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"predicate": "valid",
|
||||
"entry": [
|
||||
{
|
||||
"value": "true",
|
||||
"expanded": "This Trust is valid"
|
||||
},
|
||||
{
|
||||
"value": "false",
|
||||
"expanded": "This trust is invalid. Such as a MD5 Hash etc."
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"refs": [
|
||||
"https://trust.fyi/"
|
||||
]
|
||||
"version": 1,
|
||||
"description": "The Indicator of Trust provides insight about data on what can be trusted and known as a good actor. Similar to a whitelist but on steroids, reusing features one would use with Indicators of Compromise, but to filter out what is known to be good.",
|
||||
"expanded": "Indicators of Trust",
|
||||
"namespace": "trust",
|
||||
"exclusive": true,
|
||||
"predicates": [
|
||||
{
|
||||
"value": "trust",
|
||||
"expanded": "How much trust the analyst has with this indicator."
|
||||
},
|
||||
{
|
||||
"value": "frequency",
|
||||
"expanded": "Recency/count of occurence at which the indicator occurs in data."
|
||||
},
|
||||
{
|
||||
"value": "valid",
|
||||
"expanded": "Whether this indicator was pushed as trusted but cannot be trusted (ie. MD5 cannot be valid because it is cryptographically broken)."
|
||||
}
|
||||
],
|
||||
"values": [
|
||||
{
|
||||
"predicate": "trust",
|
||||
"entry": [
|
||||
{
|
||||
"value": "unknown",
|
||||
"expanded": "Unknown Confidence State"
|
||||
},
|
||||
{
|
||||
"value": "none",
|
||||
"expanded": "Cannot Trust, no confidence"
|
||||
},
|
||||
{
|
||||
"value": "partial",
|
||||
"expanded": "Low confidence"
|
||||
},
|
||||
{
|
||||
"value": "relationship",
|
||||
"expanded": "Inherited Full Trust by a third party that we trust"
|
||||
},
|
||||
{
|
||||
"value": "full",
|
||||
"expanded": "We fully trust it"
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"predicate": "frequency",
|
||||
"entry": [
|
||||
{
|
||||
"value": "hourly",
|
||||
"expanded": "This attribute is likely to happen at an hourly interval"
|
||||
},
|
||||
{
|
||||
"value": "daily",
|
||||
"expanded": "This attribute is likely to happen at a daily interval"
|
||||
},
|
||||
{
|
||||
"value": "weekly",
|
||||
"expanded": "This attribute is likely to happen at a weekly interval"
|
||||
},
|
||||
{
|
||||
"value": "monthly",
|
||||
"expanded": "This attribute is likely to happen at a monthly interval"
|
||||
},
|
||||
{
|
||||
"value": "yearly",
|
||||
"expanded": "Thie attribute is likely to happen at a yearly interval"
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"predicate": "valid",
|
||||
"entry": [
|
||||
{
|
||||
"value": "true",
|
||||
"expanded": "This Trust is valid"
|
||||
},
|
||||
{
|
||||
"value": "false",
|
||||
"expanded": "This trust is invalid. Such as a MD5 Hash etc."
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"refs": [
|
||||
"https://trust.fyi/"
|
||||
]
|
||||
}
|
||||
|
|
|
|||
Loading…
Reference in New Issue