MISP
/
misp-taxonomies
mirror of https://github.com/MISP/misp-taxonomies
2
0
Fork 0
Code Issues Releases Wiki Activity

After running ./jq_all_the_things.sh

pull/189/head
Sebastien Tricaud 2020-04-13 18:30:06 -07:00
parent 3dd06b302e
commit 9dbd12eccb
1 changed files with 87 additions and 87 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

174
trust/machinetag.json
View File

@ -1,89 +1,89 @@
{ {
"version": 1, "version": 1,
"description": "The Indicator of Trust provides insight about data on what can be trusted and known as a good actor. Similar to a whitelist but on steroids, reusing features one would use with Indicators of Compromise, but to filter out what is known to be good.", "description": "The Indicator of Trust provides insight about data on what can be trusted and known as a good actor. Similar to a whitelist but on steroids, reusing features one would use with Indicators of Compromise, but to filter out what is known to be good.",
"expanded": "Indicators of Trust", "expanded": "Indicators of Trust",
"namespace": "trust", "namespace": "trust",
"exclusive": true, "exclusive": true,
"predicates": [ "predicates": [
{ {
"value": "trust", "value": "trust",
"expanded": "How much trust the analyst has with this indicator." "expanded": "How much trust the analyst has with this indicator."
}, },
{ {
"value": "frequency", "value": "frequency",
"expanded": "Recency/count of occurence at which the indicator occurs in data." "expanded": "Recency/count of occurence at which the indicator occurs in data."
}, },
{ {
"value": "valid", "value": "valid",
"expanded": "Whether this indicator was pushed as trusted but cannot be trusted (ie. MD5 cannot be valid because it is cryptographically broken)." "expanded": "Whether this indicator was pushed as trusted but cannot be trusted (ie. MD5 cannot be valid because it is cryptographically broken)."
} }
], ],
"values": [ "values": [
{ {
"predicate": "trust", "predicate": "trust",
"entry": [ "entry": [
{ {
"value": "unknown", "value": "unknown",
"expanded": "Unknown Confidence State" "expanded": "Unknown Confidence State"
}, },
{ {
"value": "none", "value": "none",
"expanded": "Cannot Trust, no confidence" "expanded": "Cannot Trust, no confidence"
}, },
{ {
"value": "partial", "value": "partial",
"expanded": "Low confidence" "expanded": "Low confidence"
}, },
{ {
"value": "relationship", "value": "relationship",
"expanded": "Inherited Full Trust by a third party that we trust" "expanded": "Inherited Full Trust by a third party that we trust"
}, },
{ {
"value": "full", "value": "full",
"expanded": "We fully trust it" "expanded": "We fully trust it"
} }
] ]
}, },
{ {
"predicate": "frequency", "predicate": "frequency",
"entry": [ "entry": [
{ {
"value": "hourly", "value": "hourly",
"expanded": "This attribute is likely to happen at an hourly interval" "expanded": "This attribute is likely to happen at an hourly interval"
}, },
{ {
"value": "daily", "value": "daily",
"expanded": "This attribute is likely to happen at a daily interval" "expanded": "This attribute is likely to happen at a daily interval"
}, },
{ {
"value": "weekly", "value": "weekly",
"expanded": "This attribute is likely to happen at a weekly interval" "expanded": "This attribute is likely to happen at a weekly interval"
}, },
{ {
"value": "monthly", "value": "monthly",
"expanded": "This attribute is likely to happen at a monthly interval" "expanded": "This attribute is likely to happen at a monthly interval"
}, },
{ {
"value": "yearly", "value": "yearly",
"expanded": "Thie attribute is likely to happen at a yearly interval" "expanded": "Thie attribute is likely to happen at a yearly interval"
} }
] ]
}, },
{ {
"predicate": "valid", "predicate": "valid",
"entry": [ "entry": [
{ {
"value": "true", "value": "true",
"expanded": "This Trust is valid" "expanded": "This Trust is valid"
}, },
{ {
"value": "false", "value": "false",
"expanded": "This trust is invalid. Such as a MD5 Hash etc." "expanded": "This trust is invalid. Such as a MD5 Hash etc."
} }
] ]
} }
], ],
"refs": [ "refs": [
"https://trust.fyi/" "https://trust.fyi/"
] ]
} }