MISP
/
misp-taxonomies
mirror of https://github.com/MISP/misp-taxonomies
2
0
Fork 0
Code Issues Releases Wiki Activity

After running ./jq_all_the_things.sh

pull/189/head
Sebastien Tricaud 2020-04-13 18:30:06 -07:00
parent 3dd06b302e
commit 9dbd12eccb
1 changed files with 87 additions and 87 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

174
trust/machinetag.json
View File

@ -1,89 +1,89 @@
{
"version": 1,
"description": "The Indicator of Trust provides insight about data on what can be trusted and known as a good actor. Similar to a whitelist but on steroids, reusing features one would use with Indicators of Compromise, but to filter out what is known to be good.",
"expanded": "Indicators of Trust",
"namespace": "trust",
"exclusive": true,
"predicates": [
{
"value": "trust",
"expanded": "How much trust the analyst has with this indicator."
},
{
"value": "frequency",
"expanded": "Recency/count of occurence at which the indicator occurs in data."
},
{
"value": "valid",
"expanded": "Whether this indicator was pushed as trusted but cannot be trusted (ie. MD5 cannot be valid because it is cryptographically broken)."
}
],
"values": [
{
"predicate": "trust",
"entry": [
{
"value": "unknown",
"expanded": "Unknown Confidence State"
},
{
"value": "none",
"expanded": "Cannot Trust, no confidence"
},
{
"value": "partial",
"expanded": "Low confidence"
},
{
"value": "relationship",
"expanded": "Inherited Full Trust by a third party that we trust"
},
{
"value": "full",
"expanded": "We fully trust it"
}
]
},
{
"predicate": "frequency",
"entry": [
{
"value": "hourly",
"expanded": "This attribute is likely to happen at an hourly interval"
},
{
"value": "daily",
"expanded": "This attribute is likely to happen at a daily interval"
},
{
"value": "weekly",
"expanded": "This attribute is likely to happen at a weekly interval"
},
{
"value": "monthly",
"expanded": "This attribute is likely to happen at a monthly interval"
},
{
"value": "yearly",
"expanded": "Thie attribute is likely to happen at a yearly interval"
}
]
},
{
"predicate": "valid",
"entry": [
{
"value": "true",
"expanded": "This Trust is valid"
},
{
"value": "false",
"expanded": "This trust is invalid. Such as a MD5 Hash etc."
}
]
}
],
"refs": [
"https://trust.fyi/"
]
"version": 1,
"description": "The Indicator of Trust provides insight about data on what can be trusted and known as a good actor. Similar to a whitelist but on steroids, reusing features one would use with Indicators of Compromise, but to filter out what is known to be good.",
"expanded": "Indicators of Trust",
"namespace": "trust",
"exclusive": true,
"predicates": [
{
"value": "trust",
"expanded": "How much trust the analyst has with this indicator."
},
{
"value": "frequency",
"expanded": "Recency/count of occurence at which the indicator occurs in data."
},
{
"value": "valid",
"expanded": "Whether this indicator was pushed as trusted but cannot be trusted (ie. MD5 cannot be valid because it is cryptographically broken)."
}
],
"values": [
{
"predicate": "trust",
"entry": [
{
"value": "unknown",
"expanded": "Unknown Confidence State"
},
{
"value": "none",
"expanded": "Cannot Trust, no confidence"
},
{
"value": "partial",
"expanded": "Low confidence"
},
{
"value": "relationship",
"expanded": "Inherited Full Trust by a third party that we trust"
},
{
"value": "full",
"expanded": "We fully trust it"
}
]
},
{
"predicate": "frequency",
"entry": [
{
"value": "hourly",
"expanded": "This attribute is likely to happen at an hourly interval"
},
{
"value": "daily",
"expanded": "This attribute is likely to happen at a daily interval"
},
{
"value": "weekly",
"expanded": "This attribute is likely to happen at a weekly interval"
},
{
"value": "monthly",
"expanded": "This attribute is likely to happen at a monthly interval"
},
{
"value": "yearly",
"expanded": "Thie attribute is likely to happen at a yearly interval"
}
]
},
{
"predicate": "valid",
"entry": [
{
"value": "true",
"expanded": "This Trust is valid"
},
{
"value": "false",
"expanded": "This trust is invalid. Such as a MD5 Hash etc."
}
]
}
],
"refs": [
"https://trust.fyi/"
]
}