806 lines
24 KiB
JSON
806 lines
24 KiB
JSON
{
|
|
"namespace": "cccs",
|
|
"description": "Internal taxonomy for CCCS.",
|
|
"version": 2,
|
|
"expanded": "CCCS",
|
|
"predicates": [
|
|
{
|
|
"value": "event",
|
|
"expanded": "Event type",
|
|
"description": "Type of event associated to the internal reference"
|
|
},
|
|
{
|
|
"value": "disclosure-type",
|
|
"expanded": "Disclosure type",
|
|
"description": "Type of information being disclosed."
|
|
},
|
|
{
|
|
"value": "domain-category",
|
|
"expanded": "Domain category",
|
|
"description": "The Domain Category."
|
|
},
|
|
{
|
|
"value": "email-type",
|
|
"expanded": "Email type",
|
|
"description": "Type of email event."
|
|
},
|
|
{
|
|
"value": "exploitation-technique",
|
|
"expanded": "Exploitation technique",
|
|
"description": "The technique used to remotely exploit a GoC system."
|
|
},
|
|
{
|
|
"value": "ip-category",
|
|
"expanded": "Ip category",
|
|
"description": "The IP Category."
|
|
},
|
|
{
|
|
"value": "maliciousness",
|
|
"expanded": "Maliciousness",
|
|
"description": "Level of maliciousness."
|
|
},
|
|
{
|
|
"value": "malware-category",
|
|
"expanded": "Malware category",
|
|
"description": "The Malware Category."
|
|
},
|
|
{
|
|
"value": "misusage-type",
|
|
"expanded": "Misusage type",
|
|
"description": "The type of misusage."
|
|
},
|
|
{
|
|
"value": "mitigation-type",
|
|
"expanded": "Mitigation type",
|
|
"description": "The type of mitigation."
|
|
},
|
|
{
|
|
"value": "origin",
|
|
"expanded": "Origin",
|
|
"description": "Where the request originated from."
|
|
},
|
|
{
|
|
"value": "originating-organization",
|
|
"expanded": "Originating organization",
|
|
"description": "Origin of a signature."
|
|
},
|
|
{
|
|
"value": "scan-type",
|
|
"expanded": "Scan type",
|
|
"description": "The type of scan event."
|
|
},
|
|
{
|
|
"value": "severity",
|
|
"expanded": "Severity",
|
|
"description": "Severity of the event."
|
|
},
|
|
{
|
|
"value": "threat-vector",
|
|
"expanded": "Threat vector",
|
|
"description": "Specifies how the threat actor gained or attempted to gain initial access to the target GoC host."
|
|
}
|
|
],
|
|
"values": [
|
|
{
|
|
"predicate": "event",
|
|
"entry": [
|
|
{
|
|
"value": "beacon",
|
|
"expanded": "Beacon",
|
|
"description": "A host infected with malware is connecting to threat actor owned infrastructure."
|
|
},
|
|
{
|
|
"value": "browser-based-exploitation",
|
|
"expanded": "Browser based exploitation",
|
|
"description": "A browser component is being exploited in order to infect a host."
|
|
},
|
|
{
|
|
"value": "dos",
|
|
"expanded": "Dos",
|
|
"description": "An attack in which the goal is to disrupt access to a host or resource."
|
|
},
|
|
{
|
|
"value": "email",
|
|
"expanded": "Email",
|
|
"description": "Malicious emails sent to a department (baiting, content delivery, phishing)."
|
|
},
|
|
{
|
|
"value": "exfiltration",
|
|
"expanded": "Exfiltration",
|
|
"description": "Unauthorized transfer of data from a target's network to a location a threat actor controls."
|
|
},
|
|
{
|
|
"value": "generic-event",
|
|
"expanded": "Generic event",
|
|
"description": "Represents a collection of virtually identical events within a range of time."
|
|
},
|
|
{
|
|
"value": "improper-usage",
|
|
"expanded": "Improper usage",
|
|
"description": "Technology used in a way that compromises security or violates policy."
|
|
},
|
|
{
|
|
"value": "malware-artifacts",
|
|
"expanded": "Malware artifacts",
|
|
"description": "Signs of the presence of malware observed on a host."
|
|
},
|
|
{
|
|
"value": "malware-download",
|
|
"expanded": "Malware download",
|
|
"description": "Malware was transferred (downloaded/uploaded) to a host."
|
|
},
|
|
{
|
|
"value": "phishing",
|
|
"expanded": "Phishing",
|
|
"description": "Information or credentials disclosed to a threat actor."
|
|
},
|
|
{
|
|
"value": "remote-access",
|
|
"expanded": "Remote access",
|
|
"description": "A threat actor is attempting to or succeeding in remotely logging in to a host."
|
|
},
|
|
{
|
|
"value": "remote-exploitation",
|
|
"expanded": "Remote exploitation",
|
|
"description": "A threat actor is attempting to exploit vulnerabilities remotely."
|
|
},
|
|
{
|
|
"value": "scan",
|
|
"expanded": "Scan",
|
|
"description": "A threat actor is scanning the network."
|
|
},
|
|
{
|
|
"value": "scraping",
|
|
"expanded": "Scraping",
|
|
"description": "Represents a collection of virtually identical scraping events within a range of time."
|
|
},
|
|
{
|
|
"value": "traffic-interception",
|
|
"expanded": "Traffic interception",
|
|
"description": "Represents a collection of virtually identical traffic interception events within a range of time."
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"predicate": "disclosure-type",
|
|
"entry": [
|
|
{
|
|
"value": "goc-credential-disclosure",
|
|
"expanded": "Goc credential disclosure",
|
|
"description": "Credentials for a GoC system or user were disclosed."
|
|
},
|
|
{
|
|
"value": "personal-credential-disclosure",
|
|
"expanded": "Personal credential disclosure",
|
|
"description": "Credentials not related to a GoC system or user were disclosed."
|
|
},
|
|
{
|
|
"value": "personal-information-disclosure",
|
|
"expanded": "Personal information disclosure",
|
|
"description": "Information about a person or persons was disclosed."
|
|
},
|
|
{
|
|
"value": "none",
|
|
"expanded": "None",
|
|
"description": "No information was disclosed."
|
|
},
|
|
{
|
|
"value": "other",
|
|
"expanded": "Other",
|
|
"description": "Information other than credentials and personal information was disclosed."
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"predicate": "domain-category",
|
|
"entry": [
|
|
{
|
|
"value": "c2",
|
|
"expanded": "C2",
|
|
"description": "Domain is being used as command-and-control infrastructure."
|
|
},
|
|
{
|
|
"value": "proxy",
|
|
"expanded": "Proxy",
|
|
"description": "Domain is being used as a proxy."
|
|
},
|
|
{
|
|
"value": "seeded",
|
|
"expanded": "Seeded",
|
|
"description": "Domain has been seeded with malware or other malicious code."
|
|
},
|
|
{
|
|
"value": "wateringhole",
|
|
"expanded": "Wateringhole",
|
|
"description": "Domain is being used a wateringhole."
|
|
},
|
|
{
|
|
"value": "cloud-infrastructure",
|
|
"expanded": "Cloud infrastructure",
|
|
"description": "Domain is hosted on cloud infrastructure."
|
|
},
|
|
{
|
|
"value": "name-server",
|
|
"expanded": "Name server",
|
|
"description": "Domain is a name server."
|
|
},
|
|
{
|
|
"value": "sinkholed",
|
|
"expanded": "Sinkholed",
|
|
"description": "Domain is being re-directed to a sinkhole."
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"predicate": "email-type",
|
|
"entry": [
|
|
{
|
|
"value": "spam",
|
|
"expanded": "Spam",
|
|
"description": "Unsolicited or junk email named after a Monty Python sketch."
|
|
},
|
|
{
|
|
"value": "content\\-delivery\\-attack",
|
|
"expanded": "Content\\-delivery\\-attack",
|
|
"description": "Email contained malicious content or attachments."
|
|
},
|
|
{
|
|
"value": "phishing",
|
|
"expanded": "Phishing",
|
|
"description": "Email designed to trick the recipient into providing sensitive information."
|
|
},
|
|
{
|
|
"value": "baiting",
|
|
"expanded": "Baiting",
|
|
"description": "Email designed to trick the recipient into providing sensitive information."
|
|
},
|
|
{
|
|
"value": "unknown",
|
|
"expanded": "Unknown",
|
|
"description": "Type of email was unknown."
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"predicate": "exploitation-technique",
|
|
"entry": [
|
|
{
|
|
"value": "sql-injection",
|
|
"expanded": "Sql injection",
|
|
"description": "Exploitation occurred due to malicious SQL queries being executed against a database."
|
|
},
|
|
{
|
|
"value": "directory-traversal",
|
|
"expanded": "Directory traversal",
|
|
"description": "Exploitation occurred through a directory traversal attack allowing access to a restricted directory."
|
|
},
|
|
{
|
|
"value": "remote-file-inclusion",
|
|
"expanded": "Remote file inclusion",
|
|
"description": "Exploitation occurred due to vulnerabilities allowing malicious files to be sent."
|
|
},
|
|
{
|
|
"value": "code-injection",
|
|
"expanded": "Code injection",
|
|
"description": "Exploitation occurred due to malicious code being injected."
|
|
},
|
|
{
|
|
"value": "other",
|
|
"expanded": "Other",
|
|
"description": "Other."
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"predicate": "ip-category",
|
|
"entry": [
|
|
{
|
|
"value": "c2",
|
|
"expanded": "C2",
|
|
"description": "IP address is a command-and-control server."
|
|
},
|
|
{
|
|
"value": "proxy",
|
|
"expanded": "Proxy",
|
|
"description": "IP address is a proxy server."
|
|
},
|
|
{
|
|
"value": "seeded",
|
|
"expanded": "Seeded",
|
|
"description": "IP address has been seeded with malware or other malicious code."
|
|
},
|
|
{
|
|
"value": "wateringhole",
|
|
"expanded": "Wateringhole",
|
|
"description": "IP address is a wateringhole."
|
|
},
|
|
{
|
|
"value": "cloud-infrastructure",
|
|
"expanded": "Cloud infrastructure",
|
|
"description": "IP address is part of cloud infrastructure."
|
|
},
|
|
{
|
|
"value": "network-gateway",
|
|
"expanded": "Network gateway",
|
|
"description": "IP address is a network gateway."
|
|
},
|
|
{
|
|
"value": "server",
|
|
"expanded": "Server",
|
|
"description": "IP address is a server of some type."
|
|
},
|
|
{
|
|
"value": "dns-server",
|
|
"expanded": "Dns server",
|
|
"description": "IP address is a DNS server."
|
|
},
|
|
{
|
|
"value": "smtp-server",
|
|
"expanded": "Smtp server",
|
|
"description": "IP address is a mail server."
|
|
},
|
|
{
|
|
"value": "web-server",
|
|
"expanded": "Web server",
|
|
"description": "IP address is a web server."
|
|
},
|
|
{
|
|
"value": "file-server",
|
|
"expanded": "File server",
|
|
"description": "IP address is a file server."
|
|
},
|
|
{
|
|
"value": "database-server",
|
|
"expanded": "Database server",
|
|
"description": "IP address is a database server."
|
|
},
|
|
{
|
|
"value": "security-appliance",
|
|
"expanded": "Security appliance",
|
|
"description": "IP address is a security appliance of some type."
|
|
},
|
|
{
|
|
"value": "tor-node",
|
|
"expanded": "Tor node",
|
|
"description": "IP address is a node of the TOR anonymization system."
|
|
},
|
|
{
|
|
"value": "sinkhole",
|
|
"expanded": "Sinkhole",
|
|
"description": "IP address is a sinkhole."
|
|
},
|
|
{
|
|
"value": "router",
|
|
"expanded": "Router",
|
|
"description": "IP address is a router device."
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"predicate": "maliciousness",
|
|
"entry": [
|
|
{
|
|
"value": "non-malicious",
|
|
"expanded": "Non-malicious",
|
|
"description": "Non-malicious is not malicious or suspicious."
|
|
},
|
|
{
|
|
"value": "suspicious",
|
|
"expanded": "Suspicious",
|
|
"description": "Suspicious is not non-malicious and not malicious."
|
|
},
|
|
{
|
|
"value": "malicious",
|
|
"expanded": "Malicious",
|
|
"description": "Malicious is not non-malicious or suspicious."
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"predicate": "malware-category",
|
|
"entry": [
|
|
{
|
|
"value": "exploit-kit",
|
|
"expanded": "Exploit kit",
|
|
"description": "Toolkit used to attack vulnerabilities in systems."
|
|
},
|
|
{
|
|
"value": "first-stage",
|
|
"expanded": "First stage",
|
|
"description": "Malware used in the initial phase of an attack and commonly used to retrieve a second stage."
|
|
},
|
|
{
|
|
"value": "second-stage",
|
|
"expanded": "Second stage",
|
|
"description": "Typical more complex malware retrieved by first stage malware."
|
|
},
|
|
{
|
|
"value": "scanner",
|
|
"expanded": "Scanner",
|
|
"description": "Malware used to look for common vulnerabilities or running software."
|
|
},
|
|
{
|
|
"value": "downloader",
|
|
"expanded": "Downloader",
|
|
"description": "Malware used to retrieve additional malware or tools."
|
|
},
|
|
{
|
|
"value": "proxy",
|
|
"expanded": "Proxy",
|
|
"description": "Malware used to proxy traffic on an infected host."
|
|
},
|
|
{
|
|
"value": "reverse-proxy",
|
|
"expanded": "Reverse proxy",
|
|
"description": "If you choose this option please provide a description of what it is to the ALFRED PO."
|
|
},
|
|
{
|
|
"value": "webshell",
|
|
"expanded": "Webshell",
|
|
"description": "Malware uploaded to a web server allowing remote access to an attacker."
|
|
},
|
|
{
|
|
"value": "ransomware",
|
|
"expanded": "Ransomware",
|
|
"description": "Malware used to hold infected host's data hostage, typically through encryption until a payment is made to the attackers."
|
|
},
|
|
{
|
|
"value": "adware",
|
|
"expanded": "Adware",
|
|
"description": "Malware used to display ads to the infected host."
|
|
},
|
|
{
|
|
"value": "spyware",
|
|
"expanded": "Spyware",
|
|
"description": "Malware used to collect information from the infected host, such as credentials."
|
|
},
|
|
{
|
|
"value": "virus",
|
|
"expanded": "Virus",
|
|
"description": "Malware that propogates by inserting a copy of itself into another program."
|
|
},
|
|
{
|
|
"value": "worm",
|
|
"expanded": "Worm",
|
|
"description": "Standalone malware that propogates by copying itself.."
|
|
},
|
|
{
|
|
"value": "trojan",
|
|
"expanded": "Trojan",
|
|
"description": "Malware that looks like legitimate software but hides malicious code."
|
|
},
|
|
{
|
|
"value": "rootkit",
|
|
"expanded": "Rootkit",
|
|
"description": "Malware that can hide the existance of other malware by modifying operating system functions."
|
|
},
|
|
{
|
|
"value": "keylogger",
|
|
"expanded": "Keylogger",
|
|
"description": "Malware that runs in the background, capturing keystrokes from a user unknowingly for exfiltration."
|
|
},
|
|
{
|
|
"value": "browser-hijacker",
|
|
"expanded": "Browser hijacker",
|
|
"description": "Malware that re-directs or otherwise intercepts Internet browsing by the user."
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"predicate": "misusage-type",
|
|
"entry": [
|
|
{
|
|
"value": "unauthorized-usage",
|
|
"expanded": "Unauthorized usage",
|
|
"description": "Usage of the system or resource was without appropriate permission or authorization."
|
|
},
|
|
{
|
|
"value": "misconfiguration",
|
|
"expanded": "Misconfiguration",
|
|
"description": "System or resource is misconfigured."
|
|
},
|
|
{
|
|
"value": "lack-of-encryption",
|
|
"expanded": "Lack of encryption",
|
|
"description": "System or resources has insufficient encryption or no encryption."
|
|
},
|
|
{
|
|
"value": "vulnerable-software",
|
|
"expanded": "Vulnerable software",
|
|
"description": "System or resource has software with known vulnerabilities."
|
|
},
|
|
{
|
|
"value": "privilege-escalation",
|
|
"expanded": "Privilege escalation",
|
|
"description": "System or resource was exploited to gain higher privilege level."
|
|
},
|
|
{
|
|
"value": "other",
|
|
"expanded": "Other",
|
|
"description": "Other."
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"predicate": "mitigation-type",
|
|
"entry": [
|
|
{
|
|
"value": "anti-virus",
|
|
"expanded": "Anti-virus",
|
|
"description": "Anti-Virus"
|
|
},
|
|
{
|
|
"value": "content-filtering-system",
|
|
"expanded": "Content filtering system",
|
|
"description": "Content Filtering System"
|
|
},
|
|
{
|
|
"value": "dynamic-defense",
|
|
"expanded": "Dynamic defense",
|
|
"description": "Dynamic Defense"
|
|
},
|
|
{
|
|
"value": "insufficient-privileges",
|
|
"expanded": "Insufficient privileges",
|
|
"description": "Insufficient Privileges"
|
|
},
|
|
{
|
|
"value": "ids",
|
|
"expanded": "Ids",
|
|
"description": "Intrusion Detection System"
|
|
},
|
|
{
|
|
"value": "sink-hole-/-take-down-by-third-party",
|
|
"expanded": "Sink hole / take down by third party",
|
|
"description": "Sink Hole / Take Down by Third Party"
|
|
},
|
|
{
|
|
"value": "isp",
|
|
"expanded": "Isp",
|
|
"description": "Internet Service Provider"
|
|
},
|
|
{
|
|
"value": "invalid-credentials",
|
|
"expanded": "Invalid credentials",
|
|
"description": "Invalid Credentials"
|
|
},
|
|
{
|
|
"value": "not-vulnerable",
|
|
"expanded": "Not vulnerable",
|
|
"description": "No mitigation was required because the system was not vulnerable to the attack."
|
|
},
|
|
{
|
|
"value": "other",
|
|
"expanded": "Other",
|
|
"description": "Other"
|
|
},
|
|
{
|
|
"value": "unknown",
|
|
"expanded": "Unknown",
|
|
"description": "Unknown"
|
|
},
|
|
{
|
|
"value": "user",
|
|
"expanded": "User",
|
|
"description": "User"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"predicate": "origin",
|
|
"entry": [
|
|
{
|
|
"value": "subscriber",
|
|
"expanded": "Subscriber",
|
|
"description": "Subscriber."
|
|
},
|
|
{
|
|
"value": "internet",
|
|
"expanded": "Internet",
|
|
"description": "Internet."
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"predicate": "originating-organization",
|
|
"entry": [
|
|
{
|
|
"value": "cse",
|
|
"expanded": "Cse",
|
|
"description": "Communications Security Establishment."
|
|
},
|
|
{
|
|
"value": "nsa",
|
|
"expanded": "Nsa",
|
|
"description": "National Security Agency."
|
|
},
|
|
{
|
|
"value": "gchq",
|
|
"expanded": "Gchq",
|
|
"description": "Government Communications Headquarters."
|
|
},
|
|
{
|
|
"value": "asd",
|
|
"expanded": "Asd",
|
|
"description": "Australian Signals Directorate."
|
|
},
|
|
{
|
|
"value": "gcsb",
|
|
"expanded": "Gcsb",
|
|
"description": "Government Communications Security Bureau."
|
|
},
|
|
{
|
|
"value": "open-source",
|
|
"expanded": "Open source",
|
|
"description": "Originated from publically available information."
|
|
},
|
|
{
|
|
"value": "3rd-party",
|
|
"expanded": "3rd party",
|
|
"description": "Originated from a 3rd party organization."
|
|
},
|
|
{
|
|
"value": "other",
|
|
"expanded": "Other",
|
|
"description": "Other."
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"predicate": "scan-type",
|
|
"entry": [
|
|
{
|
|
"value": "open-port",
|
|
"expanded": "Open port",
|
|
"description": "Scan was looking for open ports corresponding to common applications or protocols."
|
|
},
|
|
{
|
|
"value": "icmp",
|
|
"expanded": "Icmp",
|
|
"description": "Scan was attempting to enumerate devices through the ICMP protocol."
|
|
},
|
|
{
|
|
"value": "os-fingerprinting",
|
|
"expanded": "Os fingerprinting",
|
|
"description": "Scan was looking for operating system information through unique characteristics in responses."
|
|
},
|
|
{
|
|
"value": "web",
|
|
"expanded": "Web",
|
|
"description": "Scan was enumerating or otherwise traversing web hosts."
|
|
},
|
|
{
|
|
"value": "other",
|
|
"expanded": "Other",
|
|
"description": "Other."
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"predicate": "severity",
|
|
"entry": [
|
|
{
|
|
"value": "reconnaissance",
|
|
"expanded": "Reconnaissance",
|
|
"description": "An actor attempted or succeeded in gaining information that may be used to identify and/or compromise systems or data."
|
|
},
|
|
{
|
|
"value": "attempted-compromise",
|
|
"expanded": "Attempted compromise",
|
|
"description": "An actor attempted affecting the confidentiality, integrity or availability of a system."
|
|
},
|
|
{
|
|
"value": "exploited",
|
|
"expanded": "Exploited",
|
|
"description": "A vulnerability was successfully exploited."
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"predicate": "threat-vector",
|
|
"entry": [
|
|
{
|
|
"value": "application:cms",
|
|
"expanded": "Application:cms",
|
|
"description": "Content Management System."
|
|
},
|
|
{
|
|
"value": "application:bash",
|
|
"expanded": "Application:bash",
|
|
"description": "BASH script."
|
|
},
|
|
{
|
|
"value": "application:acrobat-reader",
|
|
"expanded": "Application:acrobat reader",
|
|
"description": "Adobe Acrobat Reader."
|
|
},
|
|
{
|
|
"value": "application:ms-excel",
|
|
"expanded": "Application:ms excel",
|
|
"description": "Microsoft Excel."
|
|
},
|
|
{
|
|
"value": "application:other",
|
|
"expanded": "Application:other",
|
|
"description": "Other Application."
|
|
},
|
|
{
|
|
"value": "language:sql",
|
|
"expanded": "Language:sql",
|
|
"description": "Structured Query Language."
|
|
},
|
|
{
|
|
"value": "language:php",
|
|
"expanded": "Language:php",
|
|
"description": "PHP: Hypertext Preprocessor."
|
|
},
|
|
{
|
|
"value": "language:javascript",
|
|
"expanded": "Language:javascript",
|
|
"description": "JavaScript."
|
|
},
|
|
{
|
|
"value": "language:other",
|
|
"expanded": "Language:other",
|
|
"description": "Other Language."
|
|
},
|
|
{
|
|
"value": "protocol:dns",
|
|
"expanded": "Protocol:dns",
|
|
"description": "Domain Name System."
|
|
},
|
|
{
|
|
"value": "protocol:ftp",
|
|
"expanded": "Protocol:ftp",
|
|
"description": "File Transfer Protocol."
|
|
},
|
|
{
|
|
"value": "protocol:http",
|
|
"expanded": "Protocol:http",
|
|
"description": "Hyper Text Transfer Protocol."
|
|
},
|
|
{
|
|
"value": "protocol:icmp",
|
|
"expanded": "Protocol:icmp",
|
|
"description": "Internet Control Message Protocol."
|
|
},
|
|
{
|
|
"value": "protocol:ntp",
|
|
"expanded": "Protocol:ntp",
|
|
"description": "Network Time Protocol."
|
|
},
|
|
{
|
|
"value": "protocol:rdp",
|
|
"expanded": "Protocol:rdp",
|
|
"description": "Remote Desktop Protocol."
|
|
},
|
|
{
|
|
"value": "protocol:smb",
|
|
"expanded": "Protocol:smb",
|
|
"description": "Server Message Block."
|
|
},
|
|
{
|
|
"value": "protocol:snmp",
|
|
"expanded": "Protocol:snmp",
|
|
"description": "Simple Network Management Protocol."
|
|
},
|
|
{
|
|
"value": "protocol:ssl",
|
|
"expanded": "Protocol:ssl",
|
|
"description": "Secure Sockets Layer."
|
|
},
|
|
{
|
|
"value": "protocol:telnet",
|
|
"expanded": "Protocol:telnet",
|
|
"description": "Network Virtual Terminal Protocol."
|
|
},
|
|
{
|
|
"value": "protocol:sip",
|
|
"expanded": "Protocol:sip",
|
|
"description": "Session Initiation Protocol."
|
|
}
|
|
]
|
|
}
|
|
]
|
|
}
|