misp-taxonomies/trust/machinetag.json

90 lines
2.4 KiB
JSON

{
"version": 1,
"description": "The Indicator of Trust provides insight about data on what can be trusted and known as a good actor. Similar to a whitelist but on steroids, reusing features one would use with Indicators of Compromise, but to filter out what is known to be good.",
"expanded": "Indicators of Trust",
"namespace": "trust",
"exclusive": true,
"predicates": [
{
"value": "trust",
"expanded": "How much trust the analyst has with this indicator."
},
{
"value": "frequency",
"expanded": "Recency/count of occurence at which the indicator occurs in data."
},
{
"value": "valid",
"expanded": "Whether this indicator was pushed as trusted but cannot be trusted (ie. MD5 cannot be valid because it is cryptographically broken)."
}
],
"values": [
{
"predicate": "trust",
"entry": [
{
"value": "unknown",
"expanded": "Unknown Confidence State"
},
{
"value": "none",
"expanded": "Cannot Trust, no confidence"
},
{
"value": "partial",
"expanded": "Low confidence"
},
{
"value": "relationship",
"expanded": "Inherited Full Trust by a third party that we trust"
},
{
"value": "full",
"expanded": "We fully trust it"
}
]
},
{
"predicate": "frequency",
"entry": [
{
"value": "hourly",
"expanded": "This attribute is likely to happen at an hourly interval"
},
{
"value": "daily",
"expanded": "This attribute is likely to happen at a daily interval"
},
{
"value": "weekly",
"expanded": "This attribute is likely to happen at a weekly interval"
},
{
"value": "monthly",
"expanded": "This attribute is likely to happen at a monthly interval"
},
{
"value": "yearly",
"expanded": "Thie attribute is likely to happen at a yearly interval"
}
]
},
{
"predicate": "valid",
"entry": [
{
"value": "true",
"expanded": "This Trust is valid"
},
{
"value": "false",
"expanded": "This trust is invalid. Such as a MD5 Hash etc."
}
]
}
],
"refs": [
"https://trust.fyi/"
]
}