misp-training/cheatsheets/cheatsheet-data-model.tex

139 lines
7.1 KiB
TeX
Raw Normal View History

\begin{center}{
\huge{\textbf{MISP Data Model Cheat Sheet}}}\\
\end{center}
\begin{multicols*}{3}
\begin{minipage}{0.3\textwidth}
\begin{itemize}[noitemsep,topsep=2pt,parsep=0pt,partopsep=0pt]
\item[\taggable] Context such as \taxonomies or \clusters can be attached to the element
\item[\distributable] Has a distribution level
\item[\synchronisable] Can be synchronised to/from other instances
\end{itemize}
\end{minipage}
\vspace*{0.5em}
% EVENT
\cheatbox[\faicon{envelope}]
[Group datapoints and context together. Acting as an envelop, it allows setting distribution and sharing rules for itself and its children.]
[Encode incidents/events/reports/…]
[\taggable \distributable \synchronisable]
[Encapsulations for contextually linked information.]
{\linkdest{event}Event}
{
$\blacktriangleright$ \events can contain other elements such as \attributes, \objects and \eventreports.\\
$\blacktriangleright$ The distribution level and any context added on an \event (such as \taxonomies) are propagated to its underlying data.
}
% ATTRIBUTE
\cheatbox[\faicon{cube}]
[Individual data point. Can be an indicator or supporting data.]
[Domain, IP, link, sha1, attachment, …]
[\taggable \distributable \synchronisable]
[Basic building block to share information.]
{\linkdest{attribute}Attribute}
{
$\blacktriangleright$ \attributes cannot be duplicated inside the same \event and can have \sightings.\\
$\blacktriangleright$ The difference between an indicator or supporting data is usualy indicated by the state of the attribute's \texttt{to\_ids} flag.
}
% Object
\cheatbox[\faicon{cubes}]
[Groups \attributes that are intrinsically linked together.]
[File, person, credit-card, x509, device, …]
[\distributable \synchronisable]
[Advanced building block providing \attribute compositions via templates.]
{\linkdest{object}MISP Object}
{
$\blacktriangleright$ \objects have their attribute compositions described in their respective template. They are instanciated with \attributes and can \reference other \attributes or \objects.\\
$\blacktriangleright$ MISP is not required to know the template to save and display the object. However, \textit{edits} will not be possible as the template to validate against is unknown.
}
\columnbreak
% Object Reference
\cheatbox[$\nearrow$]
[Allows to create relationships between entities, thus creating a graph where they are the edges and entities are the nodes.]
[Represent behaviours, similarities, affiliation, …]
[\synchronisable]
[Relationships between individual building blocks.]
{\linkdest{reference}Object Reference}
{
$\blacktriangleright$ \references can have a textual relationship which can come from MISP or be set freely.
}
% Sightings
\cheatbox[\faicon{eye}]
[Allows to add temporality to the data.]
[Record activity or occurence, perform IoC expiration, …]
[\synchronisable]
[Means to convey that an \attribute has been seen.]
{\linkdest{sighting}Sightings}
{
$\blacktriangleright$ \sightings are the best way to express that something has been seen. They can also be used to mark \textit{false positives}.
}
% Event report
\cheatbox[\faicon{file-text}]
[Supporting data point to describe events or processes.]
[Encode reports, provide more information about the \event, …]
[\distributable \synchronisable]
[Advanced building block containing formated text.]
{\linkdest{eventreport}Event Report}
{
$\blacktriangleright$ \eventreports are markdown-aware and include a special syntax to reference data points or context.
}
% Proposals
\cheatbox[\faicon{comment}]
[Allow the correction or the creation of \attributes for \events your organisation does not own.]
[Disable the IDS flag, Correct errors]
[\synchronisable]
[Clone of an \attribute containing information about modification to be done.]
{\linkdest{proposal}Proposals}
{
$\blacktriangleright$ As \proposals are sync., if the creator organisation is connected to the MISP instance from where the \proposal has been created, it will be able to either \textit{accept} or \textit{discard} it.
}
\columnbreak
% Taxonomies
\cheatbox[$\mathcal{T}$]
[Enable efficent classification globally understood, easing consumption and automation.]
[Provide classification such as: TLP, Confidence, Source, Workflows, Event type, …]
[]
[Machine and human-readable labels standardised on a common set of vocabularies.]
{\linkdest{taxonomy}Taxonomies}
{
$\blacktriangleright$ Even though MISP allows the creation of free-text tags, it's always preferable to use those coming from \taxonomies, if they exists.
}
% Galaxies
\cheatbox[\faicon{rebel}]
[Bundle \clusters by their type to avoid confusion and to ease searches.]
[Bundle types: Exploit-Kit, Preventive Measures, ATT\&CK, Tools, Threat-actors, …]
[]
[Act as a container to group together context described in \clusters by their type.]
{\linkdest{galaxy}Galaxies}
{}
% Galaxy Clusters
\cheatbox[\faicon{rebel}]
[Enable description of complex high-level information for classification.]
% [\texttt{threat-actor="APT 29"}, \texttt{country="germany"}, \texttt{mitre-attack-pattern="Disk Wipe - T1561"}]
[Extensively describe elements such as: threat actors, countries, technique used, …]
[\distributable \synchronisable]
[Kownledge base items used as tags with additional complex meta-data aimed for human consumption.]
{\linkdest{cluster}Galaxies Clusters}
{
$\blacktriangleright$ \clusters can be seen as an enhanced \taxonomy as they can have meta-data and relationships with other \clusters.\\
$\blacktriangleright$ Any \clusters can contain the following:
\begin{itemize}[noitemsep,topsep=2pt,parsep=0pt,partopsep=0pt]
\item \texttt{Cluster Elements}: Key-Value pair forming the meta-data.
\begin{itemize}[noitemsep,topsep=2pt,parsep=0pt,partopsep=0pt]
\item[Example:] \texttt{Country:LU}, \texttt{Synonym:APT28}, \texttt{Currency:Dollar}, \texttt{refs:https://*}, …
\end{itemize}
\item \texttt{Cluster Relations} (\taggable\synchronisable\distributable): Enable the creation of relationships between one or more \clusters.
\begin{itemize}[noitemsep,topsep=2pt,parsep=0pt,partopsep=0pt]
\item[Example:] Threat actor \texttt{X} \texttt{is similar} to threat actor \texttt{Y} with \texttt{high-likelyhood.}
\end{itemize}
\end{itemize}
}
\end{multicols*}