Warning lists to inform users of MISP about potential false-positives or other information in indicators
You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
Alexandre Dulaunoy 35b1be4789
chg: [warning-lists] updated
5 days ago
.github/workflows chg: Add PR to GH actions 10 months ago
lists chg: [warning-lists] updated 5 days ago
tools chg: [[publicdns] update the golden list 5 days ago
.gitchangelog.rc chg: [config] gitchangelog configuration added 5 months ago
.gitignore Refactor last scripts, logging, central directory for downloads 1 year ago
.travis.yml Update travis 5 years ago
README.md Fix typo in the license part 3 months ago
_config.yml Set theme jekyll-theme-minimal 5 months ago
generate_all.sh new: List of known SMTP receiving IP addresses 4 months ago
jq_all_the_things.sh chg: Add script to make lists unique, and sort the keys. 2 years ago
requirements.txt new: [crl] Genreate domains and IPs directly from Mozilla intermediate list 4 months ago
schema.json fix: [schema] wildmask is not valid type 4 months ago
validate_all.sh Validate values in CI 1 year ago

README.md

misp-warninglist

misp-warninglists are lists of well-known indicators that can be associated to potential false positives, errors or mistakes.

Python application

The warning lists are integrated in MISP to display an info/warning box at the event and attribute level if such indicators are available in one of the list. The lists are also used to filter potential false-positive at API level. The list can be globally enabled or disabled in MISP following the practices of the organization. The warning lists are reused in many other open source projects.

lists

Format of a warning list

{
  "name": "List of known public DNS resolvers",
  "version": 1,
  "description": "Event contains one or more public DNS resolvers as attribute with an IDS flag set",
  "matching_attributes": [
    "ip-src",
    "ip-dst"
  ],
  "list": [
    "8.8.8.8",
    "8.8.4.4",
    "208.67.222.222",
    "208.67.220.220",
    "195.46.39.39",
    "195.46.39.40"
  ]
}

If matching_attributes are not set, the list is matched against any type of attributes.

type of warning list

  • string (default) - perfect match of a string in the warning list against matching attributes
  • substring - substring matching of a string in the warning list against matching attributes
  • hostname - hostname matching (e.g. domain matching from URL) of a string in the warning list against matching attributes
  • cidr - IP or CDIR block matching in the warning list against matching attributes
  • regex - regex matching of a string matching attributes

Processing warning lists in python

See PyMISPWarningLists for a python interface to warning lists.

License

MISP warning-lists are licensed under CC0 1.0 Universal (CC0 1.0) - Public Domain Dedication. If a specific author of a warning-list (or associated source) wants to license it under a different license, a pull request can be requested.