MISP
/
misp-warninglists
mirror of https://github.com/MISP/misp-warninglists
2
0
Fork 0
Code Issues Releases Wiki Activity

chg: Enforce type in schema

pull/46/head
Raphaël Vinot 2017-12-22 15:32:24 +01:00
parent 0f23d9cb18
commit 60aeb28fe8
20 changed files with 47 additions and 49 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
lists/alexa/list.json
View File

@ -1005,7 +1005,8 @@
"hostname", "hostname",
"domain" "domain"
], ],
"type": "hostname",
"name": "Top 1000 website from Alexa", "name": "Top 1000 website from Alexa",
"version": 20170212, "version": 20171222,
"description": "Event contains one or more entries from the top 1000 of the most used website (Alexa)." "description": "Event contains one or more entries from the top 1000 of the most used website (Alexa)."
} }

3
lists/eicar.com/list.json
View File

@ -1,6 +1,6 @@
{ {
"name": "List of hashes for EICAR test virus", "name": "List of hashes for EICAR test virus",
"version": 1, "version": 2,
"description": "Event contains one or more entries based on hashes for EICAR test virus", "description": "Event contains one or more entries based on hashes for EICAR test virus",
"matching_attributes": [ "matching_attributes": [
"md5", "md5",
@ -12,6 +12,7 @@
"filename|sha256", "filename|sha256",
"filename|sha512" "filename|sha512"
], ],
"type": "string",
"list": [ "list": [
"44d88612fea8a8f36de82e1278abb02f", "44d88612fea8a8f36de82e1278abb02f",
"6ce6f415d8475545be5ba114f208b0ff", "6ce6f415d8475545be5ba114f208b0ff",

3
lists/empty-hashes/list.json
View File

@ -1,6 +1,6 @@
{ {
"name": "List of known hashes for empty files", "name": "List of known hashes for empty files",
"version": 1, "version": 2,
"description": "Event contains one or more entries of empty files based on known hashed", "description": "Event contains one or more entries of empty files based on known hashed",
"matching_attributes": [ "matching_attributes": [
"md5", "md5",
@ -14,6 +14,7 @@
"filename|sha256", "filename|sha256",
"filename|sha512" "filename|sha512"
], ],
"type": "string",
"list": [ "list": [
"d41d8cd98f00b204e9800998ecf8427e", "d41d8cd98f00b204e9800998ecf8427e",
"da39a3ee5e6b4b0d3255bfef95601890afd80709", "da39a3ee5e6b4b0d3255bfef95601890afd80709",

3
lists/google/list.json
View File

@ -1,7 +1,8 @@
{ {
"name": "List of known google domains", "name": "List of known google domains",
"version": 3, "version": 4,
"description": "Event contains one or more entries of known google domains", "description": "Event contains one or more entries of known google domains",
"type": "hostname",
"matching_attributes": [ "matching_attributes": [
"domain", "domain",
"hostname", "hostname",

6
lists/ipv6-linklocal/list.json
View File

@ -2,15 +2,13 @@
"list": [ "list": [
"FE80::/10" "FE80::/10"
], ],
"type": [ "type": "cidr",
"cidr"
],
"matching_attributes": [ "matching_attributes": [
"ip-src", "ip-src",
"ip-dst", "ip-dst",
"domain|ip" "domain|ip"
], ],
"description": "Event contains one or more entries part of the IPv6 link local prefix (RFC 4291)", "description": "Event contains one or more entries part of the IPv6 link local prefix (RFC 4291)",
"version": 1, "version": 2,
"name": "List of IPv6 link local blocks" "name": "List of IPv6 link local blocks"
} }

3
lists/microsoft-office365/list.json
View File

@ -1519,7 +1519,8 @@
], ],
"name": "List of known Office 365 URLs and IP address ranges", "name": "List of known Office 365 URLs and IP address ranges",
"description": "Office 365 URLs and IP address ranges", "description": "Office 365 URLs and IP address ranges",
"version": 20170212, "version": 20171222,
"type": "hostname",
"matching_attributes": [ "matching_attributes": [
"ip-src", "ip-src",
"ip-dst", "ip-dst",

3
lists/microsoft/list.json
View File

@ -1,12 +1,13 @@
{ {
"name": "List of known microsoft domains", "name": "List of known microsoft domains",
"version": 1, "version": 2,
"description": "Event contains one or more entries of known microsoft domains", "description": "Event contains one or more entries of known microsoft domains",
"matching_attributes": [ "matching_attributes": [
"domain", "domain",
"hostname", "hostname",
"domain|ip" "domain|ip"
], ],
"type": "hostname",
"list": [ "list": [
".files-df.1drv.com", ".files-df.1drv.com",
".files.1drv.com", ".files.1drv.com",

6
lists/multicast/list.json
View File

@ -17,15 +17,13 @@
"238.0.0.0/8", "238.0.0.0/8",
"239.0.0.0/8" "239.0.0.0/8"
], ],
"type": [ "type": "cidr",
"cidr"
],
"matching_attributes": [ "matching_attributes": [
"ip-src", "ip-src",
"ip-dst", "ip-dst",
"domain|ip" "domain|ip"
], ],
"description": "Event contains one or more entries part of the RFC 5771 multicast CIDR blocks", "description": "Event contains one or more entries part of the RFC 5771 multicast CIDR blocks",
"version": 2, "version": 3,
"name": "List of RFC 5771 multicast CIDR blocks" "name": "List of RFC 5771 multicast CIDR blocks"
} }

6
lists/public-dns-hostname/list.json
View File

@ -25347,9 +25347,7 @@
"url", "url",
"domain|ip" "domain|ip"
], ],
"type": [ "type": "hostname",
"hostname"
],
"name": "List of known public DNS resolvers expressed as hostname", "name": "List of known public DNS resolvers expressed as hostname",
"version": 20171223 "version": 20171224
} }

3
lists/public-dns-v4/list.json
View File

@ -40654,6 +40654,7 @@
"ip-dst", "ip-dst",
"domain|ip" "domain|ip"
], ],
"type": "string",
"name": "List of known IPv4 public DNS resolvers", "name": "List of known IPv4 public DNS resolvers",
"version": 20171222 "version": 20171223
} }

3
lists/public-dns-v6/list.json
View File

@ -278,6 +278,7 @@
"ip-dst", "ip-dst",
"domain|ip" "domain|ip"
], ],
"type": "string",
"name": "List of known IPv6 public DNS resolvers", "name": "List of known IPv6 public DNS resolvers",
"version": 20170212 "version": 20171222
} }

6
lists/rfc1918/list.json
View File

@ -4,15 +4,13 @@
"172.16.0.0/12", "172.16.0.0/12",
"192.168.0.0/16" "192.168.0.0/16"
], ],
"type": [ "type": "cidr",
"cidr"
],
"matching_attributes": [ "matching_attributes": [
"ip-src", "ip-src",
"ip-dst", "ip-dst",
"domain|ip" "domain|ip"
], ],
"description": "Event contains one or more entries part of the RFC 1918 CIDR blocks", "description": "Event contains one or more entries part of the RFC 1918 CIDR blocks",
"version": 2, "version": 3,
"name": "List of RFC 1918 CIDR blocks" "name": "List of RFC 1918 CIDR blocks"
} }

6
lists/rfc3849/list.json
View File

@ -2,15 +2,13 @@
"list": [ "list": [
"2001:DB8::/32" "2001:DB8::/32"
], ],
"type": [ "type": "cidr",
"cidr"
],
"matching_attributes": [ "matching_attributes": [
"ip-src", "ip-src",
"ip-dst", "ip-dst",
"domain|ip" "domain|ip"
], ],
"description": "Event contains one or more entries part of the IPv6 documentation prefix (RFC 3849)", "description": "Event contains one or more entries part of the IPv6 documentation prefix (RFC 3849)",
"version": 2, "version": 3,
"name": "List of RFC 3849 CIDR blocks" "name": "List of RFC 3849 CIDR blocks"
} }

6
lists/rfc5735/list.json
View File

@ -16,15 +16,13 @@
"240.0.0.0/4", "240.0.0.0/4",
"255.255.255.255/32" "255.255.255.255/32"
], ],
"type": [ "type": "cidr",
"cidr"
],
"matching_attributes": [ "matching_attributes": [
"ip-src", "ip-src",
"ip-dst", "ip-dst",
"domain|ip" "domain|ip"
], ],
"description": "Event contains one or more entries part of the RFC 5735 CIDR blocks - Special Use IPv4 Addresses", "description": "Event contains one or more entries part of the RFC 5735 CIDR blocks - Special Use IPv4 Addresses",
"version": 2, "version": 3,
"name": "List of RFC 5735 CIDR blocks" "name": "List of RFC 5735 CIDR blocks"
} }

6
lists/rfc6598/list.json
View File

@ -2,15 +2,13 @@
"list": [ "list": [
"100.64.0.0/10" "100.64.0.0/10"
], ],
"type": [ "type": "cidr",
"cidr"
],
"matching_attributes": [ "matching_attributes": [
"ip-src", "ip-src",
"ip-dst", "ip-dst",
"domain|ip" "domain|ip"
], ],
"description": "Event contains one or more entries part of the RFC 6598 CIDR blocks - Special Use IPv4 Addresses", "description": "Event contains one or more entries part of the RFC 6598 CIDR blocks - Special Use IPv4 Addresses",
"version": 2, "version": 3,
"name": "List of RFC 6598 CIDR blocks" "name": "List of RFC 6598 CIDR blocks"
} }

3
lists/second-level-tlds/list.json
View File

@ -6469,6 +6469,7 @@
"domain", "domain",
"domain|ip" "domain|ip"
], ],
"type": "substring",
"name": "Second level TLDs as known by Mozilla Foundation", "name": "Second level TLDs as known by Mozilla Foundation",
"version": 2 "version": 3
} }

3
lists/tlds/list.json
View File

@ -1296,7 +1296,8 @@
"domain", "domain",
"domain|ip" "domain|ip"
], ],
"type": "substring",
"description": "Event contains one or more TLDs as attribute with an IDS flag set", "description": "Event contains one or more TLDs as attribute with an IDS flag set",
"version": 2, "version": 3,
"name": "TLDs as known by IANA" "name": "TLDs as known by IANA"
} }

6
lists/url-shortener/list.json
View File

@ -1,6 +1,6 @@
{ {
"name": "List of known URL Shorteners domains", "name": "List of known URL Shorteners domains",
"version": 4, "version": 5,
"description": "Event contains one or more entries of known Shorteners domains", "description": "Event contains one or more entries of known Shorteners domains",
"matching_attributes": [ "matching_attributes": [
"domain", "domain",
@ -9,9 +9,7 @@
"url", "url",
"uri" "uri"
], ],
"type": [ "type": "hostname",
"hostname"
],
"list": [ "list": [
"1url.com", "1url.com",
"adcraft.co", "adcraft.co",

3
lists/whats-my-ip/list.json
View File

@ -1,6 +1,6 @@
{ {
"name": "List of known domains to know external IP", "name": "List of known domains to know external IP",
"version": 2, "version": 3,
"description": "Event contains one or more entries of known 'what's is my ip' domains", "description": "Event contains one or more entries of known 'what's is my ip' domains",
"matching_attributes": [ "matching_attributes": [
"domain", "domain",
@ -9,6 +9,7 @@
"uri", "uri",
"url" "url"
], ],
"type": "hostname",
"list": [ "list": [
"2ip.ru", "2ip.ru",
"2ip.tools", "2ip.tools",

15
schema.json
View File

@ -22,11 +22,13 @@
} }
}, },
"type": { "type": {
"type": "array", "type": "string",
"uniqueItems": true, "enum": [
"items": { "string",
"type": "string" "substring",
} "hostname",
"cidr"
]
}, },
"matching_attributes": { "matching_attributes": {
"type": "array", "type": "array",
@ -40,6 +42,7 @@
"list", "list",
"description", "description",
"version", "version",
"name" "name",
"type"
] ]
} }