Warning lists to inform users of MISP about potential false-positives or other information in indicators
Go to file
Raphaël Vinot 095b5063f3 Merge branch 'master' of github.com:MISP/misp-warninglists 2017-10-28 18:50:45 -04:00
lists Update list.json 2017-09-28 11:14:45 +02:00
tools adding wikipedia scrapper for google domains 2017-06-19 09:09:33 +02:00
.travis.yml Update travis 2017-02-13 11:25:39 +01:00
README.md EICAR added in the README 2017-02-01 14:51:59 +01:00
jq_all_the_things.sh Fix JQ all the things 2017-02-12 21:43:19 +01:00
schema.json matching_attributes isn't required. 2017-02-17 09:54:53 +01:00
validate_all.sh chg: Remove exec flag on json files 2017-10-28 18:50:17 -04:00

README.md

misp-warninglist

misp-warninglists are lists of well-known indicators that can be associated to potential false positives, errors or mistakes.

Build Status

The warning lists are integrated in MISP to display an info/warning box at the event and attribute level if such indicators are available in one of the list. The list can be globally enabled or disabled in MISP following the practices of the organization.

lists

Format of a warning list

{
  "name": "List of known public DNS resolvers",
  "version": 1,
  "description": "Event contains one or more public DNS resolvers as attribute with an IDS flag set",
  "matching_attributes": [
    "ip-src",
    "ip-dst"
  ],
  "list": [
    "8.8.8.8",
    "8.8.4.4",
    "208.67.222.222",
    "208.67.220.220",
    "195.46.39.39",
    "195.46.39.40"
  ]
}

If matching_attributes are not set, the list is matched against any type of attributes.

type of warning list

  • string (default) - perfect match of a string in the warning list against matching attributes
  • substring - substring matching of a string in the warning list against matching attributes
  • hostname - hostname matching (e.g. domain matching from URL) of a string in the warning list against matching attributes

License

MISP warning-lists are licensed under CC0 1.0 Universal (CC0 1.0) - Public Domain Dedication. If a specific author of a taxonomy wants to license it under a different license, a pull request can be requested.