Warning lists to inform users of MISP about potential false-positives or other information in indicators
Go to file
Alexandre Dulaunoy 52b22ff990 Travis test scripts added 2016-06-24 10:55:51 +02:00
lists RFC 5735 added 2016-06-24 10:53:23 +02:00
tools Alexa top 1000 MISP warning list added including generation tool 2016-05-28 21:31:40 +02:00
.travis.yml Travis test scripts added 2016-06-24 10:55:51 +02:00
README.md RFC 5735 added 2016-06-24 10:53:23 +02:00

README.md

misp-warninglist

misp-warninglists are lists of well-known indicators that can be associated to potential false positives, errors or mistakes.

The warning lists are integrated in MISP to display an info/warning box at the event and attribute level if such indicators are available in one of the list. The list can be globally enabled or disabled in MISP following the practices of the organization.

lists

Format of a warning list

{
  "name": "List of known public DNS resolvers",
  "version": 1,
  "description": "Event contains one or more public DNS resolvers as attribute with an IDS flag set",
  "matching_attributes": [
    "ip-src",
    "ip-dst"
  ],
  "list": [
    "8.8.8.8",
    "8.8.4.4",
    "208.67.222.222",
    "208.67.220.220",
    "195.46.39.39",
    "195.46.39.40"
  ]
}

If matching_attributes are not set, the list is matched against any type of attributes.