Warning lists to inform users of MISP about potential false-positives or other information in indicators

forensics misp network threat-intelligence threat-sharing warning-lists warninglists

Go to file

Alexandre Dulaunoy 6850a349c0 known microsoft domains added		2016-10-01 20:08:27 +02:00
lists	warning list of known microsoft domains added	2016-10-01 20:07:25 +02:00
tools	Add a tool to generate public dns resolver list	2016-08-03 19:59:55 +02:00
.travis.yml	View error output from jq	2016-08-06 10:51:51 +02:00
README.md	known microsoft domains added	2016-10-01 20:08:27 +02:00

README.md

misp-warninglist

misp-warninglists are lists of well-known indicators that can be associated to potential false positives, errors or mistakes.

The warning lists are integrated in MISP to display an info/warning box at the event and attribute level if such indicators are available in one of the list. The list can be globally enabled or disabled in MISP following the practices of the organization.

lists

lists/alexa - Top 1000 websites from Alexa
lists/empty-hashes - hash values of empty files
lists/google - known domains and hostnames from Google
lists/ipv6-linklocal - IPv6 link local prefix
lists/microsoft - known microsoft domains
lists/multicast - known IPv4 multicast CIDR blocks
lists/public-dns-v4 - IPv4 addresses and reverse of public DNS resolver
lists/public-dns-v6 - IPv6 addresses and reverse of public DNS resolver
lists/rfc1918 - RFC 1918 network subnets
lists/rfc3849 - RFC 3849 - Documentation prefix for ipv6
lists/rfc5735 - RFC 5735 CIDR blocks - Special Use IPv4 Addresses
lists/second-level-tlds - Mozilla list of second level top-level domains
lists/tlds - top-level domains

Format of a warning list

{
  "name": "List of known public DNS resolvers",
  "version": 1,
  "description": "Event contains one or more public DNS resolvers as attribute with an IDS flag set",
  "matching_attributes": [
    "ip-src",
    "ip-dst"
  ],
  "list": [
    "8.8.8.8",
    "8.8.4.4",
    "208.67.222.222",
    "208.67.220.220",
    "195.46.39.39",
    "195.46.39.40"
  ]
}

If matching_attributes are not set, the list is matched against any type of attributes.

License

MISP warning-lists are licensed under CC0 1.0 Universal (CC0 1.0) - Public Domain Dedication. If a specific author of a taxonomy wants to license it under a different license, a pull request can be requested.