mirror of https://github.com/MISP/misp-website
chg: [website] objects updated to the latest version
parent
82bc03e226
commit
193efc332d
126
objects.html
126
objects.html
|
|
@ -480,6 +480,7 @@ body.book #toc,body.book #preamble,body.book h1.sect0,body.book .sect1>h2{page-b
|
||||||
<li><a href="#_legal_entity">legal-entity</a></li>
|
<li><a href="#_legal_entity">legal-entity</a></li>
|
||||||
<li><a href="#_macho">macho</a></li>
|
<li><a href="#_macho">macho</a></li>
|
||||||
<li><a href="#_macho_section">macho-section</a></li>
|
<li><a href="#_macho_section">macho-section</a></li>
|
||||||
|
<li><a href="#_mactime_timeline_analysis">mactime-timeline-analysis</a></li>
|
||||||
<li><a href="#_malware_config">malware-config</a></li>
|
<li><a href="#_malware_config">malware-config</a></li>
|
||||||
<li><a href="#_microblog">microblog</a></li>
|
<li><a href="#_microblog">microblog</a></li>
|
||||||
<li><a href="#_mutex">mutex</a></li>
|
<li><a href="#_mutex">mutex</a></li>
|
||||||
|
|
@ -6558,6 +6559,124 @@ macho-section is a MISP object available in JSON format at <a href="https://gith
|
||||||
</div>
|
</div>
|
||||||
</div>
|
</div>
|
||||||
<div class="sect1">
|
<div class="sect1">
|
||||||
|
<h2 id="_mactime_timeline_analysis"><a class="anchor" href="#_mactime_timeline_analysis"></a><a class="link" href="#_mactime_timeline_analysis">mactime-timeline-analysis</a></h2>
|
||||||
|
<div class="sectionbody">
|
||||||
|
<div class="paragraph">
|
||||||
|
<p>Mactime template, used in forensic investigations to describe the timeline of a file activity.</p>
|
||||||
|
</div>
|
||||||
|
<div class="admonitionblock note">
|
||||||
|
<table>
|
||||||
|
<tr>
|
||||||
|
<td class="icon">
|
||||||
|
<i class="fa icon-note" title="Note"></i>
|
||||||
|
</td>
|
||||||
|
<td class="content">
|
||||||
|
mactime-timeline-analysis is a MISP object available in JSON format at <a href="https://github.com/MISP/misp-objects/blob/master/objects/mactime-timeline-analysis/definition.json"><strong>this location</strong></a> The JSON format can be freely reused in your application or automatically enabled in <a href="https://www.github.com/MISP/MISP">MISP</a>.
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
</table>
|
||||||
|
</div>
|
||||||
|
<table class="tableblock frame-all grid-all stretch">
|
||||||
|
<colgroup>
|
||||||
|
<col style="width: 20%;">
|
||||||
|
<col style="width: 20%;">
|
||||||
|
<col style="width: 20%;">
|
||||||
|
<col style="width: 20%;">
|
||||||
|
<col style="width: 20%;">
|
||||||
|
</colgroup>
|
||||||
|
<thead>
|
||||||
|
<tr>
|
||||||
|
<th class="tableblock halign-left valign-top">Object attribute</th>
|
||||||
|
<th class="tableblock halign-left valign-top">MISP attribute type</th>
|
||||||
|
<th class="tableblock halign-left valign-top">Description</th>
|
||||||
|
<th class="tableblock halign-left valign-top">Disable correlation</th>
|
||||||
|
<th class="tableblock halign-left valign-top">Multiple</th>
|
||||||
|
</tr>
|
||||||
|
</thead>
|
||||||
|
<tbody>
|
||||||
|
<tr>
|
||||||
|
<td class="tableblock halign-left valign-top"><p class="tableblock">file-path</p></td>
|
||||||
|
<td class="tableblock halign-left valign-top"><p class="tableblock">text</p></td>
|
||||||
|
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||||||
|
<p>Location of the file on the disc</p>
|
||||||
|
</div></div></td>
|
||||||
|
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||||||
|
<p><span class="icon"><i class="fa fa-minus"></i></span></p>
|
||||||
|
</div></div></td>
|
||||||
|
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||||||
|
<p><span class="icon"><i class="fa fa-minus"></i></span></p>
|
||||||
|
</div></div></td>
|
||||||
|
</tr>
|
||||||
|
<tr>
|
||||||
|
<td class="tableblock halign-left valign-top"><p class="tableblock">datetime</p></td>
|
||||||
|
<td class="tableblock halign-left valign-top"><p class="tableblock">datetime</p></td>
|
||||||
|
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||||||
|
<p>Date and time when the operation was conducted on the file</p>
|
||||||
|
</div></div></td>
|
||||||
|
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||||||
|
<p><span class="icon"><i class="fa fa-minus"></i></span></p>
|
||||||
|
</div></div></td>
|
||||||
|
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||||||
|
<p><span class="icon"><i class="fa fa-minus"></i></span></p>
|
||||||
|
</div></div></td>
|
||||||
|
</tr>
|
||||||
|
<tr>
|
||||||
|
<td class="tableblock halign-left valign-top"><p class="tableblock">file_size</p></td>
|
||||||
|
<td class="tableblock halign-left valign-top"><p class="tableblock">text</p></td>
|
||||||
|
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||||||
|
<p>Determines the file size in bytes</p>
|
||||||
|
</div></div></td>
|
||||||
|
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||||||
|
<p><span class="icon"><i class="fa fa-minus"></i></span></p>
|
||||||
|
</div></div></td>
|
||||||
|
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||||||
|
<p><span class="icon"><i class="fa fa-minus"></i></span></p>
|
||||||
|
</div></div></td>
|
||||||
|
</tr>
|
||||||
|
<tr>
|
||||||
|
<td class="tableblock halign-left valign-top"><p class="tableblock">activityType</p></td>
|
||||||
|
<td class="tableblock halign-left valign-top"><p class="tableblock">text</p></td>
|
||||||
|
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||||||
|
<p>Determines the type of activity conducted on the file at a given time ['Accessed', 'Created', 'Changed', 'Modified', 'Other']</p>
|
||||||
|
</div></div></td>
|
||||||
|
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||||||
|
<p><span class="icon"><i class="fa fa-minus"></i></span></p>
|
||||||
|
</div></div></td>
|
||||||
|
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||||||
|
<p><span class="icon"><i class="fa fa-minus"></i></span></p>
|
||||||
|
</div></div></td>
|
||||||
|
</tr>
|
||||||
|
<tr>
|
||||||
|
<td class="tableblock halign-left valign-top"><p class="tableblock">filePermissions</p></td>
|
||||||
|
<td class="tableblock halign-left valign-top"><p class="tableblock">text</p></td>
|
||||||
|
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||||||
|
<p>Describes permissions assigned the file</p>
|
||||||
|
</div></div></td>
|
||||||
|
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||||||
|
<p><span class="icon"><i class="fa fa-minus"></i></span></p>
|
||||||
|
</div></div></td>
|
||||||
|
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||||||
|
<p><span class="icon"><i class="fa fa-minus"></i></span></p>
|
||||||
|
</div></div></td>
|
||||||
|
</tr>
|
||||||
|
<tr>
|
||||||
|
<td class="tableblock halign-left valign-top"><p class="tableblock">file</p></td>
|
||||||
|
<td class="tableblock halign-left valign-top"><p class="tableblock">attachment</p></td>
|
||||||
|
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||||||
|
<p>Mactime output file</p>
|
||||||
|
</div></div></td>
|
||||||
|
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||||||
|
<p><span class="icon"><i class="fa fa-minus"></i></span></p>
|
||||||
|
</div></div></td>
|
||||||
|
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||||||
|
<p><span class="icon"><i class="fa fa-minus"></i></span></p>
|
||||||
|
</div></div></td>
|
||||||
|
</tr>
|
||||||
|
</tbody>
|
||||||
|
</table>
|
||||||
|
</div>
|
||||||
|
</div>
|
||||||
|
<div class="sect1">
|
||||||
<h2 id="_malware_config"><a class="anchor" href="#_malware_config"></a><a class="link" href="#_malware_config">malware-config</a></h2>
|
<h2 id="_malware_config"><a class="anchor" href="#_malware_config"></a><a class="link" href="#_malware_config">malware-config</a></h2>
|
||||||
<div class="sectionbody">
|
<div class="sectionbody">
|
||||||
<div class="paragraph">
|
<div class="paragraph">
|
||||||
|
|
@ -13949,6 +14068,11 @@ yara is a MISP object available in JSON format at <a href="https://github.com/MI
|
||||||
<td class="tableblock halign-left valign-top"><p class="tableblock">This relationship describes an object which controls another object.</p></td>
|
<td class="tableblock halign-left valign-top"><p class="tableblock">This relationship describes an object which controls another object.</p></td>
|
||||||
<td class="tableblock halign-left valign-top"><p class="tableblock">['misp']</p></td>
|
<td class="tableblock halign-left valign-top"><p class="tableblock">['misp']</p></td>
|
||||||
</tr>
|
</tr>
|
||||||
|
<tr>
|
||||||
|
<td class="tableblock halign-left valign-top"><p class="tableblock">annotates</p></td>
|
||||||
|
<td class="tableblock halign-left valign-top"><p class="tableblock">This relationships describes an object which annotates another object.</p></td>
|
||||||
|
<td class="tableblock halign-left valign-top"><p class="tableblock">['misp']</p></td>
|
||||||
|
</tr>
|
||||||
</tbody>
|
</tbody>
|
||||||
</table>
|
</table>
|
||||||
</div>
|
</div>
|
||||||
|
|
@ -13956,7 +14080,7 @@ yara is a MISP object available in JSON format at <a href="https://github.com/MI
|
||||||
</div>
|
</div>
|
||||||
<div id="footer">
|
<div id="footer">
|
||||||
<div id="footer-text">
|
<div id="footer-text">
|
||||||
Last updated 2018-09-21 07:13:46 CEST
|
Last updated 2018-09-27 13:34:42 CEST
|
||||||
</div>
|
</div>
|
||||||
</div>
|
</div>
|
||||||
</body>
|
</body>
|
||||||
|
|
|
||||||
32324
objects.pdf
32324
objects.pdf
File diff suppressed because it is too large
Load Diff
Loading…
Reference in New Issue