MISP
/
misp-website
mirror of https://github.com/MISP/misp-website
2
0
Fork 0
Code Issues Releases Wiki Activity

chg: [website] objects updated to the latest version

pull/6/head
Alexandre Dulaunoy 2018-09-27 13:35:10 +02:00
parent 82bc03e226
commit 193efc332d
No known key found for this signature in database
GPG Key ID: 09E2CD4944E6CBCD
2 changed files with 17213 additions and 15237 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

126
objects.html
View File

@ -480,6 +480,7 @@ body.book #toc,body.book #preamble,body.book h1.sect0,body.book .sect1>h2{page-b
<li><a href="#_legal_entity">legal-entity</a></li>
<li><a href="#_macho">macho</a></li>
<li><a href="#_macho_section">macho-section</a></li>
<li><a href="#_mactime_timeline_analysis">mactime-timeline-analysis</a></li>
<li><a href="#_malware_config">malware-config</a></li>
<li><a href="#_microblog">microblog</a></li>
<li><a href="#_mutex">mutex</a></li>
@ -6558,6 +6559,124 @@ macho-section is a MISP object available in JSON format at <a href="https://gith
</div>
</div>
<div class="sect1">
<h2 id="_mactime_timeline_analysis"><a class="anchor" href="#_mactime_timeline_analysis"></a><a class="link" href="#_mactime_timeline_analysis">mactime-timeline-analysis</a></h2>
<div class="sectionbody">
<div class="paragraph">
<p>Mactime template, used in forensic investigations to describe the timeline of a file activity.</p>
</div>
<div class="admonitionblock note">
<table>
<tr>
<td class="icon">
<i class="fa icon-note" title="Note"></i>
</td>
<td class="content">
mactime-timeline-analysis is a MISP object available in JSON format at <a href="https://github.com/MISP/misp-objects/blob/master/objects/mactime-timeline-analysis/definition.json"><strong>this location</strong></a> The JSON format can be freely reused in your application or automatically enabled in <a href="https://www.github.com/MISP/MISP">MISP</a>.
</td>
</tr>
</table>
</div>
<table class="tableblock frame-all grid-all stretch">
<colgroup>
<col style="width: 20%;">
<col style="width: 20%;">
<col style="width: 20%;">
<col style="width: 20%;">
<col style="width: 20%;">
</colgroup>
<thead>
<tr>
<th class="tableblock halign-left valign-top">Object attribute</th>
<th class="tableblock halign-left valign-top">MISP attribute type</th>
<th class="tableblock halign-left valign-top">Description</th>
<th class="tableblock halign-left valign-top">Disable correlation</th>
<th class="tableblock halign-left valign-top">Multiple</th>
</tr>
</thead>
<tbody>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock">file-path</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">text</p></td>
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
<p>Location of the file on the disc</p>
</div></div></td>
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
<p><span class="icon"><i class="fa fa-minus"></i></span></p>
</div></div></td>
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
<p><span class="icon"><i class="fa fa-minus"></i></span></p>
</div></div></td>
</tr>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock">datetime</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">datetime</p></td>
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
<p>Date and time when the operation was conducted on the file</p>
</div></div></td>
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
<p><span class="icon"><i class="fa fa-minus"></i></span></p>
</div></div></td>
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
<p><span class="icon"><i class="fa fa-minus"></i></span></p>
</div></div></td>
</tr>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock">file_size</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">text</p></td>
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
<p>Determines the file size in bytes</p>
</div></div></td>
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
<p><span class="icon"><i class="fa fa-minus"></i></span></p>
</div></div></td>
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
<p><span class="icon"><i class="fa fa-minus"></i></span></p>
</div></div></td>
</tr>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock">activityType</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">text</p></td>
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
<p>Determines the type of activity conducted on the file at a given time ['Accessed', 'Created', 'Changed', 'Modified', 'Other']</p>
</div></div></td>
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
<p><span class="icon"><i class="fa fa-minus"></i></span></p>
</div></div></td>
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
<p><span class="icon"><i class="fa fa-minus"></i></span></p>
</div></div></td>
</tr>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock">filePermissions</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">text</p></td>
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
<p>Describes permissions assigned the file</p>
</div></div></td>
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
<p><span class="icon"><i class="fa fa-minus"></i></span></p>
</div></div></td>
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
<p><span class="icon"><i class="fa fa-minus"></i></span></p>
</div></div></td>
</tr>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock">file</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">attachment</p></td>
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
<p>Mactime output file</p>
</div></div></td>
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
<p><span class="icon"><i class="fa fa-minus"></i></span></p>
</div></div></td>
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
<p><span class="icon"><i class="fa fa-minus"></i></span></p>
</div></div></td>
</tr>
</tbody>
</table>
</div>
</div>
<div class="sect1">
<h2 id="_malware_config"><a class="anchor" href="#_malware_config"></a><a class="link" href="#_malware_config">malware-config</a></h2>
<div class="sectionbody">
<div class="paragraph">
@ -13949,6 +14068,11 @@ yara is a MISP object available in JSON format at <a href="https://github.com/MI
<td class="tableblock halign-left valign-top"><p class="tableblock">This relationship describes an object which controls another object.</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">['misp']</p></td>
</tr>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock">annotates</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">This relationships describes an object which annotates another object.</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">['misp']</p></td>
</tr>
</tbody>
</table>
</div>
@ -13956,7 +14080,7 @@ yara is a MISP object available in JSON format at <a href="https://github.com/MI
</div>
<div id="footer">
<div id="footer-text">
Last updated 2018-09-21 07:13:46 CEST
Last updated 2018-09-27 13:34:42 CEST
</div>
</div>
</body>

32324
objects.pdf
View File

File diff suppressed because it is too large Load Diff