diff --git a/_pages/datamodels.md b/_pages/datamodels.md index 6f0841f..01febdd 100755 --- a/_pages/datamodels.md +++ b/_pages/datamodels.md @@ -48,6 +48,7 @@ The MISP format is described as Internet-Draft in [misp-rfc](https://github.com/ |dns-soa-email| | | X | | | | |domain| | | | X | | | |domain|ip| | | | X | | | +|email| | | X | | | | |email-attachment| | | | | | | |email-body| | | | | | | |email-dst| | | | | | | @@ -133,6 +134,8 @@ The MISP format is described as Internet-Draft in [misp-rfc](https://github.com/ |payment-details| | | | | | | |pdb| | X | | | | | |pehash| | | | | | | +|pgp-private-key| | X | | | | | +|pgp-public-key| | X | | | | | |phone-number| | | | | X | | |place-of-birth| | | | | | | |place-port-of-clearance| | | | | | | @@ -226,6 +229,7 @@ The MISP format is described as Internet-Draft in [misp-rfc](https://github.com/ |dns-soa-email| | | | | | | |domain| X | | X | | | | |domain|ip| X | | | | | | +|email| X | | X | | | | |email-attachment| | | X | | | | |email-body| | | X | | | | |email-dst| X | | X | | | | @@ -311,6 +315,8 @@ The MISP format is described as Internet-Draft in [misp-rfc](https://github.com/ |payment-details| | | | | | | |pdb| | | | | | | |pehash| | | X | X | | | +|pgp-private-key| | X | | | | | +|pgp-public-key| | X | | | | | |phone-number| | X | | | | | |place-of-birth| | | | | | | |place-port-of-clearance| | | | | | | @@ -404,6 +410,7 @@ The MISP format is described as Internet-Draft in [misp-rfc](https://github.com/ |dns-soa-email| | | | | |domain| | | | | |domain|ip| | | | | +|email| X | X | | | |email-attachment| | | | | |email-body| | | | | |email-dst| | X | | | @@ -489,6 +496,8 @@ The MISP format is described as Internet-Draft in [misp-rfc](https://github.com/ |payment-details| X | | | | |pdb| | | | | |pehash| | | | | +|pgp-private-key| X | X | | | +|pgp-public-key| X | X | | | |phone-number| X | | | | |place-of-birth| X | | | | |place-port-of-clearance| X | | | | @@ -602,15 +611,16 @@ The MISP format is described as Internet-Draft in [misp-rfc](https://github.com/ * **dns-soa-email**: RFC1035 mandates that DNS zones should have a SOA (Statement Of Authority) record that contains an email address where a PoC for the domain could be contacted. This can sometimes be used for attribution/linkage between different domains even if protected by whois privacy * **domain**: A domain name used in the malware * **domain|ip**: A domain name and its IP address (as found in DNS lookup) separated by a | +* **email**: An e-mail address * **email-attachment**: File name of the email attachment. * **email-body**: Email body -* **email-dst**: A recipient email address +* **email-dst**: The destination email address. Used to describe the recipient when describing an e-mail. * **email-dst-display-name**: Email destination display name * **email-header**: Email header * **email-message-id**: The email message ID * **email-mime-boundary**: The email mime boundary separating parts in a multipart email * **email-reply-to**: Email reply to header -* **email-src**: The email address used to send the malware. +* **email-src**: The source email address. Used to describe the sender when describing an e-mail. * **email-src-display-name**: Email source display name * **email-subject**: The subject of the email * **email-thread-index**: The email thread index header @@ -687,6 +697,8 @@ The MISP format is described as Internet-Draft in [misp-rfc](https://github.com/ * **payment-details**: Payment details * **pdb**: Microsoft Program database (PDB) path information * **pehash**: PEhash - a hash calculated based of certain pieces of a PE executable file +* **pgp-private-key**: A PGP private key +* **pgp-public-key**: A PGP public key * **phone-number**: Telephone Number * **place-of-birth**: Place of birth of a natural person * **place-port-of-clearance**: The port of clearance