MISP
/
misp-website
mirror of https://github.com/MISP/misp-website
2
0
Fork 0
Code Issues Releases Wiki Activity

Update 2017-09-18-MISP.2.4.80.released.md

pull/2/head
Andras Iklody 2017-09-18 22:36:47 +02:00 committed by GitHub
parent 991f3dcd1f
commit 2634618075
1 changed files with 7 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
_posts/2017-09-18-MISP.2.4.80.released.md
View File

@ -8,25 +8,25 @@ A new version of MISP [2.4.80](https://github.com/MISP/MISP/tree/v2.4.80) has be
## MISP Objects
MISP now includes the support for the MISP objects. This allows MISP to support complex and combined objects in a flexible way along with their [relationships](http://www.misp-project.org/objects.html#_relationships) towards other objects or even attributes.
MISP now includes support for MISP objects. This allows MISP to support complex/combined objects in a flexible way along with their [relationships](http://www.misp-project.org/objects.html#_relationships) towards other objects or even attributes.
MISP objects already available by default are documented in [HTML](https://www.misp-project.org/objects.html) or [PDF](https://www.misp-project.org/objects.pdf).
The object model allows MISP users to add objects in addition to standard attributes in event. Objects are composed of one or more attributes which are defined by templates.
The [templates of the objects](https://github.com/MISP/misp-objects/tree/master/objects) are public and can be easily contributed by everyone. This allows analysts, users, security professionals to build their own representation of objects and share it back to their communities.
The object model allows MISP users to add objects in addition to standard attributes to an event. Objects are composed of one or more attributes which are defined by the object templates.
The [object templates](https://github.com/MISP/misp-objects/tree/master/objects) are public and can be easily contributed to by everyone, allowing analysts, users and security professionals to build their own representation of various objects and share them back to their communities.
The default MISP object included are: ail-leak, cookie, credit-card, ddos, domain|ip, elf, elf-section, email, file, geolocation, http-request, ip|port, macho, macho-section, passive-dns, pe, pe-section, person, phone, r2graphity, regexp, registry-key, tor-node, url, vulnerability, whois, x509, yabin.
The default MISP object templates included are: ail-leak, cookie, credit-card, ddos, domain|ip, elf, elf-section, email, file, geolocation, http-request, ip|port, macho, macho-section, passive-dns, pe, pe-section, person, phone, r2graphity, regexp, registry-key, tor-node, url, vulnerability, whois, x509, yabin.
An example which describes a DGA (Domain Generation Algorithm) linked to two domain indicators using the MISP object functionality:
![DGA expressed as MISP object](/assets/images/misp/blog/DGA-in-MISP.png){:class="img-responsive"}
Relationships can be described from an existing list of link types (e.g. `executed-by`, `impersonates`, `communicates-with`,...) or from your own relationship vocabulary. This allows to
Relationships can be described from an existing list of relationship types (e.g. `executed-by`, `impersonates`, `communicates-with`,...) or by values from your own relationship vocabulary. This allows to
model a fairly large set of cases from incident, collected intelligence, attacks or course-of-action to malware analysis.
The version 2.4.80 also includes an extended import of file binary relying on [PyMISP](https://github.com/MISP/PyMISP/blob/master/pymisp/tools/create_misp_object.py) and [LIEF](https://lief.quarkslab.com/) to create parsed file objects for PE, ELF and MachOS binary formats.
Version 2.4.80 also includes an extended file import for binaries relying on [PyMISP](https://github.com/MISP/PyMISP/blob/master/pymisp/tools/create_misp_object.py) and [LIEF](https://lief.quarkslab.com/) to create parsed file objects for PE, ELF and MachOS binary formats.
We are expecting to see many creative use of the new MISP object feature and improvement in the following weeks.
We are expecting to see many creative uses of the new MISP object feature and improvements in the following weeks.
This release includes many bug fixes, improvements and new features.