diff --git a/objects.html b/objects.html
index d0de0ea..16bfc32 100755
--- a/objects.html
+++ b/objects.html
@@ -584,60 +584,10 @@ ail-leak is a MISP object available in JSON format at origin
type
text
The link where the leak is (or was) accessible at first-seen.
--
first-seen
datetime
When the leak has been accessible or seen for the first time.
--
sensor
text
The AIL sensor uuid where the leak was processed and analysed.
--
last-seen
datetime
When the leak has been accessible or seen for the last time.
--
raw-data
attachment
Raw data as received by the AIL sensor compressed and encoded in Base64.
--
duplicate
text
Duplicate of the existing leaks.
+Type of information leak as discovered and classified by an AIL module. ['Credential', 'CreditCards', 'Mail', 'Onion', 'Phone', 'Keys']
@@ -654,20 +604,30 @@ ail-leak is a MISP object available in JSON format at
duplicate_number
counter
last-seen
datetime
Number of known duplicates.
+When the leak has been accessible or seen for the last time.
++
origin
text
The link where the leak is (or was) accessible at first-seen.
type
duplicate
text
Type of information leak as discovered and classified by an AIL module. ['Credential', 'CreditCards', 'Mail', 'Onion', 'Phone', 'Keys']
+Duplicate of the existing leaks.
sensor
text
The AIL sensor uuid where the leak was processed and analysed.
++
first-seen
datetime
When the leak has been accessible or seen for the first time.
++
raw-data
attachment
Raw data as received by the AIL sensor compressed and encoded in Base64.
++
duplicate_number
counter
Number of known duplicates.
++
creation-date
-datetime
Initial creation of the annotation
--
modification-date
datetime
Last update of the annotation
--
format
type
text
Format of the annotation ['text', 'markdown', 'asciidoctor', 'MultiMarkdown', 'GFM', 'pandoc', 'Fountain', 'CommonWork', 'kramdown-rfc2629', 'rfc7328', 'Extra']
+Type of the annotation ['Annotation', 'Executive Summary', 'Introduction', 'Conclusion', 'Disclaimer', 'Keywords', 'Acknowledgement', 'Other', 'Copyright', 'Authors', 'Logo']
@@ -820,20 +800,40 @@ annotation is a MISP object available in JSON format at
type
ref
link
Reference(s) to the annotation
++
creation-date
datetime
Initial creation of the annotation
++
format
text
Type of the annotation ['Annotation', 'Executive Summary', 'Introduction', 'Conclusion', 'Disclaimer', 'Keywords', 'Acknowledgement', 'Other', 'Copyright', 'Authors', 'Logo']
+Format of the annotation ['text', 'markdown', 'asciidoctor', 'MultiMarkdown', 'GFM', 'pandoc', 'Fountain', 'CommonWork', 'kramdown-rfc2629', 'rfc7328', 'Extra']
ref
link
modification-date
datetime
Reference(s) to the annotation
+Last update of the annotation
@@ -878,36 +878,6 @@ asn is a MISP object available in JSON format at
subnet-announced
ip-src
Subnet announced
--
mp-export
text
This attribute performs the same function as the export attribute above. The difference is that mp-export allows both IPv4 and IPv6 address families to be specified. The export is described in RFC 4012 – Routing Policy Specification Language next generation (RPSLng), section 4.5. format
--
asn
AS
Autonomous System Number
--
last-seen
datetime
first-seen
datetime
import
text
First time the ASN was seen
+The inbound IPv4 routing policy of the AS in RFC 2622 – Routing Policy Specification Language (RPSL) format
+
mp-import
-text
The inbound IPv4 or IPv6 routing policy of the AS in RFC 4012 – Routing Policy Specification Language next generation (RPSLng), section 4.5. format
--
description
text
Description of the autonomous system
--
country
text
import
mp-import
text
The inbound IPv4 routing policy of the AS in RFC 2622 – Routing Policy Specification Language (RPSL) format
+The inbound IPv4 or IPv6 routing policy of the AS in RFC 4012 – Routing Policy Specification Language next generation (RPSLng), section 4.5. format
++
subnet-announced
ip-src
Subnet announced
++
description
text
Description of the autonomous system
++
first-seen
datetime
First time the ASN was seen
++
asn
AS
Autonomous System Number
++
mp-export
text
This attribute performs the same function as the export attribute above. The difference is that mp-export allows both IPv4 and IPv6 address families to be specified. The export is described in RFC 4012 – Routing Policy Specification Language next generation (RPSLng), section 4.5. format
@@ -1016,16 +1016,6 @@ av-signature is a MISP object available in JSON format at
datetime
datetime
Datetime
--
text
text
software
text
Name of antivirus software
--
signature
text
datetime
datetime
Datetime
++
software
text
Name of antivirus software
++
currency-code
-text
opened
datetime
Currency of the account. ['USD', 'EUR']
--
report-code
text
Report code of the bank account. ['CTR Cash Transaction Report', 'STR Suspicious Transaction Report', 'EFT Electronic Funds Transfer', 'IFT International Funds Transfer', 'TFR Terror Financing Report', 'BCR Border Cash Report', 'UTR Unusual Transaction Report', 'AIF Additional Information File – Can be used for example to get full disclosure of transactions of an account for a period of time without reporting it as a CTR.', 'IRI Incoming Request for Information – International', 'ORI Outgoing Request for Information – International', 'IRD Incoming Request for Information – Domestic', 'ORD Outgoing Request for Information – Domestic']
--
institution-code
text
Institution code of the bank.
--
beneficiary
text
Final beneficiary of the bank account.
--
iban
iban
IBAN of the bank account.
--
beneficiary-comment
text
Comment about the final beneficiary.
--
balance
text
The balance of the account after the suspicious transaction was processed.
--
aba-rtn
aba-rtn
ABA routing transit number
--
institution-name
text
Name of the bank or financial organisation.
+When the account was opened.
@@ -1204,30 +1124,10 @@ bank-account is a MISP object available in JSON format at
non-banking-institution
boolean
A flag to define if this account belong to a non-banking organisation. If set to true, it’s a non-banking organisation.
--
account
bank-account-nr
Account number
--
text
currency-code
text
A description of the bank account.
+Currency of the account. ['USD', 'EUR']
@@ -1244,26 +1144,6 @@ bank-account is a MISP object available in JSON format at
closed
datetime
When the account was closed.
--
swift
bic
SWIFT or BIC as defined in ISO 9362.
--
client-number
text
personal-account-type
text
closed
datetime
Account type. ['A - Business', 'B - Personal Current', 'C - Savings', 'D - Trust Account', 'E - Trading Account', 'O - Other']
+When the account was closed.
aba-rtn
aba-rtn
ABA routing transit number
++
beneficiary-comment
text
Comment about the final beneficiary.
++
iban
iban
IBAN of the bank account.
++
institution-name
text
Name of the bank or financial organisation.
++
account
bank-account-nr
Account number
++
date-balance
datetime
opened
datetime
report-code
text
When the account was opened.
+Report code of the bank account. ['CTR Cash Transaction Report', 'STR Suspicious Transaction Report', 'EFT Electronic Funds Transfer', 'IFT International Funds Transfer', 'TFR Terror Financing Report', 'BCR Border Cash Report', 'UTR Unusual Transaction Report', 'AIF Additional Information File – Can be used for example to get full disclosure of transactions of an account for a period of time without reporting it as a CTR.', 'IRI Incoming Request for Information – International', 'ORI Outgoing Request for Information – International', 'IRD Incoming Request for Information – Domestic', 'ORD Outgoing Request for Information – Domestic']
++
personal-account-type
text
Account type. ['A - Business', 'B - Personal Current', 'C - Savings', 'D - Trust Account', 'E - Trading Account', 'O - Other']
++
non-banking-institution
boolean
A flag to define if this account belong to a non-banking organisation. If set to true, it’s a non-banking organisation.
++
text
text
A description of the bank account.
++
beneficiary
text
Final beneficiary of the bank account.
++
institution-code
text
Institution code of the bank.
++
balance
text
The balance of the account after the suspicious transaction was processed.
++
swift
bic
SWIFT or BIC as defined in ISO 9362.
@@ -1352,20 +1352,10 @@ cap-alert is a MISP object available in JSON format at
code
sender
text
The code denoting the special handling of the alert message.
--
msgType
text
The code denoting the nature of the alert message. ['Alert', 'Update', 'Cancel', 'Ack', 'Error']
+The identifier of the sender of the alert message which identifies the originator of this alert. Guaranteed by assigner to be unique globally; e.g., may be based on an Internet domain name.
@@ -1382,36 +1372,6 @@ cap-alert is a MISP object available in JSON format at
source
text
The text identifying the source of the alert message. The particular source of this alert; e.g., an operator or a specific device.
--
identifier
text
The identifier of the alert message in a number or string uniquely identifying this message, assigned by the sender.
--
references
text
The group listing identifying earlier message(s) referenced by the alert message. (1) The extended message identifier(s) (in the form sender,identifier,sent) of an earlier CAP message or messages referenced by this one. (2) If multiple messages are referenced, they SHALL be separated by whitespace.
--
incident
text
status
msgType
text
The code denoting the appropriate handling of the alert message. ['Actual', 'Exercise', 'System', 'Test', 'Draft']
+The code denoting the nature of the alert message. ['Alert', 'Update', 'Cancel', 'Ack', 'Error']
+
sender
source
text
The identifier of the sender of the alert message which identifies the originator of this alert. Guaranteed by assigner to be unique globally; e.g., may be based on an Internet domain name.
+The text identifying the source of the alert message. The particular source of this alert; e.g., an operator or a specific device.
++
code
text
The code denoting the special handling of the alert message.
@@ -1452,10 +1422,10 @@ cap-alert is a MISP object available in JSON format at
note
references
text
The text describing the purpose or significance of the alert message.
+The group listing identifying earlier message(s) referenced by the alert message. (1) The extended message identifier(s) (in the form sender,identifier,sent) of an earlier CAP message or messages referenced by this one. (2) If multiple messages are referenced, they SHALL be separated by whitespace.
@@ -1472,6 +1442,36 @@ cap-alert is a MISP object available in JSON format at
identifier
text
The identifier of the alert message in a number or string uniquely identifying this message, assigned by the sender.
++
note
text
The text describing the purpose or significance of the alert message.
++
status
text
The code denoting the appropriate handling of the alert message. ['Actual', 'Exercise', 'System', 'Test', 'Draft']
++
addresses
text
expires
datetime
The expiry time of the information of the alert message.
--
audience
text
The text describing the intended audience of the alert message.
--
parameter
text
A system-specific additional parameter associated with the alert message.
--
headline
text
The text headline of the alert message.
--
contact
text
The text describing the contact for follow-up and confirmation of the alert message.
--
event
text
The text denoting the type of the subject event of the alert message.
--
certainty
text
The code denoting the certainty of the subject event of the alert message. For backward compatibility with CAP 1.0, the deprecated value of “Very Likely” SHOULD be treated as equivalent to “Likely”. ['Likely', 'Possible', 'Unlikely', 'Unknown']
--
effective
datetime
The effective time of the information of the alert message.
--
instruction
text
The text describing the recommended action to be taken by recipients of the alert message.
--
severity
text
The code denoting the severity of the subject event of the alert message. ['Extreme', 'Severe', 'Moderate', 'Minor', 'Unknown']
--
language
text
category
text
The code denoting the category of the subject event of the alert message. ['Geo', 'Met', 'Safety', 'Security', 'Rescue', 'Fire', 'Health', 'Env', 'Transport', 'Infra', 'CBRNE', 'Other']
--
senderName
text
description
responseType
text
The text describing the subject event of the alert message.
--
web
link
The identifier of the hyperlink associating additional information with the alert message.
--
urgency
text
The code denoting the urgency of the subject event of the alert message. ['Immediate', 'Expected', 'Future', 'Past', 'Unknown']
+The code denoting the type of action recommended for the target audience. ['Shelter', 'Evacuate', 'Prepare', 'Execute', 'Avoid', 'Monitor', 'Assess', 'AllClear', 'None']
@@ -1690,6 +1560,106 @@ cap-info is a MISP object available in JSON format at
audience
text
The text describing the intended audience of the alert message.
++
effective
datetime
The effective time of the information of the alert message.
++
web
link
The identifier of the hyperlink associating additional information with the alert message.
++
certainty
text
The code denoting the certainty of the subject event of the alert message. For backward compatibility with CAP 1.0, the deprecated value of “Very Likely” SHOULD be treated as equivalent to “Likely”. ['Likely', 'Possible', 'Unlikely', 'Unknown']
++
parameter
text
A system-specific additional parameter associated with the alert message.
++
event
text
The text denoting the type of the subject event of the alert message.
++
expires
datetime
The expiry time of the information of the alert message.
++
urgency
text
The code denoting the urgency of the subject event of the alert message. ['Immediate', 'Expected', 'Future', 'Past', 'Unknown']
++
contact
text
The text describing the contact for follow-up and confirmation of the alert message.
++
instruction
text
The text describing the recommended action to be taken by recipients of the alert message.
++
eventCode
text
responseType
description
text
The code denoting the type of action recommended for the target audience. ['Shelter', 'Evacuate', 'Prepare', 'Execute', 'Avoid', 'Monitor', 'Assess', 'AllClear', 'None']
+The text describing the subject event of the alert message.
++
severity
text
The code denoting the severity of the subject event of the alert message. ['Extreme', 'Severe', 'Moderate', 'Minor', 'Unknown']
++
category
text
The code denoting the category of the subject event of the alert message. ['Geo', 'Met', 'Safety', 'Security', 'Rescue', 'Fire', 'Health', 'Env', 'Transport', 'Infra', 'CBRNE', 'Other']
++
headline
text
The text headline of the alert message.
@@ -1758,13 +1758,13 @@ cap-resource is a MISP object available in JSON format at
uri
link
resourceDesc
text
The identifier of the hyperlink for the resource file.
+The text describing the type and content of the resource file.
+
digest
-sha1
uri
link
The code representing the digital digest (“hash”) computed from the resource file (OPTIONAL).
+The identifier of the hyperlink for the resource file.
@@ -1798,13 +1798,13 @@ cap-resource is a MISP object available in JSON format at
resourceDesc
text
digest
sha1
The text describing the type and content of the resource file.
+The code representing the digital digest (“hash”) computed from the resource file (OPTIONAL).
+
first-seen
+last-seen
datetime
First time this payment destination address has been seen
+Last time this payment destination address has been seen
@@ -1866,16 +1866,6 @@ coin-address is a MISP object available in JSON format at
address
btc
Address used as a payment destination in a cryptocurrency
--
symbol
text
last-seen
first-seen
datetime
Last time this payment destination address has been seen
+First time this payment destination address has been seen
address
btc
Address used as a payment destination in a cryptocurrency
++
cookie-value
+cookie-name
text
Value of the cookie (if splitted)
+Name of the cookie (if splitted)
@@ -1954,20 +1954,20 @@ cookie is a MISP object available in JSON format at
type
cookie-value
text
Type of cookie and how it’s used in this specific object. ['Session management', 'Personalization', 'Tracking', 'Exfiltration', 'Malicious Payload', 'Beaconing']
+Value of the cookie (if splitted)
cookie-name
type
text
Name of the cookie (if splitted)
+Type of cookie and how it’s used in this specific object. ['Session management', 'Personalization', 'Tracking', 'Exfiltration', 'Malicious Payload', 'Beaconing']
@@ -2022,20 +2022,20 @@ course-of-action is a MISP object available in JSON format at
impact
type
text
The estimated impact of applying the course of action. ['High', 'Medium', 'Low', 'None', 'Unknown']
+The type of the course of action. ['Perimeter Blocking', 'Internal Blocking', 'Redirection', 'Redirection (Honey Pot)', 'Hardening', 'Patching', 'Eradication', 'Rebuilding', 'Training', 'Monitoring', 'Physical Access Restrictions', 'Logical Access Restrictions', 'Public Disclosure', 'Diplomatic Actions', 'Policy Actions', 'Other']
name
impact
text
The name used to identify the course of action.
+The estimated impact of applying the course of action. ['High', 'Medium', 'Low', 'None', 'Unknown']
@@ -2052,20 +2052,10 @@ course-of-action is a MISP object available in JSON format at
objective
efficacy
text
The objective of the course of action.
--
type
text
The type of the course of action. ['Perimeter Blocking', 'Internal Blocking', 'Redirection', 'Redirection (Honey Pot)', 'Hardening', 'Patching', 'Eradication', 'Rebuilding', 'Training', 'Monitoring', 'Physical Access Restrictions', 'Logical Access Restrictions', 'Public Disclosure', 'Diplomatic Actions', 'Policy Actions', 'Other']
+The estimated efficacy of applying the course of action. ['High', 'Medium', 'Low', 'None', 'Unknown']
@@ -2082,20 +2072,30 @@ course-of-action is a MISP object available in JSON format at
efficacy
description
text
The estimated efficacy of applying the course of action. ['High', 'Medium', 'Low', 'None', 'Unknown']
+A description of the course of action.
description
objective
text
A description of the course of action.
+The objective of the course of action.
++
name
text
The name used to identify the course of action.
@@ -2140,33 +2140,43 @@ cowrie is a MISP object available in JSON format at
src_ip
ip-src
macCS
text
Source IP address of the session
+SSH MAC supported in the sesssion
++
username
text
Username related to the password(s)
sensor
isError
text
Cowrie sensor name
+isError
src_port
port
session
text
Source port of the session
+Session id
+
eventid
-text
src_port
port
Eventid of the session in the cowrie honeypot
+Source port of the session
++
src_ip
ip-src
Source IP address of the session
++
timestamp
datetime
When the event happened
@@ -2200,16 +2230,6 @@ cowrie is a MISP object available in JSON format at
keyAlgs
text
SSH public-key algorithm supported in the session
--
encCS
text
system
keyAlgs
text
System origin in cowrie honeypot
+SSH public-key algorithm supported in the session
session
eventid
text
Session id
--
compCS
text
SSH compression algorithm supported in the session
--
username
text
Username related to the password(s)
--
input
text
Input of the session
--
protocol
text
Protocol used in the cowrie honeypot
+Eventid of the session in the cowrie honeypot
@@ -2300,30 +2280,50 @@ cowrie is a MISP object available in JSON format at
timestamp
datetime
sensor
text
When the event happened
+Cowrie sensor name
macCS
input
text
SSH MAC supported in the sesssion
+Input of the session
++
system
text
System origin in cowrie honeypot
isError
compCS
text
isError
+SSH compression algorithm supported in the session
++
protocol
text
Protocol used in the cowrie honeypot
@@ -2368,6 +2368,26 @@ credential is a MISP object available in JSON format at
type
text
Type of password(s) ['password', 'api-key', 'encryption-key', 'unknown']
++
text
text
A description of the credential(s)
++
origin
text
format
text
Format of the password(s) ['clear-text', 'hashed', 'encrypted', 'unknown']
++
password
text
format
text
Format of the password(s) ['clear-text', 'hashed', 'encrypted', 'unknown']
--
text
text
A description of the credential(s)
--
type
text
Type of password(s) ['password', 'api-key', 'encryption-key', 'unknown']
--
expiration
+datetime
Maximum date of validity
++
cc-number
cc-number
credit-card number as encoded on the card.
++
comment
comment
A description of the card.
++
version
text
cc-number
cc-number
credit-card number as encoded on the card.
--
name
text
expiration
datetime
Maximum date of validity
--
comment
comment
A description of the card.
--
card-security-code
text
protocol
text
src-port
port
Protocol used for the attack ['TCP', 'UDP', 'ICMP', 'IP']
+Port originating the attack
domain-dst
domain
text
text
Destination domain (victim)
+Description of the DDoS
+
src-port
-port
domain-dst
domain
Port originating the attack
--
ip-src
ip-src
IP address originating the attack
--
total-bps
counter
Bits per second
+Destination domain (victim)
@@ -2654,16 +2634,6 @@ ddos is a MISP object available in JSON format at
text
text
Description of the DDoS
--
dst-port
port
total-bps
counter
Bits per second
++
ip-src
ip-src
IP address originating the attack
++
protocol
text
Protocol used for the attack ['TCP', 'UDP', 'ICMP', 'IP']
++
ip-dst
ip-dst
Destination-Host
text
Destination-Host.
++
Username
text
Origin-Host
text
Origin-Host.
++
SessionId
text
Session-ID.
++
IdrFlags
text
first-seen
datetime
When the attack has been seen for the first time.
++
Destination-Realm
text
Destination-Realm.
++
text
text
first-seen
datetime
When the attack has been seen for the first time.
--
Origin-Host
text
Origin-Host.
--
Destination-Realm
text
Destination-Realm.
--
ApplicationId
text
SessionId
text
Session-ID.
--
Destination-Host
text
Destination-Host.
--
first-seen
+last-seen
datetime
First time the tuple has been seen
+Last time the tuple has been seen
@@ -2910,20 +2910,10 @@ domain-ip is a MISP object available in JSON format at
domain
domain
Domain name
--
last-seen
first-seen
datetime
Last time the tuple has been seen
+First time the tuple has been seen
domain
domain
Domain name
++
entrypoint-address
+type
text
Address of the entry point
+Type of ELF ['CORE', 'DYNAMIC', 'EXECUTABLE', 'HIPROC', 'LOPROC', 'NONE', 'RELOCATABLE']
++
arch
text
Architecture of the ELF file ['None', 'M32', 'SPARC', 'i386', 'ARCH_68K', 'ARCH_88K', 'IAMCU', 'ARCH_860', 'MIPS', 'S370', 'MIPS_RS3_LE', 'PARISC', 'VPP500', 'SPARC32PLUS', 'ARCH_960', 'PPC', 'PPC64', 'S390', 'SPU', 'V800', 'FR20', 'RH32', 'RCE', 'ARM', 'ALPHA', 'SH', 'SPARCV9', 'TRICORE', 'ARC', 'H8_300', 'H8_300H', 'H8S', 'H8_500', 'IA_64', 'MIPS_X', 'COLDFIRE', 'ARCH_68HC12', 'MMA', 'PCP', 'NCPU', 'NDR1', 'STARCORE', 'ME16', 'ST100', 'TINYJ', 'x86_64', 'PDSP', 'PDP10', 'PDP11', 'FX66', 'ST9PLUS', 'ST7', 'ARCH_68HC16', 'ARCH_68HC11', 'ARCH_68HC08', 'ARCH_68HC05', 'SVX', 'ST19', 'VAX', 'CRIS', 'JAVELIN', 'FIREPATH', 'ZSP', 'MMIX', 'HUANY', 'PRISM', 'AVR', 'FR30', 'D10V', 'D30V', 'V850', 'M32R', 'MN10300', 'MN10200', 'PJ', 'OPENRISC', 'ARC_COMPACT', 'XTENSA', 'VIDEOCORE', 'TMM_GPP', 'NS32K', 'TPC', 'SNP1K', 'ST200', 'IP2K', 'MAX', 'CR', 'F2MC16', 'MSP430', 'BLACKFIN', 'SE_C33', 'SEP', 'ARCA', 'UNICORE', 'EXCESS', 'DXP', 'ALTERA_NIOS2', 'CRX', 'XGATE', 'C166', 'M16C', 'DSPIC30F', 'CE', 'M32C', 'TSK3000', 'RS08', 'SHARC', 'ECOG2', 'SCORE7', 'DSP24', 'VIDEOCORE3', 'LATTICEMICO32', 'SE_C17', 'TI_C6000', 'TI_C2000', 'TI_C5500', 'MMDSP_PLUS', 'CYPRESS_M8C', 'R32C', 'TRIMEDIA', 'HEXAGON', 'ARCH_8051', 'STXP7X', 'NDS32', 'ECOG1', 'ECOG1X', 'MAXQ30', 'XIMO16', 'MANIK', 'CRAYNV2', 'RX', 'METAG', 'MCST_ELBRUS', 'ECOG16', 'CR16', 'ETPU', 'SLE9X', 'L10M', 'K10M', 'AARCH64', 'AVR32', 'STM8', 'TILE64', 'TILEPRO', 'CUDA', 'TILEGX', 'CLOUDSHIELD', 'COREA_1ST', 'COREA_2ND', 'ARC_COMPACT2', 'OPEN8', 'RL78', 'VIDEOCORE5', 'ARCH_78KOR', 'ARCH_56800EX', 'BA1', 'BA2', 'XCORE', 'MCHP_PIC', 'INTEL205', 'INTEL206', 'INTEL207', 'INTEL208', 'INTEL209', 'KM32', 'KMX32', 'KMX16', 'KMX8', 'KVARC', 'CDP', 'COGE', 'COOL', 'NORC', 'CSR_KALIMBA', 'AMDGPU']
++
os_abi
text
Header operating system application binary interface (ABI) ['AIX', 'ARM', 'AROS', 'C6000_ELFABI', 'C6000_LINUX', 'CLOUDABI', 'FENIXOS', 'FREEBSD', 'GNU', 'HPUX', 'HURD', 'IRIX', 'MODESTO', 'NETBSD', 'NSK', 'OPENBSD', 'OPENVMS', 'SOLARIS', 'STANDALONE', 'SYSTEMV', 'TRU64']
@@ -3008,30 +3028,10 @@ elf is a MISP object available in JSON format at
os_abi
entrypoint-address
text
Header operating system application binary interface (ABI) ['AIX', 'ARM', 'AROS', 'C6000_ELFABI', 'C6000_LINUX', 'CLOUDABI', 'FENIXOS', 'FREEBSD', 'GNU', 'HPUX', 'HURD', 'IRIX', 'MODESTO', 'NETBSD', 'NSK', 'OPENBSD', 'OPENVMS', 'SOLARIS', 'STANDALONE', 'SYSTEMV', 'TRU64']
--
type
text
Type of ELF ['CORE', 'DYNAMIC', 'EXECUTABLE', 'HIPROC', 'LOPROC', 'NONE', 'RELOCATABLE']
--
arch
text
Architecture of the ELF file ['None', 'M32', 'SPARC', 'i386', 'ARCH_68K', 'ARCH_88K', 'IAMCU', 'ARCH_860', 'MIPS', 'S370', 'MIPS_RS3_LE', 'PARISC', 'VPP500', 'SPARC32PLUS', 'ARCH_960', 'PPC', 'PPC64', 'S390', 'SPU', 'V800', 'FR20', 'RH32', 'RCE', 'ARM', 'ALPHA', 'SH', 'SPARCV9', 'TRICORE', 'ARC', 'H8_300', 'H8_300H', 'H8S', 'H8_500', 'IA_64', 'MIPS_X', 'COLDFIRE', 'ARCH_68HC12', 'MMA', 'PCP', 'NCPU', 'NDR1', 'STARCORE', 'ME16', 'ST100', 'TINYJ', 'x86_64', 'PDSP', 'PDP10', 'PDP11', 'FX66', 'ST9PLUS', 'ST7', 'ARCH_68HC16', 'ARCH_68HC11', 'ARCH_68HC08', 'ARCH_68HC05', 'SVX', 'ST19', 'VAX', 'CRIS', 'JAVELIN', 'FIREPATH', 'ZSP', 'MMIX', 'HUANY', 'PRISM', 'AVR', 'FR30', 'D10V', 'D30V', 'V850', 'M32R', 'MN10300', 'MN10200', 'PJ', 'OPENRISC', 'ARC_COMPACT', 'XTENSA', 'VIDEOCORE', 'TMM_GPP', 'NS32K', 'TPC', 'SNP1K', 'ST200', 'IP2K', 'MAX', 'CR', 'F2MC16', 'MSP430', 'BLACKFIN', 'SE_C33', 'SEP', 'ARCA', 'UNICORE', 'EXCESS', 'DXP', 'ALTERA_NIOS2', 'CRX', 'XGATE', 'C166', 'M16C', 'DSPIC30F', 'CE', 'M32C', 'TSK3000', 'RS08', 'SHARC', 'ECOG2', 'SCORE7', 'DSP24', 'VIDEOCORE3', 'LATTICEMICO32', 'SE_C17', 'TI_C6000', 'TI_C2000', 'TI_C5500', 'MMDSP_PLUS', 'CYPRESS_M8C', 'R32C', 'TRIMEDIA', 'HEXAGON', 'ARCH_8051', 'STXP7X', 'NDS32', 'ECOG1', 'ECOG1X', 'MAXQ30', 'XIMO16', 'MANIK', 'CRAYNV2', 'RX', 'METAG', 'MCST_ELBRUS', 'ECOG16', 'CR16', 'ETPU', 'SLE9X', 'L10M', 'K10M', 'AARCH64', 'AVR32', 'STM8', 'TILE64', 'TILEPRO', 'CUDA', 'TILEGX', 'CLOUDSHIELD', 'COREA_1ST', 'COREA_2ND', 'ARC_COMPACT2', 'OPEN8', 'RL78', 'VIDEOCORE5', 'ARCH_78KOR', 'ARCH_56800EX', 'BA1', 'BA2', 'XCORE', 'MCHP_PIC', 'INTEL205', 'INTEL206', 'INTEL207', 'INTEL208', 'INTEL209', 'KM32', 'KMX32', 'KMX16', 'KMX8', 'KVARC', 'CDP', 'COGE', 'COOL', 'NORC', 'CSR_KALIMBA', 'AMDGPU']
+Address of the entry point
@@ -3076,66 +3076,6 @@ elf-section is a MISP object available in JSON format at
sha224
sha224
Secure Hash Algorithm 2 (224 bits)
--
name
text
Name of the section
--
ssdeep
ssdeep
Fuzzy hash using context triggered piecewise hashes (CTPH)
--
sha1
sha1
[Insecure] Secure Hash Algorithm 1 (160 bits)
--
text
text
Free text value to attach to the section
--
sha256
sha256
Secure Hash Algorithm 2 (256 bits)
--
type
text
sha512
sha512
Secure Hash Algorithm 2 (512 bits)
--
sha512/224
sha512/224
Secure Hash Algorithm 2 (224 bits)
--
md5
md5
[Insecure] MD5 hash (128 bits)
--
flag
text
Flag of the section ['ALLOC', 'EXCLUDE', 'EXECINSTR', 'GROUP', 'HEX_GPREL', 'INFO_LINK', 'LINK_ORDER', 'MASKOS', 'MASKPROC', 'MERGE', 'MIPS_ADDR', 'MIPS_LOCAL', 'MIPS_MERGE', 'MIPS_NAMES', 'MIPS_NODUPES', 'MIPS_NOSTRIP', 'NONE', 'OS_NONCONFORMING', 'STRINGS', 'TLS', 'WRITE', 'XCORE_SHF_CP_SECTION']
--
size-in-bytes
size-in-bytes
sha512/256
sha512/256
flag
text
Secure Hash Algorithm 2 (256 bits)
+Flag of the section ['ALLOC', 'EXCLUDE', 'EXECINSTR', 'GROUP', 'HEX_GPREL', 'INFO_LINK', 'LINK_ORDER', 'MASKOS', 'MASKPROC', 'MERGE', 'MIPS_ADDR', 'MIPS_LOCAL', 'MIPS_MERGE', 'MIPS_NAMES', 'MIPS_NODUPES', 'MIPS_NOSTRIP', 'NONE', 'OS_NONCONFORMING', 'STRINGS', 'TLS', 'WRITE', 'XCORE_SHF_CP_SECTION']
-
sha384
sha384
Secure Hash Algorithm 2 (384 bits)
-+
sha1
sha1
[Insecure] Secure Hash Algorithm 1 (160 bits)
++
md5
md5
[Insecure] MD5 hash (128 bits)
++
sha224
sha224
Secure Hash Algorithm 2 (224 bits)
++
sha512/224
sha512/224
Secure Hash Algorithm 2 (224 bits)
++
sha512
sha512
Secure Hash Algorithm 2 (512 bits)
++
ssdeep
ssdeep
Fuzzy hash using context triggered piecewise hashes (CTPH)
++
sha256
sha256
Secure Hash Algorithm 2 (256 bits)
++
text
text
Free text value to attach to the section
++
sha512/256
sha512/256
Secure Hash Algorithm 2 (256 bits)
++
name
text
Name of the section
++
sha384
sha384
Secure Hash Algorithm 2 (384 bits)
++
attachment
-email-attachment
Attachment
--
from
email-src
Sender email address
--
eml
attachment
Full EML
--
subject
email-subject
Subject
--
thread-index
email-thread-index
Identifies a particular conversation thread
--
from-display-name
email-src-display-name
Display name of the sender
--
email-body
email-body
Body of the email
--
return-path
email-src
Message return path
--
to-display-name
email-dst-display-name
Display name of the receiver
--
header
email-header
Full headers
--
cc
email-dst
user-agent
text
User Agent of the sender
--
to
email-dst
Destination email address
--
x-mailer
email-x-mailer
X-Mailer generally tells the program that was used to draft and send the original email
--
message-id
email-message-id
mime-boundary
email-mime-boundary
screenshot
attachment
MIME Boundary
+Screenshot of email
reply-to
email-reply-to
to
email-dst
Email address the reply will be sent to
+Destination email address
++
from-display-name
email-src-display-name
Display name of the sender
screenshot
attachment
header
email-header
Screenshot of email
+Full headers
++
return-path
email-src
Message return path
++
x-mailer
email-x-mailer
X-Mailer generally tells the program that was used to draft and send the original email
subject
email-subject
Subject
++
eml
attachment
Full EML
++
email-body
email-body
Body of the email
++
thread-index
email-thread-index
Identifies a particular conversation thread
++
to-display-name
email-dst-display-name
Display name of the receiver
++
reply-to
email-reply-to
Email address the reply will be sent to
++
user-agent
text
User Agent of the sender
++
mime-boundary
email-mime-boundary
MIME Boundary
++
from
email-src
Sender email address
++
attachment
email-attachment
Attachment
++
banned-ip
+ip-src
IP Address banned by fail2ban
++
logline
text
Example log line that caused the ban.
++
processing-timestamp
datetime
victim
text
Identifier of the victim
++
sensor
text
failures
counter
Amount of failures that lead to the ban.
--
banned-ip
ip-src
IP Address banned by fail2ban
--
victim
text
Identifier of the victim
--
attack-type
text
logline
text
logfile
attachment
Example log line that caused the ban.
+Full logfile related to the attack.
logfile
attachment
failures
counter
Full logfile related to the attack.
+Amount of failures that lead to the ban.
@@ -3610,13 +3610,33 @@ file is a MISP object available in JSON format at
sha224
sha224
size-in-bytes
size-in-bytes
Secure Hash Algorithm 2 (224 bits)
+Size of the file, in bytes
+
+
path
text
Path of the filename complete or partial
++
state
text
State of the file ['Malicious', 'Harmless', 'Signed', 'Revoked', 'Expired', 'Trusted']
+
authentihash
-authentihash
sha256
sha256
Authenticode executable signature hash
--
ssdeep
ssdeep
Fuzzy hash using context triggered piecewise hashes (CTPH)
+Secure Hash Algorithm 2 (256 bits)
@@ -3660,40 +3670,30 @@ file is a MISP object available in JSON format at
text
text
md5
md5
Free text value to attach to the file
--
sha256
sha256
Secure Hash Algorithm 2 (256 bits)
+[Insecure] MD5 hash (128 bits)
state
text
sha224
sha224
State of the file ['Malicious', 'Harmless', 'Signed', 'Revoked', 'Expired', 'Trusted']
+Secure Hash Algorithm 2 (224 bits)
+
certificate
x509-fingerprint-sha1
sha512/224
sha512/224
Certificate value if the binary is signed with another authentication scheme than authenticode
+Secure Hash Algorithm 2 (224 bits)
@@ -3710,10 +3710,60 @@ file is a MISP object available in JSON format at
path
ssdeep
ssdeep
Fuzzy hash using context triggered piecewise hashes (CTPH)
++
authentihash
authentihash
Authenticode executable signature hash
++
certificate
x509-fingerprint-sha1
Certificate value if the binary is signed with another authentication scheme than authenticode
++
text
text
Path of the filename complete or partial
+Free text value to attach to the file
++
sha512/256
sha512/256
Secure Hash Algorithm 2 (256 bits)
++
entropy
float
Entropy of the whole file
@@ -3740,56 +3790,6 @@ file is a MISP object available in JSON format at
mimetype
mime-type
Mime type
--
sha512/224
sha512/224
Secure Hash Algorithm 2 (224 bits)
--
md5
md5
[Insecure] MD5 hash (128 bits)
--
entropy
float
Entropy of the whole file
--
size-in-bytes
size-in-bytes
Size of the file, in bytes
--
filename
filename
mimetype
mime-type
Mime type
++
sha384
sha384
sha512/256
sha512/256
Secure Hash Algorithm 2 (256 bits)
--
region
-text
Region.
--
latitude
float
The latitude is the decimal value of the latitude in the World Geodetic System 84 (WGS84) reference.
--
address
text
Address.
--
city
text
City.
--
country
text
Country.
--
last-seen
datetime
zipcode
text
Zip Code.
--
first-seen
datetime
When the location was seen for the first time.
--
text
text
latitude
float
The latitude is the decimal value of the latitude in the World Geodetic System 84 (WGS84) reference.
++
region
text
Region.
++
altitude
float
The altitude is the decimal value of the altitude in the World Geodetic System 84 (WGS84) reference.
++
zipcode
text
Zip Code.
++
city
text
City.
++
longitude
float
altitude
float
first-seen
datetime
The altitude is the decimal value of the altitude in the World Geodetic System 84 (WGS84) reference.
+When the location was seen for the first time.
++
country
text
Country.
++
address
text
Address.
@@ -4006,40 +4006,20 @@ gtp-attack is a MISP object available in JSON format at
ipSrc
ip-src
IP source address.
--
PortDest
GtpVersion
text
Destination port.
+GTP version ['0', '1', '2']
GtpServingNetwork
text
PortSrc
port
GTP Serving Network.
--
GtpMessageType
text
GTP defines a set of messages between two associated GSNs or an SGSN and an RNC. Message type is described as a decimal value.
+Source port.
@@ -4056,16 +4036,6 @@ gtp-attack is a MISP object available in JSON format at
PortSrc
port
Source port.
--
GtpImei
text
GtpImsi
text
GTP IMSI (International mobile subscriber identity).
++
first-seen
datetime
text
text
A description of the GTP attack.
++
GtpMessageType
text
GTP defines a set of messages between two associated GSNs or an SGSN and an RNC. Message type is described as a decimal value.
++
GtpInterface
text
GtpImsi
PortDest
text
GTP IMSI (International mobile subscriber identity).
+Destination port.
+
text
-text
ipSrc
ip-src
A description of the GTP attack.
+IP source address.
+
GtpVersion
GtpServingNetwork
text
GTP version ['0', '1', '2']
+GTP Serving Network.
@@ -4174,16 +4174,6 @@ http-request is a MISP object available in JSON format at
proxy-user
text
HTTP Proxy Username
--
basicauth-user
text
proxy-password
text
HTTP Proxy Password
--
text
text
HTTP Request comment
--
host
hostname
The domain name of the server
--
user-agent
user-agent
The user agent string of the user agent
--
basicauth-password
text
HTTP Basic Authentication Password
--
uri
uri
Request URI
--
content-type
other
method
http-method
host
hostname
HTTP Method invoked (one of GET, POST, PUT, HEAD, DELETE, OPTIONS, CONNECT)
+The domain name of the server
+
+
uri
uri
Request URI
+
text
+text
HTTP Request comment
++
method
http-method
HTTP Method invoked (one of GET, POST, PUT, HEAD, DELETE, OPTIONS, CONNECT)
++
url
url
proxy-password
text
HTTP Proxy Password
++
basicauth-password
text
HTTP Basic Authentication Password
++
proxy-user
text
HTTP Proxy Username
++
user-agent
user-agent
The user agent string of the user agent
++
src-port
-port
Source port
--
last-seen
datetime
dst-port
port
Destination port
--
first-seen
datetime
First time the tuple has been seen
--
text
text
ip
ip-dst
src-port
port
IP Address
+Source port
++
domain
domain
Domain
@@ -4412,15 +4392,35 @@ ip-port is a MISP object available in JSON format at
domain
domain
first-seen
datetime
Domain
+First time the tuple has been seen
++
ip
ip-dst
IP Address
dst-port
port
Destination port
++
ip-src
-ip-src
description
text
Source IP Address
+Type of detected software ie software, malware
@@ -4490,20 +4490,20 @@ ja3 is a MISP object available in JSON format at
ja3-fingerprint-md5
md5
ip-src
ip-src
Hash identifying source
+Source IP Address
description
text
ja3-fingerprint-md5
md5
Type of detected software ie software, malware
+Hash identifying source
@@ -4558,10 +4558,20 @@ legal-entity is a MISP object available in JSON format at
legal-form
text
text
Legal form of an entity.
+A description of the entity.
++
registration-number
text
Registration number of an entity in the relevant authority.
@@ -4578,6 +4588,26 @@ legal-entity is a MISP object available in JSON format at
legal-form
text
Legal form of an entity.
++
business
text
Business area of an entity.
++
name
text
registration-number
text
Registration number of an entity in the relevant authority.
--
text
text
A description of the entity.
--
business
text
Business area of an entity.
--
type
+text
Type of Mach-O ['BUNDLE', 'CORE', 'DSYM', 'DYLIB', 'DYLIB_STUB', 'DYLINKER', 'EXECUTE', 'FVMLIB', 'KEXT_BUNDLE', 'OBJECT', 'PRELOAD']
++
text
text
entrypoint-address
text
number-sections
counter
Address of the entry point
+Number of sections
type
text
Type of Mach-O ['BUNDLE', 'CORE', 'DSYM', 'DYLIB', 'DYLIB_STUB', 'DYLINKER', 'EXECUTE', 'FVMLIB', 'KEXT_BUNDLE', 'OBJECT', 'PRELOAD']
--
name
text
number-sections
counter
entrypoint-address
text
Number of sections
+Address of the entry point
@@ -4754,33 +4754,23 @@ macho-section is a MISP object available in JSON format at
sha224
sha224
size-in-bytes
size-in-bytes
Secure Hash Algorithm 2 (224 bits)
--
name
text
Name of the section
+Size of the section, in bytes
ssdeep
ssdeep
entropy
float
Fuzzy hash using context triggered piecewise hashes (CTPH)
+Entropy of the whole section
+
text
-text
Free text value to attach to the section
--
sha256
sha256
Secure Hash Algorithm 2 (256 bits)
--
sha512
sha512
Secure Hash Algorithm 2 (512 bits)
--
sha512/224
sha512/224
Secure Hash Algorithm 2 (224 bits)
--
md5
md5
size-in-bytes
size-in-bytes
sha224
sha224
Size of the section, in bytes
+Secure Hash Algorithm 2 (224 bits)
++
sha512/224
sha512/224
Secure Hash Algorithm 2 (224 bits)
++
sha512
sha512
Secure Hash Algorithm 2 (512 bits)
++
ssdeep
ssdeep
Fuzzy hash using context triggered piecewise hashes (CTPH)
++
sha256
sha256
Secure Hash Algorithm 2 (256 bits)
++
text
text
Free text value to attach to the section
@@ -4864,6 +4864,16 @@ macho-section is a MISP object available in JSON format at
name
text
Name of the section
++
sha384
sha384
entropy
float
Entropy of the whole section
--
creation-date
+type
text
Type of the microblog post ['Twitter', 'Facebook', 'LinkedIn', 'Reddit', 'Google+', 'Instagram', 'Forum', 'Other']
++
removal-date
datetime
Initial creation of the microblog post
--
username
text
Username who posted the microblog post
--
link
url
Link into the microblog post
--
username-quoted
text
Username who are quoted into the microblog post
+When the microblog post was removed
@@ -4972,6 +4952,46 @@ microblog is a MISP object available in JSON format at
url
url
Original URL location of the microblog post
++
username
text
Username who posted the microblog post
++
creation-date
datetime
Initial creation of the microblog post
++
username-quoted
text
Username who are quoted into the microblog post
++
modification-date
datetime
removal-date
datetime
When the microblog post was removed
--
type
text
Type of the microblog post ['Twitter', 'Facebook', 'LinkedIn', 'Reddit', 'Google+', 'Instagram', 'Forum', 'Other']
--
url
link
url
Original URL location of the microblog post
+Link into the microblog post
@@ -5050,16 +5050,6 @@ mutex is a MISP object available in JSON format at
name
text
name of the mutex
--
description
text
name
text
name of the mutex
++
src-as
-AS
Source AS number for this flow
--
packet-count
counter
direction
text
first-packet-seen
datetime
Direction of this flow ['Ingress', 'Egress']
+First packet seen in this flow
+
ip_version
counter
src-port
port
IP version of this flow
--
ip-src
ip-src
IP address source of the netflow
+Source port of the netflow
@@ -5178,76 +5158,6 @@ netflow is a MISP object available in JSON format at
dst-port
port
Destination port of the netflow
--
first-packet-seen
datetime
First packet seen in this flow
--
byte-count
counter
Bytes counted in this flow
--
icmp-type
text
ICMP type of the flow (if the traffic is ICMP)
--
src-port
port
Source port of the netflow
--
protocol
text
Protocol used for this flow ['TCP', 'UDP', 'ICMP', 'IP']
--
ip-protocol-number
size-in-bytes
IP protocol number of this flow
--
flow-count
counter
tcp-flags
text
TCP flags of the flow
--
dst-as
AS
tcp-flags
text
TCP flags of the flow
++
ip-src
ip-src
IP address source of the netflow
++
src-as
AS
Source AS number for this flow
++
direction
text
Direction of this flow ['Ingress', 'Egress']
++
ip-protocol-number
size-in-bytes
IP protocol number of this flow
++
icmp-type
text
ICMP type of the flow (if the traffic is ICMP)
++
byte-count
counter
Bytes counted in this flow
++
protocol
text
Protocol used for this flow ['TCP', 'UDP', 'ICMP', 'IP']
++
ip-dst
ip-dst
dst-port
port
Destination port of the netflow
++
ip_version
counter
IP version of this flow
++
hostname-dst
-hostname
layer7-protocol
text
Destination hostname of the network connection.
+Layer 7 protocol of the network connection. ['HTTP', 'HTTPS', 'FTP']
@@ -5356,20 +5356,10 @@ network-connection is a MISP object available in JSON format at
ip-src
ip-src
layer3-protocol
text
Source IP address of the nework connection.
--
dst-port
port
Destination port of the nework connection.
+Layer 3 protocol of the network connection. ['IP', 'ICMP', 'ARP']
@@ -5386,10 +5376,20 @@ network-connection is a MISP object available in JSON format at
layer3-protocol
text
hostname-dst
hostname
Layer 3 protocol of the network connection. ['IP', 'ICMP', 'ARP']
+Destination hostname of the network connection.
++
ip-dst
ip-dst
Destination IP address of the nework connection.
@@ -5406,20 +5406,20 @@ network-connection is a MISP object available in JSON format at
layer7-protocol
text
dst-port
port
Layer 7 protocol of the network connection. ['HTTP', 'HTTPS', 'FTP']
+Destination port of the nework connection.
ip-dst
ip-dst
ip-src
ip-src
Destination IP address of the nework connection.
+Source IP address of the nework connection.
@@ -5464,30 +5464,10 @@ network-socket is a MISP object available in JSON format at
protocol
domain-family
text
Protocol used by the network socket. ['TCP', 'UDP', 'ICMP', 'IP']
--
ip-src
ip-src
Source (local) IP address of the network socket connection.
--
option
text
Option on the socket connection.
+Domain family who specifies the communication domain (PF_*) of the socket connection. ['PF_UNSPEC', 'PF_LOCAL', 'PF_UNIX', 'PF_FILE', 'PF_INET', 'PF_AX25', 'PF_IPX', 'PF_APPLETALK', 'PF_NETROM', 'PF_BRIDGE', 'PF_ATMPVC', 'PF_X25', 'PF_INET6', 'PF_ROSE', 'PF_DECnet', 'PF_NETBEUI', 'PF_SECURITY', 'PF_KEY', 'PF_NETLINK', 'PF_ROUTE', 'PF_PACKET', 'PF_ASH', 'PF_ECONET', 'PF_ATMSVC', 'PF_RDS', 'PF_SNA', 'PF_IRDA', 'PF_PPPOX', 'PF_WANPIPE', 'PF_LLC', 'PF_IB', 'PF_MPLS', 'PF_CAN', 'PF_TIPC', 'PF_BLUETOOTH', 'PF_IUCV', 'PF_RXRPC', 'PF_ISDN', 'PF_PHONET', 'PF_IEEE802154', 'PF_CAIF', 'PF_ALG', 'PF_NFC', 'PF_VSOCK', 'PF_KCM', 'PF_MAX']
@@ -5504,10 +5484,10 @@ network-socket is a MISP object available in JSON format at
hostname-dst
hostname
state
text
Destination hostname of the network socket connection.
+State of the socket connection. ['blocking', 'listening']
@@ -5524,20 +5504,30 @@ network-socket is a MISP object available in JSON format at
domain-family
option
text
Domain family who specifies the communication domain (PF_*) of the socket connection. ['PF_UNSPEC', 'PF_LOCAL', 'PF_UNIX', 'PF_FILE', 'PF_INET', 'PF_AX25', 'PF_IPX', 'PF_APPLETALK', 'PF_NETROM', 'PF_BRIDGE', 'PF_ATMPVC', 'PF_X25', 'PF_INET6', 'PF_ROSE', 'PF_DECnet', 'PF_NETBEUI', 'PF_SECURITY', 'PF_KEY', 'PF_NETLINK', 'PF_ROUTE', 'PF_PACKET', 'PF_ASH', 'PF_ECONET', 'PF_ATMSVC', 'PF_RDS', 'PF_SNA', 'PF_IRDA', 'PF_PPPOX', 'PF_WANPIPE', 'PF_LLC', 'PF_IB', 'PF_MPLS', 'PF_CAN', 'PF_TIPC', 'PF_BLUETOOTH', 'PF_IUCV', 'PF_RXRPC', 'PF_ISDN', 'PF_PHONET', 'PF_IEEE802154', 'PF_CAIF', 'PF_ALG', 'PF_NFC', 'PF_VSOCK', 'PF_KCM', 'PF_MAX']
+Option on the socket connection.
state
hostname-dst
hostname
Destination hostname of the network socket connection.
++
protocol
text
State of the socket connection. ['blocking', 'listening']
+Protocol used by the network socket. ['TCP', 'UDP', 'ICMP', 'IP']
@@ -5554,6 +5544,16 @@ network-socket is a MISP object available in JSON format at
ip-src
ip-src
Source (local) IP address of the network socket connection.
++
address-family
text
origin
text
Origin of the Passive DNS response
--
zone_time_last
datetime
Last time that the unique tuple (rrname, rrtype, rdata) record has been seen via master file import.
--
time_first
datetime
First time that the unique tuple (rrname, rrtype, rdata) has been seen by the passive DNS
--
sensor_id
text
text
text
Description of the passive DNS record.
--
zone_time_first
datetime
text
text
Description of the passive DNS record.
++
time_first
datetime
First time that the unique tuple (rrname, rrtype, rdata) has been seen by the passive DNS
++
rdata
text
rrname
text
Resource Record name of the queried resource.
--
time_last
datetime
Last time that the unique tuple (rrname, rrtype, rdata) record has been seen by the passive DNS
--
count
counter
bailiwick
origin
text
Best estimate of the apex of the zone where this data is authoritative
+Origin of the Passive DNS response
++
time_last
datetime
Last time that the unique tuple (rrname, rrtype, rdata) record has been seen by the passive DNS
zone_time_last
datetime
Last time that the unique tuple (rrname, rrtype, rdata) record has been seen via master file import.
++
rrname
text
Resource Record name of the queried resource.
++
bailiwick
text
Best estimate of the apex of the zone where this data is authoritative
++
last-seen
+datetime
When the paste has been accessible or seen for the last time.
++
paste
text
Raw text of the paste or post
++
origin
text
last-seen
datetime
url
url
When the paste has been accessible or seen for the last time.
+Link to the original source of the paste or post.
+
paste
text
Raw text of the paste or post
--
url
url
Link to the original source of the paste or post.
--
pehash
-pehash
Hash of the structural information about a sample. See https://www.usenix.org/legacy/event/leet09/tech/full_papers/wicherski/wicherski_html/
--
company-name
text
CompanyName in the resources
--
text
text
Free text value to attach to the PE
--
product-version
text
ProductVersion in the resources
--
type
text
lang-id
text
Lang ID in the resources
--
product-name
text
ProductName in the resources
--
entrypoint-address
text
Address of the entry point
--
number-sections
counter
Number of sections
--
file-version
text
FileVersion in the resources
--
impfuzzy
impfuzzy
original-filename
filename
OriginalFilename in the resources
--
internal-filename
filename
compilation-timestamp
datetime
Compilation timestamp defined in the PE header
--
entrypoint-section-at-position
text
Name of the section and position of the section in the PE
--
file-description
text
compilation-timestamp
datetime
Compilation timestamp defined in the PE header
++
file-version
text
FileVersion in the resources
++
pehash
pehash
Hash of the structural information about a sample. See https://www.usenix.org/legacy/event/leet09/tech/full_papers/wicherski/wicherski_html/
++
original-filename
filename
OriginalFilename in the resources
++
legal-copyright
text
text
text
Free text value to attach to the PE
++
company-name
text
CompanyName in the resources
++
number-sections
counter
Number of sections
++
product-version
text
ProductVersion in the resources
++
entrypoint-section-at-position
text
Name of the section and position of the section in the PE
++
imphash
imphash
product-name
text
ProductName in the resources
++
lang-id
text
Lang ID in the resources
++
entrypoint-address
text
Address of the entry point
++
sha224
-sha224
size-in-bytes
size-in-bytes
Secure Hash Algorithm 2 (224 bits)
--
name
text
Name of the section ['.rsrc', '.reloc', '.rdata', '.data', '.text']
+Size of the section, in bytes
ssdeep
ssdeep
Fuzzy hash using context triggered piecewise hashes (CTPH)
--
characteristic
text
sha1
sha1
entropy
float
[Insecure] Secure Hash Algorithm 1 (160 bits)
--
text
text
Free text value to attach to the section
+Entropy of the whole section
sha256
sha256
sha1
sha1
Secure Hash Algorithm 2 (256 bits)
--
sha512
sha512
Secure Hash Algorithm 2 (512 bits)
--
sha512/224
sha512/224
Secure Hash Algorithm 2 (224 bits)
+[Insecure] Secure Hash Algorithm 1 (160 bits)
@@ -6186,10 +6136,60 @@ pe-section is a MISP object available in JSON format at
size-in-bytes
size-in-bytes
sha224
sha224
Size of the section, in bytes
+Secure Hash Algorithm 2 (224 bits)
++
sha512/224
sha512/224
Secure Hash Algorithm 2 (224 bits)
++
sha512
sha512
Secure Hash Algorithm 2 (512 bits)
++
ssdeep
ssdeep
Fuzzy hash using context triggered piecewise hashes (CTPH)
++
sha256
sha256
Secure Hash Algorithm 2 (256 bits)
++
text
text
Free text value to attach to the section
@@ -6206,6 +6206,16 @@ pe-section is a MISP object available in JSON format at
name
text
Name of the section ['.rsrc', '.reloc', '.rdata', '.data', '.text']
++
sha384
sha384
entropy
float
Entropy of the whole section
--
social-security-number
+mothers-name
text
Social security number
+Mother name, father, second name or other names following country’s regulation.
passport-country
passport-country
The country in which the passport was issued.
--
redress-number
redress-number
The Redress Control Number is the record identifier for people who apply for redress through the DHS Travel Redress Inquiry Program (DHS TRIP). DHS TRIP is for travelers who have been repeatedly identified for additional screening and who want to file an inquiry to have erroneous information corrected in DHS systems.
--
nationality
nationality
The nationality of a natural person.
--
text
text
A description of the person or identity.
--
passport-expiration
passport-expiration
The expiration date of a passport.
--
alias
text
Alias name or known as.
--
first-name
first-name
First name of a natural person.
--
last-name
last-name
alias
text
Alias name or known as.
++
passport-number
passport-number
place-of-birth
place-of-birth
redress-number
redress-number
Place of birth of a natural person.
--
title
text
Title of the natural person such as Dr. or equivalent.
--
gender
gender
The gender of a natural person. ['Male', 'Female', 'Other', 'Prefer not to say']
--
date-of-birth
date-of-birth
Date of birth of a natural person (in YYYY-MM-DD format).
+The Redress Control Number is the record identifier for people who apply for redress through the DHS Travel Redress Inquiry Program (DHS TRIP). DHS TRIP is for travelers who have been repeatedly identified for additional screening and who want to file an inquiry to have erroneous information corrected in DHS systems.
@@ -6424,15 +6334,105 @@ person is a MISP object available in JSON format at
mothers-name
first-name
first-name
First name of a natural person.
++
place-of-birth
place-of-birth
Place of birth of a natural person.
++
gender
gender
The gender of a natural person. ['Male', 'Female', 'Other', 'Prefer not to say']
++
text
text
Mother name, father, second name or other names following country’s regulation.
+A description of the person or identity.
++
social-security-number
text
Social security number
date-of-birth
date-of-birth
Date of birth of a natural person (in YYYY-MM-DD format).
++
nationality
nationality
The nationality of a natural person.
++
title
text
Title of the natural person such as Dr. or equivalent.
++
passport-country
passport-country
The country in which the passport was issued.
++
passport-expiration
passport-expiration
The expiration date of a passport.
++
msisdn
-text
MSISDN (pronounced as /'em es ai es di en/ or misden) is a number uniquely identifying a subscription in a GSM or a UMTS mobile network. Simply put, it is the mapping of the telephone number to the SIM card in a mobile/cellular phone. This abbreviation has a several interpretations, the most common one being Mobile Station International Subscriber Directory Number.
--
tmsi
text
Temporary Mobile Subscriber Identities (TMSI) to visiting mobile subscribers can be allocated.
--
serial-number
text
Serial Number.
--
imsi
text
A usually unique International Mobile Subscriber Identity (IMSI) is allocated to each mobile subscriber in the GSM/UMTS/EPS system. IMSI can also refer to International Mobile Station Identity in the ITU nomenclature.
--
last-seen
datetime
first-seen
datetime
When the phone has been accessible or seen for the first time.
--
text
text
guti
first-seen
datetime
When the phone has been accessible or seen for the first time.
++
gummei
text
Globally Unique Temporary UE Identity (GUTI) is a temporary identification to not reveal the phone (user equipment in 3GPP jargon) composed of GUMMEI and the M-TMSI.
+Globally Unique MME Identifier (GUMMEI) is composed from MCC, MNC and MME Identifier (MMEI).
++
serial-number
text
Serial Number.
++
msisdn
text
MSISDN (pronounced as /'em es ai es di en/ or misden) is a number uniquely identifying a subscription in a GSM or a UMTS mobile network. Simply put, it is the mapping of the telephone number to the SIM card in a mobile/cellular phone. This abbreviation has a several interpretations, the most common one being Mobile Station International Subscriber Directory Number.
@@ -6562,10 +6542,30 @@ phone is a MISP object available in JSON format at
gummei
imsi
text
Globally Unique MME Identifier (GUMMEI) is composed from MCC, MNC and MME Identifier (MMEI).
+A usually unique International Mobile Subscriber Identity (IMSI) is allocated to each mobile subscriber in the GSM/UMTS/EPS system. IMSI can also refer to International Mobile Station Identity in the ITU nomenclature.
++
tmsi
text
Temporary Mobile Subscriber Identities (TMSI) to visiting mobile subscribers can be allocated.
++
guti
text
Globally Unique Temporary UE Identity (GUTI) is a temporary identification to not reveal the phone (user equipment in 3GPP jargon) composed of GUMMEI and the M-TMSI.
@@ -6610,10 +6610,10 @@ process is a MISP object available in JSON format at
pid
text
port
src-port
Process ID of the process.
+Port(s) owned by the process.
@@ -6630,10 +6630,20 @@ process is a MISP object available in JSON format at
name
pid
text
Name of the process
+Process ID of the process.
++
parent-pid
text
Process ID of the parent process.
@@ -6650,26 +6660,6 @@ process is a MISP object available in JSON format at
port
src-port
Port(s) owned by the process.
--
parent_pid
text
Process ID of the parent process.
--
child-pid
text
name
text
Name of the process
++
shortest-path-to-create-thread
+refsglobalvar
counter
Shortest path to the first time the binary calls CreateThread
+Amount of API calls outside of code section (glob var, dynamic API)
dangling-strings
total-functions
counter
Amount of dangling strings (string with a code cross reference, that is not within a function. Radare2 failed to detect that function.)
+Total amount of functions in the file.
ratio-string
float
create-thread
counter
Ratio: amount of referenced strings per kilobyte of code section
+Amount of calls to CreateThread
callbacks
callback-average
counter
Amount of callbacks (functions started as thread)
--
local-references
counter
Amount of API calls inside a code section
+Average size of a callback
@@ -6778,16 +6768,6 @@ r2graphity is a MISP object available in JSON format at
refsglobalvar
counter
Amount of API calls outside of code section (glob var, dynamic API)
--
get-proc-address
counter
callback-largest
counter
Largest callback
++
memory-allocations
counter
text
text
Description of the r2graphity object
--
ratio-api
float
Ratio: amount of API calls per kilobyte of code section
--
gml
attachment
Graph export in G>raph Modelling Language format
--
r2-commit-version
text
create-thread
counter
ratio-api
float
Amount of calls to CreateThread
--
unknown-references
counter
Amount of API calls not ending in a function (Radare2 bug, probalby)
+Ratio: amount of API calls per kilobyte of code section
@@ -6888,20 +6838,40 @@ r2graphity is a MISP object available in JSON format at
total-functions
referenced-strings
counter
Total amount of functions in the file.
+Amount of referenced strings
referenced-strings
shortest-path-to-create-thread
counter
Amount of referenced strings
+Shortest path to the first time the binary calls CreateThread
++
ratio-string
float
Ratio: amount of referenced strings per kilobyte of code section
++
callbacks
counter
Amount of callbacks (functions started as thread)
@@ -6918,20 +6888,50 @@ r2graphity is a MISP object available in JSON format at
callback-largest
counter
text
text
Largest callback
+Description of the r2graphity object
callback-average
unknown-references
counter
Average size of a callback
+Amount of API calls not ending in a function (Radare2 bug, probalby)
++
gml
attachment
Graph export in G>raph Modelling Language format
++
dangling-strings
counter
Amount of dangling strings (string with a code cross reference, that is not within a function. Radare2 failed to detect that function.)
++
local-references
counter
Amount of API calls inside a code section
@@ -7054,13 +7054,13 @@ registry-key is a MISP object available in JSON format at
name
hive
text
Name of the registry key
+Hive used to store the registry key (file on disk)
+
data
+text
Data stored in the registry key
++
root-keys
text
name
text
Name of the registry key
++
last-modified
datetime
data
text
Data stored in the registry key
--
hive
text
Hive used to store the registry key (file on disk)
--
classification
-text
ip
ip-dst
Classification of the RTIR ticket
+IPs automatically extracted from the RTIR ticket
@@ -7240,10 +7240,10 @@ rtir is a MISP object available in JSON format at
constituency
ticket-number
text
Constituency of the RTIR ticket
+ticket-number of the RTIR ticket
@@ -7260,6 +7260,26 @@ rtir is a MISP object available in JSON format at
constituency
text
Constituency of the RTIR ticket
++
classification
text
Classification of the RTIR ticket
++
queue
text
ticket-number
text
ticket-number of the RTIR ticket
--
ip
ip-dst
IPs automatically extracted from the RTIR ticket
--
sandbox-type
-text
The type of sandbox used ['on-premise', 'web', 'saas']
--
permalink
link
web-sandbox
text
A web sandbox where results are publicly available via an URL ['malwr', 'hybrid-analysis']
++
on-premise-sandbox
text
The on-premise sandbox used ['cuckoo', 'symantec-cas-on-premise', 'bluecoat-maa', 'trendmicro-deep-discovery-analyzer', 'fireeye-ax', 'vmray', 'joe-sandbox-on-premise']
++
results
text
Freetext result values
++
raw-report
text
sandbox-type
text
The type of sandbox used ['on-premise', 'web', 'saas']
++
score
text
results
text
Freetext result values
--
on-premise-sandbox
text
The on-premise sandbox used ['cuckoo', 'symantec-cas-on-premise', 'bluecoat-maa', 'trendmicro-deep-discovery-analyzer', 'fireeye-ax', 'vmray', 'joe-sandbox-on-premise']
--
web-sandbox
text
A web sandbox where results are publicly available via an URL ['malwr', 'hybrid-analysis']
--
datetime
-datetime
Datetime
--
text
text
software
text
Name of Sandbox software
--
signature
text
datetime
datetime
Datetime
++
software
text
Name of Sandbox software
++
MapOpCode
+SccpCgGT
text
MAP operation codes - Decimal value between 0-99.
--
MapSmsTypeNumber
text
MAP SMS TypeNumber.
--
MapGsmscfGT
text
MAP GSMSCF GT. Phone number.
--
SccpCdGT
text
Signaling Connection Control Part (SCCP) CdGT - Phone number.
--
SccpCdSSN
text
Signaling Connection Control Part (SCCP) - Decimal value between 0-255.
--
MapUssdContent
text
MAP USSD Content.
+Signaling Connection Control Part (SCCP) CgGT - Phone number.
@@ -7594,46 +7544,6 @@ ss7-attack is a MISP object available in JSON format at
Category
text
Category ['Cat0', 'Cat1', 'Cat2.1', 'Cat2.2', 'Cat3.1', 'Cat3.2', 'Cat3.3', 'CatSMS', 'CatSpoofing']
--
MapSmsText
text
MAP SMS Text. Important indicators in SMS text.
--
MapVersion
text
Map version. ['1', '2', '3']
--
SccpCgSSN
text
Signaling Connection Control Part (SCCP) - Decimal value between 0-255.
--
MapUssdCoding
text
MapImsi
text
MAP IMSI. Phone number starting with MCC/MNC.
--
MapMsisdn
text
MAP MSISDN. Phone number.
--
MapApplicationContext
text
MAP application context in OID format.
--
SccpCgGT
text
Signaling Connection Control Part (SCCP) CgGT - Phone number.
--
MapGmlc
text
MAP GMLC. Phone number.
--
SccpCdPC
text
Signaling Connection Control Part (SCCP) CdPC - Phone number.
--
MapMscGT
text
MAP MSC GT. Phone number.
--
MapVlrGT
text
MAP VLR GT. Phone number.
--
first-seen
datetime
When the attack has been seen for the first time.
--
MapSmscGT
text
MapSmsTP-OA
MapGmlc
text
MAP SMS TP-OA. Phone number.
+MAP GMLC. Phone number.
++
MapApplicationContext
text
MAP application context in OID format.
++
MapOpCode
text
MAP operation codes - Decimal value between 0-99.
++
MapMscGT
text
MAP MSC GT. Phone number.
++
SccpCgPC
text
Signaling Connection Control Part (SCCP) CgPC - Phone number.
++
MapSmsText
text
MAP SMS Text. Important indicators in SMS text.
++
MapUssdContent
text
MAP USSD Content.
++
MapMsisdn
text
MAP MSISDN. Phone number.
++
MapImsi
text
MAP IMSI. Phone number starting with MCC/MNC.
++
SccpCdGT
text
Signaling Connection Control Part (SCCP) CdGT - Phone number.
++
SccpCgSSN
text
Signaling Connection Control Part (SCCP) - Decimal value between 0-255.
++
Category
text
Category ['Cat0', 'Cat1', 'Cat2.1', 'Cat2.2', 'Cat3.1', 'Cat3.2', 'Cat3.3', 'CatSMS', 'CatSpoofing']
++
first-seen
datetime
When the attack has been seen for the first time.
++
MapVlrGT
text
MAP VLR GT. Phone number.
++
SccpCdPC
text
Signaling Connection Control Part (SCCP) CdPC - Phone number.
@@ -7764,6 +7724,56 @@ ss7-attack is a MISP object available in JSON format at
MapSmsTP-OA
text
MAP SMS TP-OA. Phone number.
++
MapSmsTypeNumber
text
MAP SMS TypeNumber.
++
MapVersion
text
Map version. ['1', '2', '3']
++
MapGsmscfGT
text
MAP GSMSCF GT. Phone number.
++
SccpCdSSN
text
Signaling Connection Control Part (SCCP) - Decimal value between 0-255.
++
MapSmsTP-PID
text
SccpCgPC
text
Signaling Connection Control Part (SCCP) CgPC - Phone number.
--
version
-text
Version of STIX 2 pattern. ['stix 2.0']
--
comment
comment
version
text
Version of STIX 2 pattern. ['stix 2.0']
++
suricata
-suricata
ref
link
Suricata rule.
--
version
text
Version of the Suricata rule depending where the suricata rule is known to work as expected.
+Reference to the Suricata rule such as origin of the rule or alike.
@@ -7920,10 +7910,20 @@ suricata is a MISP object available in JSON format at
ref
link
suricata
suricata
Reference to the Suricata rule such as origin of the rule or alike.
+Suricata rule.
++
version
text
Version of the Suricata rule depending where the suricata rule is known to work as expected.
@@ -7978,20 +7978,20 @@ target-system is a MISP object available in JSON format at
timestamp_seen
datetime
targeted_ip_of_system
ip-src
Registered date and time
+Targeted system IP address
targeted_ip_of_system
ip-src
timestamp_seen
datetime
Targeted system IP address
+Registered date and time
@@ -8036,20 +8036,10 @@ timecode is a MISP object available in JSON format at
start-timecode
end-marker-timecode
text
Start marker timecode in the format hh:mm:ss.mms
--
end-timecode
text
End marker timecode in the format hh:mm:ss.mms
+End marker timecode in the format hh:mm:ss;ff
@@ -8076,6 +8066,16 @@ timecode is a MISP object available in JSON format at
end-timecode
text
End marker timecode in the format hh:mm:ss.mms
++
description
text
end-marker-timecode
start-timecode
text
End marker timecode in the format hh:mm:ss;ff
+Start marker timecode in the format hh:mm:ss.mms
@@ -8144,16 +8144,6 @@ timesketch-timeline is a MISP object available in JSON format at
timestamp
timestamp-microsec
When the log entry was seen in microseconds since Unix epoch
--
timestamp_desc
text
timestamp
timestamp-microsec
When the log entry was seen in microseconds since Unix epoch
++
first-seen
+last-seen
datetime
First time that the linked object or attribute has been seen.
@@ -8232,7 +8232,7 @@ timestamp is a MISP object available in JSON format atlast-seen
first-seen
datetime
First time that the linked object or attribute has been seen.
@@ -8290,66 +8290,16 @@ tor-node is a MISP object available in JSON format atfingerprint
text
router’s fingerprint.
--
first-seen
last-seen
datetime
When the Tor node designed by the IP address has been seen for the first time.
+When the Tor node designed by the IP address has been seen for the last time.
text
text
Tor node comment.
--
nickname
text
router’s nickname.
--
published
datetime
router’s publication time. This can be different from first-seen and last-seen.
--
flags
text
list of flag associated with the node.
--
version_line
text
version
fingerprint
text
parsed version of tor, this is None if the relay’s using a new versioning scheme.
+router’s fingerprint.
@@ -8380,20 +8330,10 @@ tor-node is a MISP object available in JSON format at
last-seen
datetime
flags
text
When the Tor node designed by the IP address has been seen for the last time.
--
address
ip-src
IP address of the Tor node seen.
+list of flag associated with the node.
nickname
text
router’s nickname.
++
version
text
parsed version of tor, this is None if the relay’s using a new versioning scheme.
++
text
text
Tor node comment.
++
first-seen
datetime
When the Tor node designed by the IP address has been seen for the first time.
++
published
datetime
router’s publication time. This can be different from first-seen and last-seen.
++
address
ip-src
IP address of the Tor node seen.
++
authorized
+to-country
text
Person who autorized the transaction.
--
transaction-number
text
A unique number identifying a transaction.
+Target country of a transaction.
@@ -8478,20 +8468,40 @@ transaction is a MISP object available in JSON format at
date
datetime
from-country
text
Date and time of the transaction.
+Origin country of a transaction.
transmode-comment
transaction-number
text
Comment describing transmode-code, if needed.
+A unique number identifying a transaction.
++
authorized
text
Person who autorized the transaction.
++
transmode-code
text
How the transaction was conducted.
@@ -8508,50 +8518,10 @@ transaction is a MISP object available in JSON format at
transmode-code
text
date
datetime
How the transaction was conducted.
--
amount
text
The value of the transaction in local currency.
--
location
text
Location where the transaction took place.
--
to-country
text
Target country of a transaction.
--
from-country
text
Origin country of a transaction.
+Date and time of the transaction.
@@ -8568,10 +8538,20 @@ transaction is a MISP object available in JSON format at
date-posting
datetime
location
text
Date of posting, if different from date of transaction.
+Location where the transaction took place.
++
amount
text
The value of the transaction in local currency.
transmode-comment
text
Comment describing transmode-code, if needed.
++
date-posting
datetime
Date of posting, if different from date of transaction.
++
port
-port
Port number
--
domain_without_tld
text
Domain without Top-Level Domain
--
domain
domain
Full domain
--
credential
text
Credential (username, password)
--
first-seen
last-seen
datetime
First time this URL has been seen
--
text
text
Description of the URL
--
host
hostname
Full hostname
--
subdomain
text
Subdomain
--
query_string
text
Query (after path, preceded by '?')
--
tld
text
Top-Level Domain
+Last time this URL has been seen
@@ -8736,10 +8646,80 @@ url is a MISP object available in JSON format at
last-seen
url
url
Full URL
++
domain
domain
Full domain
++
host
hostname
Full hostname
++
first-seen
datetime
Last time this URL has been seen
+First time this URL has been seen
++
tld
text
Top-Level Domain
++
text
text
Description of the URL
++
query_string
text
Query (after path, preceded by '?')
++
port
port
Port number
@@ -8756,6 +8736,26 @@ url is a MISP object available in JSON format at
domain_without_tld
text
Domain without Top-Level Domain
++
subdomain
text
Subdomain
++
resource_path
text
url
url
credential
text
Full URL
+Credential (username, password)
@@ -8814,10 +8814,20 @@ victim is a MISP object available in JSON format at
name
target-org
user
target-user
The name of the department(s) or organisation(s) targeted.
+The username(s) of the user targeted.
++
node
target-machine
Name(s) of node that was targeted.
@@ -8834,60 +8844,10 @@ victim is a MISP object available in JSON format at
roles
text
target-email
The list of roles targeted within the victim.
--
sectors
text
The list of sectors that the victim belong to ['agriculture', 'aerospace', 'automotive', 'communications', 'construction', 'defence', 'education', 'energy', 'engineering', 'entertainment', 'financial services', 'government national', 'government regional', 'government local', 'government public services', 'healthcare', 'hospitality leisure', 'infrastructure', 'insurance', 'manufacturing', 'mining', 'non profit', 'pharmaceuticals', 'retail', 'technology', 'telecommunications', 'transportation', 'utilities']
--
classification
text
The type of entity being targeted. ['individual', 'group', 'organization', 'class', 'unknown']
--
node
target-machine
Name(s) of node that was targeted.
--
external
target-external
External target organisations affected by this attack.
--
regions
target-location
The list of regions or locations from the victim targeted. ISO 3166 should be used.
+The email address(es) of the user targeted.
@@ -8904,20 +8864,60 @@ victim is a MISP object available in JSON format at
user
target-user
regions
target-location
The username(s) of the user targeted.
+The list of regions or locations from the victim targeted. ISO 3166 should be used.
target-email
sectors
text
The email address(es) of the user targeted.
+The list of sectors that the victim belong to ['agriculture', 'aerospace', 'automotive', 'communications', 'construction', 'defence', 'education', 'energy', 'engineering', 'entertainment', 'financial services', 'government national', 'government regional', 'government local', 'government public services', 'healthcare', 'hospitality leisure', 'infrastructure', 'insurance', 'manufacturing', 'mining', 'non profit', 'pharmaceuticals', 'retail', 'technology', 'telecommunications', 'transportation', 'utilities']
++
external
target-external
External target organisations affected by this attack.
++
name
target-org
The name of the department(s) or organisation(s) targeted.
++
classification
text
The type of entity being targeted. ['individual', 'group', 'organization', 'class', 'unknown']
++
roles
text
The list of roles targeted within the victim.
@@ -8962,20 +8962,10 @@ virustotal-report is a MISP object available in JSON format at
first-submission
datetime
First Submission
--
detection-ratio
community-score
text
Detection Ratio
+Community Score
@@ -8992,13 +8982,23 @@ virustotal-report is a MISP object available in JSON format at
community-score
text
last-submission
datetime
Community Score
+Last Submission
+
+
first-submission
datetime
First Submission
+
last-submission
-datetime
detection-ratio
text
Last Submission
+Detection Ratio
+
created
-datetime
First time when the vulnerability was discovered
--
summary
text
Summary of the vulnerability
--
references
link
External references
--
state
text
State of the vulnerability. A vulnerability can have multiple states depending of the current actions performed. ['Published', 'Embargo', 'Reviewed', 'Vulnerability ID Assigned', 'Reported', 'Fixed']
--
modified
datetime
Last modification date
--
text
text
references
link
External references
++
modified
datetime
Last modification date
++
created
datetime
First time when the vulnerability was discovered
++
published
datetime
state
text
State of the vulnerability. A vulnerability can have multiple states depending of the current actions performed. ['Published', 'Embargo', 'Reviewed', 'Vulnerability ID Assigned', 'Reported', 'Fixed']
++
summary
text
Summary of the vulnerability
++
vulnerable_configuration
text
creation-date
expiration-date
datetime
Initial creation of the whois entry
+Expiration of the whois entry
comment
text
Comment of the whois entry
--
registrant-phone
whois-registrant-phone
Registrant phone number
--
domain
domain
modification-date
creation-date
datetime
Last update of the whois entry
+Initial creation of the whois entry
text
text
registrant-phone
whois-registrant-phone
Full whois entry
+Registrant phone number
+
registrant-email
-whois-registrant-email
registrar
whois-registrar
Registrant email address
+Registrar of the whois entry
registrar
whois-registrar
text
text
Registrar of the whois entry
+Full whois entry
++
registrant-email
whois-registrant-email
Registrant email address
@@ -9298,6 +9288,16 @@ whois is a MISP object available in JSON format at
modification-date
datetime
Last update of the whois entry
++
registrant-name
whois-registrant-name
expiration-date
datetime
comment
text
Expiration of the whois entry
+Comment of the whois entry
+
self_signed
+is_ca
boolean
Self-signed certificate
+CA certificate
++
x509-fingerprint-md5
x509-fingerprint-md5
[Insecure] MD5 hash (128 bits)
++
pubkey-info-modulus
text
Modulus of the public key
++
text
text
Free text description of hte certificate
@@ -9376,6 +9406,16 @@ x509 is a MISP object available in JSON format at
validity-not-after
datetime
Certificate invalid after that date
++
pubkey-info-algorithm
text
subject
version
text
Subject of the certificate
--
raw-base64
text
Raw certificate base64 encoded (DER format)
--
text
text
Free text description of hte certificate
--
x509-fingerprint-sha1
x509-fingerprint-sha1
[Insecure] Secure Hash Algorithm 1 (160 bits)
+Version of the certificate
@@ -9446,30 +9456,10 @@ x509 is a MISP object available in JSON format at
pubkey-info-modulus
subject
text
Modulus of the public key
--
dns_names
text
DNS names
--
version
text
Version of the certificate
+Subject of the certificate
@@ -9486,30 +9476,20 @@ x509 is a MISP object available in JSON format at
validity-not-after
datetime
pubkey-info-exponent
text
Certificate invalid after that date
+Exponent of the public key
x509-fingerprint-md5
x509-fingerprint-md5
dns_names
text
[Insecure] MD5 hash (128 bits)
--
validity-not-before
datetime
Certificate invalid before that date
+DNS names
@@ -9526,20 +9506,40 @@ x509 is a MISP object available in JSON format at
pubkey-info-exponent
raw-base64
text
Exponent of the public key
+Raw certificate base64 encoded (DER format)
is_ca
self_signed
boolean
CA certificate
+Self-signed certificate
++
validity-not-before
datetime
Certificate invalid before that date
++
x509-fingerprint-sha1
x509-fingerprint-sha1
[Insecure] Secure Hash Algorithm 1 (160 bits)
@@ -9594,13 +9594,13 @@ yabin is a MISP object available in JSON format at
version
comment
yara
yara
yabin.py and regex.txt version used for the generation of the yara rules.
+Yara rule generated from -y.
+
yara
-yara
Yara rule generated from -y.
--
whitelist
comment
version
comment
yabin.py and regex.txt version used for the generation of the yara rules.
++
version
-text
yara
yara
Version of the YARA rule depending where the yara rule is known to work as expected. ['3.7.1']
+YARA rule.
@@ -9692,20 +9692,20 @@ yara is a MISP object available in JSON format at
yara
yara
context
text
YARA rule.
+Context where the YARA rule can be applied ['all', 'disk', 'memory', 'network']
context
version
text
Context where the YARA rule can be applied ['all', 'disk', 'memory', 'network']
+Version of the YARA rule depending where the yara rule is known to work as expected. ['3.7.1']