+
Any unique number assigned to the case for unique identification.
+An object template to describe a digital forensic case..
+| + + | ++forensic-case is a MISP object available in JSON format at this location The JSON format can be freely reused in your application or automatically enabled in MISP. + | +
| Object attribute | +MISP attribute type | +Description | +Disable correlation | +Multiple | +
|---|---|---|---|---|
case-number |
+text |
+
+ Any unique number assigned to the case for unique identification. + |
+
+ + |
+
+ + |
+
case-name |
+text |
+
+ Name to address the case. + |
+
+ + |
+
+ + |
+
name-of-the-analyst |
+text |
+
+ Name(s) of the analyst assigned to the case. + |
+
+ + |
+
+ + |
+
references |
+link |
+
+ External references + |
+
+ + |
+
+ + |
+
analysis-start-date |
+datetime |
+
+ Date when the analysis began. + |
+
+ + |
+
+ + |
+
additional-comments |
+text |
+
+ Comments. + |
+
+ + |
+
+ + |
+
An object template to describe a digital forensic evidence..
+| + + | ++forensic-evidence is a MISP object available in JSON format at this location The JSON format can be freely reused in your application or automatically enabled in MISP. + | +
| Object attribute | +MISP attribute type | +Description | +Disable correlation | +Multiple | +
|---|---|---|---|---|
case-number |
+text |
+
+ A unique number assigned to the case for unique identification. + |
+
+ + |
+
+ + |
+
evidence-number |
+text |
+
+ A unique number assigned to the evidence for unique identification. + |
+
+ + |
+
+ + |
+
type |
+text |
+
+ Evidence type. ['Computer', 'Network', 'Mobile Device', 'Multimedia', 'Cloud', 'IoT', 'Other'] + |
+
+ + |
+
+ + |
+
name |
+text |
+
+ Name of the evidence acquired. + |
+
+ + |
+
+ + |
+
acquisition-method |
+text |
+
+ Method used for acquisition of the evidence. ['Live acquisition', 'Dead/Offline acquisition', 'Physical collection', 'Logical collection', 'File system extraction', 'Chip-off', 'Other'] + |
+
+ + |
+
+ + |
+
acquisition-tools |
+text |
+
+ Tools used for acquisition of the evidence. ['dd', 'dc3dd', 'dcfldd', 'EnCase', 'FTK Imager', 'FDAS', 'TrueBack', 'Guymager', 'IXimager', 'Other'] + |
+
+ + |
+
+ + |
+
references |
+link |
+
+ External references + |
+
+ + |
+
+ + |
+
additional-comments |
+text |
+
+ Comments. + |
+
+ + |
+
+ + |
+
indicates
-This relationships describes that the source object indicates the target object.
This relationship describes that the source object indicates the target object.
['misp', 'stix-2.0']
exploits
-This relationships describes an object (like a PoC/exploit) which exploits another object (such as a vulnerability object).
This relationship describes an object (like a PoC/exploit) which exploits another object (such as a vulnerability object).
['misp']