Distributed Denial of Service - or short: DDoS - taxonomy supports the description of Denial of Service attacks and especially the types they belong too.-
Access Now
+Access Now classification to classify an issue (such as security, human rights, youth rights).
Action taken
+Action taken in the case of a security incident (CSIRT perspective).
Distributed Denial of Service - or short: DDoS - taxonomy supports the description of Denial of Service attacks and especially the types they belong too.-
Distributed Denial of Service - or short: DDoS - taxonomy supports the description of Denial of Service attacks and especially the types they belong too.
Economical impact is a taxonomy to describe the financial impact as positive or negative gain to the tagged information.
+Economical impact is a taxonomy to describe the financial impact as positive or negative gain to the tagged information (e.g. data exfiltration loss, a positive gain for an adversary).
Less than EUR 1 000 000
+Less than 1 million EUR
+Less than 10 million EUR
+Less than 100 million EUR
+Less than 1 billion EUR
+More than 1 billion EUR
Less than EUR 1 000 000
+Less than 1 million EUR
+Less than 10 million EUR
+Less than 100 million EUR
+Less than 1 billion EUR
+More than 1 billion EUR
pentest classification.
+Penetration test (pentest) classification.
+ + | ++use-case-applicability namespace available in JSON format at this location. The JSON format can be freely reused in your application or automatically enabled in MISP taxonomy. + | +
The Use Case Applicability categories reflect standard resolution categories, to clearly display alerting rule configuration problems.
+The process to communicate administrative activities or special user actions was in place and working correctly. Internal sensors are working and detecting privileged or irregular administrative behaviour.
+Announced administrative/user action
+The process to communicate administrative activities or special user actions was in place and working correctly. Internal sensors are working and detecting privileged or irregular administrative behaviour.
+Internal sensors have detected privileged or user activity, which was not previously communicated. This category also includes improper usage.
+Unannounced administrative/user action
+Internal sensors have detected privileged or user activity, which was not previously communicated. This category also includes improper usage.
+This category reflects false alerts that were raised due to configuration errors in the central log management system, often a SIEM, rule.
+Log management rule configuration error
+This category reflects false alerts that were raised due to configuration errors in the central log management system, often a SIEM, rule.
+This category reflects rules on detection devices, which are usually passive or active components of network security.
+Detection device/rule configuration error
+This category reflects rules on detection devices, which are usually passive or active components of network security.
+Products often require external indicator information or security feeds to be applied on active or passive infrastructure components to create alerts.
+Bad IOC/rule pattern value
+Products often require external indicator information or security feeds to be applied on active or passive infrastructure components to create alerts.
+This alert reflects alerts created for testing purposes.
+Test alert
+This alert reflects alerts created for testing purposes.
+This alert represents the classic true positives, where all security controls in place were circumvented, a security control was lacking or a misconfiguration of a security element occurred.
+Confirmed Attack with IR actions
+This alert represents the classic true positives, where all security controls in place were circumvented, a security control was lacking or a misconfiguration of a security element occurred.
+This category reflects an attempt by a threat actor, which in the end could be prevented by in place security measures but passed security controls associated with the delivery phase of the Cyber Kill Chain.
+Confirmed Attack attempt without IR actions
+This category reflects an attempt by a threat actor, which in the end could be prevented by in place security measures but passed security controls associated with the delivery phase of the Cyber Kill Chain.
+