origin
-text
The link where the leak is (or was) accessible at first-seen.
--
sensor
text
The AIL sensor uuid where the leak was processed and analysed.
--
duplicate
text
Duplicate of the existing leaks.
--
raw-data
attachment
Raw data as received by the AIL sensor compressed and encoded in Base64.
--
original-date
datetime
When the information available in the leak was created. It’s usually before the first-seen.
--
duplicate_number
counter
Number of known duplicates.
--
last-seen
datetime
text
text
A description of the leak which could include the potential victim(s) or description of the leak.
--
type
text
duplicate
text
Duplicate of the existing leaks.
++
text
text
A description of the leak which could include the potential victim(s) or description of the leak.
++
sensor
text
The AIL sensor uuid where the leak was processed and analysed.
++
duplicate_number
counter
Number of known duplicates.
++
original-date
datetime
When the information available in the leak was created. It’s usually before the first-seen.
++
raw-data
attachment
Raw data as received by the AIL sensor compressed and encoded in Base64.
++
origin
text
The link where the leak is (or was) accessible at first-seen.
++
comment
-comment
permission
text
Comment about the set of android permission(s)
+Android permission ['ACCESS_CHECKIN_PROPERTIES', 'ACCESS_COARSE_LOCATION', 'ACCESS_FINE_LOCATION', 'ACCESS_LOCATION_EXTRA_COMMANDS', 'ACCESS_NETWORK_STATE', 'ACCESS_NOTIFICATION_POLICY', 'ACCESS_WIFI_STATE', 'ACCOUNT_MANAGER', 'ADD_VOICEMAIL', 'ANSWER_PHONE_CALLS', 'BATTERY_STATS', 'BIND_ACCESSIBILITY_SERVICE', 'BIND_APPWIDGET', 'BIND_AUTOFILL_SERVICE', 'BIND_CARRIER_MESSAGING_SERVICE', 'BIND_CHOOSER_TARGET_SERVICE', 'BIND_CONDITION_PROVIDER_SERVICE', 'BIND_DEVICE_ADMIN', 'BIND_DREAM_SERVICE', 'BIND_INCALL_SERVICE', 'BIND_INPUT_METHOD', 'BIND_MIDI_DEVICE_SERVICE', 'BIND_NFC_SERVICE', 'BIND_NOTIFICATION_LISTENER_SERVICE', 'BIND_PRINT_SERVICE', 'BIND_QUICK_SETTINGS_TILE', 'BIND_REMOTEVIEWS', 'BIND_SCREENING_SERVICE', 'BIND_TELECOM_CONNECTION_SERVICE', 'BIND_TEXT_SERVICE', 'BIND_TV_INPUT', 'BIND_VISUAL_VOICEMAIL_SERVICE', 'BIND_VOICE_INTERACTION', 'BIND_VPN_SERVICE', 'BIND_VR_LISTENER_SERVICE', 'BIND_WALLPAPER', 'BLUETOOTH', 'BLUETOOTH_ADMIN', 'BLUETOOTH_PRIVILEGED', 'BODY_SENSORS', 'BROADCAST_PACKAGE_REMOVED', 'BROADCAST_SMS', 'BROADCAST_STICKY', 'BROADCAST_WAP_PUSH', 'CALL_PHONE', 'CALL_PRIVILEGED', 'CAMERA', 'CAPTURE_AUDIO_OUTPUT', 'CAPTURE_SECURE_VIDEO_OUTPUT', 'CAPTURE_VIDEO_OUTPUT', 'CHANGE_COMPONENT_ENABLED_STATE', 'CHANGE_CONFIGURATION', 'CHANGE_NETWORK_STATE', 'CHANGE_WIFI_MULTICAST_STATE', 'CHANGE_WIFI_STATE', 'CLEAR_APP_CACHE', 'CONTROL_LOCATION_UPDATES', 'DELETE_CACHE_FILES', 'DELETE_PACKAGES', 'DIAGNOSTIC', 'DISABLE_KEYGUARD', 'DUMP', 'EXPAND_STATUS_BAR', 'FACTORY_TEST', 'GET_ACCOUNTS', 'GET_ACCOUNTS_PRIVILEGED', 'GET_PACKAGE_SIZE', 'GET_TASKS', 'GLOBAL_SEARCH', 'INSTALL_LOCATION_PROVIDER', 'INSTALL_PACKAGES', 'INSTALL_SHORTCUT', 'INSTANT_APP_FOREGROUND_SERVICE', 'INTERNET', 'KILL_BACKGROUND_PROCESSES', 'LOCATION_HARDWARE', 'MANAGE_DOCUMENTS', 'MANAGE_OWN_CALLS', 'MASTER_CLEAR', 'MEDIA_CONTENT_CONTROL', 'MODIFY_AUDIO_SETTINGS', 'MODIFY_PHONE_STATE', 'MOUNT_FORMAT_FILESYSTEMS', 'MOUNT_UNMOUNT_FILESYSTEMS', 'NFC', 'PACKAGE_USAGE_STATS', 'PERSISTENT_ACTIVITY', 'PROCESS_OUTGOING_CALLS', 'READ_CALENDAR', 'READ_CALL_LOG', 'READ_CONTACTS', 'READ_EXTERNAL_STORAGE', 'READ_FRAME_BUFFER', 'READ_INPUT_STATE', 'READ_LOGS', 'READ_PHONE_NUMBERS', 'READ_PHONE_STATE', 'READ_SMS', 'READ_SYNC_SETTINGS', 'READ_SYNC_STATS', 'READ_VOICEMAIL', 'REBOOT', 'RECEIVE_BOOT_COMPLETED', 'RECEIVE_MMS', 'RECEIVE_SMS', 'RECEIVE_WAP_PUSH', 'RECORD_AUDIO', 'REORDER_TASKS', 'REQUEST_COMPANION_RUN_IN_BACKGROUND', 'REQUEST_COMPANION_USE_DATA_IN_BACKGROUND', 'REQUEST_DELETE_PACKAGES', 'REQUEST_IGNORE_BATTERY_OPTIMIZATIONS', 'REQUEST_INSTALL_PACKAGES', 'RESTART_PACKAGES', 'SEND_RESPOND_VIA_MESSAGE', 'SEND_SMS', 'SET_ALARM', 'SET_ALWAYS_FINISH', 'SET_ANIMATION_SCALE', 'SET_DEBUG_APP', 'SET_PREFERRED_APPLICATIONS', 'SET_PROCESS_LIMIT', 'SET_TIME', 'SET_TIME_ZONE', 'SET_WALLPAPER', 'SET_WALLPAPER_HINTS', 'SIGNAL_PERSISTENT_PROCESSES', 'STATUS_BAR', 'SYSTEM_ALERT_WINDOW', 'TRANSMIT_IR', 'UNINSTALL_SHORTCUT', 'UPDATE_DEVICE_STATS', 'USE_FINGERPRINT', 'USE_SIP', 'VIBRATE', 'WAKE_LOCK', 'WRITE_APN_SETTINGS', 'WRITE_CALENDAR', 'WRITE_CALL_LOG', 'WRITE_CONTACTS', 'WRITE_EXTERNAL_STORAGE', 'WRITE_GSERVICES', 'WRITE_SECURE_SETTINGS', 'WRITE_SETTINGS', 'WRITE_SYNC_SETTINGS', 'WRITE_VOICEMAIL']
permission
text
comment
comment
Android permission ['ACCESS_CHECKIN_PROPERTIES', 'ACCESS_COARSE_LOCATION', 'ACCESS_FINE_LOCATION', 'ACCESS_LOCATION_EXTRA_COMMANDS', 'ACCESS_NETWORK_STATE', 'ACCESS_NOTIFICATION_POLICY', 'ACCESS_WIFI_STATE', 'ACCOUNT_MANAGER', 'ADD_VOICEMAIL', 'ANSWER_PHONE_CALLS', 'BATTERY_STATS', 'BIND_ACCESSIBILITY_SERVICE', 'BIND_APPWIDGET', 'BIND_AUTOFILL_SERVICE', 'BIND_CARRIER_MESSAGING_SERVICE', 'BIND_CHOOSER_TARGET_SERVICE', 'BIND_CONDITION_PROVIDER_SERVICE', 'BIND_DEVICE_ADMIN', 'BIND_DREAM_SERVICE', 'BIND_INCALL_SERVICE', 'BIND_INPUT_METHOD', 'BIND_MIDI_DEVICE_SERVICE', 'BIND_NFC_SERVICE', 'BIND_NOTIFICATION_LISTENER_SERVICE', 'BIND_PRINT_SERVICE', 'BIND_QUICK_SETTINGS_TILE', 'BIND_REMOTEVIEWS', 'BIND_SCREENING_SERVICE', 'BIND_TELECOM_CONNECTION_SERVICE', 'BIND_TEXT_SERVICE', 'BIND_TV_INPUT', 'BIND_VISUAL_VOICEMAIL_SERVICE', 'BIND_VOICE_INTERACTION', 'BIND_VPN_SERVICE', 'BIND_VR_LISTENER_SERVICE', 'BIND_WALLPAPER', 'BLUETOOTH', 'BLUETOOTH_ADMIN', 'BLUETOOTH_PRIVILEGED', 'BODY_SENSORS', 'BROADCAST_PACKAGE_REMOVED', 'BROADCAST_SMS', 'BROADCAST_STICKY', 'BROADCAST_WAP_PUSH', 'CALL_PHONE', 'CALL_PRIVILEGED', 'CAMERA', 'CAPTURE_AUDIO_OUTPUT', 'CAPTURE_SECURE_VIDEO_OUTPUT', 'CAPTURE_VIDEO_OUTPUT', 'CHANGE_COMPONENT_ENABLED_STATE', 'CHANGE_CONFIGURATION', 'CHANGE_NETWORK_STATE', 'CHANGE_WIFI_MULTICAST_STATE', 'CHANGE_WIFI_STATE', 'CLEAR_APP_CACHE', 'CONTROL_LOCATION_UPDATES', 'DELETE_CACHE_FILES', 'DELETE_PACKAGES', 'DIAGNOSTIC', 'DISABLE_KEYGUARD', 'DUMP', 'EXPAND_STATUS_BAR', 'FACTORY_TEST', 'GET_ACCOUNTS', 'GET_ACCOUNTS_PRIVILEGED', 'GET_PACKAGE_SIZE', 'GET_TASKS', 'GLOBAL_SEARCH', 'INSTALL_LOCATION_PROVIDER', 'INSTALL_PACKAGES', 'INSTALL_SHORTCUT', 'INSTANT_APP_FOREGROUND_SERVICE', 'INTERNET', 'KILL_BACKGROUND_PROCESSES', 'LOCATION_HARDWARE', 'MANAGE_DOCUMENTS', 'MANAGE_OWN_CALLS', 'MASTER_CLEAR', 'MEDIA_CONTENT_CONTROL', 'MODIFY_AUDIO_SETTINGS', 'MODIFY_PHONE_STATE', 'MOUNT_FORMAT_FILESYSTEMS', 'MOUNT_UNMOUNT_FILESYSTEMS', 'NFC', 'PACKAGE_USAGE_STATS', 'PERSISTENT_ACTIVITY', 'PROCESS_OUTGOING_CALLS', 'READ_CALENDAR', 'READ_CALL_LOG', 'READ_CONTACTS', 'READ_EXTERNAL_STORAGE', 'READ_FRAME_BUFFER', 'READ_INPUT_STATE', 'READ_LOGS', 'READ_PHONE_NUMBERS', 'READ_PHONE_STATE', 'READ_SMS', 'READ_SYNC_SETTINGS', 'READ_SYNC_STATS', 'READ_VOICEMAIL', 'REBOOT', 'RECEIVE_BOOT_COMPLETED', 'RECEIVE_MMS', 'RECEIVE_SMS', 'RECEIVE_WAP_PUSH', 'RECORD_AUDIO', 'REORDER_TASKS', 'REQUEST_COMPANION_RUN_IN_BACKGROUND', 'REQUEST_COMPANION_USE_DATA_IN_BACKGROUND', 'REQUEST_DELETE_PACKAGES', 'REQUEST_IGNORE_BATTERY_OPTIMIZATIONS', 'REQUEST_INSTALL_PACKAGES', 'RESTART_PACKAGES', 'SEND_RESPOND_VIA_MESSAGE', 'SEND_SMS', 'SET_ALARM', 'SET_ALWAYS_FINISH', 'SET_ANIMATION_SCALE', 'SET_DEBUG_APP', 'SET_PREFERRED_APPLICATIONS', 'SET_PROCESS_LIMIT', 'SET_TIME', 'SET_TIME_ZONE', 'SET_WALLPAPER', 'SET_WALLPAPER_HINTS', 'SIGNAL_PERSISTENT_PROCESSES', 'STATUS_BAR', 'SYSTEM_ALERT_WINDOW', 'TRANSMIT_IR', 'UNINSTALL_SHORTCUT', 'UPDATE_DEVICE_STATS', 'USE_FINGERPRINT', 'USE_SIP', 'VIBRATE', 'WAKE_LOCK', 'WRITE_APN_SETTINGS', 'WRITE_CALENDAR', 'WRITE_CALL_LOG', 'WRITE_CONTACTS', 'WRITE_EXTERNAL_STORAGE', 'WRITE_GSERVICES', 'WRITE_SECURE_SETTINGS', 'WRITE_SETTINGS', 'WRITE_SYNC_SETTINGS', 'WRITE_VOICEMAIL']
+Comment about the set of android permission(s)
@@ -779,20 +779,40 @@ annotation is a MISP object available in JSON format at
text
text
ref
link
Raw text of the annotation
+Reference(s) to the annotation
ref
link
creation-date
datetime
Reference(s) to the annotation
+Initial creation of the annotation
++
modification-date
datetime
Last update of the annotation
++
text
text
Raw text of the annotation
@@ -809,16 +829,6 @@ annotation is a MISP object available in JSON format at
creation-date
datetime
Initial creation of the annotation
--
type
text
modification-date
datetime
Last update of the annotation
--
mp-import
-text
subnet-announced
ip-src
The inbound IPv4 or IPv6 routing policy of the AS in RFC 4012 – Routing Policy Specification Language next generation (RPSLng), section 4.5. format
+Subnet announced
@@ -897,40 +897,10 @@ asn is a MISP object available in JSON format at
first-seen
datetime
First time the ASN was seen
--
import
description
text
The inbound IPv4 routing policy of the AS in RFC 2622 – Routing Policy Specification Language (RPSL) format
--
country
text
Country code of the main location of the autonomous system
--
asn
AS
Autonomous System Number
+Description of the autonomous system
@@ -947,26 +917,36 @@ asn is a MISP object available in JSON format at
description
import
text
Description of the autonomous system
+The inbound IPv4 routing policy of the AS in RFC 2622 – Routing Policy Specification Language (RPSL) format
subnet-announced
ip-src
mp-import
text
Subnet announced
+The inbound IPv4 or IPv6 routing policy of the AS in RFC 4012 – Routing Policy Specification Language next generation (RPSLng), section 4.5. format
first-seen
datetime
First time the ASN was seen
++
export
text
asn
AS
Autonomous System Number
++
country
text
Country code of the main location of the autonomous system
++
datetime
-datetime
Datetime
--
text
software
text
Free text value to attach to the file
+Name of antivirus software
@@ -1045,10 +1035,20 @@ av-signature is a MISP object available in JSON format at
software
text
text
Name of antivirus software
+Free text value to attach to the file
++
datetime
datetime
Datetime
@@ -1093,36 +1093,6 @@ bank-account is a MISP object available in JSON format at
institution-name
text
Name of the bank or financial organisation.
--
text
text
A description of the bank account.
--
report-code
text
Report code of the bank account. ['CTR Cash Transaction Report', 'STR Suspicious Transaction Report', 'EFT Electronic Funds Transfer', 'IFT International Funds Transfer', 'TFR Terror Financing Report', 'BCR Border Cash Report', 'UTR Unusual Transaction Report', 'AIF Additional Information File – Can be used for example to get full disclosure of transactions of an account for a period of time without reporting it as a CTR.', 'IRI Incoming Request for Information – International', 'ORI Outgoing Request for Information – International', 'IRD Incoming Request for Information – Domestic', 'ORD Outgoing Request for Information – Domestic']
--
client-number
text
aba-rtn
aba-rtn
ABA routing transit number
++
branch
text
Branch code or name
++
status-code
text
Account status at the time of the transaction processed. ['A - Active', 'B - Inactive', 'C - Dormant']
++
opened
datetime
report-code
text
Report code of the bank account. ['CTR Cash Transaction Report', 'STR Suspicious Transaction Report', 'EFT Electronic Funds Transfer', 'IFT International Funds Transfer', 'TFR Terror Financing Report', 'BCR Border Cash Report', 'UTR Unusual Transaction Report', 'AIF Additional Information File – Can be used for example to get full disclosure of transactions of an account for a period of time without reporting it as a CTR.', 'IRI Incoming Request for Information – International', 'ORI Outgoing Request for Information – International', 'IRD Incoming Request for Information – Domestic', 'ORD Outgoing Request for Information – Domestic']
++
currency-code
text
status-code
beneficiary-comment
text
Account status at the time of the transaction processed. ['A - Active', 'B - Inactive', 'C - Dormant']
--
beneficiary
text
Final beneficiary of the bank account.
--
iban
iban
IBAN of the bank account.
--
account
bank-account-nr
Account number
--
personal-account-type
text
Account type. ['A - Business', 'B - Personal Current', 'C - Savings', 'D - Trust Account', 'E - Trading Account', 'O - Other']
--
aba-rtn
aba-rtn
ABA routing transit number
--
swift
bic
SWIFT or BIC as defined in ISO 9362.
--
institution-code
text
Institution code of the bank.
--
branch
text
Branch code or name
--
date-balance
datetime
When the balance was reported.
+Comment about the final beneficiary.
@@ -1273,10 +1193,50 @@ bank-account is a MISP object available in JSON format at
comments
personal-account-type
text
Comments about the bank account.
+Account type. ['A - Business', 'B - Personal Current', 'C - Savings', 'D - Trust Account', 'E - Trading Account', 'O - Other']
++
iban
iban
IBAN of the bank account.
++
beneficiary
text
Final beneficiary of the bank account.
++
date-balance
datetime
When the balance was reported.
++
institution-code
text
Institution code of the bank.
@@ -1303,15 +1263,55 @@ bank-account is a MISP object available in JSON format at
beneficiary-comment
comments
text
Comment about the final beneficiary.
+Comments about the bank account.
swift
bic
SWIFT or BIC as defined in ISO 9362.
++
institution-name
text
Name of the bank or financial organisation.
++
text
text
A description of the bank account.
++
account
bank-account-nr
Account number
++
incident
-text
The group listing naming the referent incident(s) of the alert message. (1) Used to collate multiple messages referring to different aspects of the same incident. (2) If multiple incident identifiers are referenced, they SHALL be separated by whitespace. Incident names including whitespace SHALL be surrounded by double-quotes.
--
source
text
The text identifying the source of the alert message. The particular source of this alert; e.g., an operator or a specific device.
--
sent
datetime
references
identifier
text
The group listing identifying earlier message(s) referenced by the alert message. (1) The extended message identifier(s) (in the form sender,identifier,sent) of an earlier CAP message or messages referenced by this one. (2) If multiple messages are referenced, they SHALL be separated by whitespace.
+The identifier of the alert message in a number or string uniquely identifying this message, assigned by the sender.
code
incident
text
The code denoting the special handling of the alert message.
--
sender
text
The identifier of the sender of the alert message which identifies the originator of this alert. Guaranteed by assigner to be unique globally; e.g., may be based on an Internet domain name.
--
restriction
text
The text describing the rule for limiting distribution of the restricted alert message.
+The group listing naming the referent incident(s) of the alert message. (1) Used to collate multiple messages referring to different aspects of the same incident. (2) If multiple incident identifiers are referenced, they SHALL be separated by whitespace. Incident names including whitespace SHALL be surrounded by double-quotes.
@@ -1431,16 +1391,6 @@ cap-alert is a MISP object available in JSON format at
msgType
text
The code denoting the nature of the alert message. ['Alert', 'Update', 'Cancel', 'Ack', 'Error']
--
note
text
identifier
references
text
The identifier of the alert message in a number or string uniquely identifying this message, assigned by the sender.
+The group listing identifying earlier message(s) referenced by the alert message. (1) The extended message identifier(s) (in the form sender,identifier,sent) of an earlier CAP message or messages referenced by this one. (2) If multiple messages are referenced, they SHALL be separated by whitespace.
++
msgType
text
The code denoting the nature of the alert message. ['Alert', 'Update', 'Cancel', 'Ack', 'Error']
++
restriction
text
The text describing the rule for limiting distribution of the restricted alert message.
++
source
text
The text identifying the source of the alert message. The particular source of this alert; e.g., an operator or a specific device.
++
sender
text
The identifier of the sender of the alert message which identifies the originator of this alert. Guaranteed by assigner to be unique globally; e.g., may be based on an Internet domain name.
code
text
The code denoting the special handling of the alert message.
++
contact
+certainty
text
The text describing the contact for follow-up and confirmation of the alert message.
--
onset
datetime
The expected time of the beginning of the subject event of the alert message.
--
event
text
The text denoting the type of the subject event of the alert message.
--
senderName
text
The text naming the originator of the alert message.
--
eventCode
text
A system-specific code identifying the event type of the alert message.
--
description
text
The text describing the subject event of the alert message.
--
language
text
The code denoting the language of the info sub-element of the alert message.
--
audience
text
The text describing the intended audience of the alert message.
--
category
text
The code denoting the category of the subject event of the alert message. ['Geo', 'Met', 'Safety', 'Security', 'Rescue', 'Fire', 'Health', 'Env', 'Transport', 'Infra', 'CBRNE', 'Other']
--
headline
text
The text headline of the alert message.
+The code denoting the certainty of the subject event of the alert message. For backward compatibility with CAP 1.0, the deprecated value of “Very Likely” SHOULD be treated as equivalent to “Likely”. ['Likely', 'Possible', 'Unlikely', 'Unknown']
@@ -1639,10 +1549,10 @@ cap-info is a MISP object available in JSON format at
instruction
eventCode
text
The text describing the recommended action to be taken by recipients of the alert message.
+A system-specific code identifying the event type of the alert message.
@@ -1659,6 +1569,66 @@ cap-info is a MISP object available in JSON format at
audience
text
The text describing the intended audience of the alert message.
++
language
text
The code denoting the language of the info sub-element of the alert message.
++
description
text
The text describing the subject event of the alert message.
++
senderName
text
The text naming the originator of the alert message.
++
contact
text
The text describing the contact for follow-up and confirmation of the alert message.
++
onset
datetime
The expected time of the beginning of the subject event of the alert message.
++
expires
datetime
instruction
text
The text describing the recommended action to be taken by recipients of the alert message.
++
category
text
The code denoting the category of the subject event of the alert message. ['Geo', 'Met', 'Safety', 'Security', 'Rescue', 'Fire', 'Health', 'Env', 'Transport', 'Infra', 'CBRNE', 'Other']
++
event
text
The text denoting the type of the subject event of the alert message.
++
web
link
certainty
headline
text
The code denoting the certainty of the subject event of the alert message. For backward compatibility with CAP 1.0, the deprecated value of “Very Likely” SHOULD be treated as equivalent to “Likely”. ['Likely', 'Possible', 'Unlikely', 'Unknown']
--
severity
text
The code denoting the severity of the subject event of the alert message. ['Extreme', 'Severe', 'Moderate', 'Minor', 'Unknown']
+The text headline of the alert message.
severity
text
The code denoting the severity of the subject event of the alert message. ['Extreme', 'Severe', 'Moderate', 'Minor', 'Unknown']
++
derefUri
-attachment
The base-64 encoded data content of the resource file.
--
mimeType
mime-type
derefUri
attachment
The base-64 encoded data content of the resource file.
++
resourceDesc
text
text
symbol
text
Free text value
+The (uppercase) symbol of the cryptocurrency used. Symbol should be from https://coinmarketcap.com/all/views/all/ ['BTC', 'ETH', 'BCH', 'XRP', 'MIOTA', 'DASH', 'BTG', 'LTC', 'ADA', 'XMR', 'ETC', 'NEO', 'NEM', 'EOS', 'XLM', 'BCC', 'LSK', 'OMG', 'QTUM', 'ZEC', 'USDT', 'HSR', 'STRAT', 'WAVES', 'PPT']
@@ -1865,16 +1865,6 @@ coin-address is a MISP object available in JSON format at
first-seen
datetime
First time this payment destination address has been seen
--
address
btc
symbol
text
text
The (uppercase) symbol of the cryptocurrency used. Symbol should be from https://coinmarketcap.com/all/views/all/ ['BTC', 'ETH', 'BCH', 'XRP', 'MIOTA', 'DASH', 'BTG', 'LTC', 'ADA', 'XMR', 'ETC', 'NEO', 'NEM', 'EOS', 'XLM', 'BCC', 'LSK', 'OMG', 'QTUM', 'ZEC', 'USDT', 'HSR', 'STRAT', 'WAVES', 'PPT']
+Free text value
++
first-seen
datetime
First time this payment destination address has been seen
@@ -1933,26 +1933,6 @@ cookie is a MISP object available in JSON format at
cookie-name
text
Name of the cookie (if splitted)
--
cookie-value
text
Value of the cookie (if splitted)
--
text
text
cookie-name
text
Name of the cookie (if splitted)
++
cookie-value
text
Value of the cookie (if splitted)
++
cost
+stage
text
The estimated cost of applying the course of action. ['High', 'Medium', 'Low', 'None', 'Unknown']
--
impact
text
The estimated impact of applying the course of action. ['High', 'Medium', 'Low', 'None', 'Unknown']
--
efficacy
text
The estimated efficacy of applying the course of action. ['High', 'Medium', 'Low', 'None', 'Unknown']
--
objective
text
The objective of the course of action.
+The stage of the threat management lifecycle that the course of action is applicable to. ['Remedy', 'Response']
@@ -2071,10 +2041,40 @@ course-of-action is a MISP object available in JSON format at
stage
objective
text
The stage of the threat management lifecycle that the course of action is applicable to. ['Remedy', 'Response']
+The objective of the course of action.
++
cost
text
The estimated cost of applying the course of action. ['High', 'Medium', 'Low', 'None', 'Unknown']
++
efficacy
text
The estimated efficacy of applying the course of action. ['High', 'Medium', 'Low', 'None', 'Unknown']
++
type
text
The type of the course of action. ['Perimeter Blocking', 'Internal Blocking', 'Redirection', 'Redirection (Honey Pot)', 'Hardening', 'Patching', 'Eradication', 'Rebuilding', 'Training', 'Monitoring', 'Physical Access Restrictions', 'Logical Access Restrictions', 'Public Disclosure', 'Diplomatic Actions', 'Policy Actions', 'Other']
@@ -2091,10 +2091,10 @@ course-of-action is a MISP object available in JSON format at
type
impact
text
The type of the course of action. ['Perimeter Blocking', 'Internal Blocking', 'Redirection', 'Redirection (Honey Pot)', 'Hardening', 'Patching', 'Eradication', 'Rebuilding', 'Training', 'Monitoring', 'Physical Access Restrictions', 'Logical Access Restrictions', 'Public Disclosure', 'Diplomatic Actions', 'Policy Actions', 'Other']
+The estimated impact of applying the course of action. ['High', 'Medium', 'Low', 'None', 'Unknown']
@@ -2139,20 +2139,20 @@ cowrie is a MISP object available in JSON format at
timestamp
datetime
src_ip
ip-src
When the event happened
+Source IP address of the session
+
dst_port
port
macCS
text
Destination port of the session
+SSH MAC supported in the sesssion
@@ -2169,70 +2169,20 @@ cowrie is a MISP object available in JSON format at
session
message
text
Session id
--
dst_ip
ip-dst
Destination IP address of the session
+Message of the cowrie honeypot
macCS
compCS
text
SSH MAC supported in the sesssion
--
input
text
Input of the session
--
protocol
text
Protocol used in the cowrie honeypot
--
password
text
Password
--
encCS
text
SSH symmetric encryption algorithm supported in the session
+SSH compression algorithm supported in the session
@@ -2249,23 +2199,43 @@ cowrie is a MISP object available in JSON format at
isError
input
text
isError
+Input of the session
++
session
text
Session id
++
encCS
text
SSH symmetric encryption algorithm supported in the session
src_ip
ip-src
protocol
text
Source IP address of the session
+Protocol used in the cowrie honeypot
+
compCS
-text
dst_ip
ip-dst
SSH compression algorithm supported in the session
+Destination IP address of the session
password
text
Password
++
username
text
message
dst_port
port
Destination port of the session
++
isError
text
Message of the cowrie honeypot
+isError
++
timestamp
datetime
When the event happened
@@ -2367,6 +2367,26 @@ credential is a MISP object available in JSON format at
type
text
Type of password(s) ['password', 'api-key', 'encryption-key', 'unknown']
++
notification
text
Mention of any notification(s) towards the potential owner(s) of the credential(s) ['victim-notified', 'service-notified', 'none']
++
password
text
username
text
Username related to the password(s)
++
text
text
notification
text
Mention of any notification(s) towards the potential owner(s) of the credential(s) ['victim-notified', 'service-notified', 'none']
--
format
text
username
text
Username related to the password(s)
--
type
text
Type of password(s) ['password', 'api-key', 'encryption-key', 'unknown']
--
card-security-code
-text
Card security code (CSC, CVD, CVV, CVC and SPC) as embossed or printed on the card.
--
version
text
Version of the card.
--
comment
comment
A description of the card.
--
expiration
datetime
Maximum date of validity
--
name
text
comment
comment
A description of the card.
++
card-security-code
text
Card security code (CSC, CVD, CVV, CVC and SPC) as embossed or printed on the card.
++
cc-number
cc-number
version
text
Version of the card.
++
expiration
datetime
Maximum date of validity
++
ip-dst
-ip-dst
Destination IP (victim)
--
text
protocol
text
Description of the DDoS
--
first-seen
datetime
Beginning of the attack
--
total-bps
counter
Bits per second
--
total-pps
counter
Packets per second
+Protocol used for the attack ['TCP', 'UDP', 'ICMP', 'IP']
@@ -2643,10 +2603,10 @@ ddos is a MISP object available in JSON format at
src-port
port
total-bps
counter
Port originating the attack
+Bits per second
@@ -2673,10 +2633,30 @@ ddos is a MISP object available in JSON format at
protocol
text
text
Protocol used for the attack ['TCP', 'UDP', 'ICMP', 'IP']
+Description of the DDoS
++
first-seen
datetime
Beginning of the attack
++
total-pps
counter
Packets per second
ip-dst
ip-dst
Destination IP (victim)
++
src-port
port
Port originating the attack
++
Destination-Realm
+Destination-Host
text
Destination-Realm.
--
text
text
A description of the attack seen.
--
ApplicationId
text
Application-ID is used to identify for which Diameter application the message is applicable. Application-ID is a decimal representation.
+Destination-Host.
@@ -2771,6 +2751,36 @@ diameter-attack is a MISP object available in JSON format at
ApplicationId
text
Application-ID is used to identify for which Diameter application the message is applicable. Application-ID is a decimal representation.
++
IdrFlags
text
IDR-Flags.
++
text
text
A description of the attack seen.
++
CmdCode
text
Username
text
Username (in this case, usually the IMSI).
--
category
text
Category. ['Cat0', 'Cat1', 'Cat2', 'Cat3', 'CatSMS']
--
Destination-Host
text
Destination-Host.
--
SessionId
text
Origin-Host
text
Origin-Host.
++
first-seen
datetime
Origin-Host
Username
text
Origin-Host.
+Username (in this case, usually the IMSI).
IdrFlags
Destination-Realm
text
IDR-Flags.
+Destination-Realm.
++
category
text
Category. ['Cat0', 'Cat1', 'Cat2', 'Cat3', 'CatSMS']
@@ -2889,16 +2889,6 @@ domain-ip is a MISP object available in JSON format at
ip
ip-dst
IP Address
--
text
text
first-seen
datetime
First time the tuple has been seen
++
domain
domain
first-seen
datetime
ip
ip-dst
First time the tuple has been seen
+IP Address
+
arch
+entrypoint-address
text
Architecture of the ELF file ['None', 'M32', 'SPARC', 'i386', 'ARCH_68K', 'ARCH_88K', 'IAMCU', 'ARCH_860', 'MIPS', 'S370', 'MIPS_RS3_LE', 'PARISC', 'VPP500', 'SPARC32PLUS', 'ARCH_960', 'PPC', 'PPC64', 'S390', 'SPU', 'V800', 'FR20', 'RH32', 'RCE', 'ARM', 'ALPHA', 'SH', 'SPARCV9', 'TRICORE', 'ARC', 'H8_300', 'H8_300H', 'H8S', 'H8_500', 'IA_64', 'MIPS_X', 'COLDFIRE', 'ARCH_68HC12', 'MMA', 'PCP', 'NCPU', 'NDR1', 'STARCORE', 'ME16', 'ST100', 'TINYJ', 'x86_64', 'PDSP', 'PDP10', 'PDP11', 'FX66', 'ST9PLUS', 'ST7', 'ARCH_68HC16', 'ARCH_68HC11', 'ARCH_68HC08', 'ARCH_68HC05', 'SVX', 'ST19', 'VAX', 'CRIS', 'JAVELIN', 'FIREPATH', 'ZSP', 'MMIX', 'HUANY', 'PRISM', 'AVR', 'FR30', 'D10V', 'D30V', 'V850', 'M32R', 'MN10300', 'MN10200', 'PJ', 'OPENRISC', 'ARC_COMPACT', 'XTENSA', 'VIDEOCORE', 'TMM_GPP', 'NS32K', 'TPC', 'SNP1K', 'ST200', 'IP2K', 'MAX', 'CR', 'F2MC16', 'MSP430', 'BLACKFIN', 'SE_C33', 'SEP', 'ARCA', 'UNICORE', 'EXCESS', 'DXP', 'ALTERA_NIOS2', 'CRX', 'XGATE', 'C166', 'M16C', 'DSPIC30F', 'CE', 'M32C', 'TSK3000', 'RS08', 'SHARC', 'ECOG2', 'SCORE7', 'DSP24', 'VIDEOCORE3', 'LATTICEMICO32', 'SE_C17', 'TI_C6000', 'TI_C2000', 'TI_C5500', 'MMDSP_PLUS', 'CYPRESS_M8C', 'R32C', 'TRIMEDIA', 'HEXAGON', 'ARCH_8051', 'STXP7X', 'NDS32', 'ECOG1', 'ECOG1X', 'MAXQ30', 'XIMO16', 'MANIK', 'CRAYNV2', 'RX', 'METAG', 'MCST_ELBRUS', 'ECOG16', 'CR16', 'ETPU', 'SLE9X', 'L10M', 'K10M', 'AARCH64', 'AVR32', 'STM8', 'TILE64', 'TILEPRO', 'CUDA', 'TILEGX', 'CLOUDSHIELD', 'COREA_1ST', 'COREA_2ND', 'ARC_COMPACT2', 'OPEN8', 'RL78', 'VIDEOCORE5', 'ARCH_78KOR', 'ARCH_56800EX', 'BA1', 'BA2', 'XCORE', 'MCHP_PIC', 'INTEL205', 'INTEL206', 'INTEL207', 'INTEL208', 'INTEL209', 'KM32', 'KMX32', 'KMX16', 'KMX8', 'KVARC', 'CDP', 'COGE', 'COOL', 'NORC', 'CSR_KALIMBA', 'AMDGPU']
+Address of the entry point
text
arch
text
Free text value to attach to the ELF
+Architecture of the ELF file ['None', 'M32', 'SPARC', 'i386', 'ARCH_68K', 'ARCH_88K', 'IAMCU', 'ARCH_860', 'MIPS', 'S370', 'MIPS_RS3_LE', 'PARISC', 'VPP500', 'SPARC32PLUS', 'ARCH_960', 'PPC', 'PPC64', 'S390', 'SPU', 'V800', 'FR20', 'RH32', 'RCE', 'ARM', 'ALPHA', 'SH', 'SPARCV9', 'TRICORE', 'ARC', 'H8_300', 'H8_300H', 'H8S', 'H8_500', 'IA_64', 'MIPS_X', 'COLDFIRE', 'ARCH_68HC12', 'MMA', 'PCP', 'NCPU', 'NDR1', 'STARCORE', 'ME16', 'ST100', 'TINYJ', 'x86_64', 'PDSP', 'PDP10', 'PDP11', 'FX66', 'ST9PLUS', 'ST7', 'ARCH_68HC16', 'ARCH_68HC11', 'ARCH_68HC08', 'ARCH_68HC05', 'SVX', 'ST19', 'VAX', 'CRIS', 'JAVELIN', 'FIREPATH', 'ZSP', 'MMIX', 'HUANY', 'PRISM', 'AVR', 'FR30', 'D10V', 'D30V', 'V850', 'M32R', 'MN10300', 'MN10200', 'PJ', 'OPENRISC', 'ARC_COMPACT', 'XTENSA', 'VIDEOCORE', 'TMM_GPP', 'NS32K', 'TPC', 'SNP1K', 'ST200', 'IP2K', 'MAX', 'CR', 'F2MC16', 'MSP430', 'BLACKFIN', 'SE_C33', 'SEP', 'ARCA', 'UNICORE', 'EXCESS', 'DXP', 'ALTERA_NIOS2', 'CRX', 'XGATE', 'C166', 'M16C', 'DSPIC30F', 'CE', 'M32C', 'TSK3000', 'RS08', 'SHARC', 'ECOG2', 'SCORE7', 'DSP24', 'VIDEOCORE3', 'LATTICEMICO32', 'SE_C17', 'TI_C6000', 'TI_C2000', 'TI_C5500', 'MMDSP_PLUS', 'CYPRESS_M8C', 'R32C', 'TRIMEDIA', 'HEXAGON', 'ARCH_8051', 'STXP7X', 'NDS32', 'ECOG1', 'ECOG1X', 'MAXQ30', 'XIMO16', 'MANIK', 'CRAYNV2', 'RX', 'METAG', 'MCST_ELBRUS', 'ECOG16', 'CR16', 'ETPU', 'SLE9X', 'L10M', 'K10M', 'AARCH64', 'AVR32', 'STM8', 'TILE64', 'TILEPRO', 'CUDA', 'TILEGX', 'CLOUDSHIELD', 'COREA_1ST', 'COREA_2ND', 'ARC_COMPACT2', 'OPEN8', 'RL78', 'VIDEOCORE5', 'ARCH_78KOR', 'ARCH_56800EX', 'BA1', 'BA2', 'XCORE', 'MCHP_PIC', 'INTEL205', 'INTEL206', 'INTEL207', 'INTEL208', 'INTEL209', 'KM32', 'KMX32', 'KMX16', 'KMX8', 'KVARC', 'CDP', 'COGE', 'COOL', 'NORC', 'CSR_KALIMBA', 'AMDGPU']
@@ -3007,26 +3007,6 @@ elf is a MISP object available in JSON format at
os_abi
text
Header operating system application binary interface (ABI) ['AIX', 'ARM', 'AROS', 'C6000_ELFABI', 'C6000_LINUX', 'CLOUDABI', 'FENIXOS', 'FREEBSD', 'GNU', 'HPUX', 'HURD', 'IRIX', 'MODESTO', 'NETBSD', 'NSK', 'OPENBSD', 'OPENVMS', 'SOLARIS', 'STANDALONE', 'SYSTEMV', 'TRU64']
--
entrypoint-address
text
Address of the entry point
--
type
text
text
text
Free text value to attach to the ELF
++
os_abi
text
Header operating system application binary interface (ABI) ['AIX', 'ARM', 'AROS', 'C6000_ELFABI', 'C6000_LINUX', 'CLOUDABI', 'FENIXOS', 'FREEBSD', 'GNU', 'HPUX', 'HURD', 'IRIX', 'MODESTO', 'NETBSD', 'NSK', 'OPENBSD', 'OPENVMS', 'SOLARIS', 'STANDALONE', 'SYSTEMV', 'TRU64']
++
text
-text
sha512/224
sha512/224
Free text value to attach to the section
+Secure Hash Algorithm 2 (224 bits)
+
ssdeep
-ssdeep
type
text
Fuzzy hash using context triggered piecewise hashes (CTPH)
+Type of the section ['NULL', 'PROGBITS', 'SYMTAB', 'STRTAB', 'RELA', 'HASH', 'DYNAMIC', 'NOTE', 'NOBITS', 'REL', 'SHLIB', 'DYNSYM', 'INIT_ARRAY', 'FINI_ARRAY', 'PREINIT_ARRAY', 'GROUP', 'SYMTAB_SHNDX', 'LOOS', 'GNU_ATTRIBUTES', 'GNU_HASH', 'GNU_VERDEF', 'GNU_VERNEED', 'GNU_VERSYM', 'HIOS', 'LOPROC', 'ARM_EXIDX', 'ARM_PREEMPTMAP', 'HEX_ORDERED', 'X86_64_UNWIND', 'MIPS_REGINFO', 'MIPS_OPTIONS', 'MIPS_ABIFLAGS', 'HIPROC', 'LOUSER', 'HIUSER']
+
sha384
-sha384
sha512
sha512
Secure Hash Algorithm 2 (384 bits)
+Secure Hash Algorithm 2 (512 bits)
name
text
Name of the section
--
sha256
sha256
sha512/224
sha512/224
Secure Hash Algorithm 2 (224 bits)
--
entropy
float
Entropy of the whole section
--
size-in-bytes
size-in-bytes
Size of the section, in bytes
--
sha1
sha1
[Insecure] Secure Hash Algorithm 1 (160 bits)
--
flag
text
type
name
text
Type of the section ['NULL', 'PROGBITS', 'SYMTAB', 'STRTAB', 'RELA', 'HASH', 'DYNAMIC', 'NOTE', 'NOBITS', 'REL', 'SHLIB', 'DYNSYM', 'INIT_ARRAY', 'FINI_ARRAY', 'PREINIT_ARRAY', 'GROUP', 'SYMTAB_SHNDX', 'LOOS', 'GNU_ATTRIBUTES', 'GNU_HASH', 'GNU_VERDEF', 'GNU_VERNEED', 'GNU_VERSYM', 'HIOS', 'LOPROC', 'ARM_EXIDX', 'ARM_PREEMPTMAP', 'HEX_ORDERED', 'X86_64_UNWIND', 'MIPS_REGINFO', 'MIPS_OPTIONS', 'MIPS_ABIFLAGS', 'HIPROC', 'LOUSER', 'HIUSER']
+Name of the section
sha512
sha512
sha1
sha1
Secure Hash Algorithm 2 (512 bits)
+[Insecure] Secure Hash Algorithm 1 (160 bits)
++
size-in-bytes
size-in-bytes
Size of the section, in bytes
++
text
text
Free text value to attach to the section
++
entropy
float
Entropy of the whole section
++
ssdeep
ssdeep
Fuzzy hash using context triggered piecewise hashes (CTPH)
++
sha384
sha384
Secure Hash Algorithm 2 (384 bits)
@@ -3263,150 +3263,10 @@ email is a MISP object available in JSON format at
subject
email-subject
message-id
email-message-id
Subject
--
to-display-name
email-dst-display-name
Display name of the receiver
--
screenshot
attachment
Screenshot of email
--
header
email-header
Full headers
--
attachment
email-attachment
Attachment
--
cc
email-dst
Carbon copy
--
to
email-dst
Destination email address
--
mime-boundary
email-mime-boundary
MIME Boundary
--
from
email-src
Sender email address
--
reply-to
email-reply-to
Email address the reply will be sent to
--
email-body
email-body
Body of the email
--
return-path
email-src
Message return path
--
send-date
datetime
Date the email has been sent
--
thread-index
email-thread-index
Identifies a particular conversation thread
--
user-agent
text
User Agent of the sender
+Message ID
@@ -3423,6 +3283,56 @@ email is a MISP object available in JSON format at
from
email-src
Sender email address
++
thread-index
email-thread-index
Identifies a particular conversation thread
++
mime-boundary
email-mime-boundary
MIME Boundary
++
header
email-header
Full headers
++
reply-to
email-reply-to
Email address the reply will be sent to
++
from-display-name
email-src-display-name
message-id
email-message-id
attachment
email-attachment
Message ID
+Attachment
+
email-body
email-body
Body of the email
++
user-agent
text
User Agent of the sender
++
to-display-name
email-dst-display-name
Display name of the receiver
++
cc
email-dst
Carbon copy
++
return-path
email-src
Message return path
++
screenshot
attachment
Screenshot of email
++
send-date
datetime
Date the email has been sent
++
subject
email-subject
Subject
++
to
email-dst
Destination email address
++
banned-ip
+ip-src
IP Address banned by fail2ban
++
logfile
attachment
Full logfile related to the attack.
++
logline
text
Example log line that caused the ban.
++
attack-type
text
Type of the attack
++
victim
text
Identifier of the victim
++
processing-timestamp
datetime
logline
text
Example log line that caused the ban.
--
logfile
attachment
Full logfile related to the attack.
--
attack-type
text
Type of the attack
--
banned-ip
ip-src
IP Address banned by fail2ban
--
victim
text
Identifier of the victim
--
pattern-in-file
-pattern-in-file
sha512/224
sha512/224
Pattern that can be found in the file
+Secure Hash Algorithm 2 (224 bits)
text
text
Free text value to attach to the file
--
md5
md5
size-in-bytes
size-in-bytes
path
text
Size of the file, in bytes
+Path of the filename complete or partial
ssdeep
ssdeep
sha512/256
sha512/256
Fuzzy hash using context triggered piecewise hashes (CTPH)
+Secure Hash Algorithm 2 (256 bits)
++
authentihash
authentihash
Authenticode executable signature hash
++
sha224
sha224
Secure Hash Algorithm 2 (224 bits)
++
sha512
sha512
Secure Hash Algorithm 2 (512 bits)
@@ -3669,66 +3689,6 @@ file is a MISP object available in JSON format at
sha224
sha224
Secure Hash Algorithm 2 (224 bits)
--
sha384
sha384
Secure Hash Algorithm 2 (384 bits)
--
sha512/224
sha512/224
Secure Hash Algorithm 2 (224 bits)
--
mimetype
mime-type
Mime type
--
path
text
Path of the filename complete or partial
--
authentihash
authentihash
Authenticode executable signature hash
--
sha256
sha256
tlsh
tlsh
pattern-in-file
pattern-in-file
Fuzzy hash by Trend Micro: Locality Sensitive Hash
+Pattern that can be found in the file
entropy
float
filename
filename
Entropy of the whole file
+Filename on disk
sha512/256
sha512/256
Secure Hash Algorithm 2 (256 bits)
--
certificate
x509-fingerprint-sha1
filename
filename
mimetype
mime-type
Filename on disk
+Mime type
size-in-bytes
size-in-bytes
Size of the file, in bytes
++
text
text
Free text value to attach to the file
++
entropy
float
Entropy of the whole file
++
ssdeep
ssdeep
Fuzzy hash using context triggered piecewise hashes (CTPH)
++
sha384
sha384
Secure Hash Algorithm 2 (384 bits)
++
tlsh
tlsh
Fuzzy hash by Trend Micro: Locality Sensitive Hash
++
state
text
sha512
sha512
Secure Hash Algorithm 2 (512 bits)
--
latitude
-float
The latitude is the decimal value of the latitude in the World Geodetic System 84 (WGS84) reference.
--
last-seen
datetime
first-seen
datetime
address
text
When the location was seen for the first time.
+Address.
+
+
altitude
float
The altitude is the decimal value of the altitude in the World Geodetic System 84 (WGS84) reference.
+
country
-text
Country.
--
city
text
City.
--
region
text
Region.
--
address
text
Address.
--
text
text
altitude
float
city
text
The altitude is the decimal value of the altitude in the World Geodetic System 84 (WGS84) reference.
+City.
first-seen
datetime
When the location was seen for the first time.
++
region
text
Region.
++
latitude
float
The latitude is the decimal value of the latitude in the World Geodetic System 84 (WGS84) reference.
++
longitude
float
country
text
Country.
++
text
+GtpMsisdn
text
A description of the GTP attack.
+GTP MSISDN.
+
GtpServingNetwork
GtpInterface
text
GTP Serving Network.
--
GtpMessageType
text
GTP defines a set of messages between two associated GSNs or an SGSN and an RNC. Message type is described as a decimal value.
+GTP interface. ['S5', 'S11', 'S10', 'S8', 'Gn', 'Gp']
@@ -4045,6 +4035,36 @@ gtp-attack is a MISP object available in JSON format at
GtpImsi
text
GTP IMSI (International mobile subscriber identity).
++
PortSrc
port
Source port.
++
text
text
A description of the GTP attack.
++
GtpImei
text
GtpImsi
GtpMessageType
text
GTP IMSI (International mobile subscriber identity).
+GTP defines a set of messages between two associated GSNs or an SGSN and an RNC. Message type is described as a decimal value.
+
GtpInterface
+GtpVersion
text
GTP interface. ['S5', 'S11', 'S10', 'S8', 'Gn', 'Gp']
+GTP version ['0', '1', '2']
GtpMsisdn
GtpServingNetwork
text
GTP MSISDN.
+GTP Serving Network.
+
PortSrc
port
Source port.
--
GtpVersion
text
GTP version ['0', '1', '2']
--
proxy-password
-text
host
hostname
HTTP Proxy Password
+The domain name of the server
@@ -4193,50 +4193,10 @@ http-request is a MISP object available in JSON format at
text
text
url
url
HTTP Request comment
--
basicauth-user
text
HTTP Basic Authentication Username
--
host
hostname
The domain name of the server
--
cookie
text
An HTTP cookie previously sent by the server with Set-Cookie
--
user-agent
user-agent
The user agent string of the user agent
+Full HTTP Request URL
@@ -4253,20 +4213,40 @@ http-request is a MISP object available in JSON format at
content-type
other
proxy-user
text
The MIME type of the body of the request
+HTTP Proxy Username
proxy-user
user-agent
user-agent
The user agent string of the user agent
++
basicauth-user
text
HTTP Proxy Username
+HTTP Basic Authentication Username
++
referer
other
This is the address of the previous web page from which a link to the currently requested page was followed
@@ -4283,20 +4263,40 @@ http-request is a MISP object available in JSON format at
url
url
text
text
Full HTTP Request URL
+HTTP Request comment
++
cookie
text
An HTTP cookie previously sent by the server with Set-Cookie
referer
content-type
other
This is the address of the previous web page from which a link to the currently requested page was followed
+The MIME type of the body of the request
++
proxy-password
text
HTTP Proxy Password
@@ -4341,6 +4341,26 @@ ip-port is a MISP object available in JSON format at
last-seen
datetime
Last time the tuple has been seen
++
src-port
port
Source port
++
text
text
first-seen
datetime
First time the tuple has been seen
++
ip
ip-dst
first-seen
datetime
domain
domain
First time the tuple has been seen
+Domain
-
last-seen
datetime
Last time the tuple has been seen
-+
domain
domain
Domain
--
src-port
port
Source port
--
ip-dst
-ip-dst
Destination IP address
--
last-seen
datetime
first-seen
datetime
First seen of the SSL/TLS handshake
--
ja3-fingerprint-md5
md5
Hash identifying source
--
description
text
ja3-fingerprint-md5
md5
Hash identifying source
++
first-seen
datetime
First seen of the SSL/TLS handshake
++
ip-dst
ip-dst
Destination IP address
++
legal-form
+registration-number
text
Legal form of an entity.
--
text
text
A description of the entity.
--
phone-number
phone-number
Phone number of an entity.
--
name
text
Name of an entity.
+Registration number of an entity in the relevant authority.
@@ -4607,10 +4577,20 @@ legal-entity is a MISP object available in JSON format at
registration-number
name
text
Registration number of an entity in the relevant authority.
+Name of an entity.
++
phone-number
phone-number
Phone number of an entity.
text
text
A description of the entity.
++
legal-form
text
Legal form of an entity.
++
type
+text
Type of Mach-O ['BUNDLE', 'CORE', 'DSYM', 'DYLIB', 'DYLIB_STUB', 'DYLINKER', 'EXECUTE', 'FVMLIB', 'KEXT_BUNDLE', 'OBJECT', 'PRELOAD']
++
entrypoint-address
text
type
text
Type of Mach-O ['BUNDLE', 'CORE', 'DSYM', 'DYLIB', 'DYLIB_STUB', 'DYLINKER', 'EXECUTE', 'FVMLIB', 'KEXT_BUNDLE', 'OBJECT', 'PRELOAD']
--
text
-text
sha512/224
sha512/224
Free text value to attach to the section
+Secure Hash Algorithm 2 (224 bits)
+
ssdeep
-ssdeep
Fuzzy hash using context triggered piecewise hashes (CTPH)
--
sha224
sha224
sha384
sha384
sha512
sha512
Secure Hash Algorithm 2 (384 bits)
+Secure Hash Algorithm 2 (512 bits)
++
sha256
sha256
Secure Hash Algorithm 2 (256 bits)
@@ -4823,36 +4823,16 @@ macho-section is a MISP object available in JSON format at
sha256
sha256
sha1
sha1
Secure Hash Algorithm 2 (256 bits)
+[Insecure] Secure Hash Algorithm 1 (160 bits)
sha512/224
sha512/224
Secure Hash Algorithm 2 (224 bits)
--
entropy
float
Entropy of the whole section
--
size-in-bytes
size-in-bytes
sha1
sha1
text
text
[Insecure] Secure Hash Algorithm 1 (160 bits)
+Free text value to attach to the section
++
entropy
float
Entropy of the whole section
++
ssdeep
ssdeep
Fuzzy hash using context triggered piecewise hashes (CTPH)
sha512
sha512
sha384
sha384
Secure Hash Algorithm 2 (512 bits)
+Secure Hash Algorithm 2 (384 bits)
@@ -4921,10 +4921,20 @@ microblog is a MISP object available in JSON format at
link
creation-date
datetime
Initial creation of the microblog post
++
url
url
Link into the microblog post
+Original URL location of the microblog post
@@ -4941,10 +4951,10 @@ microblog is a MISP object available in JSON format at
removal-date
datetime
link
url
When the microblog post was removed
+Link into the microblog post
@@ -4971,20 +4981,10 @@ microblog is a MISP object available in JSON format at
url
url
Original URL location of the microblog post
--
creation-date
removal-date
datetime
Initial creation of the microblog post
+When the microblog post was removed
@@ -5049,20 +5049,20 @@ mutex is a MISP object available in JSON format at
name
description
text
name of the mutex
+Description
description
name
text
Description
+name of the mutex
@@ -5117,66 +5117,6 @@ netflow is a MISP object available in JSON format at
src-as
AS
Source AS number for this flow
--
ip-dst
ip-dst
IP address destination of the netflow
--
packet-count
counter
Packets counted in this flow
--
flow-count
counter
Flows counted in this flow
--
last-packet-seen
datetime
Last packet seen in this flow
--
tcp-flags
text
TCP flags of the flow
--
direction
text
ip-src
ip-src
IP address source of the netflow
--
src-port
port
Source port of the netflow
--
protocol
text
Protocol used for this flow ['TCP', 'UDP', 'ICMP', 'IP']
--
first-packet-seen
datetime
First packet seen in this flow
--
ip-protocol-number
size-in-bytes
IP protocol number of this flow
--
dst-as
AS
Destination AS number for this flow
--
icmp-type
text
ICMP type of the flow (if the traffic is ICMP)
--
ip_version
counter
IP version of this flow
--
byte-count
counter
ip-src
ip-src
IP address source of the netflow
++
tcp-flags
text
TCP flags of the flow
++
flow-count
counter
Flows counted in this flow
++
ip-protocol-number
size-in-bytes
IP protocol number of this flow
++
first-packet-seen
datetime
First packet seen in this flow
++
icmp-type
text
ICMP type of the flow (if the traffic is ICMP)
++
protocol
text
Protocol used for this flow ['TCP', 'UDP', 'ICMP', 'IP']
++
last-packet-seen
datetime
Last packet seen in this flow
++
src-as
AS
Source AS number for this flow
++
dst-port
port
packet-count
counter
Packets counted in this flow
++
ip_version
counter
IP version of this flow
++
dst-as
AS
Destination AS number for this flow
++
ip-dst
ip-dst
IP address destination of the netflow
++
src-port
port
Source port of the netflow
++
ip-dst
-ip-dst
layer7-protocol
text
Destination IP address of the nework connection.
+Layer 7 protocol of the network connection. ['HTTP', 'HTTPS', 'FTP']
++
ip-src
ip-src
Source IP address of the nework connection.
++
src-port
port
Source port of the nework connection.
++
first-packet-seen
datetime
Datetime of the first packet seen.
++
hostname-src
hostname
Source hostname of the network connection.
++
hostname-dst
hostname
Destination hostname of the network connection.
@@ -5355,40 +5405,10 @@ network-connection is a MISP object available in JSON format at
first-packet-seen
datetime
ip-dst
ip-dst
Datetime of the first packet seen.
--
layer7-protocol
text
Layer 7 protocol of the network connection. ['HTTP', 'HTTPS', 'FTP']
--
ip-src
ip-src
Source IP address of the nework connection.
--
src-port
port
Source port of the nework connection.
+Destination IP address of the nework connection.
@@ -5443,20 +5463,20 @@ network-socket is a MISP object available in JSON format at
ip-dst
ip-dst
protocol
text
Destination IP address of the network socket connection.
+Protocol used by the network socket. ['TCP', 'UDP', 'ICMP', 'IP']
first-packet-seen
datetime
domain-family
text
Datetime of the first packet seen.
+Domain family who specifies the communication domain (PF_*) of the socket connection. ['PF_UNSPEC', 'PF_LOCAL', 'PF_UNIX', 'PF_FILE', 'PF_INET', 'PF_AX25', 'PF_IPX', 'PF_APPLETALK', 'PF_NETROM', 'PF_BRIDGE', 'PF_ATMPVC', 'PF_X25', 'PF_INET6', 'PF_ROSE', 'PF_DECnet', 'PF_NETBEUI', 'PF_SECURITY', 'PF_KEY', 'PF_NETLINK', 'PF_ROUTE', 'PF_PACKET', 'PF_ASH', 'PF_ECONET', 'PF_ATMSVC', 'PF_RDS', 'PF_SNA', 'PF_IRDA', 'PF_PPPOX', 'PF_WANPIPE', 'PF_LLC', 'PF_IB', 'PF_MPLS', 'PF_CAN', 'PF_TIPC', 'PF_BLUETOOTH', 'PF_IUCV', 'PF_RXRPC', 'PF_ISDN', 'PF_PHONET', 'PF_IEEE802154', 'PF_CAIF', 'PF_ALG', 'PF_NFC', 'PF_VSOCK', 'PF_KCM', 'PF_MAX']
@@ -5473,6 +5493,16 @@ network-socket is a MISP object available in JSON format at
state
text
State of the socket connection. ['blocking', 'listening']
++
src-port
port
hostname-src
hostname
Source (local) hostname of the network socket connection.
++
address-family
text
Address family who specifies the address family type (AF_*) of the socket connection. ['AF_UNSPEC', 'AF_LOCAL', 'AF_UNIX', 'AF_FILE', 'AF_INET', 'AF_AX25', 'AF_IPX', 'AF_APPLETALK', 'AF_NETROM', 'AF_BRIDGE', 'AF_ATMPVC', 'AF_X25', 'AF_INET6', 'AF_ROSE', 'AF_DECnet', 'AF_NETBEUI', 'AF_SECURITY', 'AF_KEY', 'AF_NETLINK', 'AF_ROUTE', 'AF_PACKET', 'AF_ASH', 'AF_ECONET', 'AF_ATMSVC', 'AF_RDS', 'AF_SNA', 'AF_IRDA', 'AF_PPPOX', 'AF_WANPIPE', 'AF_LLC', 'AF_IB', 'AF_MPLS', 'AF_CAN', 'AF_TIPC', 'AF_BLUETOOTH', 'AF_IUCV', 'AF_RXRPC', 'AF_ISDN', 'AF_PHONET', 'AF_IEEE802154', 'AF_CAIF', 'AF_ALG', 'AF_NFC', 'AF_VSOCK', 'AF_KCM', 'AF_MAX']
++
dst-port
port
option
text
Option on the socket connection.
++
ip-dst
ip-dst
Destination IP address of the network socket connection.
++
hostname-dst
hostname
Destination hostname of the network socket connection.
++
text
+time_last
datetime
Last time that the unique tuple (rrname, rrtype, rdata) record has been seen by the passive DNS
++
bailiwick
text
Description of the passive DNS record.
+Best estimate of the apex of the zone where this data is authoritative
++
origin
text
Origin of the Passive DNS response
++
time_first
datetime
First time that the unique tuple (rrname, rrtype, rdata) has been seen by the passive DNS
@@ -5551,30 +5661,10 @@ passive-dns is a MISP object available in JSON format at
count
counter
zone_time_last
datetime
How many authoritative DNS answers were received at the Passive DNS Server’s collectors with exactly the given set of values as answers.
--
rrtype
text
Resource Record type as seen by the passive DNS. ['A', 'AAAA', 'CNAME', 'PTR', 'SOA', 'TXT', 'DNAME', 'NS', 'SRV', 'RP', 'NAPTR', 'HINFO', 'A6']
--
origin
text
Origin of the Passive DNS response
+Last time that the unique tuple (rrname, rrtype, rdata) record has been seen via master file import.
@@ -5601,40 +5691,30 @@ passive-dns is a MISP object available in JSON format at
time_last
datetime
Last time that the unique tuple (rrname, rrtype, rdata) record has been seen by the passive DNS
--
time_first
datetime
First time that the unique tuple (rrname, rrtype, rdata) has been seen by the passive DNS
--
zone_time_last
datetime
Last time that the unique tuple (rrname, rrtype, rdata) record has been seen via master file import.
--
bailiwick
text
text
Best estimate of the apex of the zone where this data is authoritative
+Description of the passive DNS record.
++
rrtype
text
Resource Record type as seen by the passive DNS. ['A', 'AAAA', 'CNAME', 'PTR', 'SOA', 'TXT', 'DNAME', 'NS', 'SRV', 'RP', 'NAPTR', 'HINFO', 'A6']
++
count
counter
How many authoritative DNS answers were received at the Passive DNS Server’s collectors with exactly the given set of values as answers.
@@ -5699,6 +5779,16 @@ paste is a MISP object available in JSON format at
url
url
Link to the original source of the paste or post.
++
first-seen
datetime
paste
title
text
Raw text of the paste or post
+Title of the paste or post.
@@ -5729,20 +5819,10 @@ paste is a MISP object available in JSON format at
title
paste
text
Title of the paste or post.
--
url
url
Link to the original source of the paste or post.
+Raw text of the paste or post
@@ -5787,36 +5867,6 @@ pe is a MISP object available in JSON format at
original-filename
filename
OriginalFilename in the resources
--
number-sections
counter
Number of sections
--
entrypoint-address
text
Address of the entry point
--
impfuzzy
impfuzzy
product-name
text
ProductName in the resources
--
text
text
Free text value to attach to the PE
--
compilation-timestamp
datetime
Compilation timestamp defined in the PE header
--
product-version
text
legal-copyright
text
LegalCopyright in the resources
--
imphash
imphash
lang-id
text
Lang ID in the resources
--
file-description
text
FileDescription in the resources
--
entrypoint-section-at-position
text
internal-filename
filename
type
text
InternalFilename in the resources
+Type of PE ['exe', 'dll', 'driver', 'unknown']
++
number-sections
counter
Number of sections
@@ -5947,10 +5947,40 @@ pe is a MISP object available in JSON format at
type
file-description
text
Type of PE ['exe', 'dll', 'driver', 'unknown']
+FileDescription in the resources
++
product-name
text
ProductName in the resources
++
legal-copyright
text
LegalCopyright in the resources
++
entrypoint-address
text
Address of the entry point
compilation-timestamp
datetime
Compilation timestamp defined in the PE header
++
text
text
Free text value to attach to the PE
++
internal-filename
filename
InternalFilename in the resources
++
original-filename
filename
OriginalFilename in the resources
++
lang-id
text
Lang ID in the resources
++
text
-text
sha512/224
sha512/224
Free text value to attach to the section
+Secure Hash Algorithm 2 (224 bits)
+
ssdeep
-ssdeep
Fuzzy hash using context triggered piecewise hashes (CTPH)
--
sha224
sha224
sha384
sha384
sha512
sha512
Secure Hash Algorithm 2 (384 bits)
+Secure Hash Algorithm 2 (512 bits)
++
sha256
sha256
Secure Hash Algorithm 2 (256 bits)
@@ -6075,36 +6155,16 @@ pe-section is a MISP object available in JSON format at
sha256
sha256
sha1
sha1
Secure Hash Algorithm 2 (256 bits)
+[Insecure] Secure Hash Algorithm 1 (160 bits)
sha512/224
sha512/224
Secure Hash Algorithm 2 (224 bits)
--
entropy
float
Entropy of the whole section
--
size-in-bytes
size-in-bytes
sha1
sha1
text
text
[Insecure] Secure Hash Algorithm 1 (160 bits)
+Free text value to attach to the section
++
entropy
float
Entropy of the whole section
++
ssdeep
ssdeep
Fuzzy hash using context triggered piecewise hashes (CTPH)
sha512
sha512
sha384
sha384
Secure Hash Algorithm 2 (512 bits)
+Secure Hash Algorithm 2 (384 bits)
@@ -6183,100 +6263,20 @@ person is a MISP object available in JSON format at
passport-expiration
passport-expiration
first-name
first-name
The expiration date of a passport.
+First name of a natural person.
text
alias
text
A description of the person or identity.
--
passport-number
passport-number
The passport number of a natural person.
--
middle-name
middle-name
Middle name of a natural person.
--
place-of-birth
place-of-birth
Place of birth of a natural person.
--
gender
gender
The gender of a natural person. ['Male', 'Female', 'Other', 'Prefer not to say']
--
nationality
nationality
The nationality of a natural person.
--
redress-number
redress-number
The Redress Control Number is the record identifier for people who apply for redress through the DHS Travel Redress Inquiry Program (DHS TRIP). DHS TRIP is for travelers who have been repeatedly identified for additional screening and who want to file an inquiry to have erroneous information corrected in DHS systems.
--
passport-country
passport-country
The country in which the passport was issued.
--
mothers-name
text
Mother name, father, second name or other names following country’s regulation.
+Alias name or known as.
@@ -6293,16 +6293,6 @@ person is a MISP object available in JSON format at
alias
text
Alias name or known as.
--
title
text
passport-number
passport-number
The passport number of a natural person.
++
gender
gender
The gender of a natural person. ['Male', 'Female', 'Other', 'Prefer not to say']
++
redress-number
redress-number
The Redress Control Number is the record identifier for people who apply for redress through the DHS Travel Redress Inquiry Program (DHS TRIP). DHS TRIP is for travelers who have been repeatedly identified for additional screening and who want to file an inquiry to have erroneous information corrected in DHS systems.
++
middle-name
middle-name
Middle name of a natural person.
++
last-name
last-name
first-name
first-name
mothers-name
text
First name of a natural person.
+Mother name, father, second name or other names following country’s regulation.
++
nationality
nationality
The nationality of a natural person.
text
text
A description of the person or identity.
++
place-of-birth
place-of-birth
Place of birth of a natural person.
++
passport-expiration
passport-expiration
The expiration date of a passport.
++
social-security-number
text
Social security number
++
identity-card-number
identity-card-number
social-security-number
text
passport-country
passport-country
Social security number
+The country in which the passport was issued.
+
text
-text
A description of the phone.
--
tmsi
text
Temporary Mobile Subscriber Identities (TMSI) to visiting mobile subscribers can be allocated.
--
msisdn
text
MSISDN (pronounced as /'em es ai es di en/ or misden) is a number uniquely identifying a subscription in a GSM or a UMTS mobile network. Simply put, it is the mapping of the telephone number to the SIM card in a mobile/cellular phone. This abbreviation has a several interpretations, the most common one being Mobile Station International Subscriber Directory Number.
--
serial-number
text
Serial Number.
--
gummei
text
Globally Unique MME Identifier (GUMMEI) is composed from MCC, MNC and MME Identifier (MMEI).
--
guti
text
Globally Unique Temporary UE Identity (GUTI) is a temporary identification to not reveal the phone (user equipment in 3GPP jargon) composed of GUMMEI and the M-TMSI.
--
first-seen
datetime
When the phone has been accessible or seen for the first time.
--
imsi
text
tmsi
text
Temporary Mobile Subscriber Identities (TMSI) to visiting mobile subscribers can be allocated.
++
gummei
text
Globally Unique MME Identifier (GUMMEI) is composed from MCC, MNC and MME Identifier (MMEI).
++
imei
text
msisdn
text
MSISDN (pronounced as /'em es ai es di en/ or misden) is a number uniquely identifying a subscription in a GSM or a UMTS mobile network. Simply put, it is the mapping of the telephone number to the SIM card in a mobile/cellular phone. This abbreviation has a several interpretations, the most common one being Mobile Station International Subscriber Directory Number.
++
text
text
A description of the phone.
++
first-seen
datetime
When the phone has been accessible or seen for the first time.
++
guti
text
Globally Unique Temporary UE Identity (GUTI) is a temporary identification to not reveal the phone (user equipment in 3GPP jargon) composed of GUMMEI and the M-TMSI.
++
serial-number
text
Serial Number.
++
pid
-text
Process ID of the process.
--
creation-time
datetime
child-pid
text
port
src-port
Process ID of the child(ren) process.
--
parent_pid
text
Process ID of the parent process.
+Port(s) owned by the process.
@@ -6579,10 +6639,10 @@ process is a MISP object available in JSON format at
port
src-port
child-pid
text
Port(s) owned by the process.
+Process ID of the child(ren) process.
parent_pid
text
Process ID of the parent process.
++
pid
text
Process ID of the process.
++
text
+r2-commit-version
text
Description of the r2graphity object
--
miss-api
counter
Amount of API call reference that does not resolve to a function offset
--
memory-allocations
counter
Amount of memory allocations
--
refsglobalvar
counter
Amount of API calls outside of code section (glob var, dynamic API)
--
callback-average
counter
Average size of a callback
--
ratio-string
float
Ratio: amount of referenced strings per kilobyte of code section
+Radare2 commit ID used to generate this object
@@ -6707,50 +6737,20 @@ r2graphity is a MISP object available in JSON format at
local-references
total-api
counter
Amount of API calls inside a code section
+Total amount of API calls
total-functions
callback-largest
counter
Total amount of functions in the file.
--
r2-commit-version
text
Radare2 commit ID used to generate this object
--
create-thread
counter
Amount of calls to CreateThread
--
unknown-references
counter
Amount of API calls not ending in a function (Radare2 bug, probalby)
+Largest callback
@@ -6777,46 +6777,6 @@ r2graphity is a MISP object available in JSON format at
dangling-strings
counter
Amount of dangling strings (string with a code cross reference, that is not within a function. Radare2 failed to detect that function.)
--
get-proc-address
counter
Amount of calls to GetProcAddress
--
total-api
counter
Total amount of API calls
--
ratio-functions
float
Ratio: amount of functions per kilobyte of code section
--
shortest-path-to-create-thread
counter
referenced-strings
local-references
counter
Amount of referenced strings
+Amount of API calls inside a code section
++
miss-api
counter
Amount of API call reference that does not resolve to a function offset
@@ -6847,10 +6817,120 @@ r2graphity is a MISP object available in JSON format at
callback-largest
unknown-references
counter
Largest callback
+Amount of API calls not ending in a function (Radare2 bug, probalby)
++
referenced-strings
counter
Amount of referenced strings
++
callback-average
counter
Average size of a callback
++
memory-allocations
counter
Amount of memory allocations
++
total-functions
counter
Total amount of functions in the file.
++
refsglobalvar
counter
Amount of API calls outside of code section (glob var, dynamic API)
++
ratio-functions
float
Ratio: amount of functions per kilobyte of code section
++
create-thread
counter
Amount of calls to CreateThread
++
text
text
Description of the r2graphity object
++
dangling-strings
counter
Amount of dangling strings (string with a code cross reference, that is not within a function. Radare2 failed to detect that function.)
++
ratio-string
float
Ratio: amount of referenced strings per kilobyte of code section
++
get-proc-address
counter
Amount of calls to GetProcAddress
@@ -6895,6 +6975,16 @@ regexp is a MISP object available in JSON format at
type
text
Specify which type corresponds to this regex. ['hostname', 'domain', 'email-src', 'email-dst', 'email-subject', 'url', 'user-agent', 'regkey', 'cookie', 'uri', 'filename', 'windows-service-name', 'windows-scheduled-task']
++
regexp
text
type
text
Specify which type corresponds to this regex. ['hostname', 'domain', 'email-src', 'email-dst', 'email-subject', 'url', 'user-agent', 'regkey', 'cookie', 'uri', 'filename', 'windows-service-name', 'windows-scheduled-task']
--
regexp-type
text
key
regkey
Full key path
--
data-type
text
Registry value type ['REG_NONE', 'REG_SZ', 'REG_EXPAND_SZ', 'REG_BINARY', 'REG_DWORD', 'REG_DWORD_LITTLE_ENDIAN', 'REG_DWORD_BIG_ENDIAN', 'REG_LINK', 'REG_MULTI_SZ', 'REG_RESOURCE_LIST', 'REG_FULL_RESOURCE_DESCRIPTOR', 'REG_RESOURCE_REQUIREMENTS_LIST', 'REG_QWORD', 'REG_QWORD_LITTLE_ENDIAN']
--
root-keys
text
Root key of the Windows registry (extracted from the key) ['HKCC', 'HKCR', 'HKCU', 'HKDD', 'HKEY_CLASSES_ROOT', 'HKEY_CURRENT_CONFIG', 'HKEY_CURRENT_USER', 'HKEY_DYN_DATA', 'HKEY_LOCAL_MACHINE', 'HKEY_PERFORMANCE_DATA', 'HKEY_USERS', 'HKLM', 'HKPD', 'HKU']
--
last-modified
datetime
root-keys
text
Root key of the Windows registry (extracted from the key) ['HKCC', 'HKCR', 'HKCU', 'HKDD', 'HKEY_CLASSES_ROOT', 'HKEY_CURRENT_CONFIG', 'HKEY_CURRENT_USER', 'HKEY_DYN_DATA', 'HKEY_LOCAL_MACHINE', 'HKEY_PERFORMANCE_DATA', 'HKEY_USERS', 'HKLM', 'HKPD', 'HKU']
++
hive
text
data-type
text
Registry value type ['REG_NONE', 'REG_SZ', 'REG_EXPAND_SZ', 'REG_BINARY', 'REG_DWORD', 'REG_DWORD_LITTLE_ENDIAN', 'REG_DWORD_BIG_ENDIAN', 'REG_LINK', 'REG_MULTI_SZ', 'REG_RESOURCE_LIST', 'REG_FULL_RESOURCE_DESCRIPTOR', 'REG_RESOURCE_REQUIREMENTS_LIST', 'REG_QWORD', 'REG_QWORD_LITTLE_ENDIAN']
++
key
regkey
Full key path
++
data
text
classification
text
Classification of the RTIR ticket
++
constituency
text
Constituency of the RTIR ticket
++
subject
text
queue
text
Queue of the RTIR ticket ['incident', 'investigations', 'blocks', 'incident reports']
++
status
text
constituency
text
Constituency of the RTIR ticket
--
ip
ip-dst
classification
text
Classification of the RTIR ticket
--
queue
text
Queue of the RTIR ticket ['incident', 'investigations', 'blocks', 'incident reports']
--
on-premise-sandbox
+web-sandbox
text
The on-premise sandbox used ['cuckoo', 'symantec-cas-on-premise', 'bluecoat-maa', 'trendmicro-deep-discovery-analyzer', 'fireeye-ax', 'vmray', 'joe-sandbox-on-premise']
--
raw-report
text
Raw report from sandbox
--
results
text
Freetext result values
+A web sandbox where results are publicly available via an URL ['malwr', 'hybrid-analysis']
@@ -7287,10 +7347,10 @@ sandbox-report is a MISP object available in JSON format at
web-sandbox
on-premise-sandbox
text
A web sandbox where results are publicly available via an URL ['malwr', 'hybrid-analysis']
+The on-premise sandbox used ['cuckoo', 'symantec-cas-on-premise', 'bluecoat-maa', 'trendmicro-deep-discovery-analyzer', 'fireeye-ax', 'vmray', 'joe-sandbox-on-premise']
@@ -7307,10 +7367,10 @@ sandbox-report is a MISP object available in JSON format at
sandbox-type
raw-report
text
The type of sandbox used ['on-premise', 'web', 'saas']
+Raw report from sandbox
results
text
Freetext result values
++
sandbox-type
text
The type of sandbox used ['on-premise', 'web', 'saas']
++
datetime
-datetime
Datetime
--
text
software
text
Additional signature description
+Name of Sandbox software
@@ -7395,10 +7465,20 @@ sb-signature is a MISP object available in JSON format at
software
text
text
Name of Sandbox software
+Additional signature description
++
datetime
datetime
Datetime
@@ -7443,86 +7523,16 @@ ss7-attack is a MISP object available in JSON format at
SccpCgGT
MapApplicationContext
text
Signaling Connection Control Part (SCCP) CgGT - Phone number.
--
MapVersion
text
Map version. ['1', '2', '3']
+MAP application context in OID format.
text
text
A description of the attack seen via SS7 logging.
--
MapGsmscfGT
text
MAP GSMSCF GT. Phone number.
--
SccpCdSSN
text
Signaling Connection Control Part (SCCP) - Decimal value between 0-255.
--
MapSmsTP-OA
text
MAP SMS TP-OA. Phone number.
--
MapGmlc
text
MAP GMLC. Phone number.
--
SccpCgPC
text
Signaling Connection Control Part (SCCP) CgPC - Phone number.
--
MapUssdCoding
text
MapMscGT
MapGmlc
text
MAP MSC GT. Phone number.
--
MapSmscGT
text
MAP SMSC. Phone number.
--
MapSmsTypeNumber
text
MAP SMS TypeNumber.
--
MapOpCode
text
MAP operation codes - Decimal value between 0-99.
--
MapSmsTP-PID
text
MAP SMS TP-PID.
--
SccpCdPC
text
Signaling Connection Control Part (SCCP) CdPC - Phone number.
--
MapVlrGT
text
MAP VLR GT. Phone number.
--
MapSmsText
text
MAP SMS Text. Important indicators in SMS text.
--
SccpCdGT
text
Signaling Connection Control Part (SCCP) CdGT - Phone number.
+MAP GMLC. Phone number.
@@ -7633,26 +7563,16 @@ ss7-attack is a MISP object available in JSON format at
MapApplicationContext
SccpCdSSN
text
MAP application context in OID format.
+Signaling Connection Control Part (SCCP) - Decimal value between 0-255.
MapImsi
text
MAP IMSI. Phone number starting with MCC/MNC.
--
MapUssdContent
text
MapVersion
text
Map version. ['1', '2', '3']
++
MapSmscGT
text
MAP SMSC. Phone number.
++
MapSmsTP-DCS
text
SccpCgSSN
MapSmsTP-PID
text
Signaling Connection Control Part (SCCP) - Decimal value between 0-255.
+MAP SMS TP-PID.
++
first-seen
datetime
When the attack has been seen for the first time.
@@ -7693,15 +7643,145 @@ ss7-attack is a MISP object available in JSON format at
first-seen
datetime
MapOpCode
text
When the attack has been seen for the first time.
+MAP operation codes - Decimal value between 0-99.
MapMscGT
text
MAP MSC GT. Phone number.
++
MapVlrGT
text
MAP VLR GT. Phone number.
++
SccpCgPC
text
Signaling Connection Control Part (SCCP) CgPC - Phone number.
++
MapGsmscfGT
text
MAP GSMSCF GT. Phone number.
++
MapSmsTP-OA
text
MAP SMS TP-OA. Phone number.
++
MapSmsText
text
MAP SMS Text. Important indicators in SMS text.
++
SccpCgSSN
text
Signaling Connection Control Part (SCCP) - Decimal value between 0-255.
++
SccpCgGT
text
Signaling Connection Control Part (SCCP) CgGT - Phone number.
++
MapSmsTypeNumber
text
MAP SMS TypeNumber.
++
text
text
A description of the attack seen via SS7 logging.
++
SccpCdGT
text
Signaling Connection Control Part (SCCP) CdGT - Phone number.
++
MapImsi
text
MAP IMSI. Phone number starting with MCC/MNC.
++
SccpCdPC
text
Signaling Connection Control Part (SCCP) CdPC - Phone number.
++
comment
-comment
stix2-pattern
stix2-pattern
A description of the stix2-pattern.
+STIX 2 pattern
stix2-pattern
stix2-pattern
comment
comment
STIX 2 pattern
+A description of the stix2-pattern.
@@ -7809,6 +7889,16 @@ suricata is a MISP object available in JSON format at
ref
link
Reference to the Suricata rule such as origin of the rule or alike.
++
version
text
ref
link
Reference to the Suricata rule such as origin of the rule or alike.
--
targeted_machine
-target-machine
targeted_ip_of_system
ip-src
Targeted system
+Targeted system IP address
targeted_ip_of_system
ip-src
targeted_machine
target-machine
Targeted system IP address
+Targeted system
@@ -7955,6 +8035,16 @@ timesketch-timeline is a MISP object available in JSON format at
timestamp_desc
text
Text explaining what type of timestamp is it
++
datetime
datetime
timestamp_desc
text
Text explaining what type of timestamp is it
--
last-seen
-datetime
text
text
First time that the linked object or attribute has been seen.
+Description of the time object.
text
precision
text
Description of the time object.
+Timestamp precision represents the precision given to first_seen and/or last_seen in this object. ['year', 'month', 'day', 'hour', 'minute', 'full']
@@ -8063,10 +8143,10 @@ timestamp is a MISP object available in JSON format at
precision
text
last-seen
datetime
Timestamp precision represents the precision given to first_seen and/or last_seen in this object. ['year', 'month', 'day', 'hour', 'minute', 'full']
+First time that the linked object or attribute has been seen.
@@ -8111,46 +8191,16 @@ tor-node is a MISP object available in JSON format at
fingerprint
document
text
router’s fingerprint.
--
text
text
Tor node comment.
+Raw document from the consensus.
flags
text
list of flag associated with the node.
--
version_line
text
versioning information reported by the node.
--
published
datetime
description
fingerprint
text
Tor node description.
+router’s fingerprint.
+
version
flags
text
parsed version of tor, this is None if the relay’s using a new versioning scheme.
+list of flag associated with the node.
@@ -8191,20 +8241,40 @@ tor-node is a MISP object available in JSON format at
document
text
last-seen
datetime
Raw document from the consensus.
+When the Tor node designed by the IP address has been seen for the last time.
last-seen
datetime
description
text
When the Tor node designed by the IP address has been seen for the last time.
+Tor node description.
++
nickname
text
router’s nickname.
++
text
text
Tor node comment.
@@ -8221,10 +8291,20 @@ tor-node is a MISP object available in JSON format at
nickname
version
text
router’s nickname.
+parsed version of tor, this is None if the relay’s using a new versioning scheme.
++
version_line
text
versioning information reported by the node.
@@ -8269,56 +8349,6 @@ transaction is a MISP object available in JSON format at
location
text
Location where the transaction took place.
--
text
text
A description of the transaction.
--
date
datetime
Date and time of the transaction.
--
amount
text
The value of the transaction in local currency.
--
transmode-comment
text
Comment describing transmode-code, if needed.
--
transmode-code
text
teller
text
Person who conducted the transaction.
--
date-posting
datetime
Date of posting, if different from date of transaction.
--
to-country
text
authorized
text
Person who autorized the transaction.
--
transaction-number
text
date-posting
datetime
Date of posting, if different from date of transaction.
++
amount
text
The value of the transaction in local currency.
++
authorized
text
Person who autorized the transaction.
++
teller
text
Person who conducted the transaction.
++
text
text
A description of the transaction.
++
transmode-comment
text
Comment describing transmode-code, if needed.
++
date
datetime
Date and time of the transaction.
++
location
text
Location where the transaction took place.
++
port
+port
Port number
++
host
hostname
Full hostname
++
query_string
text
Query (after path, preceded by '?')
++
subdomain
text
resource_path
text
Path (between hostname:port and query)
++
domain
domain
Full domain
++
last-seen
datetime
Last time this URL has been seen
++
url
url
Full URL
++
domain_without_tld
text
Domain without Top-Level Domain
++
scheme
text
Scheme ['http', 'https', 'ftp', 'gopher', 'sip']
++
text
text
tld
text
first-seen
datetime
Top-Level Domain
+First time this URL has been seen
query_string
text
Query (after path, preceded by '?')
--
domain
domain
Full domain
--
host
hostname
Full hostname
--
domain_without_tld
text
Domain without Top-Level Domain
--
credential
text
last-seen
datetime
Last time this URL has been seen
--
scheme
tld
text
Scheme ['http', 'https', 'ftp', 'gopher', 'sip']
+Top-Level Domain
resource_path
text
Path (between hostname:port and query)
--
first-seen
datetime
First time this URL has been seen
--
port
port
Port number
--
url
url
Full URL
--
target-email
The email address(es) of the user targeted.
--
external
target-external
node
target-machine
Name(s) of node that was targeted.
--
sectors
classification
text
The list of sectors that the victim belong to ['agriculture', 'aerospace', 'automotive', 'communications', 'construction', 'defence', 'education', 'energy', 'engineering', 'entertainment', 'financial services', 'government national', 'government regional', 'government local', 'government public services', 'healthcare', 'hospitality leisure', 'infrastructure', 'insurance', 'manufacturing', 'mining', 'non profit', 'pharmaceuticals', 'retail', 'technology', 'telecommunications', 'transportation', 'utilities']
+The type of entity being targeted. ['individual', 'group', 'organization', 'class', 'unknown']
-
name
target-org
The name of the department(s) or organisation(s) targeted.
-+
node
+target-machine
Name(s) of node that was targeted.
++
user
target-user
classification
sectors
text
The type of entity being targeted. ['individual', 'group', 'organization', 'class', 'unknown']
+The list of sectors that the victim belong to ['agriculture', 'aerospace', 'automotive', 'communications', 'construction', 'defence', 'education', 'energy', 'engineering', 'entertainment', 'financial services', 'government national', 'government regional', 'government local', 'government public services', 'healthcare', 'hospitality leisure', 'infrastructure', 'insurance', 'manufacturing', 'mining', 'non profit', 'pharmaceuticals', 'retail', 'technology', 'telecommunications', 'transportation', 'utilities']
+
+
name
target-org
The name of the department(s) or organisation(s) targeted.
++
target-email
The email address(es) of the user targeted.
+
detection-ratio
+community-score
text
Detection Ratio
+Community Score
first-submission
last-submission
datetime
First Submission
+Last Submission
@@ -8823,20 +8903,20 @@ virustotal-report is a MISP object available in JSON format at
community-score
detection-ratio
text
Community Score
+Detection Ratio
last-submission
first-submission
datetime
Last Submission
+First Submission
@@ -8881,16 +8961,6 @@ vulnerability is a MISP object available in JSON format at
text
text
Description of the vulnerability
--
references
link
created
datetime
First time when the vulnerability was discovered
--
modified
datetime
id
vulnerability
summary
text
Vulnerability ID (generally CVE, but not necessarely). The id is not required as the object itself has an UUID and the CVE id can updated later.
+Summary of the vulnerability
published
text
text
Description of the vulnerability
++
created
datetime
Initial publication date
+First time when the vulnerability was discovered
@@ -8961,10 +9031,20 @@ vulnerability is a MISP object available in JSON format at
summary
text
published
datetime
Summary of the vulnerability
+Initial publication date
++
id
vulnerability
Vulnerability ID (generally CVE, but not necessarely). The id is not required as the object itself has an UUID and the CVE id can updated later.
@@ -9009,20 +9089,30 @@ whois is a MISP object available in JSON format at
text
text
registrant-name
whois-registrant-name
Full whois entry
+Registrant name
++
expiration-date
datetime
Expiration of the whois entry
registrant-name
whois-registrant-name
domain
domain
Registrant name
+Domain of the whois entry
@@ -9039,6 +9129,26 @@ whois is a MISP object available in JSON format at
text
text
Full whois entry
++
nameserver
hostname
Nameserver
++
comment
text
domain
domain
creation-date
datetime
Domain of the whois entry
+Initial creation of the whois entry
+
registrant-phone
whois-registrant-phone
registrant-email
whois-registrant-email
Registrant phone number
+Registrant email address
@@ -9089,13 +9199,13 @@ whois is a MISP object available in JSON format at
nameserver
hostname
registrant-phone
whois-registrant-phone
Nameserver
+Registrant phone number
+
expiration-date
datetime
Expiration of the whois entry
--
creation-date
datetime
Initial creation of the whois entry
--
registrant-email
whois-registrant-email
Registrant email address
--
subject
+serial-number
text
Subject of the certificate
+Serial number of the certificate
++
pem
text
Raw certificate in PEM formati (Unix-like newlines)
@@ -9197,6 +9287,16 @@ x509 is a MISP object available in JSON format at
issuer
text
Issuer of the certificate
++
pubkey-info-modulus
text
x509-fingerprint-sha1
x509-fingerprint-sha1
[Insecure] Secure Hash Algorithm 1 (160 bits)
++
dns_names
text
DNS names
++
is_ca
boolean
CA certificate
++
validity-not-before
datetime
subject
text
Subject of the certificate
++
pubkey-info-algorithm
text
pubkey-info-size
text
Length of the public key (in bits)
--
raw-base64
text
Raw certificate base64 encoded (DER format)
--
text
text
Free text description of hte certificate
--
issuer
text
Issuer of the certificate
--
version
text
Version of the certificate
--
pem
text
Raw certificate in PEM formati (Unix-like newlines)
--
x509-fingerprint-sha1
x509-fingerprint-sha1
[Insecure] Secure Hash Algorithm 1 (160 bits)
--
serial-number
text
Serial number of the certificate
--
x509-fingerprint-sha256
x509-fingerprint-sha256
text
text
Free text description of hte certificate
++
raw-base64
text
Raw certificate base64 encoded (DER format)
++
validity-not-after
datetime
is_ca
boolean
version
text
CA certificate
+Version of the certificate
dns_names
pubkey-info-size
text
DNS names
+Length of the public key (in bits)
@@ -9405,26 +9485,6 @@ yabin is a MISP object available in JSON format at
whitelist
comment
Whitelist name used to generate the rules.
--
version
comment
yabin.py and regex.txt version used for the generation of the yara rules.
--
comment
comment
version
comment
yabin.py and regex.txt version used for the generation of the yara rules.
++
yara
yara
whitelist
comment
Whitelist name used to generate the rules.
++
context
+version
text
Context where the YARA rule can be applied ['all', 'disk', 'memory', 'network']
+Version of the YARA rule depending where the yara rule is known to work as expected. ['3.7.1']
version
text
yara
yara
Version of the YARA rule depending where the yara rule is known to work as expected. ['3.7.1']
+YARA rule.
@@ -9523,10 +9603,10 @@ yara is a MISP object available in JSON format at
yara
yara
context
text
YARA rule.
+Context where the YARA rule can be applied ['all', 'disk', 'memory', 'network']