-
A description of the leak which could include the potential victim(s) or description of the leak.
-text
-text
A description of the leak which could include the potential victim(s) or description of the leak.
--
original-date
datetime
When the information available in the leak was created. It’s usually before the first-seen.
--
first-seen
datetime
When the leak has been accessible or seen for the first time.
--
last-seen
datetime
When the leak has been accessible or seen for the last time.
--
raw-data
attachment
Raw data as received by the AIL sensor compressed and encoded in Base64.
--
sensor
text
type
text
Type of information leak as discovered and classified by an AIL module. ['Credential', 'CreditCards', 'Mail', 'Onion', 'Phone', 'Keys']
--
duplicate
text
text
text
A description of the leak which could include the potential victim(s) or description of the leak.
++
original-date
datetime
When the information available in the leak was created. It’s usually before the first-seen.
++
last-seen
datetime
When the leak has been accessible or seen for the last time.
++
first-seen
datetime
When the leak has been accessible or seen for the first time.
++
raw-data
attachment
Raw data as received by the AIL sensor compressed and encoded in Base64.
++
Automated Indicator Sharing (AIS) Information Source Markings..
+| + + | ++ais-info is a MISP object available in JSON format at this location The JSON format can be freely reused in your application or automatically enabled in MISP. + | +
| Object attribute | +MISP attribute type | +Description | +Disable correlation | +
|---|---|---|---|
organisation |
+text |
+
+ AIS Organisation Name. + |
+
+ + |
+
administrative-area |
+text |
+
+ AIS Administrative Area represented using ISO-3166-2. + |
+
+ + |
+
industry |
+text |
+
+ AIS IndustryType. ['Chemical Sector', 'Commercial Facilities Sector', 'Communications Sector', 'Critical Manufacturing Sector', 'Dams Sector', 'Defense Industrial Base Sector', 'Emergency Services Sector', 'Energy Sector', 'Financial Services Sector', 'Food and Agriculture Sector', 'Government Facilities Sector', 'Healthcare and Public Health Sector', 'Information Technology Sector', 'Nuclear Reactors, Materials, and Waste Sector', 'Transportation Systems Sector', 'Water and Wastewater Systems Sector', 'Other'] + |
+
+ + |
+
country |
+text |
+
+ AIS Country represented using ISO-3166-1_alpha-2. + |
+
+ + |
+
type
+text
Type of the annotation ['Annotation', 'Executive Summary', 'Introduction', 'Conclusion', 'Disclaimer', 'Keywords', 'Acknowledgement', 'Other', 'Copyright', 'Authors', 'Logo']
++
format
text
type
text
Type of the annotation ['Annotation', 'Executive Summary', 'Introduction', 'Conclusion', 'Disclaimer', 'Keywords', 'Acknowledgement', 'Other', 'Copyright', 'Authors', 'Logo']
--
last-seen
-datetime
asn
AS
Last time the ASN was seen
--
import
text
The inbound IPv4 routing policy of the AS in RFC 2622 – Routing Policy Specification Language (RPSL) format
+Autonomous System Number
first-seen
datetime
description
text
First time the ASN was seen
+Description of the autonomous system
+
asn
-AS
first-seen
datetime
Autonomous System Number
+First time the ASN was seen
++
last-seen
datetime
Last time the ASN was seen
++
import
text
The inbound IPv4 routing policy of the AS in RFC 2622 – Routing Policy Specification Language (RPSL) format
++
export
text
The outbound routing policy of the AS in RFC 2622 – Routing Policy Specification Language (RPSL) format
description
text
Description of the autonomous system
--
export
text
The outbound routing policy of the AS in RFC 2622 – Routing Policy Specification Language (RPSL) format
--
text
+software
text
Free text value to attach to the file
+Name of antivirus software
@@ -1043,10 +1112,10 @@ av-signature is a MISP object available in JSON format at
software
text
text
Name of antivirus software
+Free text value to attach to the file
@@ -1101,6 +1170,26 @@ bank-account is a MISP object available in JSON format at
text
text
A description of the bank account.
++
institution-name
text
Name of the bank or financial organisation.
++
institution-code
text
beneficiary-comment
text
swift
bic
Comment about the final beneficiary.
--
date-balance
datetime
When the balance was reported.
--
comments
text
Comments about the bank account.
--
client-number
text
Client number as seen by the bank.
--
currency-code
text
Currency of the account. ['USD', 'EUR']
--
beneficiary
text
Final beneficiary of the bank account.
--
opened
datetime
When the account was opened.
--
account-name
text
A field to freely describe the bank account details.
--
personal-account-type
text
Account type. ['A - Business', 'B - Personal Current', 'C - Savings', 'D - Trust Account', 'E - Trading Account', 'O - Other']
+SWIFT or BIC as defined in ISO 9362.
@@ -1211,40 +1220,10 @@ bank-account is a MISP object available in JSON format at
balance
text
non-banking-institution
boolean
The balance of the account after the suspicious transaction was processed.
--
status-code
text
Account status at the time of the transaction processed. ['A - Active', 'B - Inactive', 'C - Dormant']
--
iban
iban
IBAN of the bank account.
--
report-code
text
Report code of the bank account. ['CTR Cash Transaction Report', 'STR Suspicious Transaction Report', 'EFT Electronic Funds Transfer', 'IFT International Funds Transfer', 'TFR Terror Financing Report', 'BCR Border Cash Report', 'UTR Unusual Transaction Report', 'AIF Additional Information File – Can be used for example to get full disclosure of transactions of an account for a period of time without reporting it as a CTR.', 'IRI Incoming Request for Information – International', 'ORI Outgoing Request for Information – International', 'IRD Incoming Request for Information – Domestic', 'ORD Outgoing Request for Information – Domestic']
+A flag to define if this account belong to a non-banking organisation. If set to true, it’s a non-banking organisation.
@@ -1261,6 +1240,16 @@ bank-account is a MISP object available in JSON format at
currency-code
text
Currency of the account. ['USD', 'EUR']
++
aba-rtn
aba-rtn
swift
bic
account-name
text
SWIFT or BIC as defined in ISO 9362.
+A field to freely describe the bank account details.
++
iban
iban
IBAN of the bank account.
++
client-number
text
Client number as seen by the bank.
++
personal-account-type
text
Account type. ['A - Business', 'B - Personal Current', 'C - Savings', 'D - Trust Account', 'E - Trading Account', 'O - Other']
text
text
opened
datetime
A description of the bank account.
--
non-banking-institution
boolean
A flag to define if this account belong to a non-banking organisation. If set to true, it’s a non-banking organisation.
+When the account was opened.
@@ -1311,10 +1320,70 @@ bank-account is a MISP object available in JSON format at
institution-name
balance
text
Name of the bank or financial organisation.
+The balance of the account after the suspicious transaction was processed.
++
date-balance
datetime
When the balance was reported.
++
status-code
text
Account status at the time of the transaction processed. ['A - Active', 'B - Inactive', 'C - Dormant']
++
beneficiary
text
Final beneficiary of the bank account.
++
beneficiary-comment
text
Comment about the final beneficiary.
++
comments
text
Comments about the bank account.
++
report-code
text
Report code of the bank account. ['CTR Cash Transaction Report', 'STR Suspicious Transaction Report', 'EFT Electronic Funds Transfer', 'IFT International Funds Transfer', 'TFR Terror Financing Report', 'BCR Border Cash Report', 'UTR Unusual Transaction Report', 'AIF Additional Information File – Can be used for example to get full disclosure of transactions of an account for a period of time without reporting it as a CTR.', 'IRI Incoming Request for Information – International', 'ORI Outgoing Request for Information – International', 'IRD Incoming Request for Information – Domestic', 'ORD Outgoing Request for Information – Domestic']
@@ -1359,6 +1428,46 @@ cap-alert is a MISP object available in JSON format at
identifier
text
The identifier of the alert message in a number or string uniquely identifying this message, assigned by the sender.
++
sender
text
The identifier of the sender of the alert message which identifies the originator of this alert. Guaranteed by assigner to be unique globally; e.g., may be based on an Internet domain name.
++
sent
datetime
The time and date of the origination of the alert message.
++
status
text
The code denoting the appropriate handling of the alert message. ['Actual', 'Exercise', 'System', 'Test', 'Draft']
++
msgType
text
scope
text
The code denoting the intended distribution of the alert message. ['Public', 'Restricted', 'Private']
++
restriction
text
The text describing the rule for limiting distribution of the restricted alert message.
++
addresses
text
The group listing of intended recipients of the alert message. (1) Required when <scope> is “Private”, optional when <scope> is “Public” or “Restricted”. (2) Each recipient SHALL be identified by an identifier or an address. (3) Multiple space-delimited addresses MAY be included. Addresses including whitespace MUST be enclosed in double-quotes.
++
code
text
The code denoting the special handling of the alert message.
++
note
text
code
text
The code denoting the special handling of the alert message.
--
restriction
text
The text describing the rule for limiting distribution of the restricted alert message.
--
sent
datetime
The time and date of the origination of the alert message.
--
scope
text
The code denoting the intended distribution of the alert message. ['Public', 'Restricted', 'Private']
--
sender
text
The identifier of the sender of the alert message which identifies the originator of this alert. Guaranteed by assigner to be unique globally; e.g., may be based on an Internet domain name.
--
status
text
The code denoting the appropriate handling of the alert message. ['Actual', 'Exercise', 'System', 'Test', 'Draft']
--
addresses
text
The group listing of intended recipients of the alert message. (1) Required when <scope> is “Private”, optional when <scope> is “Public” or “Restricted”. (2) Each recipient SHALL be identified by an identifier or an address. (3) Multiple space-delimited addresses MAY be included. Addresses including whitespace MUST be enclosed in double-quotes.
--
incident
text
identifier
text
The identifier of the alert message in a number or string uniquely identifying this message, assigned by the sender.
--
parameter
+category
text
A system-specific additional parameter associated with the alert message.
--
onset
datetime
The expected time of the beginning of the subject event of the alert message.
--
description
text
The text describing the subject event of the alert message.
--
contact
text
The text describing the contact for follow-up and confirmation of the alert message.
--
headline
text
The text headline of the alert message.
--
effective
datetime
The effective time of the information of the alert message.
--
instruction
text
The text describing the recommended action to be taken by recipients of the alert message.
+The code denoting the category of the subject event of the alert message. ['Geo', 'Met', 'Safety', 'Security', 'Rescue', 'Fire', 'Health', 'Env', 'Transport', 'Infra', 'CBRNE', 'Other']
@@ -1617,30 +1626,40 @@ cap-info is a MISP object available in JSON format at
web
link
responseType
text
The identifier of the hyperlink associating additional information with the alert message.
+The code denoting the type of action recommended for the target audience. ['Shelter', 'Evacuate', 'Prepare', 'Execute', 'Avoid', 'Monitor', 'Assess', 'AllClear', 'None']
category
urgency
text
The code denoting the category of the subject event of the alert message. ['Geo', 'Met', 'Safety', 'Security', 'Rescue', 'Fire', 'Health', 'Env', 'Transport', 'Infra', 'CBRNE', 'Other']
+The code denoting the urgency of the subject event of the alert message. ['Immediate', 'Expected', 'Future', 'Past', 'Unknown']
eventCode
severity
text
A system-specific code identifying the event type of the alert message.
+The code denoting the severity of the subject event of the alert message. ['Extreme', 'Severe', 'Moderate', 'Minor', 'Unknown']
++
certainty
text
The code denoting the certainty of the subject event of the alert message. For backward compatibility with CAP 1.0, the deprecated value of “Very Likely” SHOULD be treated as equivalent to “Likely”. ['Likely', 'Possible', 'Unlikely', 'Unknown']
@@ -1657,20 +1676,30 @@ cap-info is a MISP object available in JSON format at
responseType
eventCode
text
The code denoting the type of action recommended for the target audience. ['Shelter', 'Evacuate', 'Prepare', 'Execute', 'Avoid', 'Monitor', 'Assess', 'AllClear', 'None']
+A system-specific code identifying the event type of the alert message.
severity
text
effective
datetime
The code denoting the severity of the subject event of the alert message. ['Extreme', 'Severe', 'Moderate', 'Minor', 'Unknown']
+The effective time of the information of the alert message.
++
onset
datetime
The expected time of the beginning of the subject event of the alert message.
@@ -1697,20 +1726,60 @@ cap-info is a MISP object available in JSON format at
certainty
headline
text
The code denoting the certainty of the subject event of the alert message. For backward compatibility with CAP 1.0, the deprecated value of “Very Likely” SHOULD be treated as equivalent to “Likely”. ['Likely', 'Possible', 'Unlikely', 'Unknown']
+The text headline of the alert message.
urgency
description
text
The code denoting the urgency of the subject event of the alert message. ['Immediate', 'Expected', 'Future', 'Past', 'Unknown']
+The text describing the subject event of the alert message.
++
instruction
text
The text describing the recommended action to be taken by recipients of the alert message.
++
web
link
The identifier of the hyperlink associating additional information with the alert message.
++
contact
text
The text describing the contact for follow-up and confirmation of the alert message.
++
parameter
text
A system-specific additional parameter associated with the alert message.
@@ -1755,20 +1824,20 @@ cap-resource is a MISP object available in JSON format at
mimeType
mime-type
resourceDesc
text
The identifier of the MIME content type and sub-type describing the resource file.
+The text describing the type and content of the resource file.
derefUri
attachment
mimeType
mime-type
The base-64 encoded data content of the resource file.
+The identifier of the MIME content type and sub-type describing the resource file.
@@ -1785,10 +1854,20 @@ cap-resource is a MISP object available in JSON format at
resourceDesc
text
uri
link
The text describing the type and content of the resource file.
+The identifier of the hyperlink for the resource file.
++
derefUri
attachment
The base-64 encoded data content of the resource file.
uri
link
The identifier of the hyperlink for the resource file.
--
text
-text
first-seen
datetime
Free text value
+First time this payment destination address has been seen
first-seen
datetime
text
text
First time this payment destination address has been seen
+Free text value
@@ -1941,20 +2010,20 @@ cookie is a MISP object available in JSON format at
text
text
cookie
cookie
A description of the cookie.
+Full cookie
+
type
cookie-name
text
Type of cookie and how it’s used in this specific object. ['Session management', 'Personalization', 'Tracking', 'Exfiltration', 'Malicious Payload', 'Beaconing']
+Name of the cookie (if splitted)
@@ -1971,20 +2040,20 @@ cookie is a MISP object available in JSON format at
cookie
cookie
text
text
Full cookie
+A description of the cookie.
+
cookie-name
type
text
Name of the cookie (if splitted)
+Type of cookie and how it’s used in this specific object. ['Session management', 'Personalization', 'Tracking', 'Exfiltration', 'Malicious Payload', 'Beaconing']
@@ -2029,16 +2098,6 @@ course-of-action is a MISP object available in JSON format at
cost
text
The estimated cost of applying the course of action. ['High', 'Medium', 'Low', 'None', 'Unknown']
--
name
text
impact
type
text
The estimated impact of applying the course of action. ['High', 'Medium', 'Low', 'None', 'Unknown']
+The type of the course of action. ['Perimeter Blocking', 'Internal Blocking', 'Redirection', 'Redirection (Honey Pot)', 'Hardening', 'Patching', 'Eradication', 'Rebuilding', 'Training', 'Monitoring', 'Physical Access Restrictions', 'Logical Access Restrictions', 'Public Disclosure', 'Diplomatic Actions', 'Policy Actions', 'Other']
@@ -2089,20 +2148,30 @@ course-of-action is a MISP object available in JSON format at
efficacy
cost
text
The estimated efficacy of applying the course of action. ['High', 'Medium', 'Low', 'None', 'Unknown']
+The estimated cost of applying the course of action. ['High', 'Medium', 'Low', 'None', 'Unknown']
type
impact
text
The type of the course of action. ['Perimeter Blocking', 'Internal Blocking', 'Redirection', 'Redirection (Honey Pot)', 'Hardening', 'Patching', 'Eradication', 'Rebuilding', 'Training', 'Monitoring', 'Physical Access Restrictions', 'Logical Access Restrictions', 'Public Disclosure', 'Diplomatic Actions', 'Policy Actions', 'Other']
+The estimated impact of applying the course of action. ['High', 'Medium', 'Low', 'None', 'Unknown']
++
efficacy
text
The estimated efficacy of applying the course of action. ['High', 'Medium', 'Low', 'None', 'Unknown']
@@ -2147,6 +2216,66 @@ cowrie is a MISP object available in JSON format at
eventid
text
Eventid of the session in the cowrie honeypot
++
system
text
System origin in cowrie honeypot
++
username
text
Username related to the password(s)
++
password
text
Password
++
session
text
Session id
++
timestamp
datetime
When the event happened
++
message
text
system
text
System origin in cowrie honeypot
--
keyAlgs
text
SSH public-key algorithm supported in the session
--
input
text
Input of the session
--
sensor
text
encCS
text
SSH symmetric encryption algorithm supported in the session
--
password
text
Password
--
isError
text
isError
--
username
text
Username related to the password(s)
--
macCS
text
SSH MAC supported in the sesssion
--
src_port
port
Source port of the session
--
timestamp
datetime
When the event happened
--
session
text
Session id
--
dst_port
port
Destination port of the session
--
eventid
text
Eventid of the session in the cowrie honeypot
--
src_ip
ip-src
compCS
text
dst_ip
ip-dst
SSH compression algorithm supported in the session
+Destination IP address of the session
dst_ip
ip-dst
src_port
port
Destination IP address of the session
+Source port of the session
++
dst_port
port
Destination port of the session
++
isError
text
isError
++
input
text
Input of the session
++
macCS
text
SSH MAC supported in the sesssion
++
keyAlgs
text
SSH public-key algorithm supported in the session
++
encCS
text
SSH symmetric encryption algorithm supported in the session
++
compCS
text
SSH compression algorithm supported in the session
@@ -2395,6 +2464,16 @@ credential is a MISP object available in JSON format at
password
text
Password
++
type
text
origin
text
Origin of the credential(s) ['bruteforce-scanning', 'malware-analysis', 'memory-analysis', 'network-analysis', 'leak', 'unknown']
++
format
text
password
text
Password
--
notification
text
origin
text
Origin of the credential(s) ['bruteforce-scanning', 'malware-analysis', 'memory-analysis', 'network-analysis', 'leak', 'unknown']
--
comment
+comment
A description of the card.
++
card-security-code
text
Card security code (CSC, CVD, CVV, CVC and SPC) as embossed or printed on the card.
++
name
text
cc-number
cc-number
credit-card number as encoded on the card.
--
expiration
datetime
Maximum date of validity
--
issued
datetime
comment
comment
expiration
datetime
A description of the card.
+Maximum date of validity
card-security-code
text
cc-number
cc-number
Card security code (CSC, CVD, CVV, CVC and SPC) as embossed or printed on the card.
+credit-card number as encoded on the card.
@@ -2591,36 +2660,6 @@ ddos is a MISP object available in JSON format at
text
text
Description of the DDoS
--
protocol
text
Protocol used for the attack ['TCP', 'UDP', 'ICMP', 'IP']
--
ip-src
ip-src
IP address originating the attack
--
total-bps
counter
first-seen
datetime
text
text
Beginning of the attack
+Description of the DDoS
dst-port
port
Destination port of the attack
--
src-port
port
Port originating the attack
--
domain-dst
domain
last-seen
ip-src
ip-src
IP address originating the attack
++
dst-port
port
Destination port of the attack
++
src-port
port
Port originating the attack
++
first-seen
datetime
End of the attack
+Beginning of the attack
protocol
text
Protocol used for the attack ['TCP', 'UDP', 'ICMP', 'IP']
++
total-pps
counter
last-seen
datetime
End of the attack
++
category
+text
Category. ['Cat0', 'Cat1', 'Cat2', 'Cat3', 'CatSMS']
++
ApplicationId
text
SessionId
text
Session-ID.
++
CmdCode
text
A decimal representation of the diameter Command Code.
++
Origin-Host
text
Origin-Host.
++
Destination-Host
text
Destination-Realm
text
Destination-Realm.
++
Username
text
Username (in this case, usually the IMSI).
++
IdrFlags
text
SessionId
text
Session-ID.
--
category
text
Category. ['Cat0', 'Cat1', 'Cat2', 'Cat3', 'CatSMS']
--
Username
text
Username (in this case, usually the IMSI).
--
first-seen
datetime
Origin-Host
text
Origin-Host.
--
Destination-Realm
text
Destination-Realm.
--
CmdCode
text
A decimal representation of the diameter Command Code.
--
ip
-ip-dst
IP Address
--
last-seen
datetime
ip
ip-dst
IP Address
++
text
+entrypoint-address
text
Free text value to attach to the ELF
+Address of the entry point
++
type
text
Type of ELF ['CORE', 'DYNAMIC', 'EXECUTABLE', 'HIPROC', 'LOPROC', 'NONE', 'RELOCATABLE']
++
number-sections
counter
Number of sections
@@ -3015,35 +3104,15 @@ elf is a MISP object available in JSON format at
number-sections
counter
text
text
Number of sections
+Free text value to attach to the ELF
entrypoint-address
text
Address of the entry point
--
type
text
Type of ELF ['CORE', 'DYNAMIC', 'EXECUTABLE', 'HIPROC', 'LOPROC', 'NONE', 'RELOCATABLE']
--
md5
+md5
[Insecure] MD5 hash (128 bits)
++
sha1
sha1
[Insecure] Secure Hash Algorithm 1 (160 bits)
++
sha224
sha224
Secure Hash Algorithm 2 (224 bits)
++
sha256
sha256
Secure Hash Algorithm 2 (256 bits)
++
sha384
sha384
sha512
sha512
Secure Hash Algorithm 2 (512 bits)
++
sha512/224
sha512/224
Secure Hash Algorithm 2 (224 bits)
++
sha512/256
sha512/256
sha512/224
sha512/224
ssdeep
ssdeep
Secure Hash Algorithm 2 (224 bits)
+Fuzzy hash using context triggered piecewise hashes (CTPH)
flag
text
entropy
float
Flag of the section ['ALLOC', 'EXCLUDE', 'EXECINSTR', 'GROUP', 'HEX_GPREL', 'INFO_LINK', 'LINK_ORDER', 'MASKOS', 'MASKPROC', 'MERGE', 'MIPS_ADDR', 'MIPS_LOCAL', 'MIPS_MERGE', 'MIPS_NAMES', 'MIPS_NODUPES', 'MIPS_NOSTRIP', 'NONE', 'OS_NONCONFORMING', 'STRINGS', 'TLS', 'WRITE', 'XCORE_SHF_CP_SECTION']
+Entropy of the whole section
sha224
sha224
Secure Hash Algorithm 2 (224 bits)
--
name
text
md5
md5
[Insecure] MD5 hash (128 bits)
--
text
text
entropy
float
type
text
Entropy of the whole section
+Type of the section ['NULL', 'PROGBITS', 'SYMTAB', 'STRTAB', 'RELA', 'HASH', 'DYNAMIC', 'NOTE', 'NOBITS', 'REL', 'SHLIB', 'DYNSYM', 'INIT_ARRAY', 'FINI_ARRAY', 'PREINIT_ARRAY', 'GROUP', 'SYMTAB_SHNDX', 'LOOS', 'GNU_ATTRIBUTES', 'GNU_HASH', 'GNU_VERDEF', 'GNU_VERNEED', 'GNU_VERSYM', 'HIOS', 'LOPROC', 'ARM_EXIDX', 'ARM_PREEMPTMAP', 'HEX_ORDERED', 'X86_64_UNWIND', 'MIPS_REGINFO', 'MIPS_OPTIONS', 'MIPS_ABIFLAGS', 'HIPROC', 'LOUSER', 'HIUSER']
sha512
sha512
Secure Hash Algorithm 2 (512 bits)
--
sha1
sha1
[Insecure] Secure Hash Algorithm 1 (160 bits)
--
sha256
sha256
Secure Hash Algorithm 2 (256 bits)
--
ssdeep
ssdeep
Fuzzy hash using context triggered piecewise hashes (CTPH)
--
type
flag
text
Type of the section ['NULL', 'PROGBITS', 'SYMTAB', 'STRTAB', 'RELA', 'HASH', 'DYNAMIC', 'NOTE', 'NOBITS', 'REL', 'SHLIB', 'DYNSYM', 'INIT_ARRAY', 'FINI_ARRAY', 'PREINIT_ARRAY', 'GROUP', 'SYMTAB_SHNDX', 'LOOS', 'GNU_ATTRIBUTES', 'GNU_HASH', 'GNU_VERDEF', 'GNU_VERNEED', 'GNU_VERSYM', 'HIOS', 'LOPROC', 'ARM_EXIDX', 'ARM_PREEMPTMAP', 'HEX_ORDERED', 'X86_64_UNWIND', 'MIPS_REGINFO', 'MIPS_OPTIONS', 'MIPS_ABIFLAGS', 'HIPROC', 'LOUSER', 'HIUSER']
+Flag of the section ['ALLOC', 'EXCLUDE', 'EXECINSTR', 'GROUP', 'HEX_GPREL', 'INFO_LINK', 'LINK_ORDER', 'MASKOS', 'MASKPROC', 'MERGE', 'MIPS_ADDR', 'MIPS_LOCAL', 'MIPS_MERGE', 'MIPS_NAMES', 'MIPS_NODUPES', 'MIPS_NOSTRIP', 'NONE', 'OS_NONCONFORMING', 'STRINGS', 'TLS', 'WRITE', 'XCORE_SHF_CP_SECTION']
@@ -3271,16 +3340,6 @@ email is a MISP object available in JSON format at
subject
email-subject
Subject
--
reply-to
email-reply-to
header
email-header
Full headers
--
from
email-src
Sender email address
--
screenshot
attachment
Screenshot of email
--
return-path
email-src
Message return path
--
email-body
email-body
Body of the email
--
message-id
email-message-id
attachment
email-attachment
Attachment
--
to-display-name
email-dst-display-name
Display name of the receiver
--
cc
email-dst
Carbon copy
--
thread-index
email-thread-index
Identifies a particular conversation thread
--
eml
attachment
Full EML
--
user-agent
text
User Agent of the sender
--
send-date
datetime
Date the email has been sent
--
to
email-dst
cc
email-dst
Carbon copy
++
to-display-name
email-dst-display-name
Display name of the receiver
++
subject
email-subject
Subject
++
screenshot
attachment
Screenshot of email
++
attachment
email-attachment
Attachment
++
x-mailer
email-x-mailer
header
email-header
Full headers
++
send-date
datetime
Date the email has been sent
++
mime-boundary
email-mime-boundary
thread-index
email-thread-index
Identifies a particular conversation thread
++
from
email-src
Sender email address
++
return-path
email-src
Message return path
++
from-display-name
email-src-display-name
email-body
email-body
Body of the email
++
user-agent
text
User Agent of the sender
++
eml
attachment
Full EML
++
logfile
-attachment
banned-ip
ip-src
Full logfile related to the attack.
+IP Address banned by fail2ban
-
victim
text
Identifier of the victim
-+
sensor
-text
Identifier of the sensor
--
attack-type
text
failures
counter
Amount of failures that lead to the ban.
++
sensor
text
Identifier of the sensor
++
victim
text
Identifier of the victim
++
logline
text
banned-ip
ip-src
logfile
attachment
IP Address banned by fail2ban
--
failures
counter
Amount of failures that lead to the ban.
+Full logfile related to the attack.
@@ -3617,6 +3686,46 @@ file is a MISP object available in JSON format at
md5
md5
[Insecure] MD5 hash (128 bits)
++
sha1
sha1
[Insecure] Secure Hash Algorithm 1 (160 bits)
++
sha224
sha224
Secure Hash Algorithm 2 (224 bits)
++
sha256
sha256
Secure Hash Algorithm 2 (256 bits)
++
sha384
sha384
sha512/256
sha512/256
sha512
sha512
Secure Hash Algorithm 2 (256 bits)
+Secure Hash Algorithm 2 (512 bits)
@@ -3647,6 +3756,56 @@ file is a MISP object available in JSON format at
sha512/256
sha512/256
Secure Hash Algorithm 2 (256 bits)
++
ssdeep
ssdeep
Fuzzy hash using context triggered piecewise hashes (CTPH)
++
authentihash
authentihash
Authenticode executable signature hash
++
size-in-bytes
size-in-bytes
Size of the file, in bytes
++
entropy
float
Entropy of the whole file
++
pattern-in-file
pattern-in-file
text
text
Free text value to attach to the file
++
malware-sample
malware-sample
The file itself (binary)
++
filename
filename
Filename on disk
++
path
text
Path of the filename complete or partial
++
tlsh
tlsh
certificate
x509-fingerprint-sha1
Certificate value if the binary is signed with another authentication scheme than authenticode
++
mimetype
mime-type
sha224
sha224
Secure Hash Algorithm 2 (224 bits)
--
authentihash
authentihash
Authenticode executable signature hash
--
md5
md5
[Insecure] MD5 hash (128 bits)
--
size-in-bytes
size-in-bytes
Size of the file, in bytes
--
filename
filename
Filename on disk
--
text
text
Free text value to attach to the file
--
entropy
float
Entropy of the whole file
--
malware-sample
malware-sample
The file itself (binary)
--
sha512
sha512
Secure Hash Algorithm 2 (512 bits)
--
certificate
x509-fingerprint-sha1
Certificate value if the binary is signed with another authentication scheme than authenticode
--
sha1
sha1
[Insecure] Secure Hash Algorithm 1 (160 bits)
--
sha256
sha256
Secure Hash Algorithm 2 (256 bits)
--
ssdeep
ssdeep
Fuzzy hash using context triggered piecewise hashes (CTPH)
--
path
text
Path of the filename complete or partial
--
zipcode
-text
first-seen
datetime
Zip Code.
+When the location was seen for the first time.
+
address
text
last-seen
datetime
Address.
+When the location was seen for the last time.
+
+
text
text
A generic description of the location.
++
latitude
float
The latitude is the decimal value of the latitude in the World Geodetic System 84 (WGS84) reference.
+
address
+text
Address.
++
zipcode
text
Zip Code.
++
city
text
text
text
A generic description of the location.
--
latitude
float
The latitude is the decimal value of the latitude in the World Geodetic System 84 (WGS84) reference.
--
last-seen
datetime
When the location was seen for the last time.
--
first-seen
datetime
When the location was seen for the first time.
--
country
text
epsg
text
EPSG Geodetic Parameter value. This is an integer value of the EPSG.
++
spacial-reference
text
epsg
text
EPSG Geodetic Parameter value. This is an integer value of the EPSG.
--
GtpImei
+text
GTP IMEI (International Mobile Equipment Identity).
++
GtpMsisdn
text
GTP MSISDN.
++
GtpImsi
text
GTP IMSI (International mobile subscriber identity).
++
GtpInterface
text
GTP interface. ['S5', 'S11', 'S10', 'S8', 'Gn', 'Gp']
++
GtpMessageType
text
GTP defines a set of messages between two associated GSNs or an SGSN and an RNC. Message type is described as a decimal value.
++
PortDest
text
Destination port.
++
PortSrc
port
GtpVersion
text
GTP version ['0', '1', '2']
--
ipSrc
ip-src
PortDest
GtpVersion
text
Destination port.
--
GtpMessageType
text
GTP defines a set of messages between two associated GSNs or an SGSN and an RNC. Message type is described as a decimal value.
+GTP version ['0', '1', '2']
@@ -4113,16 +4222,6 @@ gtp-attack is a MISP object available in JSON format at
GtpInterface
text
GTP interface. ['S5', 'S11', 'S10', 'S8', 'Gn', 'Gp']
--
first-seen
datetime
GtpMsisdn
text
GTP MSISDN.
--
GtpImei
text
GTP IMEI (International Mobile Equipment Identity).
--
GtpImsi
text
GTP IMSI (International mobile subscriber identity).
--
url
-url
Full HTTP Request URL
--
host
hostname
The domain name of the server
--
cookie
text
An HTTP cookie previously sent by the server with Set-Cookie
--
basicauth-password
text
HTTP Basic Authentication Password
--
text
text
proxy-password
basicauth-password
text
HTTP Proxy Password
--
referer
other
This is the address of the previous web page from which a link to the currently requested page was followed
--
user-agent
user-agent
The user agent string of the user agent
+HTTP Basic Authentication Password
@@ -4301,10 +4310,20 @@ http-request is a MISP object available in JSON format at
proxy-user
cookie
text
HTTP Proxy Username
+An HTTP cookie previously sent by the server with Set-Cookie
++
host
hostname
The domain name of the server
@@ -4321,6 +4340,36 @@ http-request is a MISP object available in JSON format at
referer
other
This is the address of the previous web page from which a link to the currently requested page was followed
++
proxy-password
text
HTTP Proxy Password
++
proxy-user
text
HTTP Proxy Username
++
uri
uri
url
url
Full HTTP Request URL
++
user-agent
user-agent
The user agent string of the user agent
++
ip
-ip-dst
IP Address
--
last-seen
datetime
hostname
hostname
Hostname
--
first-seen
datetime
dst-port
port
Destination port
--
src-port
port
dst-port
port
Destination port
++
domain
domain
hostname
hostname
Hostname
++
ip
ip-dst
IP Address
++
ip-src
-ip-src
ja3-fingerprint-md5
md5
Source IP Address
+Hash identifying source
first-seen
datetime
First seen of the SSL/TLS handshake
--
description
text
ja3-fingerprint-md5
md5
ip-src
ip-src
Hash identifying source
+Source IP Address
@@ -4537,6 +4596,16 @@ ja3 is a MISP object available in JSON format at
first-seen
datetime
First seen of the SSL/TLS handshake
++
last-seen
datetime
legal-form
commercial-name
text
Legal form of an entity.
+Commercial name of an entity.
commercial-name
legal-form
text
Commercial name of an entity.
+Legal form of an entity.
@@ -4635,20 +4704,20 @@ legal-entity is a MISP object available in JSON format at
phone-number
phone-number
business
text
Phone number of an entity.
+Business area of an entity.
business
text
phone-number
phone-number
Business area of an entity.
+Phone number of an entity.
@@ -4693,36 +4762,6 @@ macho is a MISP object available in JSON format at
text
text
Free text value to attach to the Mach-O file
--
name
text
Binary’s name
--
number-sections
counter
Number of sections
--
entrypoint-address
text
number-sections
counter
Number of sections
++
name
text
Binary’s name
++
text
text
Free text value to attach to the Mach-O file
++
md5
+md5
[Insecure] MD5 hash (128 bits)
++
sha1
sha1
[Insecure] Secure Hash Algorithm 1 (160 bits)
++
sha224
sha224
Secure Hash Algorithm 2 (224 bits)
++
sha256
sha256
Secure Hash Algorithm 2 (256 bits)
++
sha384
sha384
sha512
sha512
Secure Hash Algorithm 2 (512 bits)
++
sha512/224
sha512/224
Secure Hash Algorithm 2 (224 bits)
++
sha512/256
sha512/256
sha512/224
sha512/224
ssdeep
ssdeep
Secure Hash Algorithm 2 (224 bits)
+Fuzzy hash using context triggered piecewise hashes (CTPH)
sha224
sha224
entropy
float
Secure Hash Algorithm 2 (224 bits)
+Entropy of the whole section
+
md5
-md5
[Insecure] MD5 hash (128 bits)
--
text
text
entropy
float
Entropy of the whole section
--
sha512
sha512
Secure Hash Algorithm 2 (512 bits)
--
sha1
sha1
[Insecure] Secure Hash Algorithm 1 (160 bits)
--
sha256
sha256
Secure Hash Algorithm 2 (256 bits)
--
ssdeep
ssdeep
Fuzzy hash using context triggered piecewise hashes (CTPH)
--
username
+post
text
Username who posted the microblog post
+Raw post
@@ -4969,20 +5038,20 @@ microblog is a MISP object available in JSON format at
removal-date
datetime
type
text
When the microblog post was removed
+Type of the microblog post ['Twitter', 'Facebook', 'LinkedIn', 'Reddit', 'Google+', 'Instagram', 'Forum', 'Other']
+
username-quoted
username
text
Username who are quoted into the microblog post
+Username who posted the microblog post
@@ -5009,16 +5078,6 @@ microblog is a MISP object available in JSON format at
post
text
Raw post
--
link
url
type
text
removal-date
datetime
Type of the microblog post ['Twitter', 'Facebook', 'LinkedIn', 'Reddit', 'Google+', 'Instagram', 'Forum', 'Other']
+When the microblog post was removed
+
+
username-quoted
text
Username who are quoted into the microblog post
+
name
+description
text
name of the mutex
+Description
@@ -5097,10 +5166,10 @@ mutex is a MISP object available in JSON format at
description
name
text
Description
+name of the mutex
@@ -5145,66 +5214,6 @@ netflow is a MISP object available in JSON format at
icmp-type
text
ICMP type of the flow (if the traffic is ICMP)
--
protocol
text
Protocol used for this flow ['TCP', 'UDP', 'ICMP', 'IP']
--
ip-protocol-number
size-in-bytes
IP protocol number of this flow
--
tcp-flags
text
TCP flags of the flow
--
ip_version
counter
IP version of this flow
--
direction
text
Direction of this flow ['Ingress', 'Egress']
--
ip-dst
ip-dst
flow-count
counter
Flows counted in this flow
--
src-as
AS
Source AS number for this flow
--
last-packet-seen
datetime
Last packet seen in this flow
--
ip-src
ip-src
first-packet-seen
datetime
First packet seen in this flow
--
packet-count
counter
Packets counted in this flow
--
dst-port
port
tcp-flags
text
TCP flags of the flow
++
icmp-type
text
ICMP type of the flow (if the traffic is ICMP)
++
ip-protocol-number
size-in-bytes
IP protocol number of this flow
++
protocol
text
Protocol used for this flow ['TCP', 'UDP', 'ICMP', 'IP']
++
src-as
AS
Source AS number for this flow
++
dst-as
AS
ip_version
counter
IP version of this flow
++
direction
text
Direction of this flow ['Ingress', 'Egress']
++
flow-count
counter
Flows counted in this flow
++
packet-count
counter
Packets counted in this flow
++
byte-count
counter
first-packet-seen
datetime
First packet seen in this flow
++
last-packet-seen
datetime
Last packet seen in this flow
++
ip-dst
+ip-dst
Destination IP address of the nework connection.
++
src-port
port
Source port of the nework connection.
++
dst-port
port
Destination port of the nework connection.
++
hostname-src
hostname
Source hostname of the network connection.
++
hostname-dst
hostname
Destination hostname of the network connection.
++
layer3-protocol
text
dst-port
port
Destination port of the nework connection.
--
ip-dst
ip-dst
Destination IP address of the nework connection.
--
first-packet-seen
datetime
src-port
port
Source port of the nework connection.
--
hostname-src
hostname
Source hostname of the network connection.
--
hostname-dst
hostname
Destination hostname of the network connection.
--
protocol
-text
Protocol used by the network socket. ['TCP', 'UDP', 'ICMP', 'IP']
--
ip-src
ip-src
domain-family
text
Domain family who specifies the communication domain (PF_*) of the socket connection. ['PF_UNSPEC', 'PF_LOCAL', 'PF_UNIX', 'PF_FILE', 'PF_INET', 'PF_AX25', 'PF_IPX', 'PF_APPLETALK', 'PF_NETROM', 'PF_BRIDGE', 'PF_ATMPVC', 'PF_X25', 'PF_INET6', 'PF_ROSE', 'PF_DECnet', 'PF_NETBEUI', 'PF_SECURITY', 'PF_KEY', 'PF_NETLINK', 'PF_ROUTE', 'PF_PACKET', 'PF_ASH', 'PF_ECONET', 'PF_ATMSVC', 'PF_RDS', 'PF_SNA', 'PF_IRDA', 'PF_PPPOX', 'PF_WANPIPE', 'PF_LLC', 'PF_IB', 'PF_MPLS', 'PF_CAN', 'PF_TIPC', 'PF_BLUETOOTH', 'PF_IUCV', 'PF_RXRPC', 'PF_ISDN', 'PF_PHONET', 'PF_IEEE802154', 'PF_CAIF', 'PF_ALG', 'PF_NFC', 'PF_VSOCK', 'PF_KCM', 'PF_MAX']
--
option
text
Option on the socket connection.
--
dst-port
port
Destination port of the network socket connection.
--
hostname-src
hostname
ip-dst
ip-dst
Destination IP address of the network socket connection.
++
hostname-dst
hostname
Destination hostname of the network socket connection.
++
src-port
port
ip-dst
ip-dst
dst-port
port
Destination IP address of the network socket connection.
+Destination port of the network socket connection.
++
protocol
text
Protocol used by the network socket. ['TCP', 'UDP', 'ICMP', 'IP']
@@ -5581,6 +5640,16 @@ network-socket is a MISP object available in JSON format at
domain-family
text
Domain family who specifies the communication domain (PF_*) of the socket connection. ['PF_UNSPEC', 'PF_LOCAL', 'PF_UNIX', 'PF_FILE', 'PF_INET', 'PF_AX25', 'PF_IPX', 'PF_APPLETALK', 'PF_NETROM', 'PF_BRIDGE', 'PF_ATMPVC', 'PF_X25', 'PF_INET6', 'PF_ROSE', 'PF_DECnet', 'PF_NETBEUI', 'PF_SECURITY', 'PF_KEY', 'PF_NETLINK', 'PF_ROUTE', 'PF_PACKET', 'PF_ASH', 'PF_ECONET', 'PF_ATMSVC', 'PF_RDS', 'PF_SNA', 'PF_IRDA', 'PF_PPPOX', 'PF_WANPIPE', 'PF_LLC', 'PF_IB', 'PF_MPLS', 'PF_CAN', 'PF_TIPC', 'PF_BLUETOOTH', 'PF_IUCV', 'PF_RXRPC', 'PF_ISDN', 'PF_PHONET', 'PF_IEEE802154', 'PF_CAIF', 'PF_ALG', 'PF_NFC', 'PF_VSOCK', 'PF_KCM', 'PF_MAX']
++
state
text
hostname-dst
hostname
option
text
Destination hostname of the network socket connection.
+Option on the socket connection.
@@ -5639,70 +5708,10 @@ passive-dns is a MISP object available in JSON format at
sensor_id
text
Sensor information where the record was seen
--
count
counter
How many authoritative DNS answers were received at the Passive DNS Server’s collectors with exactly the given set of values as answers.
--
zone_time_first
zone_time_last
datetime
First time that the unique tuple (rrname, rrtype, rdata) record has been seen via master file import
--
time_last
datetime
Last time that the unique tuple (rrname, rrtype, rdata) record has been seen by the passive DNS
--
rrtype
text
Resource Record type as seen by the passive DNS. ['A', 'AAAA', 'CNAME', 'PTR', 'SOA', 'TXT', 'DNAME', 'NS', 'SRV', 'RP', 'NAPTR', 'HINFO', 'A6']
--
rrname
text
Resource Record name of the queried resource.
--
origin
text
Origin of the Passive DNS response
+Last time that the unique tuple (rrname, rrtype, rdata) record has been seen via master file import.
@@ -5719,6 +5728,36 @@ passive-dns is a MISP object available in JSON format at
count
counter
How many authoritative DNS answers were received at the Passive DNS Server’s collectors with exactly the given set of values as answers.
++
rrname
text
Resource Record name of the queried resource.
++
rrtype
text
Resource Record type as seen by the passive DNS. ['A', 'AAAA', 'CNAME', 'PTR', 'SOA', 'TXT', 'DNAME', 'NS', 'SRV', 'RP', 'NAPTR', 'HINFO', 'A6']
++
rdata
text
zone_time_first
datetime
First time that the unique tuple (rrname, rrtype, rdata) record has been seen via master file import
++
origin
text
Origin of the Passive DNS response
++
time_last
datetime
Last time that the unique tuple (rrname, rrtype, rdata) record has been seen by the passive DNS
++
time_first
datetime
First time that the unique tuple (rrname, rrtype, rdata) has been seen by the passive DNS
++
bailiwick
text
zone_time_last
datetime
sensor_id
text
Last time that the unique tuple (rrname, rrtype, rdata) record has been seen via master file import.
--
time_first
datetime
First time that the unique tuple (rrname, rrtype, rdata) has been seen by the passive DNS
+Sensor information where the record was seen
@@ -5797,6 +5866,36 @@ paste is a MISP object available in JSON format at
paste
text
Raw text of the paste or post
++
origin
text
Original source of the paste or post. ['pastebin.com', 'pastebin.com_pro', 'pastie.org', 'slexy.org', 'gist.github.com', 'codepad.org', 'safebin.net', 'hastebin.com', 'ghostbin.com']
++
title
text
Title of the paste or post.
++
username
text
title
text
Title of the paste or post.
--
first-seen
datetime
paste
text
Raw text of the paste or post
--
origin
text
Original source of the paste or post. ['pastebin.com', 'pastebin.com_pro', 'pastie.org', 'slexy.org', 'gist.github.com', 'codepad.org', 'safebin.net', 'hastebin.com', 'ghostbin.com']
--
compilation-timestamp
-datetime
Compilation timestamp defined in the PE header
--
pehash
pehash
product-version
text
ProductVersion in the resources
--
number-sections
counter
Number of sections
--
legal-copyright
text
LegalCopyright in the resources
--
impfuzzy
impfuzzy
imphash
imphash
internal-filename
filename
Hash (md5) calculated from the import table
--
entrypoint-address
text
Address of the entry point
+InternalFilename in the resources
@@ -5995,6 +6014,16 @@ pe is a MISP object available in JSON format at
number-sections
counter
Number of sections
++
text
text
type
text
Type of PE ['exe', 'dll', 'driver', 'unknown']
++
imphash
imphash
Hash (md5) calculated from the import table
++
compilation-timestamp
datetime
Compilation timestamp defined in the PE header
++
entrypoint-section-at-position
text
company-name
entrypoint-address
text
CompanyName in the resources
+Address of the entry point
@@ -6045,26 +6104,6 @@ pe is a MISP object available in JSON format at
product-name
text
ProductName in the resources
--
internal-filename
filename
InternalFilename in the resources
--
lang-id
text
type
product-name
text
Type of PE ['exe', 'dll', 'driver', 'unknown']
+ProductName in the resources
++
product-version
text
ProductVersion in the resources
++
company-name
text
CompanyName in the resources
++
legal-copyright
text
LegalCopyright in the resources
@@ -6123,6 +6192,46 @@ pe-section is a MISP object available in JSON format at
md5
md5
[Insecure] MD5 hash (128 bits)
++
sha1
sha1
[Insecure] Secure Hash Algorithm 1 (160 bits)
++
sha224
sha224
Secure Hash Algorithm 2 (224 bits)
++
sha256
sha256
Secure Hash Algorithm 2 (256 bits)
++
sha384
sha384
sha512
sha512
Secure Hash Algorithm 2 (512 bits)
++
sha512/224
sha512/224
Secure Hash Algorithm 2 (224 bits)
++
sha512/256
sha512/256
sha512/224
sha512/224
ssdeep
ssdeep
Secure Hash Algorithm 2 (224 bits)
+Fuzzy hash using context triggered piecewise hashes (CTPH)
sha224
sha224
entropy
float
Secure Hash Algorithm 2 (224 bits)
+Entropy of the whole section
+
md5
-md5
[Insecure] MD5 hash (128 bits)
--
text
text
entropy
float
Entropy of the whole section
--
sha512
sha512
Secure Hash Algorithm 2 (512 bits)
--
sha1
sha1
[Insecure] Secure Hash Algorithm 1 (160 bits)
--
sha256
sha256
Secure Hash Algorithm 2 (256 bits)
--
ssdeep
ssdeep
Fuzzy hash using context triggered piecewise hashes (CTPH)
--
first-name
-first-name
First name of a natural person.
--
identity-card-number
identity-card-number
The identity card number of a natural person.
--
passport-country
passport-country
The country in which the passport was issued.
--
alias
text
text
Alias name or known as.
--
middle-name
middle-name
Middle name of a natural person.
--
passport-number
passport-number
The passport number of a natural person.
--
social-security-number
text
Social security number
--
mothers-name
text
Mother name, father, second name or other names following country’s regulation.
--
nationality
nationality
The nationality of a natural person.
+A description of the person or identity.
@@ -6401,10 +6390,110 @@ person is a MISP object available in JSON format at
text
middle-name
middle-name
Middle name of a natural person.
++
first-name
first-name
First name of a natural person.
++
mothers-name
text
A description of the person or identity.
+Mother name, father, second name or other names following country’s regulation.
++
title
text
Title of the natural person such as Dr. or equivalent.
++
alias
text
Alias name or known as.
++
date-of-birth
date-of-birth
Date of birth of a natural person (in YYYY-MM-DD format).
++
place-of-birth
place-of-birth
Place of birth of a natural person.
++
gender
gender
The gender of a natural person. ['Male', 'Female', 'Other', 'Prefer not to say']
++
identity-card-number
identity-card-number
The identity card number of a natural person.
++
passport-number
passport-number
The passport number of a natural person.
++
passport-country
passport-country
The country in which the passport was issued.
@@ -6431,45 +6520,25 @@ person is a MISP object available in JSON format at
title
social-security-number
text
Title of the natural person such as Dr. or equivalent.
--
gender
gender
The gender of a natural person. ['Male', 'Female', 'Other', 'Prefer not to say']
--
place-of-birth
place-of-birth
Place of birth of a natural person.
--
date-of-birth
date-of-birth
Date of birth of a natural person (in YYYY-MM-DD format).
+Social security number
nationality
nationality
The nationality of a natural person.
++
text
+imei
text
A description of the phone.
+International Mobile Equipment Identity (IMEI) is a number, usually unique, to identify 3GPP and iDEN mobile phones, as well as some satellite phones.
-
last-seen
datetime
When the phone has been accessible or seen for the last time.
-+
gummei
+tmsi
text
Globally Unique MME Identifier (GUMMEI) is composed from MCC, MNC and MME Identifier (MMEI).
+Temporary Mobile Subscriber Identities (TMSI) to visiting mobile subscribers can be allocated.
imei
gummei
text
International Mobile Equipment Identity (IMEI) is a number, usually unique, to identify 3GPP and iDEN mobile phones, as well as some satellite phones.
+Globally Unique MME Identifier (GUMMEI) is composed from MCC, MNC and MME Identifier (MMEI).
@@ -6589,13 +6648,23 @@ phone is a MISP object available in JSON format at
tmsi
text
text
Temporary Mobile Subscriber Identities (TMSI) to visiting mobile subscribers can be allocated.
+A description of the phone.
+
+
last-seen
datetime
When the phone has been accessible or seen for the last time.
+
port
-src-port
Port(s) owned by the process.
--
name
text
Name of the process
--
creation-time
datetime
parent-pid
name
text
Process ID of the parent process.
+Name of the process
@@ -6707,6 +6756,16 @@ process is a MISP object available in JSON format at
parent-pid
text
Process ID of the parent process.
++
child-pid
text
port
src-port
Port(s) owned by the process.
++
r2-commit-version
-text
Radare2 commit ID used to generate this object
--
ratio-functions
float
Ratio: amount of functions per kilobyte of code section
--
gml
attachment
Graph export in G>raph Modelling Language format
--
callback-largest
callback-average
counter
Largest callback
--
ratio-api
float
Ratio: amount of API calls per kilobyte of code section
--
referenced-strings
counter
Amount of referenced strings
+Average size of a callback
@@ -6825,16 +6844,6 @@ r2graphity is a MISP object available in JSON format at
dangling-strings
counter
Amount of dangling strings (string with a code cross reference, that is not within a function. Radare2 failed to detect that function.)
--
shortest-path-to-create-thread
counter
total-api
create-thread
counter
Total amount of API calls
--
miss-api
counter
Amount of API call reference that does not resolve to a function offset
--
refsglobalvar
counter
Amount of API calls outside of code section (glob var, dynamic API)
+Amount of calls to CreateThread
@@ -6885,10 +6874,120 @@ r2graphity is a MISP object available in JSON format at
create-thread
get-proc-address
counter
Amount of calls to CreateThread
+Amount of calls to GetProcAddress
++
dangling-strings
counter
Amount of dangling strings (string with a code cross reference, that is not within a function. Radare2 failed to detect that function.)
++
referenced-strings
counter
Amount of referenced strings
++
callback-largest
counter
Largest callback
++
gml
attachment
Graph export in G>raph Modelling Language format
++
r2-commit-version
text
Radare2 commit ID used to generate this object
++
text
text
Description of the r2graphity object
++
miss-api
counter
Amount of API call reference that does not resolve to a function offset
++
total-api
counter
Total amount of API calls
++
unknown-references
counter
Amount of API calls not ending in a function (Radare2 bug, probalby)
++
refsglobalvar
counter
Amount of API calls outside of code section (glob var, dynamic API)
++
local-references
counter
Amount of API calls inside a code section
@@ -6915,50 +7014,20 @@ r2graphity is a MISP object available in JSON format at
text
text
ratio-functions
float
Description of the r2graphity object
+Ratio: amount of functions per kilobyte of code section
callback-average
counter
ratio-api
float
Average size of a callback
--
unknown-references
counter
Amount of API calls not ending in a function (Radare2 bug, probalby)
--
get-proc-address
counter
Amount of calls to GetProcAddress
--
local-references
counter
Amount of API calls inside a code section
+Ratio: amount of API calls per kilobyte of code section
@@ -7013,20 +7082,10 @@ regexp is a MISP object available in JSON format at
type
text
comment
comment
Specify which type corresponds to this regex. ['hostname', 'domain', 'email-src', 'email-dst', 'email-subject', 'url', 'user-agent', 'regkey', 'cookie', 'uri', 'filename', 'windows-service-name', 'windows-scheduled-task']
--
regexp
text
regexp
+A description of the regular expression.
@@ -7043,15 +7102,25 @@ regexp is a MISP object available in JSON format at
comment
comment
regexp
text
A description of the regular expression.
+regexp
type
text
Specify which type corresponds to this regex. ['hostname', 'domain', 'email-src', 'email-dst', 'email-subject', 'url', 'user-agent', 'regkey', 'cookie', 'uri', 'filename', 'windows-service-name', 'windows-scheduled-task']
++
hive
-text
last-modified
datetime
Hive used to store the registry key (file on disk)
+Last time the registry key has been modified
+
key
-regkey
Full key path
--
data
text
key
regkey
Full key path
++
hive
text
Hive used to store the registry key (file on disk)
++
root-keys
text
last-modified
datetime
Last time the registry key has been modified
--
subject
-text
Subject of the RTIR ticket
--
queue
text
Queue of the RTIR ticket ['incident', 'investigations', 'blocks', 'incident reports']
--
classification
text
ip
ip-dst
IPs automatically extracted from the RTIR ticket
++
constituency
text
status
queue
text
Status of the RTIR ticket ['new', 'open', 'stalled', 'resolved', 'rejected', 'deleted']
+Queue of the RTIR ticket ['incident', 'investigations', 'blocks', 'incident reports']
ip
ip-dst
subject
text
IPs automatically extracted from the RTIR ticket
+Subject of the RTIR ticket
++
status
text
Status of the RTIR ticket ['new', 'open', 'stalled', 'resolved', 'rejected', 'deleted']
@@ -7375,36 +7444,6 @@ sandbox-report is a MISP object available in JSON format at
results
text
Freetext result values
--
saas-sandbox
text
A non-on-premise sandbox, also results are not publicly available ['forticloud-sandbox', 'joe-sandbox-cloud', 'symantec-cas-cloud']
--
on-premise-sandbox
text
The on-premise sandbox used ['cuckoo', 'symantec-cas-on-premise', 'bluecoat-maa', 'trendmicro-deep-discovery-analyzer', 'fireeye-ax', 'vmray', 'joe-sandbox-on-premise']
--
score
text
results
text
Freetext result values
++
raw-report
text
on-premise-sandbox
text
The on-premise sandbox used ['cuckoo', 'symantec-cas-on-premise', 'bluecoat-maa', 'trendmicro-deep-discovery-analyzer', 'fireeye-ax', 'vmray', 'joe-sandbox-on-premise']
++
web-sandbox
text
saas-sandbox
text
A non-on-premise sandbox, also results are not publicly available ['forticloud-sandbox', 'joe-sandbox-cloud', 'symantec-cas-cloud']
++
text
+software
text
Additional signature description
+Name of Sandbox software
@@ -7503,10 +7572,10 @@ sb-signature is a MISP object available in JSON format at
software
text
text
Name of Sandbox software
+Additional signature description
@@ -7561,36 +7630,6 @@ script is a MISP object available in JSON format at
language
text
Scripting language used for the script. ['PowerShell', 'VBScript', 'Bash', 'Lua', 'JavaScript', 'AppleScript', 'AWK', 'Python', 'Perl', 'Ruby', 'Winbatch', 'AutoIt']
--
state
text
Known state of the script. ['Malicious', 'Unknown', 'Harmless', 'Trusted']
--
filename
filename
Filename used for the script.
--
script
text
language
text
Scripting language used for the script. ['PowerShell', 'VBScript', 'Bash', 'Lua', 'JavaScript', 'AppleScript', 'AWK', 'Python', 'Perl', 'Ruby', 'Winbatch', 'AutoIt']
++
filename
filename
Filename used for the script.
++
state
text
Known state of the script. ['Malicious', 'Unknown', 'Harmless', 'Trusted']
++
text
-text
first-seen
datetime
Description and context of the shortened URL
+First time this shortened URL has been seen
++
redirect-url
url
Redirected to URL
@@ -7669,26 +7748,6 @@ shortened-link is a MISP object available in JSON format at
credential
text
Credential (username, password)
--
redirect-url
url
Redirected to URL
--
domain
domain
first-seen
datetime
credential
text
First time this shortened URL has been seen
+Credential (username, password)
+
+
text
text
Description and context of the shortened URL
+
MapApplicationContext
+Category
text
MAP application context in OID format.
+Category ['Cat0', 'Cat1', 'Cat2.1', 'Cat2.2', 'Cat3.1', 'Cat3.2', 'Cat3.3', 'CatSMS', 'CatSpoofing']
MapSmsTP-DCS
text
MAP SMS TP-DCS.
--
SccpCdSSN
text
Signaling Connection Control Part (SCCP) - Decimal value between 0-255.
--
SccpCdGT
text
Signaling Connection Control Part (SCCP) CdGT - Phone number.
--
MapGsmscfGT
text
MAP GSMSCF GT. Phone number.
--
MapUssdContent
text
MAP USSD Content.
--
MapGmlc
text
MAP GMLC. Phone number.
--
MapVersion
text
first-seen
datetime
When the attack has been seen for the first time.
--
MapMsisdn
SccpCgGT
text
MAP MSISDN. Phone number.
+Signaling Connection Control Part (SCCP) CgGT - Phone number.
MapSmsTypeNumber
SccpCdGT
text
MAP SMS TypeNumber.
--
MapImsi
text
MAP IMSI. Phone number starting with MCC/MNC.
+Signaling Connection Control Part (SCCP) CdGT - Phone number.
Category
SccpCgPC
text
Category ['Cat0', 'Cat1', 'Cat2.1', 'Cat2.2', 'Cat3.1', 'Cat3.2', 'Cat3.3', 'CatSMS', 'CatSpoofing']
--
MapUssdCoding
text
MAP USSD Content.
--
MapSmsTP-PID
text
MAP SMS TP-PID.
--
MapOpCode
text
MAP operation codes - Decimal value between 0-99.
--
MapMscGT
text
MAP MSC GT. Phone number.
+Signaling Connection Control Part (SCCP) CgPC - Phone number.
@@ -7927,30 +7876,80 @@ ss7-attack is a MISP object available in JSON format at
SccpCgGT
SccpCgSSN
text
Signaling Connection Control Part (SCCP) CgGT - Phone number.
--
text
text
A description of the attack seen via SS7 logging.
+Signaling Connection Control Part (SCCP) - Decimal value between 0-255.
SccpCgPC
SccpCdSSN
text
Signaling Connection Control Part (SCCP) CgPC - Phone number.
+Signaling Connection Control Part (SCCP) - Decimal value between 0-255.
++
MapOpCode
text
MAP operation codes - Decimal value between 0-99.
++
MapApplicationContext
text
MAP application context in OID format.
++
MapImsi
text
MAP IMSI. Phone number starting with MCC/MNC.
++
MapMsisdn
text
MAP MSISDN. Phone number.
++
MapMscGT
text
MAP MSC GT. Phone number.
++
MapGsmscfGT
text
MAP GSMSCF GT. Phone number.
@@ -7967,30 +7966,10 @@ ss7-attack is a MISP object available in JSON format at
MapSmsText
MapGmlc
text
MAP SMS Text. Important indicators in SMS text.
--
SccpCgSSN
text
Signaling Connection Control Part (SCCP) - Decimal value between 0-255.
--
MapSmsTP-OA
text
MAP SMS TP-OA. Phone number.
+MAP GMLC. Phone number.
MapSmsTP-OA
text
MAP SMS TP-OA. Phone number.
++
MapSmsText
text
MAP SMS Text. Important indicators in SMS text.
++
MapSmsTP-PID
text
MAP SMS TP-PID.
++
MapSmsTP-DCS
text
MAP SMS TP-DCS.
++
MapSmsTypeNumber
text
MAP SMS TypeNumber.
++
MapUssdContent
text
MAP USSD Content.
++
MapUssdCoding
text
MAP USSD Content.
++
text
text
A description of the attack seen via SS7 logging.
++
first-seen
datetime
When the attack has been seen for the first time.
++
comment
+comment
A description of the stix2-pattern.
++
stix2-pattern
stix2-pattern
comment
comment
A description of the stix2-pattern.
--
ref
-link
comment
comment
Reference to the Suricata rule such as origin of the rule or alike.
--
version
text
Version of the Suricata rule depending where the suricata rule is known to work as expected.
+A description of the Suricata rule.
@@ -8143,10 +8202,20 @@ suricata is a MISP object available in JSON format at
comment
comment
version
text
A description of the Suricata rule.
+Version of the Suricata rule depending where the suricata rule is known to work as expected.
++
ref
link
Reference to the Suricata rule such as origin of the rule or alike.
@@ -8259,20 +8328,10 @@ timecode is a MISP object available in JSON format at
end-marker-timecode
description
text
End marker timecode in the format hh:mm:ss;ff
--
end-timecode
text
End marker timecode in the format hh:mm:ss.mms
+Description of the video sequence
@@ -8289,20 +8348,10 @@ timecode is a MISP object available in JSON format at
description
end-marker-timecode
text
Description of the video sequence
--
recording-date
datetime
Date of recording of the video sequence
+End marker timecode in the format hh:mm:ss;ff
end-timecode
text
End marker timecode in the format hh:mm:ss.mms
++
recording-date
datetime
Date of recording of the video sequence
++
datetime
-datetime
timestamp
timestamp-microsec
When the log entry was seen
+When the log entry was seen in microseconds since Unix epoch
@@ -8387,10 +8456,10 @@ timesketch-timeline is a MISP object available in JSON format at
timestamp
timestamp-microsec
datetime
datetime
When the log entry was seen in microseconds since Unix epoch
+When the log entry was seen
@@ -8445,16 +8514,6 @@ timestamp is a MISP object available in JSON format at
last-seen
datetime
First time that the linked object or attribute has been seen.
--
precision
text
last-seen
datetime
First time that the linked object or attribute has been seen.
++
address
-ip-src
IP address of the Tor node seen.
--
published
datetime
router’s publication time. This can be different from first-seen and last-seen.
--
document
text
Raw document from the consensus.
--
description
text
last-seen
datetime
nickname
text
When the Tor node designed by the IP address has been seen for the last time.
+router’s nickname.
+
flags
-text
address
ip-src
list of flag associated with the node.
+IP address of the Tor node seen.
version_line
flags
text
versioning information reported by the node.
+list of flag associated with the node.
@@ -8613,16 +8652,36 @@ tor-node is a MISP object available in JSON format at
nickname
version_line
text
router’s nickname.
+versioning information reported by the node.
published
datetime
router’s publication time. This can be different from first-seen and last-seen.
++
last-seen
datetime
When the Tor node designed by the IP address has been seen for the last time.
++
first-seen
datetime
document
text
Raw document from the consensus.
++
teller
-text
Person who conducted the transaction.
--
to-funds-code
text
Type of funds used to finalize a transaction. ['A Deposit', 'C Currency exchange', 'D Casino chips', 'E Bank draft', 'F Money order', 'G Traveler’s cheques', 'H Life insurance policy', 'I Real estate', 'J Securities', 'K Cash', 'O Other', 'P Cheque']
--
amount
text
The value of the transaction in local currency.
--
transmode-code
text
How the transaction was conducted.
--
from-country
text
Origin country of a transaction.
--
date-posting
datetime
Date of posting, if different from date of transaction.
--
transmode-comment
text
Comment describing transmode-code, if needed.
--
date
datetime
Date and time of the transaction.
--
text
text
to-country
text
Target country of a transaction.
--
from-funds-code
text
Type of funds used to initiate a transaction. ['A Deposit', 'C Currency exchange', 'D Casino chips', 'E Bank draft', 'F Money order', 'G Traveler’s cheques', 'H Life insurance policy', 'I Real estate', 'J Securities', 'K Cash', 'O Other', 'P Cheque']
--
transaction-number
text
transmode-code
text
How the transaction was conducted.
++
transmode-comment
text
Comment describing transmode-code, if needed.
++
teller
text
Person who conducted the transaction.
++
authorized
text
date
datetime
Date and time of the transaction.
++
amount
text
The value of the transaction in local currency.
++
date-posting
datetime
Date of posting, if different from date of transaction.
++
from-funds-code
text
Type of funds used to initiate a transaction. ['A Deposit', 'C Currency exchange', 'D Casino chips', 'E Bank draft', 'F Money order', 'G Traveler’s cheques', 'H Life insurance policy', 'I Real estate', 'J Securities', 'K Cash', 'O Other', 'P Cheque']
++
to-funds-code
text
Type of funds used to finalize a transaction. ['A Deposit', 'C Currency exchange', 'D Casino chips', 'E Bank draft', 'F Money order', 'G Traveler’s cheques', 'H Life insurance policy', 'I Real estate', 'J Securities', 'K Cash', 'O Other', 'P Cheque']
++
from-country
text
Origin country of a transaction.
++
to-country
text
Target country of a transaction.
++
port
-port
Port number
--
url
url
Full URL
--
last-seen
datetime
Last time this URL has been seen
--
fragment
text
query_string
text
Query (after path, preceded by '?')
--
scheme
text
Scheme ['http', 'https', 'ftp', 'gopher', 'sip']
--
host
hostname
Full hostname
--
text
text
Description of the URL
--
tld
text
credential
port
port
Port number
++
scheme
text
Credential (username, password)
+Scheme ['http', 'https', 'ftp', 'gopher', 'sip']
++
first-seen
datetime
First time this URL has been seen
++
resource_path
text
Path (between hostname:port and query)
++
query_string
text
Query (after path, preceded by '?')
++
url
url
Full URL
@@ -8959,13 +9008,13 @@ url is a MISP object available in JSON format at
first-seen
datetime
domain
domain
First time this URL has been seen
+Full domain
+
domain
-domain
credential
text
Full domain
+Credential (username, password)
resource_path
text
text
Path (between hostname:port and query)
+Description of the URL
++
last-seen
datetime
Last time this URL has been seen
++
host
hostname
Full hostname
@@ -9037,10 +9106,10 @@ victim is a MISP object available in JSON format at
roles
description
text
The list of roles targeted within the victim.
+Description of the victim
@@ -9057,6 +9126,76 @@ victim is a MISP object available in JSON format at
external
target-external
External target organisations affected by this attack.
++
classification
text
The type of entity being targeted. ['individual', 'group', 'organization', 'class', 'unknown']
++
roles
text
The list of roles targeted within the victim.
++
sectors
text
The list of sectors that the victim belong to ['agriculture', 'aerospace', 'automotive', 'communications', 'construction', 'defence', 'education', 'energy', 'engineering', 'entertainment', 'financial services', 'government national', 'government regional', 'government local', 'government public services', 'healthcare', 'hospitality leisure', 'infrastructure', 'insurance', 'manufacturing', 'mining', 'non profit', 'pharmaceuticals', 'retail', 'technology', 'telecommunications', 'transportation', 'utilities']
++
regions
target-location
The list of regions or locations from the victim targeted. ISO 3166 should be used.
++
user
target-user
The username(s) of the user targeted.
++
target-email
The email address(es) of the user targeted.
++
node
target-machine
classification
text
The type of entity being targeted. ['individual', 'group', 'organization', 'class', 'unknown']
--
regions
target-location
The list of regions or locations from the victim targeted. ISO 3166 should be used.
--
sectors
text
The list of sectors that the victim belong to ['agriculture', 'aerospace', 'automotive', 'communications', 'construction', 'defence', 'education', 'energy', 'engineering', 'entertainment', 'financial services', 'government national', 'government regional', 'government local', 'government public services', 'healthcare', 'hospitality leisure', 'infrastructure', 'insurance', 'manufacturing', 'mining', 'non profit', 'pharmaceuticals', 'retail', 'technology', 'telecommunications', 'transportation', 'utilities']
--
target-email
The email address(es) of the user targeted.
--
description
text
Description of the victim
--
external
target-external
External target organisations affected by this attack.
--
user
target-user
The username(s) of the user targeted.
--
permalink
-link
Permalink Reference
--
community-score
text
first-submission
datetime
First Submission
++
last-submission
datetime
first-submission
datetime
permalink
link
First Submission
+Permalink Reference
@@ -9283,6 +9352,16 @@ vulnerability is a MISP object available in JSON format at
id
vulnerability
Vulnerability ID (generally CVE, but not necessarely). The id is not required as the object itself has an UUID and the CVE id can updated later.
++
text
text
summary
text
Summary of the vulnerability
++
vulnerable_configuration
text
The vulnerable configuration is described in CPE format
++
modified
datetime
id
vulnerability
created
datetime
Vulnerability ID (generally CVE, but not necessarely). The id is not required as the object itself has an UUID and the CVE id can updated later.
+First time when the vulnerability was discovered
+
summary
-text
Summary of the vulnerability
--
state
text
vulnerable_configuration
text
The vulnerable configuration is described in CPE format
--
created
datetime
First time when the vulnerability was discovered
--
registrant-email
-whois-registrant-email
text
text
Registrant email address
+Full whois entry
+
ip-address
ip-src
registrar
whois-registrar
IP address of the whois entry
+Registrar of the whois entry
@@ -9451,6 +9520,16 @@ whois is a MISP object available in JSON format at
registrant-email
whois-registrant-email
Registrant email address
++
registrant-org
whois-registrant-org
expiration-date
creation-date
datetime
Expiration of the whois entry
--
comment
text
Comment of the whois entry
--
text
text
Full whois entry
--
nameserver
hostname
Nameserver
+Initial creation of the whois entry
@@ -9511,23 +9560,23 @@ whois is a MISP object available in JSON format at
creation-date
expiration-date
datetime
Initial creation of the whois entry
+Expiration of the whois entry
registrar
whois-registrar
nameserver
hostname
Registrar of the whois entry
+Nameserver
+
comment
text
Comment of the whois entry
++
ip-address
ip-src
IP address of the whois entry
++
pubkey-info-exponent
-text
Exponent of the public key
--
subject
text
validity-not-before
datetime
pubkey-info-algorithm
text
Certificate invalid before that date
+Algorithm of the public key
@@ -9619,10 +9678,20 @@ x509 is a MISP object available in JSON format at
dns_names
pubkey-info-exponent
text
DNS names
+Exponent of the public key
++
pubkey-info-modulus
text
Modulus of the public key
@@ -9649,86 +9718,6 @@ x509 is a MISP object available in JSON format at
text
text
Free text description of hte certificate
--
issuer
text
Issuer of the certificate
--
pem
text
Raw certificate in PEM formati (Unix-like newlines)
--
serial-number
text
Serial number of the certificate
--
validity-not-after
datetime
Certificate invalid after that date
--
version
text
Version of the certificate
--
is_ca
boolean
CA certificate
--
self_signed
boolean
Self-signed certificate
--
x509-fingerprint-sha256
x509-fingerprint-sha256
pubkey-info-algorithm
pem
text
Algorithm of the public key
+Raw certificate in PEM formati (Unix-like newlines)
pubkey-info-modulus
text
text
Modulus of the public key
+Free text description of hte certificate
++
validity-not-before
datetime
Certificate invalid before that date
++
validity-not-after
datetime
Certificate invalid after that date
++
issuer
text
Issuer of the certificate
++
serial-number
text
Serial number of the certificate
++
version
text
Version of the certificate
++
self_signed
boolean
Self-signed certificate
++
is_ca
boolean
CA certificate
++
dns_names
text
DNS names
@@ -9807,6 +9876,26 @@ yabin is a MISP object available in JSON format at
version
comment
yabin.py and regex.txt version used for the generation of the yara rules.
++
comment
comment
A description of Yara rule generated.
++
whitelist
comment
version
comment
yabin.py and regex.txt version used for the generation of the yara rules.
--
comment
comment
A description of Yara rule generated.
--
comment
+comment
A description of the YARA rule.
++
yara
yara
comment
comment
A description of the YARA rule.
--