mirror of https://github.com/MISP/misp-website
67095 lines
3.2 MiB
Executable File
67095 lines
3.2 MiB
Executable File
<!DOCTYPE html>
|
||
<html lang="en">
|
||
<head>
|
||
<meta charset="UTF-8">
|
||
<meta http-equiv="X-UA-Compatible" content="IE=edge">
|
||
<meta name="viewport" content="width=device-width, initial-scale=1.0">
|
||
<meta name="generator" content="Asciidoctor 2.0.16">
|
||
<title>MISP Objects</title>
|
||
<link rel="stylesheet" href="https://fonts.googleapis.com/css?family=Open+Sans:300,300italic,400,400italic,600,600italic%7CNoto+Serif:400,400italic,700,700italic%7CDroid+Sans+Mono:400,700">
|
||
<style>
|
||
/*! Asciidoctor default stylesheet | MIT License | https://asciidoctor.org */
|
||
/* Uncomment the following line when using as a custom stylesheet */
|
||
/* @import "https://fonts.googleapis.com/css?family=Open+Sans:300,300italic,400,400italic,600,600italic%7CNoto+Serif:400,400italic,700,700italic%7CDroid+Sans+Mono:400,700"; */
|
||
html{font-family:sans-serif;-webkit-text-size-adjust:100%}
|
||
a{background:none}
|
||
a:focus{outline:thin dotted}
|
||
a:active,a:hover{outline:0}
|
||
h1{font-size:2em;margin:.67em 0}
|
||
b,strong{font-weight:bold}
|
||
abbr{font-size:.9em}
|
||
abbr[title]{cursor:help;border-bottom:1px dotted #dddddf;text-decoration:none}
|
||
dfn{font-style:italic}
|
||
hr{height:0}
|
||
mark{background:#ff0;color:#000}
|
||
code,kbd,pre,samp{font-family:monospace;font-size:1em}
|
||
pre{white-space:pre-wrap}
|
||
q{quotes:"\201C" "\201D" "\2018" "\2019"}
|
||
small{font-size:80%}
|
||
sub,sup{font-size:75%;line-height:0;position:relative;vertical-align:baseline}
|
||
sup{top:-.5em}
|
||
sub{bottom:-.25em}
|
||
img{border:0}
|
||
svg:not(:root){overflow:hidden}
|
||
figure{margin:0}
|
||
audio,video{display:inline-block}
|
||
audio:not([controls]){display:none;height:0}
|
||
fieldset{border:1px solid silver;margin:0 2px;padding:.35em .625em .75em}
|
||
legend{border:0;padding:0}
|
||
button,input,select,textarea{font-family:inherit;font-size:100%;margin:0}
|
||
button,input{line-height:normal}
|
||
button,select{text-transform:none}
|
||
button,html input[type=button],input[type=reset],input[type=submit]{-webkit-appearance:button;cursor:pointer}
|
||
button[disabled],html input[disabled]{cursor:default}
|
||
input[type=checkbox],input[type=radio]{padding:0}
|
||
button::-moz-focus-inner,input::-moz-focus-inner{border:0;padding:0}
|
||
textarea{overflow:auto;vertical-align:top}
|
||
table{border-collapse:collapse;border-spacing:0}
|
||
*,::before,::after{box-sizing:border-box}
|
||
html,body{font-size:100%}
|
||
body{background:#fff;color:rgba(0,0,0,.8);padding:0;margin:0;font-family:"Noto Serif","DejaVu Serif",serif;line-height:1;position:relative;cursor:auto;-moz-tab-size:4;-o-tab-size:4;tab-size:4;word-wrap:anywhere;-moz-osx-font-smoothing:grayscale;-webkit-font-smoothing:antialiased}
|
||
a:hover{cursor:pointer}
|
||
img,object,embed{max-width:100%;height:auto}
|
||
object,embed{height:100%}
|
||
img{-ms-interpolation-mode:bicubic}
|
||
.left{float:left!important}
|
||
.right{float:right!important}
|
||
.text-left{text-align:left!important}
|
||
.text-right{text-align:right!important}
|
||
.text-center{text-align:center!important}
|
||
.text-justify{text-align:justify!important}
|
||
.hide{display:none}
|
||
img,object,svg{display:inline-block;vertical-align:middle}
|
||
textarea{height:auto;min-height:50px}
|
||
select{width:100%}
|
||
.subheader,.admonitionblock td.content>.title,.audioblock>.title,.exampleblock>.title,.imageblock>.title,.listingblock>.title,.literalblock>.title,.stemblock>.title,.openblock>.title,.paragraph>.title,.quoteblock>.title,table.tableblock>.title,.verseblock>.title,.videoblock>.title,.dlist>.title,.olist>.title,.ulist>.title,.qlist>.title,.hdlist>.title{line-height:1.45;color:#7a2518;font-weight:400;margin-top:0;margin-bottom:.25em}
|
||
div,dl,dt,dd,ul,ol,li,h1,h2,h3,#toctitle,.sidebarblock>.content>.title,h4,h5,h6,pre,form,p,blockquote,th,td{margin:0;padding:0}
|
||
a{color:#2156a5;text-decoration:underline;line-height:inherit}
|
||
a:hover,a:focus{color:#1d4b8f}
|
||
a img{border:0}
|
||
p{line-height:1.6;margin-bottom:1.25em;text-rendering:optimizeLegibility}
|
||
p aside{font-size:.875em;line-height:1.35;font-style:italic}
|
||
h1,h2,h3,#toctitle,.sidebarblock>.content>.title,h4,h5,h6{font-family:"Open Sans","DejaVu Sans",sans-serif;font-weight:300;font-style:normal;color:#ba3925;text-rendering:optimizeLegibility;margin-top:1em;margin-bottom:.5em;line-height:1.0125em}
|
||
h1 small,h2 small,h3 small,#toctitle small,.sidebarblock>.content>.title small,h4 small,h5 small,h6 small{font-size:60%;color:#e99b8f;line-height:0}
|
||
h1{font-size:2.125em}
|
||
h2{font-size:1.6875em}
|
||
h3,#toctitle,.sidebarblock>.content>.title{font-size:1.375em}
|
||
h4,h5{font-size:1.125em}
|
||
h6{font-size:1em}
|
||
hr{border:solid #dddddf;border-width:1px 0 0;clear:both;margin:1.25em 0 1.1875em}
|
||
em,i{font-style:italic;line-height:inherit}
|
||
strong,b{font-weight:bold;line-height:inherit}
|
||
small{font-size:60%;line-height:inherit}
|
||
code{font-family:"Droid Sans Mono","DejaVu Sans Mono",monospace;font-weight:400;color:rgba(0,0,0,.9)}
|
||
ul,ol,dl{line-height:1.6;margin-bottom:1.25em;list-style-position:outside;font-family:inherit}
|
||
ul,ol{margin-left:1.5em}
|
||
ul li ul,ul li ol{margin-left:1.25em;margin-bottom:0}
|
||
ul.square li ul,ul.circle li ul,ul.disc li ul{list-style:inherit}
|
||
ul.square{list-style-type:square}
|
||
ul.circle{list-style-type:circle}
|
||
ul.disc{list-style-type:disc}
|
||
ol li ul,ol li ol{margin-left:1.25em;margin-bottom:0}
|
||
dl dt{margin-bottom:.3125em;font-weight:bold}
|
||
dl dd{margin-bottom:1.25em}
|
||
blockquote{margin:0 0 1.25em;padding:.5625em 1.25em 0 1.1875em;border-left:1px solid #ddd}
|
||
blockquote,blockquote p{line-height:1.6;color:rgba(0,0,0,.85)}
|
||
@media screen and (min-width:768px){h1,h2,h3,#toctitle,.sidebarblock>.content>.title,h4,h5,h6{line-height:1.2}
|
||
h1{font-size:2.75em}
|
||
h2{font-size:2.3125em}
|
||
h3,#toctitle,.sidebarblock>.content>.title{font-size:1.6875em}
|
||
h4{font-size:1.4375em}}
|
||
table{background:#fff;margin-bottom:1.25em;border:1px solid #dedede;word-wrap:normal}
|
||
table thead,table tfoot{background:#f7f8f7}
|
||
table thead tr th,table thead tr td,table tfoot tr th,table tfoot tr td{padding:.5em .625em .625em;font-size:inherit;color:rgba(0,0,0,.8);text-align:left}
|
||
table tr th,table tr td{padding:.5625em .625em;font-size:inherit;color:rgba(0,0,0,.8)}
|
||
table tr.even,table tr.alt{background:#f8f8f7}
|
||
table thead tr th,table tfoot tr th,table tbody tr td,table tr td,table tfoot tr td{line-height:1.6}
|
||
h1,h2,h3,#toctitle,.sidebarblock>.content>.title,h4,h5,h6{line-height:1.2;word-spacing:-.05em}
|
||
h1 strong,h2 strong,h3 strong,#toctitle strong,.sidebarblock>.content>.title strong,h4 strong,h5 strong,h6 strong{font-weight:400}
|
||
.center{margin-left:auto;margin-right:auto}
|
||
.stretch{width:100%}
|
||
.clearfix::before,.clearfix::after,.float-group::before,.float-group::after{content:" ";display:table}
|
||
.clearfix::after,.float-group::after{clear:both}
|
||
:not(pre).nobreak{word-wrap:normal}
|
||
:not(pre).nowrap{white-space:nowrap}
|
||
:not(pre).pre-wrap{white-space:pre-wrap}
|
||
:not(pre):not([class^=L])>code{font-size:.9375em;font-style:normal!important;letter-spacing:0;padding:.1em .5ex;word-spacing:-.15em;background:#f7f7f8;border-radius:4px;line-height:1.45;text-rendering:optimizeSpeed}
|
||
pre{color:rgba(0,0,0,.9);font-family:"Droid Sans Mono","DejaVu Sans Mono",monospace;line-height:1.45;text-rendering:optimizeSpeed}
|
||
pre code,pre pre{color:inherit;font-size:inherit;line-height:inherit}
|
||
pre>code{display:block}
|
||
pre.nowrap,pre.nowrap pre{white-space:pre;word-wrap:normal}
|
||
em em{font-style:normal}
|
||
strong strong{font-weight:400}
|
||
.keyseq{color:rgba(51,51,51,.8)}
|
||
kbd{font-family:"Droid Sans Mono","DejaVu Sans Mono",monospace;display:inline-block;color:rgba(0,0,0,.8);font-size:.65em;line-height:1.45;background:#f7f7f7;border:1px solid #ccc;border-radius:3px;box-shadow:0 1px 0 rgba(0,0,0,.2),inset 0 0 0 .1em #fff;margin:0 .15em;padding:.2em .5em;vertical-align:middle;position:relative;top:-.1em;white-space:nowrap}
|
||
.keyseq kbd:first-child{margin-left:0}
|
||
.keyseq kbd:last-child{margin-right:0}
|
||
.menuseq,.menuref{color:#000}
|
||
.menuseq b:not(.caret),.menuref{font-weight:inherit}
|
||
.menuseq{word-spacing:-.02em}
|
||
.menuseq b.caret{font-size:1.25em;line-height:.8}
|
||
.menuseq i.caret{font-weight:bold;text-align:center;width:.45em}
|
||
b.button::before,b.button::after{position:relative;top:-1px;font-weight:400}
|
||
b.button::before{content:"[";padding:0 3px 0 2px}
|
||
b.button::after{content:"]";padding:0 2px 0 3px}
|
||
p a>code:hover{color:rgba(0,0,0,.9)}
|
||
#header,#content,#footnotes,#footer{width:100%;margin:0 auto;max-width:62.5em;*zoom:1;position:relative;padding-left:.9375em;padding-right:.9375em}
|
||
#header::before,#header::after,#content::before,#content::after,#footnotes::before,#footnotes::after,#footer::before,#footer::after{content:" ";display:table}
|
||
#header::after,#content::after,#footnotes::after,#footer::after{clear:both}
|
||
#content{margin-top:1.25em}
|
||
#content::before{content:none}
|
||
#header>h1:first-child{color:rgba(0,0,0,.85);margin-top:2.25rem;margin-bottom:0}
|
||
#header>h1:first-child+#toc{margin-top:8px;border-top:1px solid #dddddf}
|
||
#header>h1:only-child,body.toc2 #header>h1:nth-last-child(2){border-bottom:1px solid #dddddf;padding-bottom:8px}
|
||
#header .details{border-bottom:1px solid #dddddf;line-height:1.45;padding-top:.25em;padding-bottom:.25em;padding-left:.25em;color:rgba(0,0,0,.6);display:flex;flex-flow:row wrap}
|
||
#header .details span:first-child{margin-left:-.125em}
|
||
#header .details span.email a{color:rgba(0,0,0,.85)}
|
||
#header .details br{display:none}
|
||
#header .details br+span::before{content:"\00a0\2013\00a0"}
|
||
#header .details br+span.author::before{content:"\00a0\22c5\00a0";color:rgba(0,0,0,.85)}
|
||
#header .details br+span#revremark::before{content:"\00a0|\00a0"}
|
||
#header #revnumber{text-transform:capitalize}
|
||
#header #revnumber::after{content:"\00a0"}
|
||
#content>h1:first-child:not([class]){color:rgba(0,0,0,.85);border-bottom:1px solid #dddddf;padding-bottom:8px;margin-top:0;padding-top:1rem;margin-bottom:1.25rem}
|
||
#toc{border-bottom:1px solid #e7e7e9;padding-bottom:.5em}
|
||
#toc>ul{margin-left:.125em}
|
||
#toc ul.sectlevel0>li>a{font-style:italic}
|
||
#toc ul.sectlevel0 ul.sectlevel1{margin:.5em 0}
|
||
#toc ul{font-family:"Open Sans","DejaVu Sans",sans-serif;list-style-type:none}
|
||
#toc li{line-height:1.3334;margin-top:.3334em}
|
||
#toc a{text-decoration:none}
|
||
#toc a:active{text-decoration:underline}
|
||
#toctitle{color:#7a2518;font-size:1.2em}
|
||
@media screen and (min-width:768px){#toctitle{font-size:1.375em}
|
||
body.toc2{padding-left:15em;padding-right:0}
|
||
#toc.toc2{margin-top:0!important;background:#f8f8f7;position:fixed;width:15em;left:0;top:0;border-right:1px solid #e7e7e9;border-top-width:0!important;border-bottom-width:0!important;z-index:1000;padding:1.25em 1em;height:100%;overflow:auto}
|
||
#toc.toc2 #toctitle{margin-top:0;margin-bottom:.8rem;font-size:1.2em}
|
||
#toc.toc2>ul{font-size:.9em;margin-bottom:0}
|
||
#toc.toc2 ul ul{margin-left:0;padding-left:1em}
|
||
#toc.toc2 ul.sectlevel0 ul.sectlevel1{padding-left:0;margin-top:.5em;margin-bottom:.5em}
|
||
body.toc2.toc-right{padding-left:0;padding-right:15em}
|
||
body.toc2.toc-right #toc.toc2{border-right-width:0;border-left:1px solid #e7e7e9;left:auto;right:0}}
|
||
@media screen and (min-width:1280px){body.toc2{padding-left:20em;padding-right:0}
|
||
#toc.toc2{width:20em}
|
||
#toc.toc2 #toctitle{font-size:1.375em}
|
||
#toc.toc2>ul{font-size:.95em}
|
||
#toc.toc2 ul ul{padding-left:1.25em}
|
||
body.toc2.toc-right{padding-left:0;padding-right:20em}}
|
||
#content #toc{border:1px solid #e0e0dc;margin-bottom:1.25em;padding:1.25em;background:#f8f8f7;border-radius:4px}
|
||
#content #toc>:first-child{margin-top:0}
|
||
#content #toc>:last-child{margin-bottom:0}
|
||
#footer{max-width:none;background:rgba(0,0,0,.8);padding:1.25em}
|
||
#footer-text{color:hsla(0,0%,100%,.8);line-height:1.44}
|
||
#content{margin-bottom:.625em}
|
||
.sect1{padding-bottom:.625em}
|
||
@media screen and (min-width:768px){#content{margin-bottom:1.25em}
|
||
.sect1{padding-bottom:1.25em}}
|
||
.sect1:last-child{padding-bottom:0}
|
||
.sect1+.sect1{border-top:1px solid #e7e7e9}
|
||
#content h1>a.anchor,h2>a.anchor,h3>a.anchor,#toctitle>a.anchor,.sidebarblock>.content>.title>a.anchor,h4>a.anchor,h5>a.anchor,h6>a.anchor{position:absolute;z-index:1001;width:1.5ex;margin-left:-1.5ex;display:block;text-decoration:none!important;visibility:hidden;text-align:center;font-weight:400}
|
||
#content h1>a.anchor::before,h2>a.anchor::before,h3>a.anchor::before,#toctitle>a.anchor::before,.sidebarblock>.content>.title>a.anchor::before,h4>a.anchor::before,h5>a.anchor::before,h6>a.anchor::before{content:"\00A7";font-size:.85em;display:block;padding-top:.1em}
|
||
#content h1:hover>a.anchor,#content h1>a.anchor:hover,h2:hover>a.anchor,h2>a.anchor:hover,h3:hover>a.anchor,#toctitle:hover>a.anchor,.sidebarblock>.content>.title:hover>a.anchor,h3>a.anchor:hover,#toctitle>a.anchor:hover,.sidebarblock>.content>.title>a.anchor:hover,h4:hover>a.anchor,h4>a.anchor:hover,h5:hover>a.anchor,h5>a.anchor:hover,h6:hover>a.anchor,h6>a.anchor:hover{visibility:visible}
|
||
#content h1>a.link,h2>a.link,h3>a.link,#toctitle>a.link,.sidebarblock>.content>.title>a.link,h4>a.link,h5>a.link,h6>a.link{color:#ba3925;text-decoration:none}
|
||
#content h1>a.link:hover,h2>a.link:hover,h3>a.link:hover,#toctitle>a.link:hover,.sidebarblock>.content>.title>a.link:hover,h4>a.link:hover,h5>a.link:hover,h6>a.link:hover{color:#a53221}
|
||
details,.audioblock,.imageblock,.literalblock,.listingblock,.stemblock,.videoblock{margin-bottom:1.25em}
|
||
details{margin-left:1.25rem}
|
||
details>summary{cursor:pointer;display:block;position:relative;line-height:1.6;margin-bottom:.625rem;-webkit-tap-highlight-color:transparent}
|
||
details>summary::before{content:"";border:solid transparent;border-left:solid;border-width:.3em 0 .3em .5em;position:absolute;top:.5em;left:-1.25rem;transform:translateX(15%)}
|
||
details[open]>summary::before{border:solid transparent;border-top:solid;border-width:.5em .3em 0;transform:translateY(15%)}
|
||
details>summary::after{content:"";width:1.25rem;height:1em;position:absolute;top:.3em;left:-1.25rem}
|
||
.admonitionblock td.content>.title,.audioblock>.title,.exampleblock>.title,.imageblock>.title,.listingblock>.title,.literalblock>.title,.stemblock>.title,.openblock>.title,.paragraph>.title,.quoteblock>.title,table.tableblock>.title,.verseblock>.title,.videoblock>.title,.dlist>.title,.olist>.title,.ulist>.title,.qlist>.title,.hdlist>.title{text-rendering:optimizeLegibility;text-align:left;font-family:"Noto Serif","DejaVu Serif",serif;font-size:1rem;font-style:italic}
|
||
table.tableblock.fit-content>caption.title{white-space:nowrap;width:0}
|
||
.paragraph.lead>p,#preamble>.sectionbody>[class=paragraph]:first-of-type p{font-size:1.21875em;line-height:1.6;color:rgba(0,0,0,.85)}
|
||
.admonitionblock>table{border-collapse:separate;border:0;background:none;width:100%}
|
||
.admonitionblock>table td.icon{text-align:center;width:80px}
|
||
.admonitionblock>table td.icon img{max-width:none}
|
||
.admonitionblock>table td.icon .title{font-weight:bold;font-family:"Open Sans","DejaVu Sans",sans-serif;text-transform:uppercase}
|
||
.admonitionblock>table td.content{padding-left:1.125em;padding-right:1.25em;border-left:1px solid #dddddf;color:rgba(0,0,0,.6);word-wrap:anywhere}
|
||
.admonitionblock>table td.content>:last-child>:last-child{margin-bottom:0}
|
||
.exampleblock>.content{border:1px solid #e6e6e6;margin-bottom:1.25em;padding:1.25em;background:#fff;border-radius:4px}
|
||
.exampleblock>.content>:first-child{margin-top:0}
|
||
.exampleblock>.content>:last-child{margin-bottom:0}
|
||
.sidebarblock{border:1px solid #dbdbd6;margin-bottom:1.25em;padding:1.25em;background:#f3f3f2;border-radius:4px}
|
||
.sidebarblock>:first-child{margin-top:0}
|
||
.sidebarblock>:last-child{margin-bottom:0}
|
||
.sidebarblock>.content>.title{color:#7a2518;margin-top:0;text-align:center}
|
||
.exampleblock>.content>:last-child>:last-child,.exampleblock>.content .olist>ol>li:last-child>:last-child,.exampleblock>.content .ulist>ul>li:last-child>:last-child,.exampleblock>.content .qlist>ol>li:last-child>:last-child,.sidebarblock>.content>:last-child>:last-child,.sidebarblock>.content .olist>ol>li:last-child>:last-child,.sidebarblock>.content .ulist>ul>li:last-child>:last-child,.sidebarblock>.content .qlist>ol>li:last-child>:last-child{margin-bottom:0}
|
||
.literalblock pre,.listingblock>.content>pre{border-radius:4px;overflow-x:auto;padding:1em;font-size:.8125em}
|
||
@media screen and (min-width:768px){.literalblock pre,.listingblock>.content>pre{font-size:.90625em}}
|
||
@media screen and (min-width:1280px){.literalblock pre,.listingblock>.content>pre{font-size:1em}}
|
||
.literalblock pre,.listingblock>.content>pre:not(.highlight),.listingblock>.content>pre[class=highlight],.listingblock>.content>pre[class^="highlight "]{background:#f7f7f8}
|
||
.literalblock.output pre{color:#f7f7f8;background:rgba(0,0,0,.9)}
|
||
.listingblock>.content{position:relative}
|
||
.listingblock code[data-lang]::before{display:none;content:attr(data-lang);position:absolute;font-size:.75em;top:.425rem;right:.5rem;line-height:1;text-transform:uppercase;color:inherit;opacity:.5}
|
||
.listingblock:hover code[data-lang]::before{display:block}
|
||
.listingblock.terminal pre .command::before{content:attr(data-prompt);padding-right:.5em;color:inherit;opacity:.5}
|
||
.listingblock.terminal pre .command:not([data-prompt])::before{content:"$"}
|
||
.listingblock pre.highlightjs{padding:0}
|
||
.listingblock pre.highlightjs>code{padding:1em;border-radius:4px}
|
||
.listingblock pre.prettyprint{border-width:0}
|
||
.prettyprint{background:#f7f7f8}
|
||
pre.prettyprint .linenums{line-height:1.45;margin-left:2em}
|
||
pre.prettyprint li{background:none;list-style-type:inherit;padding-left:0}
|
||
pre.prettyprint li code[data-lang]::before{opacity:1}
|
||
pre.prettyprint li:not(:first-child) code[data-lang]::before{display:none}
|
||
table.linenotable{border-collapse:separate;border:0;margin-bottom:0;background:none}
|
||
table.linenotable td[class]{color:inherit;vertical-align:top;padding:0;line-height:inherit;white-space:normal}
|
||
table.linenotable td.code{padding-left:.75em}
|
||
table.linenotable td.linenos{border-right:1px solid;opacity:.35;padding-right:.5em}
|
||
pre.pygments .lineno{border-right:1px solid;opacity:.35;display:inline-block;margin-right:.75em}
|
||
pre.pygments .lineno::before{content:"";margin-right:-.125em}
|
||
.quoteblock{margin:0 1em 1.25em 1.5em;display:table}
|
||
.quoteblock:not(.excerpt)>.title{margin-left:-1.5em;margin-bottom:.75em}
|
||
.quoteblock blockquote,.quoteblock p{color:rgba(0,0,0,.85);font-size:1.15rem;line-height:1.75;word-spacing:.1em;letter-spacing:0;font-style:italic;text-align:justify}
|
||
.quoteblock blockquote{margin:0;padding:0;border:0}
|
||
.quoteblock blockquote::before{content:"\201c";float:left;font-size:2.75em;font-weight:bold;line-height:.6em;margin-left:-.6em;color:#7a2518;text-shadow:0 1px 2px rgba(0,0,0,.1)}
|
||
.quoteblock blockquote>.paragraph:last-child p{margin-bottom:0}
|
||
.quoteblock .attribution{margin-top:.75em;margin-right:.5ex;text-align:right}
|
||
.verseblock{margin:0 1em 1.25em}
|
||
.verseblock pre{font-family:"Open Sans","DejaVu Sans",sans-serif;font-size:1.15rem;color:rgba(0,0,0,.85);font-weight:300;text-rendering:optimizeLegibility}
|
||
.verseblock pre strong{font-weight:400}
|
||
.verseblock .attribution{margin-top:1.25rem;margin-left:.5ex}
|
||
.quoteblock .attribution,.verseblock .attribution{font-size:.9375em;line-height:1.45;font-style:italic}
|
||
.quoteblock .attribution br,.verseblock .attribution br{display:none}
|
||
.quoteblock .attribution cite,.verseblock .attribution cite{display:block;letter-spacing:-.025em;color:rgba(0,0,0,.6)}
|
||
.quoteblock.abstract blockquote::before,.quoteblock.excerpt blockquote::before,.quoteblock .quoteblock blockquote::before{display:none}
|
||
.quoteblock.abstract blockquote,.quoteblock.abstract p,.quoteblock.excerpt blockquote,.quoteblock.excerpt p,.quoteblock .quoteblock blockquote,.quoteblock .quoteblock p{line-height:1.6;word-spacing:0}
|
||
.quoteblock.abstract{margin:0 1em 1.25em;display:block}
|
||
.quoteblock.abstract>.title{margin:0 0 .375em;font-size:1.15em;text-align:center}
|
||
.quoteblock.excerpt>blockquote,.quoteblock .quoteblock{padding:0 0 .25em 1em;border-left:.25em solid #dddddf}
|
||
.quoteblock.excerpt,.quoteblock .quoteblock{margin-left:0}
|
||
.quoteblock.excerpt blockquote,.quoteblock.excerpt p,.quoteblock .quoteblock blockquote,.quoteblock .quoteblock p{color:inherit;font-size:1.0625rem}
|
||
.quoteblock.excerpt .attribution,.quoteblock .quoteblock .attribution{color:inherit;font-size:.85rem;text-align:left;margin-right:0}
|
||
p.tableblock:last-child{margin-bottom:0}
|
||
td.tableblock>.content{margin-bottom:1.25em;word-wrap:anywhere}
|
||
td.tableblock>.content>:last-child{margin-bottom:-1.25em}
|
||
table.tableblock,th.tableblock,td.tableblock{border:0 solid #dedede}
|
||
table.grid-all>*>tr>*{border-width:1px}
|
||
table.grid-cols>*>tr>*{border-width:0 1px}
|
||
table.grid-rows>*>tr>*{border-width:1px 0}
|
||
table.frame-all{border-width:1px}
|
||
table.frame-ends{border-width:1px 0}
|
||
table.frame-sides{border-width:0 1px}
|
||
table.frame-none>colgroup+*>:first-child>*,table.frame-sides>colgroup+*>:first-child>*{border-top-width:0}
|
||
table.frame-none>:last-child>:last-child>*,table.frame-sides>:last-child>:last-child>*{border-bottom-width:0}
|
||
table.frame-none>*>tr>:first-child,table.frame-ends>*>tr>:first-child{border-left-width:0}
|
||
table.frame-none>*>tr>:last-child,table.frame-ends>*>tr>:last-child{border-right-width:0}
|
||
table.stripes-all tr,table.stripes-odd tr:nth-of-type(odd),table.stripes-even tr:nth-of-type(even),table.stripes-hover tr:hover{background:#f8f8f7}
|
||
th.halign-left,td.halign-left{text-align:left}
|
||
th.halign-right,td.halign-right{text-align:right}
|
||
th.halign-center,td.halign-center{text-align:center}
|
||
th.valign-top,td.valign-top{vertical-align:top}
|
||
th.valign-bottom,td.valign-bottom{vertical-align:bottom}
|
||
th.valign-middle,td.valign-middle{vertical-align:middle}
|
||
table thead th,table tfoot th{font-weight:bold}
|
||
tbody tr th{background:#f7f8f7}
|
||
tbody tr th,tbody tr th p,tfoot tr th,tfoot tr th p{color:rgba(0,0,0,.8);font-weight:bold}
|
||
p.tableblock>code:only-child{background:none;padding:0}
|
||
p.tableblock{font-size:1em}
|
||
ol{margin-left:1.75em}
|
||
ul li ol{margin-left:1.5em}
|
||
dl dd{margin-left:1.125em}
|
||
dl dd:last-child,dl dd:last-child>:last-child{margin-bottom:0}
|
||
ol>li p,ul>li p,ul dd,ol dd,.olist .olist,.ulist .ulist,.ulist .olist,.olist .ulist{margin-bottom:.625em}
|
||
ul.checklist,ul.none,ol.none,ul.no-bullet,ol.no-bullet,ol.unnumbered,ul.unstyled,ol.unstyled{list-style-type:none}
|
||
ul.no-bullet,ol.no-bullet,ol.unnumbered{margin-left:.625em}
|
||
ul.unstyled,ol.unstyled{margin-left:0}
|
||
ul.checklist>li>p:first-child{margin-left:-1em}
|
||
ul.checklist>li>p:first-child>.fa-square-o:first-child,ul.checklist>li>p:first-child>.fa-check-square-o:first-child{width:1.25em;font-size:.8em;position:relative;bottom:.125em}
|
||
ul.checklist>li>p:first-child>input[type=checkbox]:first-child{margin-right:.25em}
|
||
ul.inline{display:flex;flex-flow:row wrap;list-style:none;margin:0 0 .625em -1.25em}
|
||
ul.inline>li{margin-left:1.25em}
|
||
.unstyled dl dt{font-weight:400;font-style:normal}
|
||
ol.arabic{list-style-type:decimal}
|
||
ol.decimal{list-style-type:decimal-leading-zero}
|
||
ol.loweralpha{list-style-type:lower-alpha}
|
||
ol.upperalpha{list-style-type:upper-alpha}
|
||
ol.lowerroman{list-style-type:lower-roman}
|
||
ol.upperroman{list-style-type:upper-roman}
|
||
ol.lowergreek{list-style-type:lower-greek}
|
||
.hdlist>table,.colist>table{border:0;background:none}
|
||
.hdlist>table>tbody>tr,.colist>table>tbody>tr{background:none}
|
||
td.hdlist1,td.hdlist2{vertical-align:top;padding:0 .625em}
|
||
td.hdlist1{font-weight:bold;padding-bottom:1.25em}
|
||
td.hdlist2{word-wrap:anywhere}
|
||
.literalblock+.colist,.listingblock+.colist{margin-top:-.5em}
|
||
.colist td:not([class]):first-child{padding:.4em .75em 0;line-height:1;vertical-align:top}
|
||
.colist td:not([class]):first-child img{max-width:none}
|
||
.colist td:not([class]):last-child{padding:.25em 0}
|
||
.thumb,.th{line-height:0;display:inline-block;border:4px solid #fff;box-shadow:0 0 0 1px #ddd}
|
||
.imageblock.left{margin:.25em .625em 1.25em 0}
|
||
.imageblock.right{margin:.25em 0 1.25em .625em}
|
||
.imageblock>.title{margin-bottom:0}
|
||
.imageblock.thumb,.imageblock.th{border-width:6px}
|
||
.imageblock.thumb>.title,.imageblock.th>.title{padding:0 .125em}
|
||
.image.left,.image.right{margin-top:.25em;margin-bottom:.25em;display:inline-block;line-height:0}
|
||
.image.left{margin-right:.625em}
|
||
.image.right{margin-left:.625em}
|
||
a.image{text-decoration:none;display:inline-block}
|
||
a.image object{pointer-events:none}
|
||
sup.footnote,sup.footnoteref{font-size:.875em;position:static;vertical-align:super}
|
||
sup.footnote a,sup.footnoteref a{text-decoration:none}
|
||
sup.footnote a:active,sup.footnoteref a:active{text-decoration:underline}
|
||
#footnotes{padding-top:.75em;padding-bottom:.75em;margin-bottom:.625em}
|
||
#footnotes hr{width:20%;min-width:6.25em;margin:-.25em 0 .75em;border-width:1px 0 0}
|
||
#footnotes .footnote{padding:0 .375em 0 .225em;line-height:1.3334;font-size:.875em;margin-left:1.2em;margin-bottom:.2em}
|
||
#footnotes .footnote a:first-of-type{font-weight:bold;text-decoration:none;margin-left:-1.05em}
|
||
#footnotes .footnote:last-of-type{margin-bottom:0}
|
||
#content #footnotes{margin-top:-.625em;margin-bottom:0;padding:.75em 0}
|
||
.gist .file-data>table{border:0;background:#fff;width:100%;margin-bottom:0}
|
||
.gist .file-data>table td.line-data{width:99%}
|
||
div.unbreakable{page-break-inside:avoid}
|
||
.big{font-size:larger}
|
||
.small{font-size:smaller}
|
||
.underline{text-decoration:underline}
|
||
.overline{text-decoration:overline}
|
||
.line-through{text-decoration:line-through}
|
||
.aqua{color:#00bfbf}
|
||
.aqua-background{background:#00fafa}
|
||
.black{color:#000}
|
||
.black-background{background:#000}
|
||
.blue{color:#0000bf}
|
||
.blue-background{background:#0000fa}
|
||
.fuchsia{color:#bf00bf}
|
||
.fuchsia-background{background:#fa00fa}
|
||
.gray{color:#606060}
|
||
.gray-background{background:#7d7d7d}
|
||
.green{color:#006000}
|
||
.green-background{background:#007d00}
|
||
.lime{color:#00bf00}
|
||
.lime-background{background:#00fa00}
|
||
.maroon{color:#600000}
|
||
.maroon-background{background:#7d0000}
|
||
.navy{color:#000060}
|
||
.navy-background{background:#00007d}
|
||
.olive{color:#606000}
|
||
.olive-background{background:#7d7d00}
|
||
.purple{color:#600060}
|
||
.purple-background{background:#7d007d}
|
||
.red{color:#bf0000}
|
||
.red-background{background:#fa0000}
|
||
.silver{color:#909090}
|
||
.silver-background{background:#bcbcbc}
|
||
.teal{color:#006060}
|
||
.teal-background{background:#007d7d}
|
||
.white{color:#bfbfbf}
|
||
.white-background{background:#fafafa}
|
||
.yellow{color:#bfbf00}
|
||
.yellow-background{background:#fafa00}
|
||
span.icon>.fa{cursor:default}
|
||
a span.icon>.fa{cursor:inherit}
|
||
.admonitionblock td.icon [class^="fa icon-"]{font-size:2.5em;text-shadow:1px 1px 2px rgba(0,0,0,.5);cursor:default}
|
||
.admonitionblock td.icon .icon-note::before{content:"\f05a";color:#19407c}
|
||
.admonitionblock td.icon .icon-tip::before{content:"\f0eb";text-shadow:1px 1px 2px rgba(155,155,0,.8);color:#111}
|
||
.admonitionblock td.icon .icon-warning::before{content:"\f071";color:#bf6900}
|
||
.admonitionblock td.icon .icon-caution::before{content:"\f06d";color:#bf3400}
|
||
.admonitionblock td.icon .icon-important::before{content:"\f06a";color:#bf0000}
|
||
.conum[data-value]{display:inline-block;color:#fff!important;background:rgba(0,0,0,.8);border-radius:50%;text-align:center;font-size:.75em;width:1.67em;height:1.67em;line-height:1.67em;font-family:"Open Sans","DejaVu Sans",sans-serif;font-style:normal;font-weight:bold}
|
||
.conum[data-value] *{color:#fff!important}
|
||
.conum[data-value]+b{display:none}
|
||
.conum[data-value]::after{content:attr(data-value)}
|
||
pre .conum[data-value]{position:relative;top:-.125em}
|
||
b.conum *{color:inherit!important}
|
||
.conum:not([data-value]):empty{display:none}
|
||
dt,th.tableblock,td.content,div.footnote{text-rendering:optimizeLegibility}
|
||
h1,h2,p,td.content,span.alt,summary{letter-spacing:-.01em}
|
||
p strong,td.content strong,div.footnote strong{letter-spacing:-.005em}
|
||
p,blockquote,dt,td.content,span.alt,summary{font-size:1.0625rem}
|
||
p{margin-bottom:1.25rem}
|
||
.sidebarblock p,.sidebarblock dt,.sidebarblock td.content,p.tableblock{font-size:1em}
|
||
.exampleblock>.content{background:#fffef7;border-color:#e0e0dc;box-shadow:0 1px 4px #e0e0dc}
|
||
.print-only{display:none!important}
|
||
@page{margin:1.25cm .75cm}
|
||
@media print{*{box-shadow:none!important;text-shadow:none!important}
|
||
html{font-size:80%}
|
||
a{color:inherit!important;text-decoration:underline!important}
|
||
a.bare,a[href^="#"],a[href^="mailto:"]{text-decoration:none!important}
|
||
a[href^="http:"]:not(.bare)::after,a[href^="https:"]:not(.bare)::after{content:"(" attr(href) ")";display:inline-block;font-size:.875em;padding-left:.25em}
|
||
abbr[title]{border-bottom:1px dotted}
|
||
abbr[title]::after{content:" (" attr(title) ")"}
|
||
pre,blockquote,tr,img,object,svg{page-break-inside:avoid}
|
||
thead{display:table-header-group}
|
||
svg{max-width:100%}
|
||
p,blockquote,dt,td.content{font-size:1em;orphans:3;widows:3}
|
||
h2,h3,#toctitle,.sidebarblock>.content>.title{page-break-after:avoid}
|
||
#header,#content,#footnotes,#footer{max-width:none}
|
||
#toc,.sidebarblock,.exampleblock>.content{background:none!important}
|
||
#toc{border-bottom:1px solid #dddddf!important;padding-bottom:0!important}
|
||
body.book #header{text-align:center}
|
||
body.book #header>h1:first-child{border:0!important;margin:2.5em 0 1em}
|
||
body.book #header .details{border:0!important;display:block;padding:0!important}
|
||
body.book #header .details span:first-child{margin-left:0!important}
|
||
body.book #header .details br{display:block}
|
||
body.book #header .details br+span::before{content:none!important}
|
||
body.book #toc{border:0!important;text-align:left!important;padding:0!important;margin:0!important}
|
||
body.book #toc,body.book #preamble,body.book h1.sect0,body.book .sect1>h2{page-break-before:always}
|
||
.listingblock code[data-lang]::before{display:block}
|
||
#footer{padding:0 .9375em}
|
||
.hide-on-print{display:none!important}
|
||
.print-only{display:block!important}
|
||
.hide-for-print{display:none!important}
|
||
.show-for-print{display:inherit!important}}
|
||
@media amzn-kf8,print{#header>h1:first-child{margin-top:1.25rem}
|
||
.sect1{padding:0!important}
|
||
.sect1+.sect1{border:0}
|
||
#footer{background:none}
|
||
#footer-text{color:rgba(0,0,0,.6);font-size:.9em}}
|
||
@media amzn-kf8{#header,#content,#footnotes,#footer{padding:0}}
|
||
</style>
|
||
<link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/font-awesome/4.7.0/css/font-awesome.min.css">
|
||
</head>
|
||
<body class="article toc2 toc-right">
|
||
<div id="header">
|
||
<h1>MISP Objects</h1>
|
||
<div id="toc" class="toc2">
|
||
<div id="toctitle">MISP Objects</div>
|
||
<ul class="sectlevel0">
|
||
<li><a href="#_introduction">Introduction</a>
|
||
<ul class="sectlevel1">
|
||
<li><a href="#_funding_and_support">Funding and Support</a></li>
|
||
</ul>
|
||
</li>
|
||
<li><a href="#_misp_objects">MISP objects</a>
|
||
<ul class="sectlevel1">
|
||
<li><a href="#_ail_leak">ail-leak</a></li>
|
||
<li><a href="#_ais_info">ais-info</a></li>
|
||
<li><a href="#_android_app">android-app</a></li>
|
||
<li><a href="#_android_permission">android-permission</a></li>
|
||
<li><a href="#_annotation">annotation</a></li>
|
||
<li><a href="#_anonymisation">anonymisation</a></li>
|
||
<li><a href="#_asn">asn</a></li>
|
||
<li><a href="#_attack_pattern">attack-pattern</a></li>
|
||
<li><a href="#_authentication_failure_report">authentication-failure-report</a></li>
|
||
<li><a href="#_authenticode_signerinfo">authenticode-signerinfo</a></li>
|
||
<li><a href="#_av_signature">av-signature</a></li>
|
||
<li><a href="#_bank_account">bank-account</a></li>
|
||
<li><a href="#_bgp_hijack">bgp-hijack</a></li>
|
||
<li><a href="#_bgp_ranking">bgp-ranking</a></li>
|
||
<li><a href="#_blog">blog</a></li>
|
||
<li><a href="#_boleto">boleto</a></li>
|
||
<li><a href="#_btc_transaction">btc-transaction</a></li>
|
||
<li><a href="#_btc_wallet">btc-wallet</a></li>
|
||
<li><a href="#_cap_alert">cap-alert</a></li>
|
||
<li><a href="#_cap_info">cap-info</a></li>
|
||
<li><a href="#_cap_resource">cap-resource</a></li>
|
||
<li><a href="#_coin_address">coin-address</a></li>
|
||
<li><a href="#_command">command</a></li>
|
||
<li><a href="#_command_line">command-line</a></li>
|
||
<li><a href="#_concordia_mtmf_intrusion_set">concordia-mtmf-intrusion-set</a></li>
|
||
<li><a href="#_cookie">cookie</a></li>
|
||
<li><a href="#_cortex">cortex</a></li>
|
||
<li><a href="#_cortex_taxonomy">cortex-taxonomy</a></li>
|
||
<li><a href="#_course_of_action">course-of-action</a></li>
|
||
<li><a href="#_covid19_csse_daily_report">covid19-csse-daily-report</a></li>
|
||
<li><a href="#_covid19_dxy_live_city">covid19-dxy-live-city</a></li>
|
||
<li><a href="#_covid19_dxy_live_province">covid19-dxy-live-province</a></li>
|
||
<li><a href="#_cowrie">cowrie</a></li>
|
||
<li><a href="#_cpe_asset">cpe-asset</a></li>
|
||
<li><a href="#_credential">credential</a></li>
|
||
<li><a href="#_credit_card">credit-card</a></li>
|
||
<li><a href="#_crypto_material">crypto-material</a></li>
|
||
<li><a href="#_cytomic_orion_file">cytomic-orion-file</a></li>
|
||
<li><a href="#_cytomic_orion_machine">cytomic-orion-machine</a></li>
|
||
<li><a href="#_dark_pattern_item">dark-pattern-item</a></li>
|
||
<li><a href="#_ddos">ddos</a></li>
|
||
<li><a href="#_device">device</a></li>
|
||
<li><a href="#_diameter_attack">diameter-attack</a></li>
|
||
<li><a href="#_dkim">dkim</a></li>
|
||
<li><a href="#_dns_record">dns-record</a></li>
|
||
<li><a href="#_domain_crawled">domain-crawled</a></li>
|
||
<li><a href="#_domain_ip">domain-ip</a></li>
|
||
<li><a href="#_edr_report">edr-report</a></li>
|
||
<li><a href="#_elf">elf</a></li>
|
||
<li><a href="#_elf_section">elf-section</a></li>
|
||
<li><a href="#_email">email</a></li>
|
||
<li><a href="#_employee">employee</a></li>
|
||
<li><a href="#_exploit_poc">exploit-poc</a></li>
|
||
<li><a href="#_facebook_account">facebook-account</a></li>
|
||
<li><a href="#_facebook_group">facebook-group</a></li>
|
||
<li><a href="#_facebook_page">facebook-page</a></li>
|
||
<li><a href="#_facebook_post">facebook-post</a></li>
|
||
<li><a href="#_facial_composite">facial-composite</a></li>
|
||
<li><a href="#_fail2ban">fail2ban</a></li>
|
||
<li><a href="#_favicon">favicon</a></li>
|
||
<li><a href="#_file">file</a></li>
|
||
<li><a href="#_forensic_case">forensic-case</a></li>
|
||
<li><a href="#_forensic_evidence">forensic-evidence</a></li>
|
||
<li><a href="#_forged_document">forged-document</a></li>
|
||
<li><a href="#_ftm_airplane">ftm-Airplane</a></li>
|
||
<li><a href="#_ftm_assessment">ftm-Assessment</a></li>
|
||
<li><a href="#_ftm_asset">ftm-Asset</a></li>
|
||
<li><a href="#_ftm_associate">ftm-Associate</a></li>
|
||
<li><a href="#_ftm_audio">ftm-Audio</a></li>
|
||
<li><a href="#_ftm_bankaccount">ftm-BankAccount</a></li>
|
||
<li><a href="#_ftm_call">ftm-Call</a></li>
|
||
<li><a href="#_ftm_company">ftm-Company</a></li>
|
||
<li><a href="#_ftm_contract">ftm-Contract</a></li>
|
||
<li><a href="#_ftm_contractaward">ftm-ContractAward</a></li>
|
||
<li><a href="#_ftm_courtcase">ftm-CourtCase</a></li>
|
||
<li><a href="#_ftm_courtcaseparty">ftm-CourtCaseParty</a></li>
|
||
<li><a href="#_ftm_debt">ftm-Debt</a></li>
|
||
<li><a href="#_ftm_directorship">ftm-Directorship</a></li>
|
||
<li><a href="#_ftm_document">ftm-Document</a></li>
|
||
<li><a href="#_ftm_documentation">ftm-Documentation</a></li>
|
||
<li><a href="#_ftm_economicactivity">ftm-EconomicActivity</a></li>
|
||
<li><a href="#_ftm_email">ftm-Email</a></li>
|
||
<li><a href="#_ftm_event">ftm-Event</a></li>
|
||
<li><a href="#_ftm_family">ftm-Family</a></li>
|
||
<li><a href="#_ftm_folder">ftm-Folder</a></li>
|
||
<li><a href="#_ftm_hypertext">ftm-HyperText</a></li>
|
||
<li><a href="#_ftm_image">ftm-Image</a></li>
|
||
<li><a href="#_ftm_land">ftm-Land</a></li>
|
||
<li><a href="#_ftm_legalentity">ftm-LegalEntity</a></li>
|
||
<li><a href="#_ftm_license">ftm-License</a></li>
|
||
<li><a href="#_ftm_membership">ftm-Membership</a></li>
|
||
<li><a href="#_ftm_message">ftm-Message</a></li>
|
||
<li><a href="#_ftm_organization">ftm-Organization</a></li>
|
||
<li><a href="#_ftm_ownership">ftm-Ownership</a></li>
|
||
<li><a href="#_ftm_package">ftm-Package</a></li>
|
||
<li><a href="#_ftm_page">ftm-Page</a></li>
|
||
<li><a href="#_ftm_pages">ftm-Pages</a></li>
|
||
<li><a href="#_ftm_passport">ftm-Passport</a></li>
|
||
<li><a href="#_ftm_payment">ftm-Payment</a></li>
|
||
<li><a href="#_ftm_person">ftm-Person</a></li>
|
||
<li><a href="#_ftm_plaintext">ftm-PlainText</a></li>
|
||
<li><a href="#_ftm_publicbody">ftm-PublicBody</a></li>
|
||
<li><a href="#_ftm_realestate">ftm-RealEstate</a></li>
|
||
<li><a href="#_ftm_representation">ftm-Representation</a></li>
|
||
<li><a href="#_ftm_row">ftm-Row</a></li>
|
||
<li><a href="#_ftm_sanction">ftm-Sanction</a></li>
|
||
<li><a href="#_ftm_succession">ftm-Succession</a></li>
|
||
<li><a href="#_ftm_table">ftm-Table</a></li>
|
||
<li><a href="#_ftm_taxroll">ftm-TaxRoll</a></li>
|
||
<li><a href="#_ftm_unknownlink">ftm-UnknownLink</a></li>
|
||
<li><a href="#_ftm_useraccount">ftm-UserAccount</a></li>
|
||
<li><a href="#_ftm_vehicle">ftm-Vehicle</a></li>
|
||
<li><a href="#_ftm_vessel">ftm-Vessel</a></li>
|
||
<li><a href="#_ftm_video">ftm-Video</a></li>
|
||
<li><a href="#_ftm_workbook">ftm-Workbook</a></li>
|
||
<li><a href="#_geolocation">geolocation</a></li>
|
||
<li><a href="#_git_vuln_finder">git-vuln-finder</a></li>
|
||
<li><a href="#_github_user">github-user</a></li>
|
||
<li><a href="#_gitlab_user">gitlab-user</a></li>
|
||
<li><a href="#_gtp_attack">gtp-attack</a></li>
|
||
<li><a href="#_hashlookup">hashlookup</a></li>
|
||
<li><a href="#_http_request">http-request</a></li>
|
||
<li><a href="#_ilr_impact">ilr-impact</a></li>
|
||
<li><a href="#_ilr_notification_incident">ilr-notification-incident</a></li>
|
||
<li><a href="#_image">image</a></li>
|
||
<li><a href="#_impersonation">impersonation</a></li>
|
||
<li><a href="#_imsi_catcher">imsi-catcher</a></li>
|
||
<li><a href="#_instant_message">instant-message</a></li>
|
||
<li><a href="#_instant_message_group">instant-message-group</a></li>
|
||
<li><a href="#_intel471_vulnerability_intelligence">intel471-vulnerability-intelligence</a></li>
|
||
<li><a href="#_intelmq_event">intelmq_event</a></li>
|
||
<li><a href="#_intelmq_report">intelmq_report</a></li>
|
||
<li><a href="#_internal_reference">internal-reference</a></li>
|
||
<li><a href="#_interpol_notice">interpol-notice</a></li>
|
||
<li><a href="#_iot_device">iot-device</a></li>
|
||
<li><a href="#_iot_firmware">iot-firmware</a></li>
|
||
<li><a href="#_ip_api_address">ip-api-address</a></li>
|
||
<li><a href="#_ip_port">ip-port</a></li>
|
||
<li><a href="#_irc">irc</a></li>
|
||
<li><a href="#_ja3">ja3</a></li>
|
||
<li><a href="#_ja3s">ja3s</a></li>
|
||
<li><a href="#_jarm">jarm</a></li>
|
||
<li><a href="#_keybase_account">keybase-account</a></li>
|
||
<li><a href="#_leaked_document">leaked-document</a></li>
|
||
<li><a href="#_legal_entity">legal-entity</a></li>
|
||
<li><a href="#_lnk">lnk</a></li>
|
||
<li><a href="#_macho">macho</a></li>
|
||
<li><a href="#_macho_section">macho-section</a></li>
|
||
<li><a href="#_mactime_timeline_analysis">mactime-timeline-analysis</a></li>
|
||
<li><a href="#_malware_config">malware-config</a></li>
|
||
<li><a href="#_meme_image">meme-image</a></li>
|
||
<li><a href="#_microblog">microblog</a></li>
|
||
<li><a href="#_mutex">mutex</a></li>
|
||
<li><a href="#_narrative">narrative</a></li>
|
||
<li><a href="#_netflow">netflow</a></li>
|
||
<li><a href="#_network_connection">network-connection</a></li>
|
||
<li><a href="#_network_profile">network-profile</a></li>
|
||
<li><a href="#_network_socket">network-socket</a></li>
|
||
<li><a href="#_news_agency">news-agency</a></li>
|
||
<li><a href="#_news_media">news-media</a></li>
|
||
<li><a href="#_open_data_security">open-data-security</a></li>
|
||
<li><a href="#_organization">organization</a></li>
|
||
<li><a href="#_original_imported_file">original-imported-file</a></li>
|
||
<li><a href="#_paloalto_threat_event">paloalto-threat-event</a></li>
|
||
<li><a href="#_parler_account">parler-account</a></li>
|
||
<li><a href="#_parler_comment">parler-comment</a></li>
|
||
<li><a href="#_parler_post">parler-post</a></li>
|
||
<li><a href="#_passive_dns">passive-dns</a></li>
|
||
<li><a href="#_passive_dns_dnsdbflex">passive-dns-dnsdbflex</a></li>
|
||
<li><a href="#_passive_ssh">passive-ssh</a></li>
|
||
<li><a href="#_paste">paste</a></li>
|
||
<li><a href="#_pcap_metadata">pcap-metadata</a></li>
|
||
<li><a href="#_pe">pe</a></li>
|
||
<li><a href="#_pe_section">pe-section</a></li>
|
||
<li><a href="#_person">person</a></li>
|
||
<li><a href="#_pgp_meta">pgp-meta</a></li>
|
||
<li><a href="#_phishing">phishing</a></li>
|
||
<li><a href="#_phishing_kit">phishing-kit</a></li>
|
||
<li><a href="#_phone">phone</a></li>
|
||
<li><a href="#_postal_address">postal-address</a></li>
|
||
<li><a href="#_probabilistic_data_structure">probabilistic-data-structure</a></li>
|
||
<li><a href="#_process">process</a></li>
|
||
<li><a href="#_publication">publication</a></li>
|
||
<li><a href="#_python_etvx_event_log">python-etvx-event-log</a></li>
|
||
<li><a href="#_r2graphity">r2graphity</a></li>
|
||
<li><a href="#_reddit_account">reddit-account</a></li>
|
||
<li><a href="#_reddit_comment">reddit-comment</a></li>
|
||
<li><a href="#_reddit_post">reddit-post</a></li>
|
||
<li><a href="#_reddit_subreddit">reddit-subreddit</a></li>
|
||
<li><a href="#_regexp">regexp</a></li>
|
||
<li><a href="#_registry_key">registry-key</a></li>
|
||
<li><a href="#_regripper_ntuser">regripper-NTUser</a></li>
|
||
<li><a href="#_regripper_sam_hive_single_user">regripper-sam-hive-single-user</a></li>
|
||
<li><a href="#_regripper_sam_hive_user_group">regripper-sam-hive-user-group</a></li>
|
||
<li><a href="#_regripper_software_hive_bho">regripper-software-hive-BHO</a></li>
|
||
<li><a href="#_regripper_software_hive_appinit_dlls">regripper-software-hive-appInit-DLLS</a></li>
|
||
<li><a href="#_regripper_software_hive_application_paths">regripper-software-hive-application-paths</a></li>
|
||
<li><a href="#_regripper_software_hive_applications_installed">regripper-software-hive-applications-installed</a></li>
|
||
<li><a href="#_regripper_software_hive_command_shell">regripper-software-hive-command-shell</a></li>
|
||
<li><a href="#_regripper_software_hive_software_run">regripper-software-hive-software-run</a></li>
|
||
<li><a href="#_regripper_software_hive_userprofile_winlogon">regripper-software-hive-userprofile-winlogon</a></li>
|
||
<li><a href="#_regripper_software_hive_windows_general_info">regripper-software-hive-windows-general-info</a></li>
|
||
<li><a href="#_regripper_system_hive_firewall_configuration">regripper-system-hive-firewall-configuration</a></li>
|
||
<li><a href="#_regripper_system_hive_general_configuration">regripper-system-hive-general-configuration</a></li>
|
||
<li><a href="#_regripper_system_hive_network_information">regripper-system-hive-network-information</a></li>
|
||
<li><a href="#_regripper_system_hive_services_drivers">regripper-system-hive-services-drivers</a></li>
|
||
<li><a href="#_report">report</a></li>
|
||
<li><a href="#_research_scanner">research-scanner</a></li>
|
||
<li><a href="#_rogue_dns">rogue-dns</a></li>
|
||
<li><a href="#_rtir">rtir</a></li>
|
||
<li><a href="#_sandbox_report">sandbox-report</a></li>
|
||
<li><a href="#_sb_signature">sb-signature</a></li>
|
||
<li><a href="#_scheduled_event">scheduled-event</a></li>
|
||
<li><a href="#_scrippsco2_c13_daily">scrippsco2-c13-daily</a></li>
|
||
<li><a href="#_scrippsco2_c13_monthly">scrippsco2-c13-monthly</a></li>
|
||
<li><a href="#_scrippsco2_co2_daily">scrippsco2-co2-daily</a></li>
|
||
<li><a href="#_scrippsco2_co2_monthly">scrippsco2-co2-monthly</a></li>
|
||
<li><a href="#_scrippsco2_o18_daily">scrippsco2-o18-daily</a></li>
|
||
<li><a href="#_scrippsco2_o18_monthly">scrippsco2-o18-monthly</a></li>
|
||
<li><a href="#_script">script</a></li>
|
||
<li><a href="#_security_playbook">security-playbook</a></li>
|
||
<li><a href="#_shell_commands">shell-commands</a></li>
|
||
<li><a href="#_shodan_report">shodan-report</a></li>
|
||
<li><a href="#_short_message_service">short-message-service</a></li>
|
||
<li><a href="#_shortened_link">shortened-link</a></li>
|
||
<li><a href="#_social_media_group">social-media-group</a></li>
|
||
<li><a href="#_splunk">splunk</a></li>
|
||
<li><a href="#_ss7_attack">ss7-attack</a></li>
|
||
<li><a href="#_ssh_authorized_keys">ssh-authorized-keys</a></li>
|
||
<li><a href="#_stix2_pattern">stix2-pattern</a></li>
|
||
<li><a href="#_submarine">submarine</a></li>
|
||
<li><a href="#_suricata">suricata</a></li>
|
||
<li><a href="#_target_system">target-system</a></li>
|
||
<li><a href="#_telegram_account">telegram-account</a></li>
|
||
<li><a href="#_temporal_event">temporal-event</a></li>
|
||
<li><a href="#_threatgrid_report">threatgrid-report</a></li>
|
||
<li><a href="#_timecode">timecode</a></li>
|
||
<li><a href="#_timesketch_timeline">timesketch-timeline</a></li>
|
||
<li><a href="#_timesketch_message">timesketch_message</a></li>
|
||
<li><a href="#_timestamp">timestamp</a></li>
|
||
<li><a href="#_tor_hiddenservice">tor-hiddenservice</a></li>
|
||
<li><a href="#_tor_node">tor-node</a></li>
|
||
<li><a href="#_tracking_id">tracking-id</a></li>
|
||
<li><a href="#_transaction">transaction</a></li>
|
||
<li><a href="#_translation">translation</a></li>
|
||
<li><a href="#_trustar_report">trustar_report</a></li>
|
||
<li><a href="#_tsk_chats">tsk-chats</a></li>
|
||
<li><a href="#_tsk_web_bookmark">tsk-web-bookmark</a></li>
|
||
<li><a href="#_tsk_web_cookie">tsk-web-cookie</a></li>
|
||
<li><a href="#_tsk_web_downloads">tsk-web-downloads</a></li>
|
||
<li><a href="#_tsk_web_history">tsk-web-history</a></li>
|
||
<li><a href="#_tsk_web_search_query">tsk-web-search-query</a></li>
|
||
<li><a href="#_twitter_account">twitter-account</a></li>
|
||
<li><a href="#_twitter_list">twitter-list</a></li>
|
||
<li><a href="#_twitter_post">twitter-post</a></li>
|
||
<li><a href="#_url">url</a></li>
|
||
<li><a href="#_user_account">user-account</a></li>
|
||
<li><a href="#_vehicle">vehicle</a></li>
|
||
<li><a href="#_victim">victim</a></li>
|
||
<li><a href="#_virustotal_graph">virustotal-graph</a></li>
|
||
<li><a href="#_virustotal_report">virustotal-report</a></li>
|
||
<li><a href="#_vulnerability">vulnerability</a></li>
|
||
<li><a href="#_weakness">weakness</a></li>
|
||
<li><a href="#_whois">whois</a></li>
|
||
<li><a href="#_windows_service">windows-service</a></li>
|
||
<li><a href="#_x509">x509</a></li>
|
||
<li><a href="#_yabin">yabin</a></li>
|
||
<li><a href="#_yara">yara</a></li>
|
||
<li><a href="#_youtube_channel">youtube-channel</a></li>
|
||
<li><a href="#_youtube_comment">youtube-comment</a></li>
|
||
<li><a href="#_youtube_playlist">youtube-playlist</a></li>
|
||
<li><a href="#_youtube_video">youtube-video</a></li>
|
||
<li><a href="#_relationships">Relationships</a></li>
|
||
</ul>
|
||
</li>
|
||
</ul>
|
||
</div>
|
||
</div>
|
||
<div id="content">
|
||
<h1 id="_introduction" class="sect0"><a class="anchor" href="#_introduction"></a><a class="link" href="#_introduction">Introduction</a></h1>
|
||
<div class="imageblock">
|
||
<div class="content">
|
||
<img src="https://raw.githubusercontent.com/MISP/MISP/2.4/INSTALL/logos/misp-logo.png" alt="MISP logo">
|
||
</div>
|
||
</div>
|
||
<div class="paragraph">
|
||
<p>The MISP threat sharing platform is a free and open source software helping information sharing of threat intelligence including cyber security indicators, financial fraud or counter-terrorism information. The MISP project includes multiple sub-projects to support the operational requirements of analysts and improve the overall quality of information shared.</p>
|
||
</div>
|
||
<div class="paragraph">
|
||
<p>MISP objects are used in MISP (starting from version 2.4.80) system and can be used by other information sharing tool. MISP objects are in addition to MISP attributes to allow advanced combinations of attributes. The creation of these objects and their associated attributes are based on real cyber security use-cases and existing practices in information sharing. The objects are just shared like any other attributes in MISP even if the other MISP instances don’t have the template of the object.
|
||
The following document is generated from the machine-readable JSON describing the <a href="https://github.com/MISP/misp-objects">MISP objects</a>.</p>
|
||
</div>
|
||
<div style="page-break-after: always;"></div>
|
||
<div class="sect1">
|
||
<h2 id="_funding_and_support"><a class="anchor" href="#_funding_and_support"></a><a class="link" href="#_funding_and_support">Funding and Support</a></h2>
|
||
<div class="sectionbody">
|
||
<div class="paragraph">
|
||
<p>The MISP project is financially and resource supported by <a href="https://www.circl.lu/">CIRCL Computer Incident Response Center Luxembourg </a>.</p>
|
||
</div>
|
||
<div class="paragraph">
|
||
<p><span class="image"><img src="https://www.misp-project.org/assets/images/logo.png" alt="CIRCL logo"></span></p>
|
||
</div>
|
||
<div class="paragraph">
|
||
<p>A CEF (Connecting Europe Facility) funding under CEF-TC-2016-3 - Cyber Security has been granted from 1st September 2017 until 31th August 2019 as <strong><strong>Improving MISP as building blocks for next-generation information sharing</strong></strong>.</p>
|
||
</div>
|
||
<div class="paragraph">
|
||
<p><span class="image"><img src="https://www.misp-project.org/assets/images/en_cef.png" alt="CEF funding"></span></p>
|
||
</div>
|
||
<div class="paragraph">
|
||
<p>If you are interested to co-fund projects around MISP, feel free to get in touch with us.</p>
|
||
</div>
|
||
<div style="page-break-after: always;"></div>
|
||
</div>
|
||
</div>
|
||
<h1 id="_misp_objects" class="sect0"><a class="anchor" href="#_misp_objects"></a><a class="link" href="#_misp_objects">MISP objects</a></h1>
|
||
<div class="sect1">
|
||
<h2 id="_ail_leak"><a class="anchor" href="#_ail_leak"></a><a class="link" href="#_ail_leak">ail-leak</a></h2>
|
||
<div class="sectionbody">
|
||
<div class="paragraph">
|
||
<p>An information leak as defined by the AIL Analysis Information Leak framework.</p>
|
||
</div>
|
||
<div class="admonitionblock note">
|
||
<table>
|
||
<tr>
|
||
<td class="icon">
|
||
<i class="fa icon-note" title="Note"></i>
|
||
</td>
|
||
<td class="content">
|
||
ail-leak is a MISP object available in JSON format at <a href="https://github.com/MISP/misp-objects/blob/main/objects/ail-leak/definition.json"><strong>this location</strong></a> The JSON format can be freely reused in your application or automatically enabled in <a href="https://www.github.com/MISP/MISP">MISP</a>.
|
||
</td>
|
||
</tr>
|
||
</table>
|
||
</div>
|
||
<table class="tableblock frame-all grid-all stretch">
|
||
<colgroup>
|
||
<col style="width: 20%;">
|
||
<col style="width: 20%;">
|
||
<col style="width: 20%;">
|
||
<col style="width: 20%;">
|
||
<col style="width: 20%;">
|
||
</colgroup>
|
||
<thead>
|
||
<tr>
|
||
<th class="tableblock halign-left valign-top">Object attribute</th>
|
||
<th class="tableblock halign-left valign-top">MISP attribute type</th>
|
||
<th class="tableblock halign-left valign-top">Description</th>
|
||
<th class="tableblock halign-left valign-top">Disable correlation</th>
|
||
<th class="tableblock halign-left valign-top">Multiple</th>
|
||
</tr>
|
||
</thead>
|
||
<tbody>
|
||
<tr>
|
||
<td class="tableblock halign-left valign-top"><p class="tableblock">duplicate</p></td>
|
||
<td class="tableblock halign-left valign-top"><p class="tableblock">text</p></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p>Duplicate of the existing leaks.</p>
|
||
</div></div></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p><span class="icon"><i class="fa fa-minus"></i></span></p>
|
||
</div></div></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p><span class="icon"><i class="fa fa-check"></i></span></p>
|
||
</div></div></td>
|
||
</tr>
|
||
<tr>
|
||
<td class="tableblock halign-left valign-top"><p class="tableblock">duplicate_number</p></td>
|
||
<td class="tableblock halign-left valign-top"><p class="tableblock">counter</p></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p>Number of known duplicates.</p>
|
||
</div></div></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p><span class="icon"><i class="fa fa-check"></i></span></p>
|
||
</div></div></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p><span class="icon"><i class="fa fa-minus"></i></span></p>
|
||
</div></div></td>
|
||
</tr>
|
||
<tr>
|
||
<td class="tableblock halign-left valign-top"><p class="tableblock">first-seen</p></td>
|
||
<td class="tableblock halign-left valign-top"><p class="tableblock">datetime</p></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p>When the leak has been accessible or seen for the first time.</p>
|
||
</div></div></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p><span class="icon"><i class="fa fa-check"></i></span></p>
|
||
</div></div></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p><span class="icon"><i class="fa fa-minus"></i></span></p>
|
||
</div></div></td>
|
||
</tr>
|
||
<tr>
|
||
<td class="tableblock halign-left valign-top"><p class="tableblock">last-seen</p></td>
|
||
<td class="tableblock halign-left valign-top"><p class="tableblock">datetime</p></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p>When the leak has been accessible or seen for the last time.</p>
|
||
</div></div></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p><span class="icon"><i class="fa fa-check"></i></span></p>
|
||
</div></div></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p><span class="icon"><i class="fa fa-minus"></i></span></p>
|
||
</div></div></td>
|
||
</tr>
|
||
<tr>
|
||
<td class="tableblock halign-left valign-top"><p class="tableblock">origin</p></td>
|
||
<td class="tableblock halign-left valign-top"><p class="tableblock">text</p></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p>The link where the leak is (or was) accessible at first-seen.</p>
|
||
</div></div></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p><span class="icon"><i class="fa fa-minus"></i></span></p>
|
||
</div></div></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p><span class="icon"><i class="fa fa-minus"></i></span></p>
|
||
</div></div></td>
|
||
</tr>
|
||
<tr>
|
||
<td class="tableblock halign-left valign-top"><p class="tableblock">original-date</p></td>
|
||
<td class="tableblock halign-left valign-top"><p class="tableblock">datetime</p></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p>When the information available in the leak was created. It’s usually before the first-seen.</p>
|
||
</div></div></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p><span class="icon"><i class="fa fa-check"></i></span></p>
|
||
</div></div></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p><span class="icon"><i class="fa fa-minus"></i></span></p>
|
||
</div></div></td>
|
||
</tr>
|
||
<tr>
|
||
<td class="tableblock halign-left valign-top"><p class="tableblock">raw-data</p></td>
|
||
<td class="tableblock halign-left valign-top"><p class="tableblock">attachment</p></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p>Raw data as received by the AIL sensor compressed and encoded in Base64.</p>
|
||
</div></div></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p><span class="icon"><i class="fa fa-check"></i></span></p>
|
||
</div></div></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p><span class="icon"><i class="fa fa-minus"></i></span></p>
|
||
</div></div></td>
|
||
</tr>
|
||
<tr>
|
||
<td class="tableblock halign-left valign-top"><p class="tableblock">sensor</p></td>
|
||
<td class="tableblock halign-left valign-top"><p class="tableblock">text</p></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p>The AIL sensor uuid where the leak was processed and analysed.</p>
|
||
</div></div></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p><span class="icon"><i class="fa fa-check"></i></span></p>
|
||
</div></div></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p><span class="icon"><i class="fa fa-minus"></i></span></p>
|
||
</div></div></td>
|
||
</tr>
|
||
<tr>
|
||
<td class="tableblock halign-left valign-top"><p class="tableblock">text</p></td>
|
||
<td class="tableblock halign-left valign-top"><p class="tableblock">text</p></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p>A description of the leak which could include the potential victim(s) or description of the leak.</p>
|
||
</div></div></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p><span class="icon"><i class="fa fa-check"></i></span></p>
|
||
</div></div></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p><span class="icon"><i class="fa fa-minus"></i></span></p>
|
||
</div></div></td>
|
||
</tr>
|
||
</tbody>
|
||
</table>
|
||
</div>
|
||
</div>
|
||
<div class="sect1">
|
||
<h2 id="_ais_info"><a class="anchor" href="#_ais_info"></a><a class="link" href="#_ais_info">ais-info</a></h2>
|
||
<div class="sectionbody">
|
||
<div class="paragraph">
|
||
<p>Automated Indicator Sharing (AIS) Information Source Markings.</p>
|
||
</div>
|
||
<div class="admonitionblock note">
|
||
<table>
|
||
<tr>
|
||
<td class="icon">
|
||
<i class="fa icon-note" title="Note"></i>
|
||
</td>
|
||
<td class="content">
|
||
ais-info is a MISP object available in JSON format at <a href="https://github.com/MISP/misp-objects/blob/main/objects/ais-info/definition.json"><strong>this location</strong></a> The JSON format can be freely reused in your application or automatically enabled in <a href="https://www.github.com/MISP/MISP">MISP</a>.
|
||
</td>
|
||
</tr>
|
||
</table>
|
||
</div>
|
||
<table class="tableblock frame-all grid-all stretch">
|
||
<colgroup>
|
||
<col style="width: 20%;">
|
||
<col style="width: 20%;">
|
||
<col style="width: 20%;">
|
||
<col style="width: 20%;">
|
||
<col style="width: 20%;">
|
||
</colgroup>
|
||
<thead>
|
||
<tr>
|
||
<th class="tableblock halign-left valign-top">Object attribute</th>
|
||
<th class="tableblock halign-left valign-top">MISP attribute type</th>
|
||
<th class="tableblock halign-left valign-top">Description</th>
|
||
<th class="tableblock halign-left valign-top">Disable correlation</th>
|
||
<th class="tableblock halign-left valign-top">Multiple</th>
|
||
</tr>
|
||
</thead>
|
||
<tbody>
|
||
<tr>
|
||
<td class="tableblock halign-left valign-top"><p class="tableblock">administrative-area</p></td>
|
||
<td class="tableblock halign-left valign-top"><p class="tableblock">text</p></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p>AIS Administrative Area represented using ISO-3166-2.</p>
|
||
</div></div></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p><span class="icon"><i class="fa fa-minus"></i></span></p>
|
||
</div></div></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p><span class="icon"><i class="fa fa-minus"></i></span></p>
|
||
</div></div></td>
|
||
</tr>
|
||
<tr>
|
||
<td class="tableblock halign-left valign-top"><p class="tableblock">country</p></td>
|
||
<td class="tableblock halign-left valign-top"><p class="tableblock">text</p></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p>AIS Country represented using ISO-3166-1_alpha-2.</p>
|
||
</div></div></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p><span class="icon"><i class="fa fa-minus"></i></span></p>
|
||
</div></div></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p><span class="icon"><i class="fa fa-minus"></i></span></p>
|
||
</div></div></td>
|
||
</tr>
|
||
<tr>
|
||
<td class="tableblock halign-left valign-top"><p class="tableblock">industry</p></td>
|
||
<td class="tableblock halign-left valign-top"><p class="tableblock">text</p></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p>AIS IndustryType. ['Chemical Sector', 'Commercial Facilities Sector', 'Communications Sector', 'Critical Manufacturing Sector', 'Dams Sector', 'Defense Industrial Base Sector', 'Emergency Services Sector', 'Energy Sector', 'Financial Services Sector', 'Food and Agriculture Sector', 'Government Facilities Sector', 'Healthcare and Public Health Sector', 'Information Technology Sector', 'Nuclear Reactors, Materials, and Waste Sector', 'Transportation Systems Sector', 'Water and Wastewater Systems Sector', 'Other']</p>
|
||
</div></div></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p><span class="icon"><i class="fa fa-minus"></i></span></p>
|
||
</div></div></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p><span class="icon"><i class="fa fa-check"></i></span></p>
|
||
</div></div></td>
|
||
</tr>
|
||
<tr>
|
||
<td class="tableblock halign-left valign-top"><p class="tableblock">organisation</p></td>
|
||
<td class="tableblock halign-left valign-top"><p class="tableblock">text</p></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p>AIS Organisation Name.</p>
|
||
</div></div></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p><span class="icon"><i class="fa fa-minus"></i></span></p>
|
||
</div></div></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p><span class="icon"><i class="fa fa-minus"></i></span></p>
|
||
</div></div></td>
|
||
</tr>
|
||
</tbody>
|
||
</table>
|
||
</div>
|
||
</div>
|
||
<div class="sect1">
|
||
<h2 id="_android_app"><a class="anchor" href="#_android_app"></a><a class="link" href="#_android_app">android-app</a></h2>
|
||
<div class="sectionbody">
|
||
<div class="paragraph">
|
||
<p>Indicators related to an Android app.</p>
|
||
</div>
|
||
<div class="admonitionblock note">
|
||
<table>
|
||
<tr>
|
||
<td class="icon">
|
||
<i class="fa icon-note" title="Note"></i>
|
||
</td>
|
||
<td class="content">
|
||
android-app is a MISP object available in JSON format at <a href="https://github.com/MISP/misp-objects/blob/main/objects/android-app/definition.json"><strong>this location</strong></a> The JSON format can be freely reused in your application or automatically enabled in <a href="https://www.github.com/MISP/MISP">MISP</a>.
|
||
</td>
|
||
</tr>
|
||
</table>
|
||
</div>
|
||
<table class="tableblock frame-all grid-all stretch">
|
||
<colgroup>
|
||
<col style="width: 20%;">
|
||
<col style="width: 20%;">
|
||
<col style="width: 20%;">
|
||
<col style="width: 20%;">
|
||
<col style="width: 20%;">
|
||
</colgroup>
|
||
<thead>
|
||
<tr>
|
||
<th class="tableblock halign-left valign-top">Object attribute</th>
|
||
<th class="tableblock halign-left valign-top">MISP attribute type</th>
|
||
<th class="tableblock halign-left valign-top">Description</th>
|
||
<th class="tableblock halign-left valign-top">Disable correlation</th>
|
||
<th class="tableblock halign-left valign-top">Multiple</th>
|
||
</tr>
|
||
</thead>
|
||
<tbody>
|
||
<tr>
|
||
<td class="tableblock halign-left valign-top"><p class="tableblock">appid</p></td>
|
||
<td class="tableblock halign-left valign-top"><p class="tableblock">text</p></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p>Application ID</p>
|
||
</div></div></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p><span class="icon"><i class="fa fa-minus"></i></span></p>
|
||
</div></div></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p><span class="icon"><i class="fa fa-check"></i></span></p>
|
||
</div></div></td>
|
||
</tr>
|
||
<tr>
|
||
<td class="tableblock halign-left valign-top"><p class="tableblock">certificate</p></td>
|
||
<td class="tableblock halign-left valign-top"><p class="tableblock">sha1</p></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p>Android certificate</p>
|
||
</div></div></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p><span class="icon"><i class="fa fa-minus"></i></span></p>
|
||
</div></div></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p><span class="icon"><i class="fa fa-check"></i></span></p>
|
||
</div></div></td>
|
||
</tr>
|
||
<tr>
|
||
<td class="tableblock halign-left valign-top"><p class="tableblock">domain</p></td>
|
||
<td class="tableblock halign-left valign-top"><p class="tableblock">domain</p></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p>Domain used by the app</p>
|
||
</div></div></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p><span class="icon"><i class="fa fa-minus"></i></span></p>
|
||
</div></div></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p><span class="icon"><i class="fa fa-check"></i></span></p>
|
||
</div></div></td>
|
||
</tr>
|
||
<tr>
|
||
<td class="tableblock halign-left valign-top"><p class="tableblock">name</p></td>
|
||
<td class="tableblock halign-left valign-top"><p class="tableblock">text</p></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p>Generic name of the application</p>
|
||
</div></div></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p><span class="icon"><i class="fa fa-minus"></i></span></p>
|
||
</div></div></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p><span class="icon"><i class="fa fa-minus"></i></span></p>
|
||
</div></div></td>
|
||
</tr>
|
||
<tr>
|
||
<td class="tableblock halign-left valign-top"><p class="tableblock">sha256</p></td>
|
||
<td class="tableblock halign-left valign-top"><p class="tableblock">sha256</p></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p>SHA256 of the APK.</p>
|
||
</div></div></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p><span class="icon"><i class="fa fa-minus"></i></span></p>
|
||
</div></div></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p><span class="icon"><i class="fa fa-check"></i></span></p>
|
||
</div></div></td>
|
||
</tr>
|
||
</tbody>
|
||
</table>
|
||
</div>
|
||
</div>
|
||
<div class="sect1">
|
||
<h2 id="_android_permission"><a class="anchor" href="#_android_permission"></a><a class="link" href="#_android_permission">android-permission</a></h2>
|
||
<div class="sectionbody">
|
||
<div class="paragraph">
|
||
<p>A set of android permissions - one or more permission(s) which can be linked to other objects (e.g. malware, app).</p>
|
||
</div>
|
||
<div class="admonitionblock note">
|
||
<table>
|
||
<tr>
|
||
<td class="icon">
|
||
<i class="fa icon-note" title="Note"></i>
|
||
</td>
|
||
<td class="content">
|
||
android-permission is a MISP object available in JSON format at <a href="https://github.com/MISP/misp-objects/blob/main/objects/android-permission/definition.json"><strong>this location</strong></a> The JSON format can be freely reused in your application or automatically enabled in <a href="https://www.github.com/MISP/MISP">MISP</a>.
|
||
</td>
|
||
</tr>
|
||
</table>
|
||
</div>
|
||
<table class="tableblock frame-all grid-all stretch">
|
||
<colgroup>
|
||
<col style="width: 20%;">
|
||
<col style="width: 20%;">
|
||
<col style="width: 20%;">
|
||
<col style="width: 20%;">
|
||
<col style="width: 20%;">
|
||
</colgroup>
|
||
<thead>
|
||
<tr>
|
||
<th class="tableblock halign-left valign-top">Object attribute</th>
|
||
<th class="tableblock halign-left valign-top">MISP attribute type</th>
|
||
<th class="tableblock halign-left valign-top">Description</th>
|
||
<th class="tableblock halign-left valign-top">Disable correlation</th>
|
||
<th class="tableblock halign-left valign-top">Multiple</th>
|
||
</tr>
|
||
</thead>
|
||
<tbody>
|
||
<tr>
|
||
<td class="tableblock halign-left valign-top"><p class="tableblock">comment</p></td>
|
||
<td class="tableblock halign-left valign-top"><p class="tableblock">comment</p></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p>Comment about the set of android permission(s)</p>
|
||
</div></div></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p><span class="icon"><i class="fa fa-minus"></i></span></p>
|
||
</div></div></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p><span class="icon"><i class="fa fa-minus"></i></span></p>
|
||
</div></div></td>
|
||
</tr>
|
||
<tr>
|
||
<td class="tableblock halign-left valign-top"><p class="tableblock">permission</p></td>
|
||
<td class="tableblock halign-left valign-top"><p class="tableblock">text</p></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p>Android permission ['ACCESS_CHECKIN_PROPERTIES', 'ACCESS_COARSE_LOCATION', 'ACCESS_FINE_LOCATION', 'ACCESS_LOCATION_EXTRA_COMMANDS', 'ACCESS_NETWORK_STATE', 'ACCESS_NOTIFICATION_POLICY', 'ACCESS_WIFI_STATE', 'ACCOUNT_MANAGER', 'ADD_VOICEMAIL', 'ANSWER_PHONE_CALLS', 'BATTERY_STATS', 'BIND_ACCESSIBILITY_SERVICE', 'BIND_APPWIDGET', 'BIND_AUTOFILL_SERVICE', 'BIND_CARRIER_MESSAGING_SERVICE', 'BIND_CHOOSER_TARGET_SERVICE', 'BIND_CONDITION_PROVIDER_SERVICE', 'BIND_DEVICE_ADMIN', 'BIND_DREAM_SERVICE', 'BIND_INCALL_SERVICE', 'BIND_INPUT_METHOD', 'BIND_MIDI_DEVICE_SERVICE', 'BIND_NFC_SERVICE', 'BIND_NOTIFICATION_LISTENER_SERVICE', 'BIND_PRINT_SERVICE', 'BIND_QUICK_SETTINGS_TILE', 'BIND_REMOTEVIEWS', 'BIND_SCREENING_SERVICE', 'BIND_TELECOM_CONNECTION_SERVICE', 'BIND_TEXT_SERVICE', 'BIND_TV_INPUT', 'BIND_VISUAL_VOICEMAIL_SERVICE', 'BIND_VOICE_INTERACTION', 'BIND_VPN_SERVICE', 'BIND_VR_LISTENER_SERVICE', 'BIND_WALLPAPER', 'BLUETOOTH', 'BLUETOOTH_ADMIN', 'BLUETOOTH_PRIVILEGED', 'BODY_SENSORS', 'BROADCAST_PACKAGE_REMOVED', 'BROADCAST_SMS', 'BROADCAST_STICKY', 'BROADCAST_WAP_PUSH', 'CALL_PHONE', 'CALL_PRIVILEGED', 'CAMERA', 'CAPTURE_AUDIO_OUTPUT', 'CAPTURE_SECURE_VIDEO_OUTPUT', 'CAPTURE_VIDEO_OUTPUT', 'CHANGE_COMPONENT_ENABLED_STATE', 'CHANGE_CONFIGURATION', 'CHANGE_NETWORK_STATE', 'CHANGE_WIFI_MULTICAST_STATE', 'CHANGE_WIFI_STATE', 'CLEAR_APP_CACHE', 'CONTROL_LOCATION_UPDATES', 'DELETE_CACHE_FILES', 'DELETE_PACKAGES', 'DIAGNOSTIC', 'DISABLE_KEYGUARD', 'DUMP', 'EXPAND_STATUS_BAR', 'FACTORY_TEST', 'GET_ACCOUNTS', 'GET_ACCOUNTS_PRIVILEGED', 'GET_PACKAGE_SIZE', 'GET_TASKS', 'GLOBAL_SEARCH', 'INSTALL_LOCATION_PROVIDER', 'INSTALL_PACKAGES', 'INSTALL_SHORTCUT', 'INSTANT_APP_FOREGROUND_SERVICE', 'INTERNET', 'KILL_BACKGROUND_PROCESSES', 'LOCATION_HARDWARE', 'MANAGE_DOCUMENTS', 'MANAGE_OWN_CALLS', 'MASTER_CLEAR', 'MEDIA_CONTENT_CONTROL', 'MODIFY_AUDIO_SETTINGS', 'MODIFY_PHONE_STATE', 'MOUNT_FORMAT_FILESYSTEMS', 'MOUNT_UNMOUNT_FILESYSTEMS', 'NFC', 'PACKAGE_USAGE_STATS', 'PERSISTENT_ACTIVITY', 'PROCESS_OUTGOING_CALLS', 'READ_CALENDAR', 'READ_CALL_LOG', 'READ_CONTACTS', 'READ_EXTERNAL_STORAGE', 'READ_FRAME_BUFFER', 'READ_INPUT_STATE', 'READ_LOGS', 'READ_PHONE_NUMBERS', 'READ_PHONE_STATE', 'READ_SMS', 'READ_SYNC_SETTINGS', 'READ_SYNC_STATS', 'READ_VOICEMAIL', 'REBOOT', 'RECEIVE_BOOT_COMPLETED', 'RECEIVE_MMS', 'RECEIVE_SMS', 'RECEIVE_WAP_PUSH', 'RECORD_AUDIO', 'REORDER_TASKS', 'REQUEST_COMPANION_RUN_IN_BACKGROUND', 'REQUEST_COMPANION_USE_DATA_IN_BACKGROUND', 'REQUEST_DELETE_PACKAGES', 'REQUEST_IGNORE_BATTERY_OPTIMIZATIONS', 'REQUEST_INSTALL_PACKAGES', 'RESTART_PACKAGES', 'SEND_RESPOND_VIA_MESSAGE', 'SEND_SMS', 'SET_ALARM', 'SET_ALWAYS_FINISH', 'SET_ANIMATION_SCALE', 'SET_DEBUG_APP', 'SET_PREFERRED_APPLICATIONS', 'SET_PROCESS_LIMIT', 'SET_TIME', 'SET_TIME_ZONE', 'SET_WALLPAPER', 'SET_WALLPAPER_HINTS', 'SIGNAL_PERSISTENT_PROCESSES', 'STATUS_BAR', 'SYSTEM_ALERT_WINDOW', 'TRANSMIT_IR', 'UNINSTALL_SHORTCUT', 'UPDATE_DEVICE_STATS', 'USE_FINGERPRINT', 'USE_SIP', 'VIBRATE', 'WAKE_LOCK', 'WRITE_APN_SETTINGS', 'WRITE_CALENDAR', 'WRITE_CALL_LOG', 'WRITE_CONTACTS', 'WRITE_EXTERNAL_STORAGE', 'WRITE_GSERVICES', 'WRITE_SECURE_SETTINGS', 'WRITE_SETTINGS', 'WRITE_SYNC_SETTINGS', 'WRITE_VOICEMAIL']</p>
|
||
</div></div></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p><span class="icon"><i class="fa fa-minus"></i></span></p>
|
||
</div></div></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p><span class="icon"><i class="fa fa-check"></i></span></p>
|
||
</div></div></td>
|
||
</tr>
|
||
</tbody>
|
||
</table>
|
||
</div>
|
||
</div>
|
||
<div class="sect1">
|
||
<h2 id="_annotation"><a class="anchor" href="#_annotation"></a><a class="link" href="#_annotation">annotation</a></h2>
|
||
<div class="sectionbody">
|
||
<div class="paragraph">
|
||
<p>An annotation object allowing analysts to add annotations, comments, executive summary to a MISP event, objects or attributes.</p>
|
||
</div>
|
||
<div class="admonitionblock note">
|
||
<table>
|
||
<tr>
|
||
<td class="icon">
|
||
<i class="fa icon-note" title="Note"></i>
|
||
</td>
|
||
<td class="content">
|
||
annotation is a MISP object available in JSON format at <a href="https://github.com/MISP/misp-objects/blob/main/objects/annotation/definition.json"><strong>this location</strong></a> The JSON format can be freely reused in your application or automatically enabled in <a href="https://www.github.com/MISP/MISP">MISP</a>.
|
||
</td>
|
||
</tr>
|
||
</table>
|
||
</div>
|
||
<table class="tableblock frame-all grid-all stretch">
|
||
<colgroup>
|
||
<col style="width: 20%;">
|
||
<col style="width: 20%;">
|
||
<col style="width: 20%;">
|
||
<col style="width: 20%;">
|
||
<col style="width: 20%;">
|
||
</colgroup>
|
||
<thead>
|
||
<tr>
|
||
<th class="tableblock halign-left valign-top">Object attribute</th>
|
||
<th class="tableblock halign-left valign-top">MISP attribute type</th>
|
||
<th class="tableblock halign-left valign-top">Description</th>
|
||
<th class="tableblock halign-left valign-top">Disable correlation</th>
|
||
<th class="tableblock halign-left valign-top">Multiple</th>
|
||
</tr>
|
||
</thead>
|
||
<tbody>
|
||
<tr>
|
||
<td class="tableblock halign-left valign-top"><p class="tableblock">attachment</p></td>
|
||
<td class="tableblock halign-left valign-top"><p class="tableblock">attachment</p></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p>An attachment to support the annotation</p>
|
||
</div></div></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p><span class="icon"><i class="fa fa-minus"></i></span></p>
|
||
</div></div></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p><span class="icon"><i class="fa fa-check"></i></span></p>
|
||
</div></div></td>
|
||
</tr>
|
||
<tr>
|
||
<td class="tableblock halign-left valign-top"><p class="tableblock">creation-date</p></td>
|
||
<td class="tableblock halign-left valign-top"><p class="tableblock">datetime</p></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p>Initial creation of the annotation</p>
|
||
</div></div></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p><span class="icon"><i class="fa fa-minus"></i></span></p>
|
||
</div></div></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p><span class="icon"><i class="fa fa-minus"></i></span></p>
|
||
</div></div></td>
|
||
</tr>
|
||
<tr>
|
||
<td class="tableblock halign-left valign-top"><p class="tableblock">format</p></td>
|
||
<td class="tableblock halign-left valign-top"><p class="tableblock">text</p></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p>Format of the annotation ['text', 'markdown', 'asciidoctor', 'MultiMarkdown', 'GFM', 'pandoc', 'Fountain', 'CommonWork', 'kramdown-rfc2629', 'rfc7328', 'Extra']</p>
|
||
</div></div></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p><span class="icon"><i class="fa fa-check"></i></span></p>
|
||
</div></div></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p><span class="icon"><i class="fa fa-minus"></i></span></p>
|
||
</div></div></td>
|
||
</tr>
|
||
<tr>
|
||
<td class="tableblock halign-left valign-top"><p class="tableblock">modification-date</p></td>
|
||
<td class="tableblock halign-left valign-top"><p class="tableblock">datetime</p></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p>Last update of the annotation</p>
|
||
</div></div></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p><span class="icon"><i class="fa fa-minus"></i></span></p>
|
||
</div></div></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p><span class="icon"><i class="fa fa-minus"></i></span></p>
|
||
</div></div></td>
|
||
</tr>
|
||
<tr>
|
||
<td class="tableblock halign-left valign-top"><p class="tableblock">ref</p></td>
|
||
<td class="tableblock halign-left valign-top"><p class="tableblock">link</p></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p>Reference(s) to the annotation</p>
|
||
</div></div></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p><span class="icon"><i class="fa fa-minus"></i></span></p>
|
||
</div></div></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p><span class="icon"><i class="fa fa-check"></i></span></p>
|
||
</div></div></td>
|
||
</tr>
|
||
<tr>
|
||
<td class="tableblock halign-left valign-top"><p class="tableblock">text</p></td>
|
||
<td class="tableblock halign-left valign-top"><p class="tableblock">text</p></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p>Raw text of the annotation</p>
|
||
</div></div></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p><span class="icon"><i class="fa fa-minus"></i></span></p>
|
||
</div></div></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p><span class="icon"><i class="fa fa-minus"></i></span></p>
|
||
</div></div></td>
|
||
</tr>
|
||
<tr>
|
||
<td class="tableblock halign-left valign-top"><p class="tableblock">type</p></td>
|
||
<td class="tableblock halign-left valign-top"><p class="tableblock">text</p></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p>Type of the annotation ['Annotation', 'Executive Summary', 'Introduction', 'Conclusion', 'Disclaimer', 'Keywords', 'Acknowledgement', 'Other', 'Copyright', 'Authors', 'Logo', 'Full Report']</p>
|
||
</div></div></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p><span class="icon"><i class="fa fa-check"></i></span></p>
|
||
</div></div></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p><span class="icon"><i class="fa fa-minus"></i></span></p>
|
||
</div></div></td>
|
||
</tr>
|
||
</tbody>
|
||
</table>
|
||
</div>
|
||
</div>
|
||
<div class="sect1">
|
||
<h2 id="_anonymisation"><a class="anchor" href="#_anonymisation"></a><a class="link" href="#_anonymisation">anonymisation</a></h2>
|
||
<div class="sectionbody">
|
||
<div class="paragraph">
|
||
<p>Anonymisation object describing an anonymisation technique used to encode MISP attribute values. Reference: <a href="https://www.caida.org/tools/taxonomy/anonymization.xml" class="bare">https://www.caida.org/tools/taxonomy/anonymization.xml</a>.</p>
|
||
</div>
|
||
<div class="admonitionblock note">
|
||
<table>
|
||
<tr>
|
||
<td class="icon">
|
||
<i class="fa icon-note" title="Note"></i>
|
||
</td>
|
||
<td class="content">
|
||
anonymisation is a MISP object available in JSON format at <a href="https://github.com/MISP/misp-objects/blob/main/objects/anonymisation/definition.json"><strong>this location</strong></a> The JSON format can be freely reused in your application or automatically enabled in <a href="https://www.github.com/MISP/MISP">MISP</a>.
|
||
</td>
|
||
</tr>
|
||
</table>
|
||
</div>
|
||
<table class="tableblock frame-all grid-all stretch">
|
||
<colgroup>
|
||
<col style="width: 20%;">
|
||
<col style="width: 20%;">
|
||
<col style="width: 20%;">
|
||
<col style="width: 20%;">
|
||
<col style="width: 20%;">
|
||
</colgroup>
|
||
<thead>
|
||
<tr>
|
||
<th class="tableblock halign-left valign-top">Object attribute</th>
|
||
<th class="tableblock halign-left valign-top">MISP attribute type</th>
|
||
<th class="tableblock halign-left valign-top">Description</th>
|
||
<th class="tableblock halign-left valign-top">Disable correlation</th>
|
||
<th class="tableblock halign-left valign-top">Multiple</th>
|
||
</tr>
|
||
</thead>
|
||
<tbody>
|
||
<tr>
|
||
<td class="tableblock halign-left valign-top"><p class="tableblock">description</p></td>
|
||
<td class="tableblock halign-left valign-top"><p class="tableblock">text</p></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p>Description of the anonymisation technique or tool used</p>
|
||
</div></div></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p><span class="icon"><i class="fa fa-check"></i></span></p>
|
||
</div></div></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p><span class="icon"><i class="fa fa-minus"></i></span></p>
|
||
</div></div></td>
|
||
</tr>
|
||
<tr>
|
||
<td class="tableblock halign-left valign-top"><p class="tableblock">encryption-function</p></td>
|
||
<td class="tableblock halign-left valign-top"><p class="tableblock">text</p></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p>Encryption function or algorithm used to anonymise the attribute ['aes128', 'aes-128-cbc', 'aes-128-cfb', 'aes-128-cfb1', 'aes-128-cfb8', 'aes-128-ctr', 'aes-128-ecb', 'aes-128-ofb', 'aes192', 'aes-192-cbc', 'aes-192-cfb', 'aes-192-cfb1', 'aes-192-cfb8', 'aes-192-ctr', 'aes-192-ecb', 'aes-192-ofb', 'aes-256-cfb', 'aes-256-cfb1', 'aes-256-cfb8', 'aes-256-ctr', 'aes-256-ecb', 'aes-256-ofb', 'bf', 'bf-cbc', 'bf-cfb', 'bf-ecb', 'bf-ofb', 'blowfish', 'camellia128', 'camellia-128-cbc', 'camellia-128-cfb', 'camellia-128-cfb1', 'camellia-128-cfb8', 'camellia-128-ctr', 'camellia-128-ecb', 'camellia-128-ofb', 'camellia192', 'camellia-192-cbc', 'camellia-192-cfb', 'camellia-192-cfb1', 'camellia-192-cfb8', 'camellia-192-ctr', 'camellia-192-ecb', 'camellia-192-ofb', 'camellia256', 'camellia-256-cbc', 'camellia-256-cfb', 'camellia-256-cfb1', 'camellia-256-cfb8', 'camellia-256-ctr', 'camellia-256-ecb', 'camellia-256-ofb', 'cast', 'cast5-cbc', 'cast5-cfb', 'cast5-ecb', 'cast5-ofb', 'cast-cbc', 'des', 'des3', 'des-cbc', 'des-cfb', 'des-ecb', 'des-ede', 'des-ede3', 'des-ede3-cbc', 'des-ede3-cfb', 'des-ede3-ofb', 'des-ede-cbc', 'des-ede-cfb', 'des-ede-ofb', 'des-ofb', 'desx', 'gost89', 'gost89-cnt', 'idea', 'idea-cbc', 'idea-cfb', 'idea-ecb', 'idea-ofb', 'rc2', 'rc2-40-cbc', 'rc2-64-cbc', 'rc2-cbc', 'rc2-cfb', 'rc2-ecb', 'rc2-ofb', 'rc4', 'rc4-40', 'rc4-64', 'rc5', 'rc5-cbc', 'rc5-cfb', 'rc5-ecb', 'rc5-ofb', 'seed', 'seed-cbc', 'seed-cfb', 'seed-ecb', 'seed-ofb', 'sm4', 'sm4-cbc', 'sm4-cfb', 'sm4-ctr', 'sm4-ecb', 'sm4-ofb']</p>
|
||
</div></div></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p><span class="icon"><i class="fa fa-check"></i></span></p>
|
||
</div></div></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p><span class="icon"><i class="fa fa-minus"></i></span></p>
|
||
</div></div></td>
|
||
</tr>
|
||
<tr>
|
||
<td class="tableblock halign-left valign-top"><p class="tableblock">iv</p></td>
|
||
<td class="tableblock halign-left valign-top"><p class="tableblock">text</p></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p>Initialisation vector for the encryption function used to anonymise the attribute</p>
|
||
</div></div></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p><span class="icon"><i class="fa fa-check"></i></span></p>
|
||
</div></div></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p><span class="icon"><i class="fa fa-minus"></i></span></p>
|
||
</div></div></td>
|
||
</tr>
|
||
<tr>
|
||
<td class="tableblock halign-left valign-top"><p class="tableblock">key</p></td>
|
||
<td class="tableblock halign-left valign-top"><p class="tableblock">text</p></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p>Key (such as a PSK in a keyed-hash-function) used to anonymise the attribute</p>
|
||
</div></div></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p><span class="icon"><i class="fa fa-check"></i></span></p>
|
||
</div></div></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p><span class="icon"><i class="fa fa-minus"></i></span></p>
|
||
</div></div></td>
|
||
</tr>
|
||
<tr>
|
||
<td class="tableblock halign-left valign-top"><p class="tableblock">keyed-hash-function</p></td>
|
||
<td class="tableblock halign-left valign-top"><p class="tableblock">text</p></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p>Keyed-hash function used to anonymise the attribute ['hmac-sha1', 'hmac-md5', 'hmac-sha256', 'hmac-sha384', 'hmac-sha512']</p>
|
||
</div></div></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p><span class="icon"><i class="fa fa-check"></i></span></p>
|
||
</div></div></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p><span class="icon"><i class="fa fa-minus"></i></span></p>
|
||
</div></div></td>
|
||
</tr>
|
||
<tr>
|
||
<td class="tableblock halign-left valign-top"><p class="tableblock">level-of-knowledge</p></td>
|
||
<td class="tableblock halign-left valign-top"><p class="tableblock">text</p></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p>Level of knowledge of the organisation who created this object ['Only the anonymised data is known', 'Deanonymised data is known']</p>
|
||
</div></div></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p><span class="icon"><i class="fa fa-check"></i></span></p>
|
||
</div></div></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p><span class="icon"><i class="fa fa-minus"></i></span></p>
|
||
</div></div></td>
|
||
</tr>
|
||
<tr>
|
||
<td class="tableblock halign-left valign-top"><p class="tableblock">method</p></td>
|
||
<td class="tableblock halign-left valign-top"><p class="tableblock">text</p></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p>Anonymisation (or pseudo-anonymisation) method(s) used ["hiding - Attribute is replaced with a constant value (typically 0) of the same size. Sometimes called 'black marker'.", 'hash - A hash function maps each attribute to a new (not necessarily unique) attribute.', 'permutation - Maps each original value to a unique new value.', "prefix-preserving - Any two values that had the same n-bit prefix before anonymisation will still have the same n-bit prefix as each other after anonymization. (Would be more accurately called 'prefix-relationship-preserving', because the actual prefix values are not preserved.) ", 'shift - Adds a fixed offset to each value/attribute.', 'enumeration - Map each original value to a new value such that their ordering is preserved.', 'partitioning - Possible values are partitioned into meaningful sets; actual values are replaced with a fixed value from the same set. E.g., TCP port numbers 0 to 1023 are replaced with 0, and 1024 to 65535 replaced with 65535.', 'updated - Checksums are recalculated to reflect changes made to other fields.', 'truncation - Field is shortened, losing data at the end.', 'encryption - Attribute is encrypted.']</p>
|
||
</div></div></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p><span class="icon"><i class="fa fa-check"></i></span></p>
|
||
</div></div></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p><span class="icon"><i class="fa fa-check"></i></span></p>
|
||
</div></div></td>
|
||
</tr>
|
||
<tr>
|
||
<td class="tableblock halign-left valign-top"><p class="tableblock">regexp</p></td>
|
||
<td class="tableblock halign-left valign-top"><p class="tableblock">text</p></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p>Regular expression to perfom the anonymisation (reversible or not)</p>
|
||
</div></div></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p><span class="icon"><i class="fa fa-check"></i></span></p>
|
||
</div></div></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p><span class="icon"><i class="fa fa-minus"></i></span></p>
|
||
</div></div></td>
|
||
</tr>
|
||
</tbody>
|
||
</table>
|
||
</div>
|
||
</div>
|
||
<div class="sect1">
|
||
<h2 id="_asn"><a class="anchor" href="#_asn"></a><a class="link" href="#_asn">asn</a></h2>
|
||
<div class="sectionbody">
|
||
<div class="paragraph">
|
||
<p>Autonomous system object describing an autonomous system which can include one or more network operators management an entity (e.g. ISP) along with their routing policy, routing prefixes or alike.</p>
|
||
</div>
|
||
<div class="admonitionblock note">
|
||
<table>
|
||
<tr>
|
||
<td class="icon">
|
||
<i class="fa icon-note" title="Note"></i>
|
||
</td>
|
||
<td class="content">
|
||
asn is a MISP object available in JSON format at <a href="https://github.com/MISP/misp-objects/blob/main/objects/asn/definition.json"><strong>this location</strong></a> The JSON format can be freely reused in your application or automatically enabled in <a href="https://www.github.com/MISP/MISP">MISP</a>.
|
||
</td>
|
||
</tr>
|
||
</table>
|
||
</div>
|
||
<table class="tableblock frame-all grid-all stretch">
|
||
<colgroup>
|
||
<col style="width: 20%;">
|
||
<col style="width: 20%;">
|
||
<col style="width: 20%;">
|
||
<col style="width: 20%;">
|
||
<col style="width: 20%;">
|
||
</colgroup>
|
||
<thead>
|
||
<tr>
|
||
<th class="tableblock halign-left valign-top">Object attribute</th>
|
||
<th class="tableblock halign-left valign-top">MISP attribute type</th>
|
||
<th class="tableblock halign-left valign-top">Description</th>
|
||
<th class="tableblock halign-left valign-top">Disable correlation</th>
|
||
<th class="tableblock halign-left valign-top">Multiple</th>
|
||
</tr>
|
||
</thead>
|
||
<tbody>
|
||
<tr>
|
||
<td class="tableblock halign-left valign-top"><p class="tableblock">asn</p></td>
|
||
<td class="tableblock halign-left valign-top"><p class="tableblock">AS</p></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p>Autonomous System Number</p>
|
||
</div></div></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p><span class="icon"><i class="fa fa-minus"></i></span></p>
|
||
</div></div></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p><span class="icon"><i class="fa fa-minus"></i></span></p>
|
||
</div></div></td>
|
||
</tr>
|
||
<tr>
|
||
<td class="tableblock halign-left valign-top"><p class="tableblock">country</p></td>
|
||
<td class="tableblock halign-left valign-top"><p class="tableblock">text</p></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p>Country code of the main location of the autonomous system</p>
|
||
</div></div></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p><span class="icon"><i class="fa fa-minus"></i></span></p>
|
||
</div></div></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p><span class="icon"><i class="fa fa-minus"></i></span></p>
|
||
</div></div></td>
|
||
</tr>
|
||
<tr>
|
||
<td class="tableblock halign-left valign-top"><p class="tableblock">description</p></td>
|
||
<td class="tableblock halign-left valign-top"><p class="tableblock">text</p></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p>Description of the autonomous system</p>
|
||
</div></div></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p><span class="icon"><i class="fa fa-minus"></i></span></p>
|
||
</div></div></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p><span class="icon"><i class="fa fa-minus"></i></span></p>
|
||
</div></div></td>
|
||
</tr>
|
||
<tr>
|
||
<td class="tableblock halign-left valign-top"><p class="tableblock">export</p></td>
|
||
<td class="tableblock halign-left valign-top"><p class="tableblock">text</p></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p>The outbound routing policy of the AS in RFC 2622 – Routing Policy Specification Language (RPSL) format</p>
|
||
</div></div></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p><span class="icon"><i class="fa fa-minus"></i></span></p>
|
||
</div></div></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p><span class="icon"><i class="fa fa-check"></i></span></p>
|
||
</div></div></td>
|
||
</tr>
|
||
<tr>
|
||
<td class="tableblock halign-left valign-top"><p class="tableblock">first-seen</p></td>
|
||
<td class="tableblock halign-left valign-top"><p class="tableblock">datetime</p></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p>First time the ASN was seen</p>
|
||
</div></div></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p><span class="icon"><i class="fa fa-check"></i></span></p>
|
||
</div></div></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p><span class="icon"><i class="fa fa-minus"></i></span></p>
|
||
</div></div></td>
|
||
</tr>
|
||
<tr>
|
||
<td class="tableblock halign-left valign-top"><p class="tableblock">import</p></td>
|
||
<td class="tableblock halign-left valign-top"><p class="tableblock">text</p></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p>The inbound IPv4 routing policy of the AS in RFC 2622 – Routing Policy Specification Language (RPSL) format</p>
|
||
</div></div></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p><span class="icon"><i class="fa fa-minus"></i></span></p>
|
||
</div></div></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p><span class="icon"><i class="fa fa-check"></i></span></p>
|
||
</div></div></td>
|
||
</tr>
|
||
<tr>
|
||
<td class="tableblock halign-left valign-top"><p class="tableblock">last-seen</p></td>
|
||
<td class="tableblock halign-left valign-top"><p class="tableblock">datetime</p></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p>Last time the ASN was seen</p>
|
||
</div></div></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p><span class="icon"><i class="fa fa-check"></i></span></p>
|
||
</div></div></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p><span class="icon"><i class="fa fa-minus"></i></span></p>
|
||
</div></div></td>
|
||
</tr>
|
||
<tr>
|
||
<td class="tableblock halign-left valign-top"><p class="tableblock">mp-export</p></td>
|
||
<td class="tableblock halign-left valign-top"><p class="tableblock">text</p></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p>This attribute performs the same function as the export attribute above. The difference is that mp-export allows both IPv4 and IPv6 address families to be specified. The export is described in RFC 4012 – Routing Policy Specification Language next generation (RPSLng), section 4.5. format</p>
|
||
</div></div></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p><span class="icon"><i class="fa fa-minus"></i></span></p>
|
||
</div></div></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p><span class="icon"><i class="fa fa-check"></i></span></p>
|
||
</div></div></td>
|
||
</tr>
|
||
<tr>
|
||
<td class="tableblock halign-left valign-top"><p class="tableblock">mp-import</p></td>
|
||
<td class="tableblock halign-left valign-top"><p class="tableblock">text</p></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p>The inbound IPv4 or IPv6 routing policy of the AS in RFC 4012 – Routing Policy Specification Language next generation (RPSLng), section 4.5. format</p>
|
||
</div></div></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p><span class="icon"><i class="fa fa-minus"></i></span></p>
|
||
</div></div></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p><span class="icon"><i class="fa fa-check"></i></span></p>
|
||
</div></div></td>
|
||
</tr>
|
||
<tr>
|
||
<td class="tableblock halign-left valign-top"><p class="tableblock">subnet-announced</p></td>
|
||
<td class="tableblock halign-left valign-top"><p class="tableblock">ip-src</p></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p>Subnet announced</p>
|
||
</div></div></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p><span class="icon"><i class="fa fa-minus"></i></span></p>
|
||
</div></div></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p><span class="icon"><i class="fa fa-check"></i></span></p>
|
||
</div></div></td>
|
||
</tr>
|
||
</tbody>
|
||
</table>
|
||
</div>
|
||
</div>
|
||
<div class="sect1">
|
||
<h2 id="_attack_pattern"><a class="anchor" href="#_attack_pattern"></a><a class="link" href="#_attack_pattern">attack-pattern</a></h2>
|
||
<div class="sectionbody">
|
||
<div class="paragraph">
|
||
<p>Attack pattern describing a common attack pattern enumeration and classification.</p>
|
||
</div>
|
||
<div class="admonitionblock note">
|
||
<table>
|
||
<tr>
|
||
<td class="icon">
|
||
<i class="fa icon-note" title="Note"></i>
|
||
</td>
|
||
<td class="content">
|
||
attack-pattern is a MISP object available in JSON format at <a href="https://github.com/MISP/misp-objects/blob/main/objects/attack-pattern/definition.json"><strong>this location</strong></a> The JSON format can be freely reused in your application or automatically enabled in <a href="https://www.github.com/MISP/MISP">MISP</a>.
|
||
</td>
|
||
</tr>
|
||
</table>
|
||
</div>
|
||
<table class="tableblock frame-all grid-all stretch">
|
||
<colgroup>
|
||
<col style="width: 20%;">
|
||
<col style="width: 20%;">
|
||
<col style="width: 20%;">
|
||
<col style="width: 20%;">
|
||
<col style="width: 20%;">
|
||
</colgroup>
|
||
<thead>
|
||
<tr>
|
||
<th class="tableblock halign-left valign-top">Object attribute</th>
|
||
<th class="tableblock halign-left valign-top">MISP attribute type</th>
|
||
<th class="tableblock halign-left valign-top">Description</th>
|
||
<th class="tableblock halign-left valign-top">Disable correlation</th>
|
||
<th class="tableblock halign-left valign-top">Multiple</th>
|
||
</tr>
|
||
</thead>
|
||
<tbody>
|
||
<tr>
|
||
<td class="tableblock halign-left valign-top"><p class="tableblock">id</p></td>
|
||
<td class="tableblock halign-left valign-top"><p class="tableblock">text</p></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p>CAPEC ID.</p>
|
||
</div></div></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p><span class="icon"><i class="fa fa-check"></i></span></p>
|
||
</div></div></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p><span class="icon"><i class="fa fa-minus"></i></span></p>
|
||
</div></div></td>
|
||
</tr>
|
||
<tr>
|
||
<td class="tableblock halign-left valign-top"><p class="tableblock">name</p></td>
|
||
<td class="tableblock halign-left valign-top"><p class="tableblock">text</p></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p>Name of the attack pattern.</p>
|
||
</div></div></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p><span class="icon"><i class="fa fa-minus"></i></span></p>
|
||
</div></div></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p><span class="icon"><i class="fa fa-minus"></i></span></p>
|
||
</div></div></td>
|
||
</tr>
|
||
<tr>
|
||
<td class="tableblock halign-left valign-top"><p class="tableblock">prerequisites</p></td>
|
||
<td class="tableblock halign-left valign-top"><p class="tableblock">text</p></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p>Prerequisites for the attack pattern to succeed.</p>
|
||
</div></div></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p><span class="icon"><i class="fa fa-minus"></i></span></p>
|
||
</div></div></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p><span class="icon"><i class="fa fa-minus"></i></span></p>
|
||
</div></div></td>
|
||
</tr>
|
||
<tr>
|
||
<td class="tableblock halign-left valign-top"><p class="tableblock">references</p></td>
|
||
<td class="tableblock halign-left valign-top"><p class="tableblock">link</p></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p>External references</p>
|
||
</div></div></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p><span class="icon"><i class="fa fa-minus"></i></span></p>
|
||
</div></div></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p><span class="icon"><i class="fa fa-check"></i></span></p>
|
||
</div></div></td>
|
||
</tr>
|
||
<tr>
|
||
<td class="tableblock halign-left valign-top"><p class="tableblock">related-weakness</p></td>
|
||
<td class="tableblock halign-left valign-top"><p class="tableblock">weakness</p></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p>Weakness related to the attack pattern.</p>
|
||
</div></div></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p><span class="icon"><i class="fa fa-minus"></i></span></p>
|
||
</div></div></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p><span class="icon"><i class="fa fa-check"></i></span></p>
|
||
</div></div></td>
|
||
</tr>
|
||
<tr>
|
||
<td class="tableblock halign-left valign-top"><p class="tableblock">solutions</p></td>
|
||
<td class="tableblock halign-left valign-top"><p class="tableblock">text</p></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p>Solutions for the attack pattern to be countered.</p>
|
||
</div></div></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p><span class="icon"><i class="fa fa-minus"></i></span></p>
|
||
</div></div></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p><span class="icon"><i class="fa fa-minus"></i></span></p>
|
||
</div></div></td>
|
||
</tr>
|
||
<tr>
|
||
<td class="tableblock halign-left valign-top"><p class="tableblock">summary</p></td>
|
||
<td class="tableblock halign-left valign-top"><p class="tableblock">text</p></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p>Summary description of the attack pattern.</p>
|
||
</div></div></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p><span class="icon"><i class="fa fa-minus"></i></span></p>
|
||
</div></div></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p><span class="icon"><i class="fa fa-minus"></i></span></p>
|
||
</div></div></td>
|
||
</tr>
|
||
</tbody>
|
||
</table>
|
||
</div>
|
||
</div>
|
||
<div class="sect1">
|
||
<h2 id="_authentication_failure_report"><a class="anchor" href="#_authentication_failure_report"></a><a class="link" href="#_authentication_failure_report">authentication-failure-report</a></h2>
|
||
<div class="sectionbody">
|
||
<div class="paragraph">
|
||
<p>Authentication Failure Report.</p>
|
||
</div>
|
||
<div class="admonitionblock note">
|
||
<table>
|
||
<tr>
|
||
<td class="icon">
|
||
<i class="fa icon-note" title="Note"></i>
|
||
</td>
|
||
<td class="content">
|
||
authentication-failure-report is a MISP object available in JSON format at <a href="https://github.com/MISP/misp-objects/blob/main/objects/authentication-failure-report/definition.json"><strong>this location</strong></a> The JSON format can be freely reused in your application or automatically enabled in <a href="https://www.github.com/MISP/MISP">MISP</a>.
|
||
</td>
|
||
</tr>
|
||
</table>
|
||
</div>
|
||
<table class="tableblock frame-all grid-all stretch">
|
||
<colgroup>
|
||
<col style="width: 20%;">
|
||
<col style="width: 20%;">
|
||
<col style="width: 20%;">
|
||
<col style="width: 20%;">
|
||
<col style="width: 20%;">
|
||
</colgroup>
|
||
<thead>
|
||
<tr>
|
||
<th class="tableblock halign-left valign-top">Object attribute</th>
|
||
<th class="tableblock halign-left valign-top">MISP attribute type</th>
|
||
<th class="tableblock halign-left valign-top">Description</th>
|
||
<th class="tableblock halign-left valign-top">Disable correlation</th>
|
||
<th class="tableblock halign-left valign-top">Multiple</th>
|
||
</tr>
|
||
</thead>
|
||
<tbody>
|
||
<tr>
|
||
<td class="tableblock halign-left valign-top"><p class="tableblock">ip-dst</p></td>
|
||
<td class="tableblock halign-left valign-top"><p class="tableblock">ip-dst</p></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p>Destination IP.</p>
|
||
</div></div></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p><span class="icon"><i class="fa fa-minus"></i></span></p>
|
||
</div></div></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p><span class="icon"><i class="fa fa-minus"></i></span></p>
|
||
</div></div></td>
|
||
</tr>
|
||
<tr>
|
||
<td class="tableblock halign-left valign-top"><p class="tableblock">ip-src</p></td>
|
||
<td class="tableblock halign-left valign-top"><p class="tableblock">ip-src</p></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p>IP address originating the authentication failure.</p>
|
||
</div></div></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p><span class="icon"><i class="fa fa-minus"></i></span></p>
|
||
</div></div></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p><span class="icon"><i class="fa fa-minus"></i></span></p>
|
||
</div></div></td>
|
||
</tr>
|
||
<tr>
|
||
<td class="tableblock halign-left valign-top"><p class="tableblock">total</p></td>
|
||
<td class="tableblock halign-left valign-top"><p class="tableblock">counter</p></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p>the number of authentication failures reported.</p>
|
||
</div></div></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p><span class="icon"><i class="fa fa-check"></i></span></p>
|
||
</div></div></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p><span class="icon"><i class="fa fa-minus"></i></span></p>
|
||
</div></div></td>
|
||
</tr>
|
||
<tr>
|
||
<td class="tableblock halign-left valign-top"><p class="tableblock">type</p></td>
|
||
<td class="tableblock halign-left valign-top"><p class="tableblock">text</p></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p>the type of authentication failure. ['ssh']</p>
|
||
</div></div></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p><span class="icon"><i class="fa fa-check"></i></span></p>
|
||
</div></div></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p><span class="icon"><i class="fa fa-minus"></i></span></p>
|
||
</div></div></td>
|
||
</tr>
|
||
<tr>
|
||
<td class="tableblock halign-left valign-top"><p class="tableblock">username</p></td>
|
||
<td class="tableblock halign-left valign-top"><p class="tableblock">text</p></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p>the username used.</p>
|
||
</div></div></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p><span class="icon"><i class="fa fa-check"></i></span></p>
|
||
</div></div></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p><span class="icon"><i class="fa fa-minus"></i></span></p>
|
||
</div></div></td>
|
||
</tr>
|
||
</tbody>
|
||
</table>
|
||
</div>
|
||
</div>
|
||
<div class="sect1">
|
||
<h2 id="_authenticode_signerinfo"><a class="anchor" href="#_authenticode_signerinfo"></a><a class="link" href="#_authenticode_signerinfo">authenticode-signerinfo</a></h2>
|
||
<div class="sectionbody">
|
||
<div class="paragraph">
|
||
<p>Authenticode Signer Info.</p>
|
||
</div>
|
||
<div class="admonitionblock note">
|
||
<table>
|
||
<tr>
|
||
<td class="icon">
|
||
<i class="fa icon-note" title="Note"></i>
|
||
</td>
|
||
<td class="content">
|
||
authenticode-signerinfo is a MISP object available in JSON format at <a href="https://github.com/MISP/misp-objects/blob/main/objects/authenticode-signerinfo/definition.json"><strong>this location</strong></a> The JSON format can be freely reused in your application or automatically enabled in <a href="https://www.github.com/MISP/MISP">MISP</a>.
|
||
</td>
|
||
</tr>
|
||
</table>
|
||
</div>
|
||
<table class="tableblock frame-all grid-all stretch">
|
||
<colgroup>
|
||
<col style="width: 20%;">
|
||
<col style="width: 20%;">
|
||
<col style="width: 20%;">
|
||
<col style="width: 20%;">
|
||
<col style="width: 20%;">
|
||
</colgroup>
|
||
<thead>
|
||
<tr>
|
||
<th class="tableblock halign-left valign-top">Object attribute</th>
|
||
<th class="tableblock halign-left valign-top">MISP attribute type</th>
|
||
<th class="tableblock halign-left valign-top">Description</th>
|
||
<th class="tableblock halign-left valign-top">Disable correlation</th>
|
||
<th class="tableblock halign-left valign-top">Multiple</th>
|
||
</tr>
|
||
</thead>
|
||
<tbody>
|
||
<tr>
|
||
<td class="tableblock halign-left valign-top"><p class="tableblock">content-type</p></td>
|
||
<td class="tableblock halign-left valign-top"><p class="tableblock">text</p></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p>Content type</p>
|
||
</div></div></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p><span class="icon"><i class="fa fa-minus"></i></span></p>
|
||
</div></div></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p><span class="icon"><i class="fa fa-minus"></i></span></p>
|
||
</div></div></td>
|
||
</tr>
|
||
<tr>
|
||
<td class="tableblock halign-left valign-top"><p class="tableblock">digest-base64</p></td>
|
||
<td class="tableblock halign-left valign-top"><p class="tableblock">text</p></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p>Signature created by the signing certificate’s private key</p>
|
||
</div></div></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p><span class="icon"><i class="fa fa-check"></i></span></p>
|
||
</div></div></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p><span class="icon"><i class="fa fa-minus"></i></span></p>
|
||
</div></div></td>
|
||
</tr>
|
||
<tr>
|
||
<td class="tableblock halign-left valign-top"><p class="tableblock">digest_algorithm</p></td>
|
||
<td class="tableblock halign-left valign-top"><p class="tableblock">text</p></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p>Algorithm used to hash the file.</p>
|
||
</div></div></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p><span class="icon"><i class="fa fa-check"></i></span></p>
|
||
</div></div></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p><span class="icon"><i class="fa fa-minus"></i></span></p>
|
||
</div></div></td>
|
||
</tr>
|
||
<tr>
|
||
<td class="tableblock halign-left valign-top"><p class="tableblock">encryption_algorithm</p></td>
|
||
<td class="tableblock halign-left valign-top"><p class="tableblock">text</p></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p>Algorithm used to encrypt the digest</p>
|
||
</div></div></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p><span class="icon"><i class="fa fa-check"></i></span></p>
|
||
</div></div></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p><span class="icon"><i class="fa fa-minus"></i></span></p>
|
||
</div></div></td>
|
||
</tr>
|
||
<tr>
|
||
<td class="tableblock halign-left valign-top"><p class="tableblock">issuer</p></td>
|
||
<td class="tableblock halign-left valign-top"><p class="tableblock">text</p></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p>Issuer of the certificate</p>
|
||
</div></div></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p><span class="icon"><i class="fa fa-check"></i></span></p>
|
||
</div></div></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p><span class="icon"><i class="fa fa-minus"></i></span></p>
|
||
</div></div></td>
|
||
</tr>
|
||
<tr>
|
||
<td class="tableblock halign-left valign-top"><p class="tableblock">program-name</p></td>
|
||
<td class="tableblock halign-left valign-top"><p class="tableblock">text</p></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p>Program name</p>
|
||
</div></div></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p><span class="icon"><i class="fa fa-minus"></i></span></p>
|
||
</div></div></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p><span class="icon"><i class="fa fa-minus"></i></span></p>
|
||
</div></div></td>
|
||
</tr>
|
||
<tr>
|
||
<td class="tableblock halign-left valign-top"><p class="tableblock">serial-number</p></td>
|
||
<td class="tableblock halign-left valign-top"><p class="tableblock">text</p></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p>Serial number of the certificate</p>
|
||
</div></div></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p><span class="icon"><i class="fa fa-check"></i></span></p>
|
||
</div></div></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p><span class="icon"><i class="fa fa-minus"></i></span></p>
|
||
</div></div></td>
|
||
</tr>
|
||
<tr>
|
||
<td class="tableblock halign-left valign-top"><p class="tableblock">signature_algorithm</p></td>
|
||
<td class="tableblock halign-left valign-top"><p class="tableblock">text</p></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p>Signature algorithm ['SHA1_WITH_RSA_ENCRYPTION', 'SHA256_WITH_RSA_ENCRYPTION']</p>
|
||
</div></div></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p><span class="icon"><i class="fa fa-check"></i></span></p>
|
||
</div></div></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p><span class="icon"><i class="fa fa-minus"></i></span></p>
|
||
</div></div></td>
|
||
</tr>
|
||
<tr>
|
||
<td class="tableblock halign-left valign-top"><p class="tableblock">text</p></td>
|
||
<td class="tableblock halign-left valign-top"><p class="tableblock">text</p></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p>Free text description of the signer info</p>
|
||
</div></div></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p><span class="icon"><i class="fa fa-minus"></i></span></p>
|
||
</div></div></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p><span class="icon"><i class="fa fa-minus"></i></span></p>
|
||
</div></div></td>
|
||
</tr>
|
||
<tr>
|
||
<td class="tableblock halign-left valign-top"><p class="tableblock">url</p></td>
|
||
<td class="tableblock halign-left valign-top"><p class="tableblock">url</p></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p>Url</p>
|
||
</div></div></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p><span class="icon"><i class="fa fa-minus"></i></span></p>
|
||
</div></div></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p><span class="icon"><i class="fa fa-check"></i></span></p>
|
||
</div></div></td>
|
||
</tr>
|
||
<tr>
|
||
<td class="tableblock halign-left valign-top"><p class="tableblock">version</p></td>
|
||
<td class="tableblock halign-left valign-top"><p class="tableblock">text</p></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p>Version of the certificate</p>
|
||
</div></div></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p><span class="icon"><i class="fa fa-check"></i></span></p>
|
||
</div></div></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p><span class="icon"><i class="fa fa-minus"></i></span></p>
|
||
</div></div></td>
|
||
</tr>
|
||
</tbody>
|
||
</table>
|
||
</div>
|
||
</div>
|
||
<div class="sect1">
|
||
<h2 id="_av_signature"><a class="anchor" href="#_av_signature"></a><a class="link" href="#_av_signature">av-signature</a></h2>
|
||
<div class="sectionbody">
|
||
<div class="paragraph">
|
||
<p>Antivirus detection signature.</p>
|
||
</div>
|
||
<div class="admonitionblock note">
|
||
<table>
|
||
<tr>
|
||
<td class="icon">
|
||
<i class="fa icon-note" title="Note"></i>
|
||
</td>
|
||
<td class="content">
|
||
av-signature is a MISP object available in JSON format at <a href="https://github.com/MISP/misp-objects/blob/main/objects/av-signature/definition.json"><strong>this location</strong></a> The JSON format can be freely reused in your application or automatically enabled in <a href="https://www.github.com/MISP/MISP">MISP</a>.
|
||
</td>
|
||
</tr>
|
||
</table>
|
||
</div>
|
||
<table class="tableblock frame-all grid-all stretch">
|
||
<colgroup>
|
||
<col style="width: 20%;">
|
||
<col style="width: 20%;">
|
||
<col style="width: 20%;">
|
||
<col style="width: 20%;">
|
||
<col style="width: 20%;">
|
||
</colgroup>
|
||
<thead>
|
||
<tr>
|
||
<th class="tableblock halign-left valign-top">Object attribute</th>
|
||
<th class="tableblock halign-left valign-top">MISP attribute type</th>
|
||
<th class="tableblock halign-left valign-top">Description</th>
|
||
<th class="tableblock halign-left valign-top">Disable correlation</th>
|
||
<th class="tableblock halign-left valign-top">Multiple</th>
|
||
</tr>
|
||
</thead>
|
||
<tbody>
|
||
<tr>
|
||
<td class="tableblock halign-left valign-top"><p class="tableblock">datetime</p></td>
|
||
<td class="tableblock halign-left valign-top"><p class="tableblock">datetime</p></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p>Datetime</p>
|
||
</div></div></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p><span class="icon"><i class="fa fa-check"></i></span></p>
|
||
</div></div></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p><span class="icon"><i class="fa fa-minus"></i></span></p>
|
||
</div></div></td>
|
||
</tr>
|
||
<tr>
|
||
<td class="tableblock halign-left valign-top"><p class="tableblock">signature</p></td>
|
||
<td class="tableblock halign-left valign-top"><p class="tableblock">text</p></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p>Name of detection signature</p>
|
||
</div></div></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p><span class="icon"><i class="fa fa-minus"></i></span></p>
|
||
</div></div></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p><span class="icon"><i class="fa fa-minus"></i></span></p>
|
||
</div></div></td>
|
||
</tr>
|
||
<tr>
|
||
<td class="tableblock halign-left valign-top"><p class="tableblock">software</p></td>
|
||
<td class="tableblock halign-left valign-top"><p class="tableblock">text</p></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p>Name of antivirus software</p>
|
||
</div></div></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p><span class="icon"><i class="fa fa-check"></i></span></p>
|
||
</div></div></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p><span class="icon"><i class="fa fa-minus"></i></span></p>
|
||
</div></div></td>
|
||
</tr>
|
||
<tr>
|
||
<td class="tableblock halign-left valign-top"><p class="tableblock">text</p></td>
|
||
<td class="tableblock halign-left valign-top"><p class="tableblock">text</p></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p>Free text value to attach to the file</p>
|
||
</div></div></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p><span class="icon"><i class="fa fa-check"></i></span></p>
|
||
</div></div></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p><span class="icon"><i class="fa fa-minus"></i></span></p>
|
||
</div></div></td>
|
||
</tr>
|
||
</tbody>
|
||
</table>
|
||
</div>
|
||
</div>
|
||
<div class="sect1">
|
||
<h2 id="_bank_account"><a class="anchor" href="#_bank_account"></a><a class="link" href="#_bank_account">bank-account</a></h2>
|
||
<div class="sectionbody">
|
||
<div class="paragraph">
|
||
<p>An object describing bank account information based on account description from goAML 4.0.</p>
|
||
</div>
|
||
<div class="admonitionblock note">
|
||
<table>
|
||
<tr>
|
||
<td class="icon">
|
||
<i class="fa icon-note" title="Note"></i>
|
||
</td>
|
||
<td class="content">
|
||
bank-account is a MISP object available in JSON format at <a href="https://github.com/MISP/misp-objects/blob/main/objects/bank-account/definition.json"><strong>this location</strong></a> The JSON format can be freely reused in your application or automatically enabled in <a href="https://www.github.com/MISP/MISP">MISP</a>.
|
||
</td>
|
||
</tr>
|
||
</table>
|
||
</div>
|
||
<table class="tableblock frame-all grid-all stretch">
|
||
<colgroup>
|
||
<col style="width: 20%;">
|
||
<col style="width: 20%;">
|
||
<col style="width: 20%;">
|
||
<col style="width: 20%;">
|
||
<col style="width: 20%;">
|
||
</colgroup>
|
||
<thead>
|
||
<tr>
|
||
<th class="tableblock halign-left valign-top">Object attribute</th>
|
||
<th class="tableblock halign-left valign-top">MISP attribute type</th>
|
||
<th class="tableblock halign-left valign-top">Description</th>
|
||
<th class="tableblock halign-left valign-top">Disable correlation</th>
|
||
<th class="tableblock halign-left valign-top">Multiple</th>
|
||
</tr>
|
||
</thead>
|
||
<tbody>
|
||
<tr>
|
||
<td class="tableblock halign-left valign-top"><p class="tableblock">aba-rtn</p></td>
|
||
<td class="tableblock halign-left valign-top"><p class="tableblock">aba-rtn</p></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p>ABA routing transit number</p>
|
||
</div></div></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p><span class="icon"><i class="fa fa-minus"></i></span></p>
|
||
</div></div></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p><span class="icon"><i class="fa fa-minus"></i></span></p>
|
||
</div></div></td>
|
||
</tr>
|
||
<tr>
|
||
<td class="tableblock halign-left valign-top"><p class="tableblock">account</p></td>
|
||
<td class="tableblock halign-left valign-top"><p class="tableblock">bank-account-nr</p></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p>Account number</p>
|
||
</div></div></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p><span class="icon"><i class="fa fa-minus"></i></span></p>
|
||
</div></div></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p><span class="icon"><i class="fa fa-minus"></i></span></p>
|
||
</div></div></td>
|
||
</tr>
|
||
<tr>
|
||
<td class="tableblock halign-left valign-top"><p class="tableblock">account-name</p></td>
|
||
<td class="tableblock halign-left valign-top"><p class="tableblock">text</p></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p>A field to freely describe the bank account details.</p>
|
||
</div></div></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p><span class="icon"><i class="fa fa-minus"></i></span></p>
|
||
</div></div></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p><span class="icon"><i class="fa fa-minus"></i></span></p>
|
||
</div></div></td>
|
||
</tr>
|
||
<tr>
|
||
<td class="tableblock halign-left valign-top"><p class="tableblock">balance</p></td>
|
||
<td class="tableblock halign-left valign-top"><p class="tableblock">text</p></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p>The balance of the account after the suspicious transaction was processed.</p>
|
||
</div></div></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p><span class="icon"><i class="fa fa-check"></i></span></p>
|
||
</div></div></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p><span class="icon"><i class="fa fa-minus"></i></span></p>
|
||
</div></div></td>
|
||
</tr>
|
||
<tr>
|
||
<td class="tableblock halign-left valign-top"><p class="tableblock">beneficiary</p></td>
|
||
<td class="tableblock halign-left valign-top"><p class="tableblock">text</p></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p>Final beneficiary of the bank account.</p>
|
||
</div></div></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p><span class="icon"><i class="fa fa-check"></i></span></p>
|
||
</div></div></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p><span class="icon"><i class="fa fa-minus"></i></span></p>
|
||
</div></div></td>
|
||
</tr>
|
||
<tr>
|
||
<td class="tableblock halign-left valign-top"><p class="tableblock">beneficiary-comment</p></td>
|
||
<td class="tableblock halign-left valign-top"><p class="tableblock">text</p></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p>Comment about the final beneficiary.</p>
|
||
</div></div></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p><span class="icon"><i class="fa fa-check"></i></span></p>
|
||
</div></div></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p><span class="icon"><i class="fa fa-minus"></i></span></p>
|
||
</div></div></td>
|
||
</tr>
|
||
<tr>
|
||
<td class="tableblock halign-left valign-top"><p class="tableblock">branch</p></td>
|
||
<td class="tableblock halign-left valign-top"><p class="tableblock">text</p></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p>Branch code or name</p>
|
||
</div></div></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p><span class="icon"><i class="fa fa-check"></i></span></p>
|
||
</div></div></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p><span class="icon"><i class="fa fa-minus"></i></span></p>
|
||
</div></div></td>
|
||
</tr>
|
||
<tr>
|
||
<td class="tableblock halign-left valign-top"><p class="tableblock">client-number</p></td>
|
||
<td class="tableblock halign-left valign-top"><p class="tableblock">text</p></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p>Client number as seen by the bank.</p>
|
||
</div></div></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p><span class="icon"><i class="fa fa-minus"></i></span></p>
|
||
</div></div></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p><span class="icon"><i class="fa fa-minus"></i></span></p>
|
||
</div></div></td>
|
||
</tr>
|
||
<tr>
|
||
<td class="tableblock halign-left valign-top"><p class="tableblock">closed</p></td>
|
||
<td class="tableblock halign-left valign-top"><p class="tableblock">datetime</p></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p>When the account was closed.</p>
|
||
</div></div></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p><span class="icon"><i class="fa fa-check"></i></span></p>
|
||
</div></div></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p><span class="icon"><i class="fa fa-minus"></i></span></p>
|
||
</div></div></td>
|
||
</tr>
|
||
<tr>
|
||
<td class="tableblock halign-left valign-top"><p class="tableblock">comments</p></td>
|
||
<td class="tableblock halign-left valign-top"><p class="tableblock">text</p></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p>Comments about the bank account.</p>
|
||
</div></div></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p><span class="icon"><i class="fa fa-check"></i></span></p>
|
||
</div></div></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p><span class="icon"><i class="fa fa-minus"></i></span></p>
|
||
</div></div></td>
|
||
</tr>
|
||
<tr>
|
||
<td class="tableblock halign-left valign-top"><p class="tableblock">currency-code</p></td>
|
||
<td class="tableblock halign-left valign-top"><p class="tableblock">text</p></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p>Currency of the account. ['USD', 'EUR']</p>
|
||
</div></div></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p><span class="icon"><i class="fa fa-check"></i></span></p>
|
||
</div></div></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p><span class="icon"><i class="fa fa-minus"></i></span></p>
|
||
</div></div></td>
|
||
</tr>
|
||
<tr>
|
||
<td class="tableblock halign-left valign-top"><p class="tableblock">date-balance</p></td>
|
||
<td class="tableblock halign-left valign-top"><p class="tableblock">datetime</p></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p>When the balance was reported.</p>
|
||
</div></div></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p><span class="icon"><i class="fa fa-check"></i></span></p>
|
||
</div></div></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p><span class="icon"><i class="fa fa-minus"></i></span></p>
|
||
</div></div></td>
|
||
</tr>
|
||
<tr>
|
||
<td class="tableblock halign-left valign-top"><p class="tableblock">iban</p></td>
|
||
<td class="tableblock halign-left valign-top"><p class="tableblock">iban</p></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p>IBAN of the bank account.</p>
|
||
</div></div></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p><span class="icon"><i class="fa fa-minus"></i></span></p>
|
||
</div></div></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p><span class="icon"><i class="fa fa-minus"></i></span></p>
|
||
</div></div></td>
|
||
</tr>
|
||
<tr>
|
||
<td class="tableblock halign-left valign-top"><p class="tableblock">institution-code</p></td>
|
||
<td class="tableblock halign-left valign-top"><p class="tableblock">text</p></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p>Institution code of the bank.</p>
|
||
</div></div></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p><span class="icon"><i class="fa fa-check"></i></span></p>
|
||
</div></div></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p><span class="icon"><i class="fa fa-minus"></i></span></p>
|
||
</div></div></td>
|
||
</tr>
|
||
<tr>
|
||
<td class="tableblock halign-left valign-top"><p class="tableblock">institution-name</p></td>
|
||
<td class="tableblock halign-left valign-top"><p class="tableblock">text</p></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p>Name of the bank or financial organisation.</p>
|
||
</div></div></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p><span class="icon"><i class="fa fa-check"></i></span></p>
|
||
</div></div></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p><span class="icon"><i class="fa fa-minus"></i></span></p>
|
||
</div></div></td>
|
||
</tr>
|
||
<tr>
|
||
<td class="tableblock halign-left valign-top"><p class="tableblock">non-banking-institution</p></td>
|
||
<td class="tableblock halign-left valign-top"><p class="tableblock">boolean</p></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p>A flag to define if this account belong to a non-banking organisation. If set to true, it’s a non-banking organisation. ['True', 'False']</p>
|
||
</div></div></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p><span class="icon"><i class="fa fa-check"></i></span></p>
|
||
</div></div></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p><span class="icon"><i class="fa fa-minus"></i></span></p>
|
||
</div></div></td>
|
||
</tr>
|
||
<tr>
|
||
<td class="tableblock halign-left valign-top"><p class="tableblock">opened</p></td>
|
||
<td class="tableblock halign-left valign-top"><p class="tableblock">datetime</p></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p>When the account was opened.</p>
|
||
</div></div></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p><span class="icon"><i class="fa fa-check"></i></span></p>
|
||
</div></div></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p><span class="icon"><i class="fa fa-minus"></i></span></p>
|
||
</div></div></td>
|
||
</tr>
|
||
<tr>
|
||
<td class="tableblock halign-left valign-top"><p class="tableblock">personal-account-type</p></td>
|
||
<td class="tableblock halign-left valign-top"><p class="tableblock">text</p></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p>Account type. ['A - Business', 'B - Personal Current', 'C - Savings', 'D - Trust Account', 'E - Trading Account', 'O - Other']</p>
|
||
</div></div></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p><span class="icon"><i class="fa fa-check"></i></span></p>
|
||
</div></div></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p><span class="icon"><i class="fa fa-minus"></i></span></p>
|
||
</div></div></td>
|
||
</tr>
|
||
<tr>
|
||
<td class="tableblock halign-left valign-top"><p class="tableblock">report-code</p></td>
|
||
<td class="tableblock halign-left valign-top"><p class="tableblock">text</p></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p>Report code of the bank account. ['CTR Cash Transaction Report', 'STR Suspicious Transaction Report', 'EFT Electronic Funds Transfer', 'IFT International Funds Transfer', 'TFR Terror Financing Report', 'BCR Border Cash Report', 'UTR Unusual Transaction Report', 'AIF Additional Information File – Can be used for example to get full disclosure of transactions of an account for a period of time without reporting it as a CTR.', 'IRI Incoming Request for Information – International', 'ORI Outgoing Request for Information – International', 'IRD Incoming Request for Information – Domestic', 'ORD Outgoing Request for Information – Domestic']</p>
|
||
</div></div></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p><span class="icon"><i class="fa fa-check"></i></span></p>
|
||
</div></div></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p><span class="icon"><i class="fa fa-minus"></i></span></p>
|
||
</div></div></td>
|
||
</tr>
|
||
<tr>
|
||
<td class="tableblock halign-left valign-top"><p class="tableblock">status-code</p></td>
|
||
<td class="tableblock halign-left valign-top"><p class="tableblock">text</p></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p>Account status at the time of the transaction processed. ['A - Active', 'B - Inactive', 'C - Dormant']</p>
|
||
</div></div></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p><span class="icon"><i class="fa fa-check"></i></span></p>
|
||
</div></div></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p><span class="icon"><i class="fa fa-minus"></i></span></p>
|
||
</div></div></td>
|
||
</tr>
|
||
<tr>
|
||
<td class="tableblock halign-left valign-top"><p class="tableblock">swift</p></td>
|
||
<td class="tableblock halign-left valign-top"><p class="tableblock">bic</p></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p>SWIFT or BIC as defined in ISO 9362.</p>
|
||
</div></div></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p><span class="icon"><i class="fa fa-check"></i></span></p>
|
||
</div></div></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p><span class="icon"><i class="fa fa-minus"></i></span></p>
|
||
</div></div></td>
|
||
</tr>
|
||
<tr>
|
||
<td class="tableblock halign-left valign-top"><p class="tableblock">text</p></td>
|
||
<td class="tableblock halign-left valign-top"><p class="tableblock">text</p></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p>A description of the bank account.</p>
|
||
</div></div></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p><span class="icon"><i class="fa fa-check"></i></span></p>
|
||
</div></div></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p><span class="icon"><i class="fa fa-minus"></i></span></p>
|
||
</div></div></td>
|
||
</tr>
|
||
</tbody>
|
||
</table>
|
||
</div>
|
||
</div>
|
||
<div class="sect1">
|
||
<h2 id="_bgp_hijack"><a class="anchor" href="#_bgp_hijack"></a><a class="link" href="#_bgp_hijack">bgp-hijack</a></h2>
|
||
<div class="sectionbody">
|
||
<div class="paragraph">
|
||
<p>Object encapsulating BGP Hijack description as specified, for example, by bgpstream.com.</p>
|
||
</div>
|
||
<div class="admonitionblock note">
|
||
<table>
|
||
<tr>
|
||
<td class="icon">
|
||
<i class="fa icon-note" title="Note"></i>
|
||
</td>
|
||
<td class="content">
|
||
bgp-hijack is a MISP object available in JSON format at <a href="https://github.com/MISP/misp-objects/blob/main/objects/bgp-hijack/definition.json"><strong>this location</strong></a> The JSON format can be freely reused in your application or automatically enabled in <a href="https://www.github.com/MISP/MISP">MISP</a>.
|
||
</td>
|
||
</tr>
|
||
</table>
|
||
</div>
|
||
<table class="tableblock frame-all grid-all stretch">
|
||
<colgroup>
|
||
<col style="width: 20%;">
|
||
<col style="width: 20%;">
|
||
<col style="width: 20%;">
|
||
<col style="width: 20%;">
|
||
<col style="width: 20%;">
|
||
</colgroup>
|
||
<thead>
|
||
<tr>
|
||
<th class="tableblock halign-left valign-top">Object attribute</th>
|
||
<th class="tableblock halign-left valign-top">MISP attribute type</th>
|
||
<th class="tableblock halign-left valign-top">Description</th>
|
||
<th class="tableblock halign-left valign-top">Disable correlation</th>
|
||
<th class="tableblock halign-left valign-top">Multiple</th>
|
||
</tr>
|
||
</thead>
|
||
<tbody>
|
||
<tr>
|
||
<td class="tableblock halign-left valign-top"><p class="tableblock">country</p></td>
|
||
<td class="tableblock halign-left valign-top"><p class="tableblock">text</p></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p>Country code of the main location of the attacking autonomous system</p>
|
||
</div></div></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p><span class="icon"><i class="fa fa-minus"></i></span></p>
|
||
</div></div></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p><span class="icon"><i class="fa fa-minus"></i></span></p>
|
||
</div></div></td>
|
||
</tr>
|
||
<tr>
|
||
<td class="tableblock halign-left valign-top"><p class="tableblock">description</p></td>
|
||
<td class="tableblock halign-left valign-top"><p class="tableblock">text</p></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p>BGP Hijack details</p>
|
||
</div></div></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p><span class="icon"><i class="fa fa-minus"></i></span></p>
|
||
</div></div></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p><span class="icon"><i class="fa fa-minus"></i></span></p>
|
||
</div></div></td>
|
||
</tr>
|
||
<tr>
|
||
<td class="tableblock halign-left valign-top"><p class="tableblock">detected-asn</p></td>
|
||
<td class="tableblock halign-left valign-top"><p class="tableblock">AS</p></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p>Detected Autonomous System Number</p>
|
||
</div></div></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p><span class="icon"><i class="fa fa-minus"></i></span></p>
|
||
</div></div></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p><span class="icon"><i class="fa fa-minus"></i></span></p>
|
||
</div></div></td>
|
||
</tr>
|
||
<tr>
|
||
<td class="tableblock halign-left valign-top"><p class="tableblock">end</p></td>
|
||
<td class="tableblock halign-left valign-top"><p class="tableblock">datetime</p></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p>Last time the Prefix hijack was seen</p>
|
||
</div></div></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p><span class="icon"><i class="fa fa-check"></i></span></p>
|
||
</div></div></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p><span class="icon"><i class="fa fa-minus"></i></span></p>
|
||
</div></div></td>
|
||
</tr>
|
||
<tr>
|
||
<td class="tableblock halign-left valign-top"><p class="tableblock">expected-asn</p></td>
|
||
<td class="tableblock halign-left valign-top"><p class="tableblock">AS</p></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p>Expected Autonomous System Number</p>
|
||
</div></div></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p><span class="icon"><i class="fa fa-minus"></i></span></p>
|
||
</div></div></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p><span class="icon"><i class="fa fa-minus"></i></span></p>
|
||
</div></div></td>
|
||
</tr>
|
||
<tr>
|
||
<td class="tableblock halign-left valign-top"><p class="tableblock">start</p></td>
|
||
<td class="tableblock halign-left valign-top"><p class="tableblock">datetime</p></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p>First time the Prefix hijack was seen</p>
|
||
</div></div></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p><span class="icon"><i class="fa fa-check"></i></span></p>
|
||
</div></div></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p><span class="icon"><i class="fa fa-minus"></i></span></p>
|
||
</div></div></td>
|
||
</tr>
|
||
<tr>
|
||
<td class="tableblock halign-left valign-top"><p class="tableblock">subnet-announced</p></td>
|
||
<td class="tableblock halign-left valign-top"><p class="tableblock">ip-src</p></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p>Subnet announced</p>
|
||
</div></div></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p><span class="icon"><i class="fa fa-minus"></i></span></p>
|
||
</div></div></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p><span class="icon"><i class="fa fa-check"></i></span></p>
|
||
</div></div></td>
|
||
</tr>
|
||
</tbody>
|
||
</table>
|
||
</div>
|
||
</div>
|
||
<div class="sect1">
|
||
<h2 id="_bgp_ranking"><a class="anchor" href="#_bgp_ranking"></a><a class="link" href="#_bgp_ranking">bgp-ranking</a></h2>
|
||
<div class="sectionbody">
|
||
<div class="paragraph">
|
||
<p>BGP Ranking object describing the ranking of an ASN for a given day, along with its position, 1 being the most malicious ASN of the day, with the highest ranking. This object is meant to have a relationship with the corresponding ASN object and represents its ranking for a specific date.</p>
|
||
</div>
|
||
<div class="admonitionblock note">
|
||
<table>
|
||
<tr>
|
||
<td class="icon">
|
||
<i class="fa icon-note" title="Note"></i>
|
||
</td>
|
||
<td class="content">
|
||
bgp-ranking is a MISP object available in JSON format at <a href="https://github.com/MISP/misp-objects/blob/main/objects/bgp-ranking/definition.json"><strong>this location</strong></a> The JSON format can be freely reused in your application or automatically enabled in <a href="https://www.github.com/MISP/MISP">MISP</a>.
|
||
</td>
|
||
</tr>
|
||
</table>
|
||
</div>
|
||
<table class="tableblock frame-all grid-all stretch">
|
||
<colgroup>
|
||
<col style="width: 20%;">
|
||
<col style="width: 20%;">
|
||
<col style="width: 20%;">
|
||
<col style="width: 20%;">
|
||
<col style="width: 20%;">
|
||
</colgroup>
|
||
<thead>
|
||
<tr>
|
||
<th class="tableblock halign-left valign-top">Object attribute</th>
|
||
<th class="tableblock halign-left valign-top">MISP attribute type</th>
|
||
<th class="tableblock halign-left valign-top">Description</th>
|
||
<th class="tableblock halign-left valign-top">Disable correlation</th>
|
||
<th class="tableblock halign-left valign-top">Multiple</th>
|
||
</tr>
|
||
</thead>
|
||
<tbody>
|
||
<tr>
|
||
<td class="tableblock halign-left valign-top"><p class="tableblock">address-family</p></td>
|
||
<td class="tableblock halign-left valign-top"><p class="tableblock">text</p></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p>The IP address family concerned by the ranking. ['v4', 'v6']</p>
|
||
</div></div></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p><span class="icon"><i class="fa fa-check"></i></span></p>
|
||
</div></div></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p><span class="icon"><i class="fa fa-minus"></i></span></p>
|
||
</div></div></td>
|
||
</tr>
|
||
<tr>
|
||
<td class="tableblock halign-left valign-top"><p class="tableblock">date</p></td>
|
||
<td class="tableblock halign-left valign-top"><p class="tableblock">datetime</p></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p>Date fo the ranking.</p>
|
||
</div></div></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p><span class="icon"><i class="fa fa-check"></i></span></p>
|
||
</div></div></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p><span class="icon"><i class="fa fa-minus"></i></span></p>
|
||
</div></div></td>
|
||
</tr>
|
||
<tr>
|
||
<td class="tableblock halign-left valign-top"><p class="tableblock">position</p></td>
|
||
<td class="tableblock halign-left valign-top"><p class="tableblock">float</p></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p>Position of the ASN for a given day.</p>
|
||
</div></div></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p><span class="icon"><i class="fa fa-check"></i></span></p>
|
||
</div></div></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p><span class="icon"><i class="fa fa-minus"></i></span></p>
|
||
</div></div></td>
|
||
</tr>
|
||
<tr>
|
||
<td class="tableblock halign-left valign-top"><p class="tableblock">ranking</p></td>
|
||
<td class="tableblock halign-left valign-top"><p class="tableblock">float</p></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p>Ranking of the Autonomous System number.</p>
|
||
</div></div></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p><span class="icon"><i class="fa fa-check"></i></span></p>
|
||
</div></div></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p><span class="icon"><i class="fa fa-minus"></i></span></p>
|
||
</div></div></td>
|
||
</tr>
|
||
</tbody>
|
||
</table>
|
||
</div>
|
||
</div>
|
||
<div class="sect1">
|
||
<h2 id="_blog"><a class="anchor" href="#_blog"></a><a class="link" href="#_blog">blog</a></h2>
|
||
<div class="sectionbody">
|
||
<div class="paragraph">
|
||
<p>Blog post like Medium or WordPress.</p>
|
||
</div>
|
||
<div class="admonitionblock note">
|
||
<table>
|
||
<tr>
|
||
<td class="icon">
|
||
<i class="fa icon-note" title="Note"></i>
|
||
</td>
|
||
<td class="content">
|
||
blog is a MISP object available in JSON format at <a href="https://github.com/MISP/misp-objects/blob/main/objects/blog/definition.json"><strong>this location</strong></a> The JSON format can be freely reused in your application or automatically enabled in <a href="https://www.github.com/MISP/MISP">MISP</a>.
|
||
</td>
|
||
</tr>
|
||
</table>
|
||
</div>
|
||
<table class="tableblock frame-all grid-all stretch">
|
||
<colgroup>
|
||
<col style="width: 20%;">
|
||
<col style="width: 20%;">
|
||
<col style="width: 20%;">
|
||
<col style="width: 20%;">
|
||
<col style="width: 20%;">
|
||
</colgroup>
|
||
<thead>
|
||
<tr>
|
||
<th class="tableblock halign-left valign-top">Object attribute</th>
|
||
<th class="tableblock halign-left valign-top">MISP attribute type</th>
|
||
<th class="tableblock halign-left valign-top">Description</th>
|
||
<th class="tableblock halign-left valign-top">Disable correlation</th>
|
||
<th class="tableblock halign-left valign-top">Multiple</th>
|
||
</tr>
|
||
</thead>
|
||
<tbody>
|
||
<tr>
|
||
<td class="tableblock halign-left valign-top"><p class="tableblock">archive</p></td>
|
||
<td class="tableblock halign-left valign-top"><p class="tableblock">link</p></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p>Archive of the original document (Internet Archive, Archive.is, etc).</p>
|
||
</div></div></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p><span class="icon"><i class="fa fa-minus"></i></span></p>
|
||
</div></div></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p><span class="icon"><i class="fa fa-check"></i></span></p>
|
||
</div></div></td>
|
||
</tr>
|
||
<tr>
|
||
<td class="tableblock halign-left valign-top"><p class="tableblock">creation-date</p></td>
|
||
<td class="tableblock halign-left valign-top"><p class="tableblock">datetime</p></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p>Initial creation of the blog post.</p>
|
||
</div></div></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p><span class="icon"><i class="fa fa-minus"></i></span></p>
|
||
</div></div></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p><span class="icon"><i class="fa fa-minus"></i></span></p>
|
||
</div></div></td>
|
||
</tr>
|
||
<tr>
|
||
<td class="tableblock halign-left valign-top"><p class="tableblock">embedded-link</p></td>
|
||
<td class="tableblock halign-left valign-top"><p class="tableblock">url</p></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p>Site linked by the blog post.</p>
|
||
</div></div></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p><span class="icon"><i class="fa fa-minus"></i></span></p>
|
||
</div></div></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p><span class="icon"><i class="fa fa-check"></i></span></p>
|
||
</div></div></td>
|
||
</tr>
|
||
<tr>
|
||
<td class="tableblock halign-left valign-top"><p class="tableblock">embedded-safe-link</p></td>
|
||
<td class="tableblock halign-left valign-top"><p class="tableblock">link</p></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p>Safe site linked by the blog post.</p>
|
||
</div></div></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p><span class="icon"><i class="fa fa-minus"></i></span></p>
|
||
</div></div></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p><span class="icon"><i class="fa fa-check"></i></span></p>
|
||
</div></div></td>
|
||
</tr>
|
||
<tr>
|
||
<td class="tableblock halign-left valign-top"><p class="tableblock">link</p></td>
|
||
<td class="tableblock halign-left valign-top"><p class="tableblock">link</p></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p>Original link into the blog post (Supposed harmless).</p>
|
||
</div></div></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p><span class="icon"><i class="fa fa-minus"></i></span></p>
|
||
</div></div></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p><span class="icon"><i class="fa fa-minus"></i></span></p>
|
||
</div></div></td>
|
||
</tr>
|
||
<tr>
|
||
<td class="tableblock halign-left valign-top"><p class="tableblock">modification-date</p></td>
|
||
<td class="tableblock halign-left valign-top"><p class="tableblock">datetime</p></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p>Last update of the blog post.</p>
|
||
</div></div></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p><span class="icon"><i class="fa fa-minus"></i></span></p>
|
||
</div></div></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p><span class="icon"><i class="fa fa-minus"></i></span></p>
|
||
</div></div></td>
|
||
</tr>
|
||
<tr>
|
||
<td class="tableblock halign-left valign-top"><p class="tableblock">post</p></td>
|
||
<td class="tableblock halign-left valign-top"><p class="tableblock">text</p></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p>Raw post.</p>
|
||
</div></div></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p><span class="icon"><i class="fa fa-minus"></i></span></p>
|
||
</div></div></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p><span class="icon"><i class="fa fa-minus"></i></span></p>
|
||
</div></div></td>
|
||
</tr>
|
||
<tr>
|
||
<td class="tableblock halign-left valign-top"><p class="tableblock">removal-date</p></td>
|
||
<td class="tableblock halign-left valign-top"><p class="tableblock">datetime</p></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p>When the blog post was removed.</p>
|
||
</div></div></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p><span class="icon"><i class="fa fa-minus"></i></span></p>
|
||
</div></div></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p><span class="icon"><i class="fa fa-minus"></i></span></p>
|
||
</div></div></td>
|
||
</tr>
|
||
<tr>
|
||
<td class="tableblock halign-left valign-top"><p class="tableblock">title</p></td>
|
||
<td class="tableblock halign-left valign-top"><p class="tableblock">text</p></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p>Title of blog post.</p>
|
||
</div></div></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p><span class="icon"><i class="fa fa-minus"></i></span></p>
|
||
</div></div></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p><span class="icon"><i class="fa fa-minus"></i></span></p>
|
||
</div></div></td>
|
||
</tr>
|
||
<tr>
|
||
<td class="tableblock halign-left valign-top"><p class="tableblock">type</p></td>
|
||
<td class="tableblock halign-left valign-top"><p class="tableblock">text</p></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p>Type of blog post. ['Medium', 'WordPress', 'Blogger', 'Tumbler', 'LiveJournal', 'Forum', 'Other']</p>
|
||
</div></div></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p><span class="icon"><i class="fa fa-check"></i></span></p>
|
||
</div></div></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p><span class="icon"><i class="fa fa-minus"></i></span></p>
|
||
</div></div></td>
|
||
</tr>
|
||
<tr>
|
||
<td class="tableblock halign-left valign-top"><p class="tableblock">url</p></td>
|
||
<td class="tableblock halign-left valign-top"><p class="tableblock">url</p></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p>Original URL location of the blog post (potentially malicious).</p>
|
||
</div></div></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p><span class="icon"><i class="fa fa-minus"></i></span></p>
|
||
</div></div></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p><span class="icon"><i class="fa fa-minus"></i></span></p>
|
||
</div></div></td>
|
||
</tr>
|
||
<tr>
|
||
<td class="tableblock halign-left valign-top"><p class="tableblock">username</p></td>
|
||
<td class="tableblock halign-left valign-top"><p class="tableblock">text</p></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p>Username who posted the blog post.</p>
|
||
</div></div></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p><span class="icon"><i class="fa fa-minus"></i></span></p>
|
||
</div></div></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p><span class="icon"><i class="fa fa-minus"></i></span></p>
|
||
</div></div></td>
|
||
</tr>
|
||
<tr>
|
||
<td class="tableblock halign-left valign-top"><p class="tableblock">username-quoted</p></td>
|
||
<td class="tableblock halign-left valign-top"><p class="tableblock">text</p></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p>Username who are quoted into the blog post.</p>
|
||
</div></div></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p><span class="icon"><i class="fa fa-minus"></i></span></p>
|
||
</div></div></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p><span class="icon"><i class="fa fa-check"></i></span></p>
|
||
</div></div></td>
|
||
</tr>
|
||
<tr>
|
||
<td class="tableblock halign-left valign-top"><p class="tableblock">verified-username</p></td>
|
||
<td class="tableblock halign-left valign-top"><p class="tableblock">text</p></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p>Is the username account verified by the operator of the blog platform. ['Verified', 'Unverified', 'Unknown']</p>
|
||
</div></div></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p><span class="icon"><i class="fa fa-check"></i></span></p>
|
||
</div></div></td>
|
||
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
|
||
<p><span class="icon"><i class="fa fa-minus"></i></span></p>
|
||
</div></div></td>
|
||
</tr>
|
||
</tbody>
|
||
</table>
|
||
</div>
|
||
</div>
|
||
<div class="sect1">
|
||
<h2 id="_boleto"><a class="anchor" href="#_boleto"></a><a class="link" href="#_boleto">boleto</a></h2>
|
||
<div class="sectionbody">
|
||
<div class="paragraph">
|
||
<p>A common form of payment used in Brazil.</p>
|
||
</div>
|
||
<div class="admonitionblock note">
|
||
<table>
|
||
<tr>
|
||
<td class="icon">
|
||
<i class="fa icon-note" title="Note"></i>
|
||
</td>
|
||
<td class="content">
|
||
boleto is a MISP object available in JSON format at <a href="https://github.com/MISP/misp-objects/blob/main/objects/boleto/definition.json"><strong>this location</strong></a> The JSON format can be freely reused in your application or automatically enabled in <a href="https://www.github.com/MISP/MISP">MISP</a>.
|
||
</td>
|
||
</tr>
|
||
</table>
|
||
</div>
|
||
<table class="tableblock frame-all grid-all stretch">
|
||
<colgroup>
|
||
<col style="width: 20%;">
|
||
<col style="width: 20%;">
|
||
<col style="width: 20%;">
|
||
<col style="width: 20%;">
|
||
<col style="width: 20%;">
|
||
</colgroup>
|
||