Skip to content

Commit 186b33d

Browse files
adulauadulau
authored
Merge pull request #498 from MISP/codex/create-misp-object-templates-and-pr
Add generic software-package, service, and container object templates
2 parents f70f229 + 44d7590 commit 186b33d

5 files changed

Lines changed: 346 additions & 0 deletions

File tree

‎objects/container-image/definition.json‎

Lines changed: 78 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,78 @@
1+
{
2+
"attributes": {
3+
"architecture": {
4+
"description": "CPU architecture for the image (e.g., amd64, arm64).",
5+
"disable_correlation": true,
6+
"misp-attribute": "text",
7+
"ui-priority": 7
8+
},
9+
"created": {
10+
"description": "Date and time at which the image was created.",
11+
"disable_correlation": true,
12+
"misp-attribute": "datetime",
13+
"ui-priority": 6
14+
},
15+
"digest": {
16+
"description": "Image digest.",
17+
"misp-attribute": "sha256",
18+
"ui-priority": 9
19+
},
20+
"image-name": {
21+
"description": "Name of the image (e.g., nginx).",
22+
"misp-attribute": "text",
23+
"ui-priority": 10
24+
},
25+
"labels": {
26+
"description": "Metadata labels attached to the image.",
27+
"disable_correlation": true,
28+
"misp-attribute": "text",
29+
"multiple": true,
30+
"ui-priority": 4
31+
},
32+
"layers": {
33+
"description": "List of image layers or references to them.",
34+
"disable_correlation": true,
35+
"misp-attribute": "text",
36+
"multiple": true,
37+
"ui-priority": 5
38+
},
39+
"os": {
40+
"description": "Base OS of the image (e.g., alpine, debian).",
41+
"disable_correlation": true,
42+
"misp-attribute": "text",
43+
"ui-priority": 7
44+
},
45+
"registry": {
46+
"description": "Container registry URL or name (e.g., docker.io, ghcr.io).",
47+
"misp-attribute": "text",
48+
"ui-priority": 8
49+
},
50+
"signature": {
51+
"description": "Signing information for the image (e.g., cosign metadata).",
52+
"disable_correlation": true,
53+
"misp-attribute": "text",
54+
"ui-priority": 4
55+
},
56+
"size": {
57+
"description": "Image size in bytes.",
58+
"disable_correlation": true,
59+
"misp-attribute": "counter",
60+
"ui-priority": 6
61+
},
62+
"tag": {
63+
"description": "Image tag (e.g., latest, 1.21-alpine).",
64+
"disable_correlation": true,
65+
"misp-attribute": "text",
66+
"ui-priority": 9
67+
}
68+
},
69+
"description": "Generic container-image object template to represent container images across platforms.",
70+
"meta-category": "misc",
71+
"name": "container-image",
72+
"requiredOneOf": [
73+
"image-name",
74+
"digest"
75+
],
76+
"uuid": "4aa82e67-ed3d-48a2-8ecd-7a39cf2c3f3c",
77+
"version": 1
78+
}

‎objects/container-instance/definition.json‎

Lines changed: 126 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,126 @@
1+
{
2+
"attributes": {
3+
"capabilities": {
4+
"description": "Additional Linux capabilities granted to the container.",
5+
"disable_correlation": true,
6+
"misp-attribute": "text",
7+
"multiple": true,
8+
"ui-priority": 5
9+
},
10+
"command": {
11+
"description": "Command used to start the container.",
12+
"misp-attribute": "text",
13+
"ui-priority": 8
14+
},
15+
"container-id": {
16+
"description": "Identifier of the container instance.",
17+
"misp-attribute": "text",
18+
"ui-priority": 10
19+
},
20+
"created": {
21+
"description": "Date and time when the container was created.",
22+
"disable_correlation": true,
23+
"misp-attribute": "datetime",
24+
"ui-priority": 7
25+
},
26+
"environment-variables": {
27+
"description": "Environment variables configured for the container.",
28+
"disable_correlation": true,
29+
"misp-attribute": "text",
30+
"multiple": true,
31+
"ui-priority": 3
32+
},
33+
"finished": {
34+
"description": "Date and time when the container finished.",
35+
"disable_correlation": true,
36+
"misp-attribute": "datetime",
37+
"ui-priority": 7
38+
},
39+
"hostname": {
40+
"description": "Hostname configured for the container.",
41+
"disable_correlation": true,
42+
"misp-attribute": "hostname",
43+
"ui-priority": 6
44+
},
45+
"image": {
46+
"description": "Reference to image used by the container.",
47+
"misp-attribute": "text",
48+
"ui-priority": 9
49+
},
50+
"ip-address": {
51+
"description": "IP address assigned to the container.",
52+
"misp-attribute": "ip-dst",
53+
"multiple": true,
54+
"ui-priority": 4
55+
},
56+
"mounts": {
57+
"description": "Mount points attached to the container.",
58+
"disable_correlation": true,
59+
"misp-attribute": "text",
60+
"multiple": true,
61+
"ui-priority": 4
62+
},
63+
"network-mode": {
64+
"description": "Networking mode configured for the container.",
65+
"disable_correlation": true,
66+
"misp-attribute": "text",
67+
"ui-priority": 4
68+
},
69+
"ports": {
70+
"description": "Exposed or mapped ports for the container.",
71+
"disable_correlation": true,
72+
"misp-attribute": "port",
73+
"multiple": true,
74+
"ui-priority": 4
75+
},
76+
"privileged": {
77+
"description": "Indicates whether the container was run in privileged mode.",
78+
"disable_correlation": true,
79+
"misp-attribute": "boolean",
80+
"sane_default": [
81+
"1",
82+
"0"
83+
],
84+
"ui-priority": 6
85+
},
86+
"security-opt": {
87+
"description": "Security options applied to the container.",
88+
"disable_correlation": true,
89+
"misp-attribute": "text",
90+
"multiple": true,
91+
"ui-priority": 5
92+
},
93+
"started": {
94+
"description": "Date and time when the container was started.",
95+
"disable_correlation": true,
96+
"misp-attribute": "datetime",
97+
"ui-priority": 7
98+
},
99+
"state": {
100+
"description": "Runtime state of the container (e.g., running, exited, paused).",
101+
"disable_correlation": true,
102+
"misp-attribute": "text",
103+
"sane_default": [
104+
"running",
105+
"exited",
106+
"paused"
107+
],
108+
"ui-priority": 8
109+
},
110+
"user": {
111+
"description": "User configured to run inside the container.",
112+
"disable_correlation": true,
113+
"misp-attribute": "text",
114+
"ui-priority": 6
115+
}
116+
},
117+
"description": "Generic container-instance object template to represent runtime container details.",
118+
"meta-category": "misc",
119+
"name": "container-instance",
120+
"requiredOneOf": [
121+
"container-id",
122+
"image"
123+
],
124+
"uuid": "abbf4433-be8f-409e-8a9b-20cf0cc5bb48",
125+
"version": 1
126+
}

‎objects/container-network/definition.json‎

Lines changed: 60 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,60 @@
1+
{
2+
"attributes": {
3+
"connected-containers": {
4+
"description": "Connected container identifiers or references.",
5+
"disable_correlation": true,
6+
"misp-attribute": "text",
7+
"multiple": true,
8+
"ui-priority": 6
9+
},
10+
"dns": {
11+
"description": "DNS server(s) configured for the network.",
12+
"disable_correlation": true,
13+
"misp-attribute": "text",
14+
"multiple": true,
15+
"ui-priority": 4
16+
},
17+
"driver": {
18+
"description": "Network driver type (e.g., bridge, overlay).",
19+
"disable_correlation": true,
20+
"misp-attribute": "text",
21+
"ui-priority": 9
22+
},
23+
"gateway": {
24+
"description": "Gateway address for the container network.",
25+
"misp-attribute": "ip-dst",
26+
"ui-priority": 7
27+
},
28+
"internal": {
29+
"description": "Indicates whether the network is internal-only.",
30+
"disable_correlation": true,
31+
"misp-attribute": "boolean",
32+
"sane_default": [
33+
"1",
34+
"0"
35+
],
36+
"ui-priority": 5
37+
},
38+
"network-name": {
39+
"description": "Name of the container network.",
40+
"misp-attribute": "text",
41+
"ui-priority": 10
42+
},
43+
"subnet": {
44+
"description": "Subnet used by the container network.",
45+
"disable_correlation": true,
46+
"misp-attribute": "text",
47+
"multiple": true,
48+
"ui-priority": 8
49+
}
50+
},
51+
"description": "Generic container-network object template to represent container networking settings.",
52+
"meta-category": "network",
53+
"name": "container-network",
54+
"requiredOneOf": [
55+
"network-name",
56+
"subnet"
57+
],
58+
"uuid": "2e821b9d-3a49-4dd8-b0bd-2b266a8cb98a",
59+
"version": 1
60+
}

‎objects/service/definition.json‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"attributes": {
3+
"command-line": {
4+
"description": "Command line used to run the service.",
5+
"misp-attribute": "text",
6+
"ui-priority": 7
7+
},
8+
"function": {
9+
"description": "Function or purpose of the service.",
10+
"disable_correlation": true,
11+
"misp-attribute": "text",
12+
"ui-priority": 8
13+
},
14+
"name": {
15+
"description": "Name of the service.",
16+
"misp-attribute": "text",
17+
"ui-priority": 10
18+
},
19+
"port": {
20+
"description": "Port used by the service.",
21+
"disable_correlation": true,
22+
"misp-attribute": "port",
23+
"multiple": true,
24+
"ui-priority": 9
25+
}
26+
},
27+
"description": "Generic service object template to represent services that may be attacked or compromised.",
28+
"meta-category": "misc",
29+
"name": "service",
30+
"requiredOneOf": [
31+
"name",
32+
"command-line"
33+
],
34+
"uuid": "c69bd10e-0829-451d-8fe5-9ee4dda4492a",
35+
"version": 1
36+
}

‎objects/software-package/definition.json‎

Lines changed: 46 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,46 @@
1+
{
2+
"attributes": {
3+
"description": {
4+
"description": "Description of the software package.",
5+
"disable_correlation": true,
6+
"misp-attribute": "text",
7+
"ui-priority": 4
8+
},
9+
"name": {
10+
"description": "Name of the software package.",
11+
"misp-attribute": "text",
12+
"ui-priority": 10
13+
},
14+
"state": {
15+
"description": "Known state of the package (e.g., valid, backdoored, unknown).",
16+
"disable_correlation": true,
17+
"misp-attribute": "text",
18+
"sane_default": [
19+
"valid",
20+
"backdoored",
21+
"unknown"
22+
],
23+
"ui-priority": 7
24+
},
25+
"vendor": {
26+
"description": "Vendor or maintainer of the software package.",
27+
"disable_correlation": true,
28+
"misp-attribute": "text",
29+
"ui-priority": 8
30+
},
31+
"version": {
32+
"description": "Version of the software package.",
33+
"disable_correlation": true,
34+
"misp-attribute": "text",
35+
"ui-priority": 9
36+
}
37+
},
38+
"description": "Generic software package object template to represent software packages and their state.",
39+
"meta-category": "misc",
40+
"name": "software-package",
41+
"requiredOneOf": [
42+
"name"
43+
],
44+
"uuid": "77038ecf-89e3-4115-a86f-4d00f0308e1e",
45+
"version": 1
46+
}

0 commit comments

Comments
 (0)