|
1 | 1 | { |
2 | 2 | "attributes": { |
3 | | - "type": { |
4 | | - "description": "The type of the Log Event", |
| 3 | + "app": { |
| 4 | + "description": "The application identified (e.g. vnc, ssh, sip, irc, http or smtp).", |
5 | 5 | "misp-attribute": "text", |
6 | 6 | "ui-priority": 1 |
7 | 7 | }, |
8 | | - "subtype": { |
9 | | - "description": "The subtype of the Log Event.", |
| 8 | + "direction": { |
| 9 | + "description": "The Direction of the Event.", |
10 | 10 | "misp-attribute": "text", |
11 | 11 | "ui-priority": 1 |
12 | 12 | }, |
13 | | - "thr_category": { |
14 | | - "description": "The Threat Category.", |
15 | | - "misp-attribute": "text", |
| 13 | + "dport": { |
| 14 | + "description": "The port to which the connection headed.", |
| 15 | + "misp-attribute": "counter", |
16 | 16 | "ui-priority": 1 |
17 | 17 | }, |
18 | | - "direction": { |
19 | | - "description": "The Direction of the Event.", |
| 18 | + "dst": { |
| 19 | + "description": "The Destination IP which is the target of the observed connections.", |
| 20 | + "misp-attribute": "ip-dst", |
| 21 | + "ui-priority": 1 |
| 22 | + }, |
| 23 | + "dstloc": { |
| 24 | + "description": "The Destination Location of the event.", |
20 | 25 | "misp-attribute": "text", |
21 | 26 | "ui-priority": 1 |
22 | 27 | }, |
23 | | - "threatid": { |
24 | | - "description": "The Threat ID.", |
| 28 | + "proto": { |
| 29 | + "description": "The transport protocol (e.g. tcp, udp, icmp).", |
25 | 30 | "misp-attribute": "text", |
26 | 31 | "ui-priority": 1 |
27 | 32 | }, |
28 | | - "time_generated": { |
29 | | - "description": "The datetime of the event.", |
30 | | - "misp-attribute": "datetime", |
| 33 | + "sport": { |
| 34 | + "description": "The port from which the connection originated.", |
| 35 | + "misp-attribute": "counter", |
| 36 | + "ui-priority": 1 |
| 37 | + }, |
| 38 | + "src": { |
| 39 | + "description": "The ip observed to initiate the connection", |
| 40 | + "misp-attribute": "ip-src", |
31 | 41 | "ui-priority": 1 |
32 | 42 | }, |
33 | 43 | "srcloc": { |
34 | 44 | "description": "The Source Location of the event.", |
35 | 45 | "misp-attribute": "text", |
36 | 46 | "ui-priority": 1 |
37 | 47 | }, |
38 | | - "dstloc": { |
39 | | - "description": "The Destination Location of the event.", |
| 48 | + "subtype": { |
| 49 | + "description": "The subtype of the Log Event.", |
40 | 50 | "misp-attribute": "text", |
41 | 51 | "ui-priority": 1 |
42 | 52 | }, |
43 | | - "dst": { |
44 | | - "description": "The Destination IP which is the target of the observed connections.", |
45 | | - "misp-attribute": "ip-dst", |
46 | | - "ui-priority": 1 |
47 | | - }, |
48 | | - "dport": { |
49 | | - "description": "The port to which the connection headed.", |
50 | | - "misp-attribute": "counter", |
51 | | - "ui-priority": 1 |
52 | | - }, |
53 | | - "app": { |
54 | | - "description": "The application identified (e.g. vnc, ssh, sip, irc, http or smtp).", |
| 53 | + "thr_category": { |
| 54 | + "description": "The Threat Category.", |
55 | 55 | "misp-attribute": "text", |
56 | 56 | "ui-priority": 1 |
57 | 57 | }, |
58 | | - "proto": { |
59 | | - "description": "The transport protocol (e.g. tcp, udp, icmp).", |
| 58 | + "threatid": { |
| 59 | + "description": "The Threat ID.", |
60 | 60 | "misp-attribute": "text", |
61 | 61 | "ui-priority": 1 |
62 | 62 | }, |
63 | | - "src": { |
64 | | - "description": "The ip observed to initiate the connection", |
65 | | - "misp-attribute": "ip-src", |
| 63 | + "time_generated": { |
| 64 | + "description": "The datetime of the event.", |
| 65 | + "misp-attribute": "datetime", |
66 | 66 | "ui-priority": 1 |
67 | 67 | }, |
68 | | - "sport": { |
69 | | - "description": "The port from which the connection originated.", |
70 | | - "misp-attribute": "counter", |
| 68 | + "type": { |
| 69 | + "description": "The type of the Log Event", |
| 70 | + "misp-attribute": "text", |
71 | 71 | "ui-priority": 1 |
72 | 72 | } |
73 | 73 | }, |
74 | 74 | "description": "Palo Alto Threat Log Event", |
75 | 75 | "meta-category": "network", |
76 | 76 | "name": "paloalto-threat-event", |
77 | 77 | "uuid": "e6fa7a87-1173-43d6-86c2-b4d02af5fc74", |
78 | | - "version": 4 |
| 78 | + "version": 5 |
79 | 79 | } |
0 commit comments