Skip to content

Commit 4137562

Browse files
adulauadulau
authored
Merge pull request #307 from hackunagi/main
Creation of Network Profile MISP Object
2 parents 67d364a + 85dc07a commit 4137562

1 file changed

Lines changed: 218 additions & 0 deletions

File tree

‎objects/network-profile/definition.json‎

Lines changed: 218 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,218 @@
1+
{
2+
"attributes": {
3+
"domain": {
4+
"categories": [
5+
"Network activity",
6+
"External analysis"
7+
],
8+
"description": "Domain of the whois entry",
9+
"misp-attribute": "domain",
10+
"multiple": true,
11+
"ui-priority": 0
12+
},
13+
"ip-address": {
14+
"description": "IP address of the whois entry",
15+
"misp-attribute": "ip-src",
16+
"multiple": true,
17+
"ui-priority": 0
18+
},
19+
"dns-server": {
20+
"description": "DNS server",
21+
"misp-attribute": "hostname",
22+
"multiple": true,
23+
"to_ids": false,
24+
"ui-priority": 0
25+
},
26+
"subdomain": {
27+
"description": "Subdomain",
28+
"disable_correlation": true,
29+
"misp-attribute": "text",
30+
"ui-priority": 0
31+
},
32+
"tld": {
33+
"description": "Top-Level Domain",
34+
"disable_correlation": true,
35+
"misp-attribute": "text",
36+
"ui-priority": 0
37+
},
38+
"threat-actor-infrastructure-pattern": {
39+
"description": "Patterns found on threat actor infrastructure that can correlate with other analysis.",
40+
"misp-attribute": "text",
41+
"multiple": true,
42+
"ui-priority": 0
43+
},
44+
"threat-actor-infrastructure-value": {
45+
"description": "Unique valeu found on threat actor infrastructure identified through an investigation.",
46+
"misp-attribute": "text",
47+
"multiple": true,
48+
"ui-priority": 0
49+
},
50+
"hosting-provider": {
51+
"description": "The hosting provider/ISP where the resources are.",
52+
"misp-attribute": "text",
53+
"ui-priority": 0
54+
},
55+
"port": {
56+
"description": "Port number",
57+
"disable_correlation": true,
58+
"misp-attribute": "port",
59+
"ui-priority": 0
60+
},
61+
"query_string": {
62+
"description": "Query (after path, preceded by '?')",
63+
"misp-attribute": "text",
64+
"multiple": true,
65+
"ui-priority": 0
66+
},
67+
"resource_path": {
68+
"description": "Path (between hostname:port and query)",
69+
"misp-attribute": "text",
70+
"multiple": true,
71+
"ui-priority": 0
72+
},
73+
"jarm": {
74+
"description": "JARM Footprint string",
75+
"misp-attribute": "text",
76+
"ui-priority": 0
77+
},
78+
"google-analytics-id": {
79+
"description": "Google analytics IDS",
80+
"misp-attribute": "text",
81+
"ui-priority": 0
82+
},
83+
"certificate-issuer": {
84+
"description": "Certificate Issuer",
85+
"misp-attribute": "text",
86+
"ui-priority": 0
87+
},
88+
"certificate-common-name": {
89+
"description": "Certificate common name",
90+
"misp-attribute": "text",
91+
"ui-priority": 0
92+
},
93+
"certificate-organization-unit": {
94+
"description": "Certificate organization unit",
95+
"misp-attribute": "text",
96+
"ui-priority": 0
97+
},
98+
"certificate-organization": {
99+
"description": "Certificate organization",
100+
"misp-attribute": "text",
101+
"ui-priority": 0
102+
},
103+
"certificate-organization-locality": {
104+
"description": "Certificate locality",
105+
"misp-attribute": "text",
106+
"ui-priority": 0
107+
},
108+
"certificate-organization-state": {
109+
"description": "Certificate state or provincy name",
110+
"misp-attribute": "text",
111+
"ui-priority": 0
112+
},
113+
"certificate-country": {
114+
"description": "Certificate country name",
115+
"misp-attribute": "text",
116+
"ui-priority": 0
117+
},
118+
"service-abuse": {
119+
"description": "Service abused by threat actors as part of their infrastructure.",
120+
"misp-attribute": "text",
121+
"multiple": true,
122+
"ui-priority": 0,
123+
"values_list": [
124+
"OneDrive",
125+
"Google Drive",
126+
"Dropbox",
127+
"Microsoft",
128+
"Google",
129+
"DuckDNS",
130+
"Cloudflare",
131+
"AWS"
132+
]
133+
},
134+
"asn":{
135+
"description": "ASN where the content is hosted",
136+
"misp-attribute": "as",
137+
"ui-priority":0
138+
},
139+
"url": {
140+
"description": "Full URL",
141+
"misp-attribute": "url",
142+
"ui-priority": 1
143+
},
144+
"whois-registrant-email": {
145+
"description": "Registrant email address",
146+
"misp-attribute": "whois-registrant-email",
147+
"ui-priority": 1
148+
},
149+
"whois-registrant-name": {
150+
"description": "Registrant name",
151+
"misp-attribute": "whois-registrant-name",
152+
"ui-priority": 0
153+
},
154+
"whois-registrant-org": {
155+
"description": "Registrant organisation",
156+
"misp-attribute": "whois-registrant-org",
157+
"ui-priority": 1
158+
},
159+
"whois-registrant-phone": {
160+
"description": "Registrant phone number",
161+
"misp-attribute": "whois-registrant-phone",
162+
"ui-priority": 0
163+
},
164+
"whois-registrar": {
165+
"description": "Registrar of the whois entry",
166+
"misp-attribute": "whois-registrar",
167+
"ui-priority": 0
168+
},
169+
"whois-creation-date": {
170+
"description": "Initial creation of the whois entry",
171+
"disable_correlation": true,
172+
"misp-attribute": "datetime",
173+
"ui-priority": 0
174+
},
175+
"whois-expiration-date": {
176+
"description": "Expiration of the whois entry",
177+
"disable_correlation": true,
178+
"misp-attribute": "datetime",
179+
"ui-priority": 0
180+
},
181+
"text": {
182+
"description": "Full whois entry",
183+
"disable_correlation": true,
184+
"misp-attribute": "text",
185+
"ui-priority": 1
186+
},
187+
"evidences": {
188+
"categories": [
189+
"External analysis"
190+
],
191+
"description": "Screenshot of the network resources.",
192+
"disable_correlation": true,
193+
"misp-attribute": "attachment",
194+
"multiple": true,
195+
"ui-priority": 1
196+
},
197+
"certificate-creation-date": {
198+
"description": "Certificate date it was created",
199+
"misp-attribute": "datetime",
200+
"ui-priority": 0
201+
},
202+
"certificate-expiry-date": {
203+
"description": "Certificate date it will expire",
204+
"misp-attribute": "datetime",
205+
"ui-priority": 0
206+
}
207+
},
208+
"description": "Elements that can be used to profile, pivot or identify a network infrastructure, including domains, ip and urls.",
209+
"meta-category": "network",
210+
"name": "network-profile",
211+
"requiredOneOf": [
212+
"domain",
213+
"ip-address",
214+
"url"
215+
],
216+
"uuid": "f0f9e287-8067-49a4-b0f8-7a0fed8d4e43",
217+
"version": 4
218+
}

0 commit comments

Comments
 (0)