|
1 | 1 | { |
2 | 2 | "attributes": { |
| 3 | + "counter": { |
| 4 | + "description": "counter (ex.: bytes, packets, flows, events, etc)", |
| 5 | + "disable_correlation": true, |
| 6 | + "misp-attribute": "counter", |
| 7 | + "multiple": true, |
| 8 | + "ui-priority": 3 |
| 9 | + }, |
| 10 | + "data": { |
| 11 | + "description": "network traffic (ex.: payload, log lines, etc)", |
| 12 | + "disable_correlation": true, |
| 13 | + "misp-attribute": "text", |
| 14 | + "multiple": true, |
| 15 | + "ui-priority": 0 |
| 16 | + }, |
3 | 17 | "description": { |
4 | 18 | "categories": [ |
5 | 19 | "Network activity", |
|
9 | 23 | "disable_correlation": true, |
10 | 24 | "misp-attribute": "text", |
11 | 25 | "multiple": true, |
12 | | - "ui-priority": 15 |
| 26 | + "ui-priority": 15 |
13 | 27 | }, |
14 | | - "src_CC": { |
| 28 | + "dst_ASN": { |
15 | 29 | "categories": [ |
16 | 30 | "Network activity", |
17 | 31 | "External analysis" |
18 | 32 | ], |
19 | | - "description": "source country code", |
| 33 | + "description": "destination autonomous system number", |
20 | 34 | "disable_correlation": true, |
21 | | - "misp-attribute": "text", |
| 35 | + "misp-attribute": "AS", |
22 | 36 | "multiple": true, |
23 | | - "ui-priority": 14 |
| 37 | + "ui-priority": 8 |
24 | 38 | }, |
25 | | - "src_ASN": { |
| 39 | + "dst_CC": { |
26 | 40 | "categories": [ |
27 | 41 | "Network activity", |
28 | 42 | "External analysis" |
29 | 43 | ], |
30 | | - "description": "source autonomous system number", |
| 44 | + "description": "destination country code", |
31 | 45 | "disable_correlation": true, |
32 | | - "misp-attribute": "AS", |
| 46 | + "misp-attribute": "text", |
33 | 47 | "multiple": true, |
34 | | - "ui-priority": 13 |
| 48 | + "ui-priority": 9 |
35 | 49 | }, |
36 | | - "src_IP": { |
| 50 | + "dst_IP": { |
37 | 51 | "categories": [ |
38 | 52 | "Network activity", |
39 | 53 | "External analysis" |
40 | 54 | ], |
41 | | - "description": "source IP address", |
42 | | - "misp-attribute": "ip-src", |
| 55 | + "description": "destination IP address", |
| 56 | + "misp-attribute": "ip-dst", |
43 | 57 | "multiple": true, |
44 | | - "ui-priority": 12 |
| 58 | + "ui-priority": 7 |
45 | 59 | }, |
46 | | - "src_port": { |
| 60 | + "dst_hostname": { |
47 | 61 | "categories": [ |
48 | 62 | "Network activity", |
49 | 63 | "External analysis" |
50 | 64 | ], |
51 | | - "description": "source port", |
52 | | - "disable_correlation": true, |
53 | | - "misp-attribute": "port", |
| 65 | + "description": "destination hostname", |
| 66 | + "misp-attribute": "hostname", |
54 | 67 | "multiple": true, |
55 | | - "ui-priority": 11 |
| 68 | + "ui-priority": 5 |
56 | 69 | }, |
57 | | - "src_hostname": { |
| 70 | + "dst_port": { |
58 | 71 | "categories": [ |
59 | 72 | "Network activity", |
60 | 73 | "External analysis" |
61 | 74 | ], |
62 | | - "description": "source hostname", |
63 | | - "misp-attribute": "hostname", |
| 75 | + "description": "destination port", |
| 76 | + "disable_correlation": true, |
| 77 | + "misp-attribute": "port", |
64 | 78 | "multiple": true, |
65 | | - "ui-priority": 10 |
| 79 | + "ui-priority": 6 |
66 | 80 | }, |
67 | | - "dst_CC": { |
| 81 | + "first_seen": { |
| 82 | + "description": "timestamp of the first data seen", |
| 83 | + "disable_correlation": true, |
| 84 | + "misp-attribute": "datetime", |
| 85 | + "ui-priority": 2 |
| 86 | + }, |
| 87 | + "last_seen": { |
| 88 | + "description": "timestamp of the last data seen", |
| 89 | + "disable_correlation": true, |
| 90 | + "misp-attribute": "datetime", |
| 91 | + "ui-priority": 1 |
| 92 | + }, |
| 93 | + "protocol": { |
68 | 94 | "categories": [ |
69 | 95 | "Network activity", |
70 | 96 | "External analysis" |
71 | 97 | ], |
72 | | - "description": "destination country code", |
| 98 | + "description": "protocol (ex.: TCP, UDP, ICMP, TLS, HTTP, HTTPS, SIP, etc)", |
73 | 99 | "disable_correlation": true, |
74 | 100 | "misp-attribute": "text", |
75 | 101 | "multiple": true, |
76 | | - "ui-priority": 9 |
| 102 | + "ui-priority": 4 |
77 | 103 | }, |
78 | | - "dst_ASN": { |
| 104 | + "src_ASN": { |
79 | 105 | "categories": [ |
80 | 106 | "Network activity", |
81 | 107 | "External analysis" |
82 | 108 | ], |
83 | | - "description": "destination autonomous system number", |
| 109 | + "description": "source autonomous system number", |
84 | 110 | "disable_correlation": true, |
85 | 111 | "misp-attribute": "AS", |
86 | 112 | "multiple": true, |
87 | | - "ui-priority": 8 |
| 113 | + "ui-priority": 13 |
88 | 114 | }, |
89 | | - "dst_IP": { |
| 115 | + "src_CC": { |
90 | 116 | "categories": [ |
91 | 117 | "Network activity", |
92 | 118 | "External analysis" |
93 | 119 | ], |
94 | | - "description": "destination IP address", |
95 | | - "misp-attribute": "ip-dst", |
| 120 | + "description": "source country code", |
| 121 | + "disable_correlation": true, |
| 122 | + "misp-attribute": "text", |
96 | 123 | "multiple": true, |
97 | | - "ui-priority": 7 |
| 124 | + "ui-priority": 14 |
98 | 125 | }, |
99 | | - "dst_port": { |
| 126 | + "src_IP": { |
100 | 127 | "categories": [ |
101 | 128 | "Network activity", |
102 | 129 | "External analysis" |
103 | 130 | ], |
104 | | - "description": "destination port", |
105 | | - "disable_correlation": true, |
106 | | - "misp-attribute": "port", |
| 131 | + "description": "source IP address", |
| 132 | + "misp-attribute": "ip-src", |
107 | 133 | "multiple": true, |
108 | | - "ui-priority": 6 |
| 134 | + "ui-priority": 12 |
109 | 135 | }, |
110 | | - "dst_hostname": { |
| 136 | + "src_hostname": { |
111 | 137 | "categories": [ |
112 | 138 | "Network activity", |
113 | 139 | "External analysis" |
114 | 140 | ], |
115 | | - "description": "destination hostname", |
| 141 | + "description": "source hostname", |
116 | 142 | "misp-attribute": "hostname", |
117 | 143 | "multiple": true, |
118 | | - "ui-priority": 5 |
| 144 | + "ui-priority": 10 |
119 | 145 | }, |
120 | | - "protocol": { |
| 146 | + "src_port": { |
121 | 147 | "categories": [ |
122 | 148 | "Network activity", |
123 | 149 | "External analysis" |
124 | 150 | ], |
125 | | - "description": "protocol (ex.: TCP, UDP, ICMP, TLS, HTTP, HTTPS, SIP, etc)", |
126 | | - "disable_correlation": true, |
127 | | - "misp-attribute": "text", |
128 | | - "multiple": true, |
129 | | - "ui-priority": 4 |
130 | | - }, |
131 | | - "counter": { |
132 | | - "description": "counter (ex.: bytes, packets, flows, events, etc)", |
133 | | - "disable_correlation": true, |
134 | | - "misp-attribute": "counter", |
135 | | - "multiple": true, |
136 | | - "ui-priority": 3 |
137 | | - }, |
138 | | - "first_seen": { |
139 | | - "description": "timestamp of the first data seen", |
140 | | - "disable_correlation": true, |
141 | | - "misp-attribute": "datetime", |
142 | | - "ui-priority": 2 |
143 | | - }, |
144 | | - "last_seen": { |
145 | | - "description": "timestamp of the last data seen", |
146 | | - "disable_correlation": true, |
147 | | - "misp-attribute": "datetime", |
148 | | - "ui-priority": 1 |
149 | | - }, |
150 | | - "data": { |
151 | | - "description": "network traffic (ex.: payload, log lines, etc)", |
| 151 | + "description": "source port", |
152 | 152 | "disable_correlation": true, |
153 | | - "misp-attribute": "text", |
| 153 | + "misp-attribute": "port", |
154 | 154 | "multiple": true, |
155 | | - "ui-priority": 0 |
| 155 | + "ui-priority": 11 |
156 | 156 | } |
157 | 157 | }, |
158 | 158 | "description": "network data, including payloads/logs, relevant timestamps, data volume and enrichment of the TCP/IP 5-tuple connection information.", |
159 | 159 | "meta-category": "network", |
160 | 160 | "name": "network-data", |
161 | 161 | "requiredOneOf": [ |
162 | | - "src_IP", |
163 | | - "data" |
| 162 | + "src_IP", |
| 163 | + "data" |
164 | 164 | ], |
165 | 165 | "uuid": "64d5949b-98ac-459d-83b8-4688f45795de", |
166 | 166 | "version": 2 |
|
0 commit comments