Skip to content

Commit 81968ba

Browse files
adulauadulau
committed
chg: [shadowserver-scan-http-proxy] new template for MISP-LEA project
1 parent 7bef45c commit 81968ba

1 file changed

Lines changed: 185 additions & 0 deletions

File tree

‎objects/shadowserver-scan-http-proxy/definition.json‎

Lines changed: 185 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,185 @@
1+
{
2+
"attributes": {
3+
"asn": {
4+
"description": "ASN where the IP resides",
5+
"misp-attribute": "AS",
6+
"ui-priority": 0
7+
},
8+
"city": {
9+
"description": "City location of the IP in question",
10+
"disable_correlation": true,
11+
"misp-attribute": "text",
12+
"ui-priority": 0
13+
},
14+
"connection": {
15+
"description": "Control options for the current connection and list of hop-by-hop request fields",
16+
"disable_correlation": true,
17+
"misp-attribute": "text",
18+
"multiple": true,
19+
"ui-priority": 0
20+
},
21+
"content_length": {
22+
"description": "The length of the response body in octets",
23+
"disable_correlation": true,
24+
"misp-attribute": "text",
25+
"multiple": true,
26+
"ui-priority": 0
27+
},
28+
"content_type": {
29+
"description": "The MIME type of the body of the request",
30+
"disable_correlation": true,
31+
"misp-attribute": "text",
32+
"multiple": true,
33+
"ui-priority": 0
34+
},
35+
"geo": {
36+
"description": "Country location of the IP",
37+
"disable_correlation": true,
38+
"misp-attribute": "text",
39+
"ui-priority": 0
40+
},
41+
"hostname": {
42+
"description": "Any of the capabilities identified for the malware instance or family.",
43+
"misp-attribute": "hostname",
44+
"multiple": true,
45+
"ui-priority": 0
46+
},
47+
"hostname_source": {
48+
"description": "Hostname source",
49+
"disable_correlation": true,
50+
"misp-attribute": "text",
51+
"multiple": true,
52+
"ui-priority": 0
53+
},
54+
"http": {
55+
"description": "Hypertext Transfer Protocol Version",
56+
"disable_correlation": true,
57+
"misp-attribute": "text",
58+
"multiple": true,
59+
"ui-priority": 0
60+
},
61+
"http_code": {
62+
"description": "HTTP Response code: e.g., 200, 401, 404",
63+
"disable_correlation": true,
64+
"misp-attribute": "text",
65+
"multiple": true,
66+
"ui-priority": 0
67+
},
68+
"http_date": {
69+
"description": "The date and time that the message was sent",
70+
"disable_correlation": true,
71+
"misp-attribute": "text",
72+
"multiple": true,
73+
"ui-priority": 0
74+
},
75+
"http_reason": {
76+
"description": "The text reason to go with the HTTP Code",
77+
"disable_correlation": true,
78+
"misp-attribute": "text",
79+
"multiple": true,
80+
"ui-priority": 0
81+
},
82+
"ip": {
83+
"description": "The IP address of the device in question",
84+
"misp-attribute": "ip-src",
85+
"multiple": true,
86+
"ui-priority": 0
87+
},
88+
"naics": {
89+
"description": "North American Industry Classification System Code",
90+
"disable_correlation": true,
91+
"misp-attribute": "text",
92+
"multiple": true,
93+
"ui-priority": 0
94+
},
95+
"port": {
96+
"description": "Port the response came from",
97+
"misp-attribute": "port",
98+
"multiple": true,
99+
"ui-priority": 0
100+
},
101+
"protocol": {
102+
"description": "Protocol observed in the network traffic",
103+
"misp-attribute": "text",
104+
"multiple": true,
105+
"ui-priority": 0
106+
},
107+
"proxy_authenticate": {
108+
"description": "The authentication method that should be used to gain access to a resource behind a proxy server",
109+
"disable_correlation": true,
110+
"misp-attribute": "text",
111+
"multiple": true,
112+
"ui-priority": 0
113+
},
114+
"region": {
115+
"description": "Regional location of the IP in question",
116+
"disable_correlation": true,
117+
"misp-attribute": "text",
118+
"ui-priority": 1
119+
},
120+
"sector": {
121+
"description": "Sector of the IP in question",
122+
"disable_correlation": true,
123+
"misp-attribute": "text",
124+
"multiple": true,
125+
"ui-priority": 0
126+
},
127+
"server": {
128+
"description": "HTTP Server type",
129+
"disable_correlation": true,
130+
"misp-attribute": "text",
131+
"multiple": true,
132+
"ui-priority": 0
133+
},
134+
"severity": {
135+
"description": "Severity leve",
136+
"disable_correlation": true,
137+
"misp-attribute": "text",
138+
"sane_default": [
139+
"critical",
140+
"high",
141+
"medium",
142+
"low",
143+
"info"
144+
],
145+
"ui-priority": 0
146+
},
147+
"tag": {
148+
"description": "Array of tags associated with the URL if any. In this report typically it will be a CVE entry, for example CVE-2021-44228. This allows for better understanding of the URL context observed (ie. usage associated with a particular CVE).",
149+
"disable_correlation": true,
150+
"misp-attribute": "text",
151+
"multiple": true,
152+
"ui-priority": 0
153+
},
154+
"timestamp": {
155+
"description": "Time that the IP was probed in UTC+0",
156+
"misp-attribute": "datetime",
157+
"ui-priority": 0
158+
},
159+
"transfer_encoding": {
160+
"description": "The form of encoding used to safely transfer the entity to the user",
161+
"disable_correlation": true,
162+
"misp-attribute": "text",
163+
"multiple": true,
164+
"ui-priority": 0
165+
},
166+
"via": {
167+
"description": "General header added by proxies",
168+
"disable_correlation": true,
169+
"misp-attribute": "text",
170+
"multiple": true,
171+
"ui-priority": 0
172+
}
173+
},
174+
"description": "This report identifies open HTTP proxy servers on multiple ports. While HTTP proxies have legitimate uses, they are also used for attacks or other forms of abuse. https://www.shadowserver.org/what-we-do/network-reporting/open-http-proxy-report/",
175+
"meta-category": "misc",
176+
"name": "shadowserver-scan-http-proxy",
177+
"required": [
178+
"timestamp",
179+
"ip",
180+
"port",
181+
"tag"
182+
],
183+
"uuid": "ad0c83d5-56bf-4300-8743-ed2b4caf6206",
184+
"version": 1
185+
}

0 commit comments

Comments
 (0)