Skip to content

Commit 995c51f

Browse files
adulauadulau
authored
Merge pull request #501 from MISP/codex/propose-packet-filter-object-template
Add packet-filter-rule MISP object definition and README entry
2 parents 15711f2 + c2bcab5 commit 995c51f

2 files changed

Lines changed: 256 additions & 0 deletions

File tree

‎README.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -347,6 +347,7 @@ for a specific attribute. An optional **to_ids** boolean field to disable the ID
347347
- [objects/parler-account](https://github.com/MISP/misp-objects/blob/main/objects/parler-account/definition.json) - Parler account.
348348
- [objects/parler-comment](https://github.com/MISP/misp-objects/blob/main/objects/parler-comment/definition.json) - Parler comment.
349349
- [objects/parler-post](https://github.com/MISP/misp-objects/blob/main/objects/parler-post/definition.json) - Parler post (parley).
350+
- [objects/packet-filter-rule](https://github.com/MISP/misp-objects/blob/main/objects/packet-filter-rule/definition.json) - Packet filter, firewall, or ACL rule metadata across network security platforms.
350351
- [objects/passive-dns](https://github.com/MISP/misp-objects/blob/main/objects/passive-dns/definition.json) - Passive DNS records as expressed in draft-dulaunoy-dnsop-passive-dns-cof-07. See https://tools.ietf.org/id/draft-dulaunoy-dnsop-passive-dns-cof-07.html.
351352
- [objects/passive-dns-dnsdbflex](https://github.com/MISP/misp-objects/blob/main/objects/passive-dns-dnsdbflex/definition.json) - DNSDBFLEX object. This object is used at farsight security. Roughly based on Passive DNS records as expressed in draft-dulaunoy-dnsop-passive-dns-cof-07. See https://tools.ietf.org/id/draft-dulaunoy-dnsop-passive-dns-cof-07.html.
352353
- [objects/passive-ssh](https://github.com/MISP/misp-objects/blob/main/objects/passive-ssh/definition.json) - Passive-ssh object as described on passive-ssh services from circl.lu - https://github.com/D4-project/passive-ssh.

‎objects/packet-filter-rule/definition.json‎

Lines changed: 255 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,255 @@
1+
{
2+
"attributes": {
3+
"action": {
4+
"description": "Primary action of the packet filter rule.",
5+
"disable_correlation": true,
6+
"misp-attribute": "text",
7+
"sane_default": [
8+
"allow",
9+
"deny",
10+
"drop",
11+
"accept",
12+
"reject",
13+
"pass",
14+
"permit",
15+
"block",
16+
"log",
17+
"count",
18+
"queue",
19+
"return"
20+
],
21+
"ui-priority": 1
22+
},
23+
"comment": {
24+
"description": "Comment, rationale, or analyst note associated with the rule.",
25+
"disable_correlation": true,
26+
"misp-attribute": "comment",
27+
"ui-priority": 3
28+
},
29+
"destination": {
30+
"description": "Destination selector (IP, CIDR, object/group, or keyword such as any).",
31+
"misp-attribute": "text",
32+
"multiple": true,
33+
"ui-priority": 2
34+
},
35+
"destination-port": {
36+
"description": "Destination port or port range targeted by the rule.",
37+
"misp-attribute": "port",
38+
"multiple": true,
39+
"ui-priority": 2
40+
},
41+
"direction": {
42+
"description": "Traffic direction the rule applies to.",
43+
"disable_correlation": true,
44+
"misp-attribute": "text",
45+
"sane_default": [
46+
"ingress",
47+
"egress",
48+
"inbound",
49+
"outbound",
50+
"forward",
51+
"input",
52+
"output",
53+
"any"
54+
],
55+
"ui-priority": 2
56+
},
57+
"enabled": {
58+
"description": "Whether the rule is enabled/active in policy.",
59+
"disable_correlation": true,
60+
"misp-attribute": "boolean",
61+
"sane_default": [
62+
"true",
63+
"false"
64+
],
65+
"ui-priority": 2
66+
},
67+
"interface": {
68+
"description": "Interface, zone, or security context where the rule is enforced.",
69+
"disable_correlation": true,
70+
"misp-attribute": "text",
71+
"multiple": true,
72+
"ui-priority": 3
73+
},
74+
"logging": {
75+
"description": "Whether matching traffic should be logged.",
76+
"disable_correlation": true,
77+
"misp-attribute": "boolean",
78+
"sane_default": [
79+
"true",
80+
"false"
81+
],
82+
"ui-priority": 3
83+
},
84+
"product": {
85+
"description": "Firewall/packet-filter product implementing the rule.",
86+
"disable_correlation": true,
87+
"misp-attribute": "text",
88+
"sane_default": [
89+
"netfilter",
90+
"nftables",
91+
"OpenBSD PF",
92+
"Cisco IOS",
93+
"Palo Alto PAN-OS",
94+
"Fortinet FortiGate",
95+
"Check Point Gaia",
96+
"Windows Defender Firewall",
97+
"AWS Security Group",
98+
"Azure Network Security Group",
99+
"Google Cloud VPC Firewall",
100+
"pfSense",
101+
"OPNsense",
102+
"Cisco ASA",
103+
"Cisco Firepower",
104+
"Juniper SRX",
105+
"SonicWall",
106+
"MikroTik RouterOS",
107+
"VyOS",
108+
"ipfw",
109+
"AWS Network ACL",
110+
"Kubernetes NetworkPolicy"
111+
],
112+
"ui-priority": 2
113+
},
114+
"protocol": {
115+
"description": "L3/L4 protocol matched by the rule.",
116+
"disable_correlation": true,
117+
"misp-attribute": "text",
118+
"multiple": true,
119+
"sane_default": [
120+
"tcp",
121+
"udp",
122+
"icmp",
123+
"ip",
124+
"icmpv6",
125+
"sctp",
126+
"gre",
127+
"esp",
128+
"ah",
129+
"any"
130+
],
131+
"ui-priority": 2
132+
},
133+
"raw-rule": {
134+
"description": "Original packet-filter rule string or policy stanza.",
135+
"disable_correlation": true,
136+
"misp-attribute": "text",
137+
"multiple": true,
138+
"ui-priority": 3
139+
},
140+
"reference": {
141+
"description": "Reference URL for the rule source, policy export, or documentation.",
142+
"disable_correlation": true,
143+
"misp-attribute": "link",
144+
"multiple": true,
145+
"ui-priority": 3
146+
},
147+
"rule-format": {
148+
"description": "Rule syntax or policy format used by the platform.",
149+
"disable_correlation": true,
150+
"misp-attribute": "text",
151+
"sane_default": [
152+
"netfilter-iptables",
153+
"nftables",
154+
"pf",
155+
"cisco-ios-acl",
156+
"cisco-asa-acl",
157+
"juniper-junos-firewall-filter",
158+
"paloalto-pan-os-security-policy",
159+
"fortinet-fortios-policy",
160+
"checkpoint-access-control-policy",
161+
"windows-defender-firewall-powershell",
162+
"aws-security-group",
163+
"azure-network-security-group",
164+
"gcp-vpc-firewall",
165+
"netfilter-ip6tables",
166+
"ipfw",
167+
"cisco-fmc-acp",
168+
"sonicwall-access-rule",
169+
"mikrotik-routeros-firewall-filter",
170+
"vyos-firewall",
171+
"windows-netsh-advfirewall",
172+
"aws-network-acl",
173+
"kubernetes-network-policy"
174+
],
175+
"ui-priority": 1
176+
},
177+
"rule-id": {
178+
"description": "Identifier, number, or handle of the rule.",
179+
"disable_correlation": true,
180+
"misp-attribute": "text",
181+
"ui-priority": 1
182+
},
183+
"rule-name": {
184+
"description": "Human-readable name or label of the rule.",
185+
"disable_correlation": true,
186+
"misp-attribute": "text",
187+
"ui-priority": 1
188+
},
189+
"sequence-number": {
190+
"description": "Rule order or sequence position in the policy table.",
191+
"disable_correlation": true,
192+
"misp-attribute": "text",
193+
"ui-priority": 2
194+
},
195+
"source": {
196+
"description": "Source selector (IP, CIDR, object/group, or keyword such as any).",
197+
"misp-attribute": "text",
198+
"multiple": true,
199+
"ui-priority": 2
200+
},
201+
"source-port": {
202+
"description": "Source port or port range matched by the rule.",
203+
"misp-attribute": "port",
204+
"multiple": true,
205+
"ui-priority": 3
206+
},
207+
"vendor": {
208+
"description": "Firewall or network security vendor associated with this rule syntax.",
209+
"disable_correlation": true,
210+
"misp-attribute": "text",
211+
"sane_default": [
212+
"Cisco",
213+
"Juniper",
214+
"Palo Alto Networks",
215+
"Fortinet",
216+
"Check Point",
217+
"Microsoft",
218+
"Linux Netfilter Project",
219+
"OpenBSD",
220+
"Amazon Web Services",
221+
"Microsoft Azure",
222+
"Google Cloud",
223+
"SonicWall",
224+
"Netgate",
225+
"Deciso",
226+
"MikroTik",
227+
"VyOS",
228+
"FreeBSD",
229+
"Huawei",
230+
"H3C",
231+
"Arista",
232+
"Nokia",
233+
"Stormshield",
234+
"Sophos",
235+
"WatchGuard",
236+
"Barracuda",
237+
"Forcepoint",
238+
"Zscaler",
239+
"PFSense Community",
240+
"OPNsense Project"
241+
],
242+
"ui-priority": 1
243+
}
244+
},
245+
"description": "Packet filter, firewall, or ACL rule metadata across network security platforms (for example netfilter, PF, and Cisco ACL syntax).",
246+
"meta-category": "network",
247+
"name": "packet-filter-rule",
248+
"requiredOneOf": [
249+
"raw-rule",
250+
"rule-id",
251+
"rule-name"
252+
],
253+
"uuid": "2f06d31e-cc48-4e50-bd3a-9f97c0c71e6a",
254+
"version": 1
255+
}

0 commit comments

Comments
 (0)