Skip to content

Commit c6ab0f0

Browse files
TerrtiaTerrtia
authored
Merge branch 'MISP:main' into master
2 parents f84fd3a + e7e7e2d commit c6ab0f0

35 files changed

Lines changed: 3513 additions & 19 deletions

File tree

‎README.md‎

Lines changed: 29 additions & 10 deletions
Large diffs are not rendered by default.

‎objects/ads-b-observation/definition.json‎

Lines changed: 143 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,143 @@
1+
{
2+
"attributes": {
3+
"attack-type": {
4+
"description": "Suspected attack or manipulation type affecting this ADS-B observation.",
5+
"disable_correlation": true,
6+
"misp-attribute": "text",
7+
"multiple": true,
8+
"ui-priority": 30,
9+
"values_list": [
10+
"none",
11+
"spoofing",
12+
"replay",
13+
"jamming",
14+
"message-injection",
15+
"ghost-aircraft",
16+
"position-manipulation",
17+
"identity-hijack",
18+
"mlat-discrepancy",
19+
"other"
20+
]
21+
},
22+
"barometric-altitude-ft": {
23+
"description": "Barometric altitude in feet.",
24+
"disable_correlation": true,
25+
"misp-attribute": "float",
26+
"ui-priority": 95
27+
},
28+
"callsign": {
29+
"description": "Flight callsign observed in ADS-B messages.",
30+
"misp-attribute": "text",
31+
"ui-priority": 99
32+
},
33+
"detection-method": {
34+
"description": "Method used to detect the anomaly (rule, multilateration, radar cross-check, etc.).",
35+
"disable_correlation": true,
36+
"misp-attribute": "text",
37+
"multiple": true,
38+
"ui-priority": 28
39+
},
40+
"discrepancy-detail": {
41+
"description": "Structured human-readable details explaining why this observation appears suspicious.",
42+
"disable_correlation": true,
43+
"misp-attribute": "comment",
44+
"multiple": true,
45+
"ui-priority": 27
46+
},
47+
"first-seen": {
48+
"description": "First timestamp this observation was seen.",
49+
"disable_correlation": true,
50+
"misp-attribute": "datetime",
51+
"ui-priority": 88
52+
},
53+
"geometric-altitude-ft": {
54+
"description": "Geometric (GNSS) altitude in feet.",
55+
"disable_correlation": true,
56+
"misp-attribute": "float",
57+
"ui-priority": 94
58+
},
59+
"ground-speed-kt": {
60+
"description": "Ground speed in knots.",
61+
"disable_correlation": true,
62+
"misp-attribute": "float",
63+
"ui-priority": 93
64+
},
65+
"icao24": {
66+
"description": "24-bit ICAO aircraft address represented as 6 hexadecimal characters.",
67+
"misp-attribute": "text",
68+
"ui-priority": 100
69+
},
70+
"last-seen": {
71+
"description": "Last timestamp this observation was seen.",
72+
"disable_correlation": true,
73+
"misp-attribute": "datetime",
74+
"ui-priority": 87
75+
},
76+
"latitude": {
77+
"description": "Observed latitude (WGS84).",
78+
"disable_correlation": true,
79+
"misp-attribute": "float",
80+
"ui-priority": 97
81+
},
82+
"longitude": {
83+
"description": "Observed longitude (WGS84).",
84+
"disable_correlation": true,
85+
"misp-attribute": "float",
86+
"ui-priority": 96
87+
},
88+
"on-ground": {
89+
"description": "True if the aircraft is reported as on ground.",
90+
"disable_correlation": true,
91+
"misp-attribute": "boolean",
92+
"ui-priority": 89
93+
},
94+
"raw-message": {
95+
"description": "Raw ADS-B / Mode-S frame content when available.",
96+
"disable_correlation": true,
97+
"misp-attribute": "text",
98+
"multiple": true,
99+
"ui-priority": 85
100+
},
101+
"receiver-id": {
102+
"description": "Identifier of the receiver or sensor producing this observation.",
103+
"misp-attribute": "text",
104+
"ui-priority": 86
105+
},
106+
"registration": {
107+
"description": "Aircraft registration (tail number).",
108+
"misp-attribute": "text",
109+
"ui-priority": 98
110+
},
111+
"squawk": {
112+
"description": "4-digit transponder squawk code.",
113+
"misp-attribute": "text",
114+
"ui-priority": 90
115+
},
116+
"suspicion-score": {
117+
"description": "Analyst or system confidence score (0-100) that the observation is malicious or manipulated.",
118+
"disable_correlation": true,
119+
"misp-attribute": "float",
120+
"ui-priority": 29
121+
},
122+
"track-deg": {
123+
"description": "Ground track in degrees (0-359).",
124+
"disable_correlation": true,
125+
"misp-attribute": "float",
126+
"ui-priority": 92
127+
},
128+
"vertical-rate-ft-min": {
129+
"description": "Vertical rate in feet per minute.",
130+
"disable_correlation": true,
131+
"misp-attribute": "float",
132+
"ui-priority": 91
133+
}
134+
},
135+
"description": "Observation object for ADS-B telemetry, including fields to flag spoofing and other ADS-B attacks.",
136+
"meta-category": "transport",
137+
"name": "ads-b-observation",
138+
"requiredOneOf": [
139+
"icao24"
140+
],
141+
"uuid": "e8d9de0f-fb0d-44f4-8d83-7368fb64e9d6",
142+
"version": 1
143+
}

‎objects/ais-info/definition.json‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -41,7 +41,7 @@
4141
"ui-priority": 1
4242
}
4343
},
44-
"description": "Automated Indicator Sharing (AIS) Information Source Markings.",
44+
"description": "Automated Indicator Sharing (AIS) information source markings. This object complements ais or ais-observation by documenting sharing provenance/context and is not related to maritime Automatic Identification System protocol fields.",
4545
"meta-category": "misc",
4646
"name": "ais-info",
4747
"requiredOneOf": [
@@ -51,5 +51,5 @@
5151
"country"
5252
],
5353
"uuid": "1f3f466d-465f-4c3a-8cce-933642c9ea83",
54-
"version": 1
54+
"version": 2
5555
}

‎objects/ais-observation/definition.json‎

Lines changed: 162 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,162 @@
1+
{
2+
"attributes": {
3+
"ETA": {
4+
"description": "Estimated time of arrival at destination.",
5+
"disable_correlation": true,
6+
"misp-attribute": "datetime",
7+
"ui-priority": 89
8+
},
9+
"IMO-number": {
10+
"description": "IMO ship identification number.",
11+
"misp-attribute": "text",
12+
"ui-priority": 99
13+
},
14+
"MMSI": {
15+
"description": "Maritime Mobile Service Identity (MMSI): unique 9-digit vessel identity.",
16+
"misp-attribute": "text",
17+
"ui-priority": 100
18+
},
19+
"attack-type": {
20+
"description": "Suspected attack or manipulation type affecting this AIS observation.",
21+
"disable_correlation": true,
22+
"misp-attribute": "text",
23+
"multiple": true,
24+
"ui-priority": 30,
25+
"values_list": [
26+
"none",
27+
"spoofing",
28+
"replay",
29+
"jamming",
30+
"message-injection",
31+
"ghost-vessel",
32+
"position-manipulation",
33+
"identity-hijack",
34+
"route-manipulation",
35+
"other"
36+
]
37+
},
38+
"call-sign": {
39+
"description": "International radio call-sign.",
40+
"misp-attribute": "text",
41+
"ui-priority": 97
42+
},
43+
"course-over-ground": {
44+
"description": "Observed course over ground in degrees.",
45+
"disable_correlation": true,
46+
"misp-attribute": "float",
47+
"ui-priority": 93
48+
},
49+
"destination": {
50+
"description": "Destination declared in AIS static/voyage data.",
51+
"disable_correlation": true,
52+
"misp-attribute": "text",
53+
"ui-priority": 90
54+
},
55+
"detection-method": {
56+
"description": "Method used to detect the anomaly (geofence, impossible movement, sensor fusion, etc.).",
57+
"disable_correlation": true,
58+
"misp-attribute": "text",
59+
"multiple": true,
60+
"ui-priority": 28
61+
},
62+
"discrepancy-detail": {
63+
"description": "Structured human-readable details explaining why this observation appears suspicious.",
64+
"disable_correlation": true,
65+
"misp-attribute": "comment",
66+
"multiple": true,
67+
"ui-priority": 27
68+
},
69+
"first-seen": {
70+
"description": "First timestamp this observation was seen.",
71+
"disable_correlation": true,
72+
"misp-attribute": "datetime",
73+
"ui-priority": 88
74+
},
75+
"last-seen": {
76+
"description": "Last timestamp this observation was seen.",
77+
"disable_correlation": true,
78+
"misp-attribute": "datetime",
79+
"ui-priority": 87
80+
},
81+
"latitude": {
82+
"description": "Observed latitude (WGS84).",
83+
"disable_correlation": true,
84+
"misp-attribute": "float",
85+
"ui-priority": 96
86+
},
87+
"longitude": {
88+
"description": "Observed longitude (WGS84).",
89+
"disable_correlation": true,
90+
"misp-attribute": "float",
91+
"ui-priority": 95
92+
},
93+
"name": {
94+
"description": "Vessel name as broadcast over AIS.",
95+
"misp-attribute": "text",
96+
"ui-priority": 98
97+
},
98+
"navigational-status": {
99+
"description": "Navigational status transmitted by AIS.",
100+
"disable_correlation": true,
101+
"misp-attribute": "text",
102+
"ui-priority": 91
103+
},
104+
"observation-type": {
105+
"description": "Classification of the shared record to distinguish routine telemetry from security-focused observations.",
106+
"disable_correlation": true,
107+
"misp-attribute": "text",
108+
"ui-priority": 84,
109+
"values_list": [
110+
"telemetry-snapshot",
111+
"security-alert",
112+
"correlation-result"
113+
]
114+
},
115+
"raw-message": {
116+
"description": "Raw NMEA AIS message payload when available.",
117+
"disable_correlation": true,
118+
"misp-attribute": "text",
119+
"multiple": true,
120+
"ui-priority": 85
121+
},
122+
"receiver-id": {
123+
"description": "Identifier of the receiver or sensor producing this observation.",
124+
"misp-attribute": "text",
125+
"ui-priority": 86
126+
},
127+
"related-ais-object-uuid": {
128+
"description": "UUID of a related ais object containing baseline vessel telemetry context for this observation.",
129+
"disable_correlation": true,
130+
"misp-attribute": "text",
131+
"ui-priority": 83
132+
},
133+
"speed-over-ground": {
134+
"description": "Observed speed over ground in knots.",
135+
"disable_correlation": true,
136+
"misp-attribute": "float",
137+
"ui-priority": 94
138+
},
139+
"suspicion-score": {
140+
"description": "Analyst or system confidence score (0-100) that the observation is malicious or manipulated.",
141+
"disable_correlation": true,
142+
"misp-attribute": "float",
143+
"ui-priority": 29
144+
},
145+
"true-heading": {
146+
"description": "Observed true heading in degrees.",
147+
"disable_correlation": true,
148+
"misp-attribute": "float",
149+
"ui-priority": 92
150+
}
151+
},
152+
"description": "Observation object for AIS telemetry and security anomalies, including spoofing and other AIS attacks. This template complements ais (baseline vessel data) and ais-info (source/provenance markings).",
153+
"meta-category": "marine",
154+
"name": "ais-observation",
155+
"requiredOneOf": [
156+
"MMSI",
157+
"IMO-number",
158+
"raw-message"
159+
],
160+
"uuid": "7aef2fc4-6d89-4293-94f2-f2010b7e3ad0",
161+
"version": 2
162+
}

‎objects/ais/definition.json‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -124,12 +124,12 @@
124124
"ui-priority": 91
125125
}
126126
},
127-
"description": "Automatic Identification System (AIS) is an automatic tracking system that uses transceivers on ships.",
127+
"description": "Automatic Identification System (AIS) baseline vessel telemetry object (identity, voyage and navigation data). Use together with ais-observation when sharing suspicious/spoofed AIS observations.",
128128
"meta-category": "marine",
129129
"name": "ais",
130130
"requiredOneOf": [
131131
"MMSI"
132132
],
133133
"uuid": "ef90551a-ff34-472c-9fba-c272c4435baa",
134-
"version": 3
134+
"version": 4
135135
}

0 commit comments

Comments
 (0)