Skip to content

Commit d13c47e

Browse files
chrisr3dchrisr3d
committed
Merge branch 'main' of github.com:MISP/misp-objects
2 parents ca371d4 + b99e7c8 commit d13c47e

9 files changed

Lines changed: 447 additions & 8 deletions

File tree

‎README.md‎

Lines changed: 30 additions & 3 deletions
Large diffs are not rendered by default.

‎objects/attack-step/definition.json‎

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -26,11 +26,13 @@
2626
"description": "IP destination of the attack step, if any.",
2727
"disable_correlation": true,
2828
"misp-attribute": "ip-dst",
29+
"multiple": true,
2930
"ui-priority": 1
3031
},
3132
"dst-misc": {
32-
"description": "Other type of source of the attack step, if any. This can be e.g. localhost.",
33+
"description": "Other type of destination of the attack step, if any. This can be e.g. localhost.",
3334
"misp-attribute": "text",
35+
"multiple": true,
3436
"ui-priority": 1
3537
},
3638
"expected-response": {
@@ -50,16 +52,19 @@
5052
"source-domain": {
5153
"description": "Domain source of the attack step, if any.",
5254
"misp-attribute": "domain",
55+
"multiple": true,
5356
"ui-priority": 1
5457
},
5558
"source-ip": {
5659
"description": "IP source of the attack step, if any.",
5760
"misp-attribute": "ip-src",
61+
"multiple": true,
5862
"ui-priority": 1
5963
},
6064
"source-misc": {
6165
"description": "Other type of source of the attack step, if any. This can be e.g. rotating ip from cloud providers such as AWS, or localhost.",
6266
"misp-attribute": "text",
67+
"multiple": true,
6368
"ui-priority": 1
6469
},
6570
"succesful": {

‎objects/crowdstrike-report/definition.json‎

Lines changed: 53 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,53 @@
1+
{
2+
"attributes": {
3+
"command": {
4+
"description": "Commandline triggering the detection",
5+
"disable_correlation": true,
6+
"misp-attribute": "text",
7+
"multiple": true,
8+
"ui-priority": 1
9+
},
10+
"file-hash": {
11+
"description": "Unique file hash",
12+
"misp-attribute": "sha256",
13+
"ui-priority": 1
14+
},
15+
"filename": {
16+
"description": "Filename on disk",
17+
"disable_correlation": true,
18+
"misp-attribute": "filename",
19+
"multiple": true,
20+
"ui-priority": 1
21+
},
22+
"fullpath": {
23+
"description": "Complete path of the filename including the filename",
24+
"disable_correlation": true,
25+
"misp-attribute": "text",
26+
"multiple": true,
27+
"ui-priority": 0
28+
},
29+
"ip": {
30+
"description": "Source IP address",
31+
"misp-attribute": "ip-src",
32+
"ui-priority": 1
33+
},
34+
"parent-command": {
35+
"description": "Commandline of the parent process",
36+
"disable_correlation": true,
37+
"misp-attribute": "text",
38+
"multiple": true,
39+
"ui-priority": 1
40+
},
41+
"process-name": {
42+
"description": "Name of the process trigerring the detection",
43+
"misp-attribute": "text",
44+
"multiple": true,
45+
"ui-priority": 1
46+
}
47+
},
48+
"description": "An Object Template to encode an Crowdstrike detection report",
49+
"meta-category": "misc",
50+
"name": "crowdstrike-report",
51+
"uuid": "805b327c-8f1b-4d76-a3ba-c8bc4964e740",
52+
"version": 1
53+
}

‎objects/cs-beacon-config/definition.json‎

Lines changed: 33 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,11 @@
11
{
22
"attributes": {
3+
"asn": {
4+
"description": "Originating ASN for the CS Beacon Config",
5+
"disable_correlation": true,
6+
"misp-attribute": "AS",
7+
"ui-priority": 0
8+
},
39
"c2": {
410
"categories": [
511
"Network activity"
@@ -9,6 +15,18 @@
915
"multiple": true,
1016
"ui-priority": 1
1117
},
18+
"city": {
19+
"description": "City location of the CS Beacon Config in question",
20+
"disable_correlation": true,
21+
"misp-attribute": "text",
22+
"ui-priority": 0
23+
},
24+
"geo": {
25+
"description": "Country location of the CS Beacon Config",
26+
"disable_correlation": true,
27+
"misp-attribute": "text",
28+
"ui-priority": 0
29+
},
1230
"ip": {
1331
"description": "IP of the C2",
1432
"misp-attribute": "ip-dst",
@@ -36,6 +54,20 @@
3654
"misp-attribute": "md5",
3755
"ui-priority": 1
3856
},
57+
"naics": {
58+
"description": "North American Industry Classification System Code",
59+
"disable_correlation": true,
60+
"misp-attribute": "text",
61+
"multiple": true,
62+
"ui-priority": 0
63+
},
64+
"sector": {
65+
"description": "Sector of for the CS Beacon Config in question",
66+
"disable_correlation": true,
67+
"misp-attribute": "text",
68+
"multiple": true,
69+
"ui-priority": 0
70+
},
3971
"sha1": {
4072
"categories": [
4173
"Payload delivery"
@@ -80,5 +112,5 @@
80112
"watermark"
81113
],
82114
"uuid": "d17355ef-ca1f-4b5a-86cd-65d877991f54",
83-
"version": 2
115+
"version": 3
84116
}

‎objects/flowintel-cm-case/definition.json‎

Lines changed: 90 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,90 @@
1+
{
2+
"attributes": {
3+
"case-owner-org-name": {
4+
"description": "Name of the organisation that created the case.",
5+
"disable_correlation": true,
6+
"misp-attribute": "text",
7+
"ui-priority": 0
8+
},
9+
"case-owner-org-uuid": {
10+
"description": "UUID of the organisation that created the case.",
11+
"disable_correlation": true,
12+
"misp-attribute": "text",
13+
"ui-priority": 0
14+
},
15+
"case-uuid": {
16+
"description": "UUID of the case",
17+
"disable_correlation": true,
18+
"misp-attribute": "text",
19+
"ui-priority": 1
20+
},
21+
"creation-date": {
22+
"description": "Creation date of the case",
23+
"disable_correlation": true,
24+
"misp-attribute": "datetime",
25+
"ui-priority": 0
26+
},
27+
"deadline": {
28+
"description": "Deadline of the case",
29+
"disable_correlation": true,
30+
"misp-attribute": "datetime",
31+
"ui-priority": 0
32+
},
33+
"description": {
34+
"description": "A description of the case",
35+
"disable_correlation": true,
36+
"misp-attribute": "text",
37+
"ui-priority": 0
38+
},
39+
"finish-date": {
40+
"description": "Finish date of the case",
41+
"disable_correlation": true,
42+
"misp-attribute": "datetime",
43+
"ui-priority": 0
44+
},
45+
"origin-url": {
46+
"description": "Origin of the case",
47+
"disable_correlation": true,
48+
"misp-attribute": "url",
49+
"to_ids": false,
50+
"ui-priority": 1
51+
},
52+
"recurring-type": {
53+
"description": "Recurring type",
54+
"disable_correlation": true,
55+
"misp-attribute": "text",
56+
"sane_default": [
57+
"once",
58+
"weekly",
59+
"daily",
60+
"monthly"
61+
],
62+
"ui-priority": 0
63+
},
64+
"status": {
65+
"description": "Status of the case",
66+
"disable_correlation": true,
67+
"misp-attribute": "text",
68+
"sane_default": [
69+
"created",
70+
"ongoing",
71+
"recurring",
72+
"unavailable",
73+
"rejected",
74+
"finished"
75+
],
76+
"ui-priority": 0
77+
},
78+
"title": {
79+
"description": "Title of the case",
80+
"disable_correlation": true,
81+
"misp-attribute": "text",
82+
"ui-priority": 1
83+
}
84+
},
85+
"description": "A case as defined by flowintel-cm.",
86+
"meta-category": "misc",
87+
"name": "flowintel-cm-case",
88+
"uuid": "19df57c7-b315-4fd2-84e5-d81ab221425e",
89+
"version": 2
90+
}

‎objects/flowintel-cm-task/definition.json‎

Lines changed: 92 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,92 @@
1+
{
2+
"attributes": {
3+
"case-uuid": {
4+
"description": "UUID of the parent case",
5+
"disable_correlation": true,
6+
"misp-attribute": "text",
7+
"ui-priority": 2
8+
},
9+
"creation-date": {
10+
"description": "Creation date of the task",
11+
"disable_correlation": true,
12+
"misp-attribute": "datetime",
13+
"ui-priority": 0
14+
},
15+
"deadline": {
16+
"description": "Deadline of the task",
17+
"disable_correlation": true,
18+
"misp-attribute": "datetime",
19+
"ui-priority": 0
20+
},
21+
"description": {
22+
"description": "A description of the task",
23+
"disable_correlation": true,
24+
"misp-attribute": "text",
25+
"ui-priority": 0
26+
},
27+
"file": {
28+
"description": "File",
29+
"disable_correlation": true,
30+
"misp-attribute": "attachment",
31+
"multiple": true,
32+
"ui-priority": 0
33+
},
34+
"finish-date": {
35+
"description": "Finish date of the task",
36+
"disable_correlation": true,
37+
"misp-attribute": "datetime",
38+
"ui-priority": 0
39+
},
40+
"notes": {
41+
"description": "Notes of the task",
42+
"disable_correlation": true,
43+
"misp-attribute": "text",
44+
"ui-priority": 0
45+
},
46+
"origin-url": {
47+
"description": "Origin of the task",
48+
"disable_correlation": true,
49+
"misp-attribute": "url",
50+
"to_ids": false,
51+
"ui-priority": 1
52+
},
53+
"status": {
54+
"description": "Status of the task",
55+
"disable_correlation": true,
56+
"misp-attribute": "text",
57+
"sane_default": [
58+
"created",
59+
"ongoing",
60+
"recurring",
61+
"unavailable",
62+
"rejected",
63+
"finished"
64+
],
65+
"ui-priority": 0
66+
},
67+
"task-uuid": {
68+
"description": "UUID of the task",
69+
"disable_correlation": true,
70+
"misp-attribute": "text",
71+
"ui-priority": 1
72+
},
73+
"title": {
74+
"description": "Title of the task",
75+
"disable_correlation": true,
76+
"misp-attribute": "text",
77+
"ui-priority": 1
78+
},
79+
"url": {
80+
"description": "An url to an external tool",
81+
"disable_correlation": true,
82+
"misp-attribute": "url",
83+
"to_ids": false,
84+
"ui-priority": 0
85+
}
86+
},
87+
"description": "A task as defined by flowintel-cm.",
88+
"meta-category": "misc",
89+
"name": "flowintel-cm-task",
90+
"uuid": "2f525f6e-d3f2-4cb9-9ca0-f1160d99397d",
91+
"version": 3
92+
}

‎objects/report/definition.json‎

Lines changed: 9 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -31,6 +31,12 @@
3131
"multiple": true,
3232
"ui-priority": 100
3333
},
34+
"title": {
35+
"description": "Title of the report",
36+
"misp-attribute": "text",
37+
"multiple": true,
38+
"ui-priority": 100
39+
},
3440
"type": {
3541
"description": "Type of report",
3642
"disable_correlation": true,
@@ -80,13 +86,14 @@
8086
"ui-priority": 100
8187
}
8288
},
83-
"description": "Metadata used to generate an executive level report",
89+
"description": "Report object to describe a report along with its metadata.",
8490
"meta-category": "misc",
8591
"name": "report",
8692
"requiredOneOf": [
93+
"title",
8794
"summary",
8895
"link"
8996
],
9097
"uuid": "70a68471-df22-4e3f-aa1a-5a3be19f82df",
91-
"version": 7
98+
"version": 8
9299
}

0 commit comments

Comments
 (0)