diff --git a/README.md b/README.md index 12843da3..c7e3b44d 100644 --- a/README.md +++ b/README.md @@ -312,6 +312,7 @@ for a specific attribute. An optional **to_ids** boolean field to disable the ID - [objects/iot-firmware](https://github.com/MISP/misp-objects/blob/main/objects/iot-firmware/definition.json) - A firmware for an IoT device. - [objects/ip-api-address](https://github.com/MISP/misp-objects/blob/main/objects/ip-api-address/definition.json) - IP Address information. Useful if you are pulling your ip information from ip-api.com. - [objects/ip-port](https://github.com/MISP/misp-objects/blob/main/objects/ip-port/definition.json) - An IP address (or domain or hostname) and a port seen as a tuple (or as a triple) in a specific time frame. +- [objects/ipapi-is-ip](https://github.com/MISP/misp-objects/blob/main/objects/ipapi-is-ip/definition.json) - IP address intelligence from ipapi.is: VPN (with the provider), proxy, Tor, datacenter, abuser, crawler, mobile, satellite and anycast detection, the organisation the address is registered to with its abuser score, and the abuse contact. - [objects/ipgeolocation-ip](https://github.com/MISP/misp-objects/blob/main/objects/ipgeolocation-ip/definition.json) - IP address intelligence from IPGeolocation.io: threat score, anonymisation signals (VPN, proxy, Tor, relay), bot, spam and attacker flags, hosting provider, company and abuse contact. - [objects/irc](https://github.com/MISP/misp-objects/blob/main/objects/irc/definition.json) - An IRC object to describe an IRC server and the associated channels. - [objects/ja3](https://github.com/MISP/misp-objects/blob/main/objects/ja3/definition.json) - JA3 is a new technique for creating SSL client fingerprints that are easy to produce and can be easily shared for threat intelligence. Fingerprints are composed of Client Hello packet; SSL Version, Accepted Ciphers, List of Extensions, Elliptic Curves, and Elliptic Curve Formats. https://github.com/salesforce/ja3. diff --git a/objects/ipapi-is-ip/definition.json b/objects/ipapi-is-ip/definition.json new file mode 100644 index 00000000..14ac9a08 --- /dev/null +++ b/objects/ipapi-is-ip/definition.json @@ -0,0 +1,161 @@ +{ + "attributes": { + "abuse-address": { + "description": "Postal address of the abuse contact for the network the IP address belongs to", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 0 + }, + "abuse-email": { + "description": "Email address of the abuse contact", + "disable_correlation": true, + "misp-attribute": "email", + "ui-priority": 1 + }, + "abuse-name": { + "description": "Name of the abuse contact", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 0 + }, + "abuse-phone": { + "description": "Phone number of the abuse contact", + "disable_correlation": true, + "misp-attribute": "phone-number", + "ui-priority": 0 + }, + "asn-abuser-score": { + "description": "Abuser score of the autonomous system announcing the IP address, over all its IPv4 routes: the share of its addresses seen in abuse, followed by a label from Very Low to Very High, such as 0.0327 (High)", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 0 + }, + "company-abuser-score": { + "description": "Abuser score of the network the IP address is registered in: the share of its addresses seen in abuse, followed by a label from Very Low to Very High, such as 0.3086 (Very High)", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 1 + }, + "company-domain": { + "description": "Domain of the organisation the IP address is registered to", + "disable_correlation": true, + "misp-attribute": "domain", + "ui-priority": 0 + }, + "company-name": { + "description": "Name of the organisation the IP address is registered to, from WHOIS", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 1 + }, + "company-type": { + "description": "Type of the organisation the IP address is registered to: hosting, isp, education, government, banking or business", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 0 + }, + "crawler": { + "description": "Name of the crawler or bot operating from the IP address, such as GoogleBot", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 1 + }, + "datacenter": { + "description": "Name of the hosting, cloud or CDN provider the IP address belongs to", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 1 + }, + "ip": { + "description": "IP address the information refers to", + "misp-attribute": "ip-src", + "ui-priority": 1 + }, + "is-abuser": { + "description": "The IP address was recently seen in abuse (attacks, spam, scanning) by blocklists or honeypots", + "disable_correlation": true, + "misp-attribute": "boolean", + "ui-priority": 1 + }, + "is-anycast": { + "description": "The IP address is anycast: it is announced from many sites and answers from the nearest one", + "disable_correlation": true, + "misp-attribute": "boolean", + "ui-priority": 1 + }, + "is-crawler": { + "description": "The IP address is used by a crawler or bot, such as a search engine, SEO or AI crawler or an uptime monitor", + "disable_correlation": true, + "misp-attribute": "boolean", + "ui-priority": 1 + }, + "is-datacenter": { + "description": "The IP address belongs to a hosting, cloud or CDN provider", + "disable_correlation": true, + "misp-attribute": "boolean", + "ui-priority": 1 + }, + "is-mobile": { + "description": "The IP address belongs to a mobile carrier", + "disable_correlation": true, + "misp-attribute": "boolean", + "ui-priority": 1 + }, + "is-proxy": { + "description": "The IP address is a known open proxy (HTTP, SOCKS4, SOCKS5)", + "disable_correlation": true, + "misp-attribute": "boolean", + "ui-priority": 1 + }, + "is-satellite": { + "description": "The IP address belongs to a satellite ISP, such as Starlink or Viasat", + "disable_correlation": true, + "misp-attribute": "boolean", + "ui-priority": 1 + }, + "is-tor": { + "description": "The IP address is a Tor exit node", + "disable_correlation": true, + "misp-attribute": "boolean", + "ui-priority": 1 + }, + "is-vpn": { + "description": "The IP address is a VPN exit node or server", + "disable_correlation": true, + "misp-attribute": "boolean", + "ui-priority": 1 + }, + "rir": { + "description": "Registry the WHOIS record of the IP address comes from, such as RIPE, ARIN or JPNIC", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 0 + }, + "vpn-last-seen": { + "description": "Last time the IP address was seen as a VPN exit node or server", + "disable_correlation": true, + "misp-attribute": "datetime", + "ui-priority": 0 + }, + "vpn-service": { + "description": "Name of the VPN provider; several providers sharing a range are joined with +", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 1 + }, + "vpn-type": { + "description": "exit_node when VPN traffic was seen leaving from the IP address, vpn_server when the VPN provider lists it as one of its servers", + "disable_correlation": true, + "misp-attribute": "text", + "ui-priority": 0 + } + }, + "description": "IP address intelligence from ipapi.is: VPN (with the provider), proxy, Tor, datacenter, abuser, crawler, mobile, satellite and anycast detection, the organisation the address is registered to with its abuser score, and the abuse contact.", + "meta-category": "network", + "name": "ipapi-is-ip", + "required": [ + "ip" + ], + "uuid": "2961a5dc-0c3c-4e68-8d65-1565c118c723", + "version": 1 +} \ No newline at end of file