New Object templates

objects/breach/definition.json

@@ -0,0 +1,119 @@
+{
+  "attributes": {
+    "added-date": {
+      "description": "When the breach was added to the notification service - not when it happened",
+      "disable_correlation": true,
+      "misp-attribute": "datetime",
+      "ui-priority": 0
+    },
+    "breach-date": {
+      "description": "When the breach occurred, as far as the service knows",
+      "disable_correlation": true,
+      "misp-attribute": "datetime",
+      "ui-priority": 1
+    },
+    "data-classes": {
+      "description": "A class of data exposed by the breach (e.g. `Email addresses`, `Passwords`, `Phone numbers`). One attribute per class",
+      "misp-attribute": "text",
+      "multiple": true,
+      "sane_default": [
+        "Email addresses",
+        "Passwords",
+        "Usernames",
+        "Names",
+        "IP addresses",
+        "Phone numbers",
+        "Physical addresses",
+        "Dates of birth",
+        "Genders",
+        "Geographic locations",
+        "Job titles",
+        "Employers",
+        "Social media profiles",
+        "Website activity",
+        "Password hints",
+        "Security questions and answers",
+        "Partial credit card data",
+        "Credit cards",
+        "Browser user agent details",
+        "Device information"
+      ],
+      "ui-priority": 1
+    },
+    "description": {
+      "description": "The service's own description of the breach",
+      "disable_correlation": true,
+      "misp-attribute": "text",
+      "ui-priority": 0
+    },
+    "domain": {
+      "description": "Domain of the breached service",
+      "misp-attribute": "domain",
+      "ui-priority": 1
+    },
+    "link": {
+      "description": "Link to the service's page for this breach",
+      "misp-attribute": "link",
+      "ui-priority": 0
+    },
+    "modification-date": {
+      "description": "When the service last changed its record of the breach",
+      "disable_correlation": true,
+      "misp-attribute": "datetime",
+      "ui-priority": 0
+    },
+    "name": {
+      "description": "The breach as the service names it, stable across its API",
+      "misp-attribute": "text",
+      "ui-priority": 1
+    },
+    "pwn-count": {
+      "description": "How many accounts the breach exposed",
+      "disable_correlation": true,
+      "misp-attribute": "counter",
+      "ui-priority": 1
+    },
+    "sensitive": {
+      "description": "Whether the service treats the breach as sensitive, meaning membership is not publicly searchable",
+      "misp-attribute": "boolean",
+      "sane_default": [
+        "True",
+        "False"
+      ],
+      "ui-priority": 0
+    },
+    "source": {
+      "description": "The breach notification service the record came from",
+      "misp-attribute": "text",
+      "sane_default": [
+        "Have I Been Pwned",
+        "XposedOrNot",
+        "LeakCheck",
+        "DeHashed"
+      ],
+      "ui-priority": 1
+    },
+    "title": {
+      "description": "Display name of the breach, where the service gives one distinct from `name`",
+      "misp-attribute": "text",
+      "ui-priority": 0
+    },
+    "verified": {
+      "description": "Whether the service considers the breach verified rather than claimed",
+      "misp-attribute": "boolean",
+      "sane_default": [
+        "True",
+        "False"
+      ],
+      "ui-priority": 0
+    }
+  },
+  "description": "A data breach in which accounts or personal data were exposed, as published by a breach notification service. Describes the breach itself, so that an address or account found in one links to the breach rather than restating it; `credential` holds what was exposed and `ail-leak` holds a leak as an analysis framework saw it.",
+  "meta-category": "misc",
+  "name": "breach",
+  "required": [
+    "name"
+  ],
+  "uuid": "9a73cc75-6e1a-41dc-8a71-6f24e4db1f2d",
+  "version": 1
+}

objects/btc-transaction/definition.json

@@ -1,9 +1,9 @@
 {
   "attributes": {
     "btc-address": {
-      "description": "A Bitcoin transactional address",
-      "disable_correlation": true,
+      "description": "A Bitcoin address taking part in the transaction: the wallet the object describes, and the counterparties it exchanged value with",
       "misp-attribute": "btc",
+      "multiple": true,
       "ui-priority": 0
     },
     "time": {
@@ -47,5 +47,5 @@
     "value_BTC"
   ],
   "uuid": "B7341729-5A8A-439F-A775-6D814DA3C7B5",
-  "version": 4
+  "version": 5
 }

objects/exploit/definition.json

@@ -99,8 +99,10 @@
   "requiredOneOf": [
     "exploit",
     "filename",
-    "exploit-as-attachment"
+    "exploit-as-attachment",
+    "title",
+    "reference"
   ],
   "uuid": "611a25d5-d8aa-4dde-b9c8-c084e786ebf3",
-  "version": 1
+  "version": 2
 }

objects/page-capture/definition.json

@@ -0,0 +1,60 @@
+{
+  "attributes": {
+    "archive": {
+      "description": "Link to an archived copy of the page held elsewhere",
+      "misp-attribute": "link",
+      "multiple": true,
+      "ui-priority": 1
+    },
+    "attachment": {
+      "description": "The captured page itself, stored as an attachment",
+      "misp-attribute": "attachment",
+      "ui-priority": 1
+    },
+    "capture-date": {
+      "description": "When the capture was taken. Distinct from the date the object was created: a capture fetched from an archive can be years older",
+      "disable_correlation": true,
+      "misp-attribute": "datetime",
+      "ui-priority": 1
+    },
+    "domain": {
+      "description": "Domain the page was served from",
+      "misp-attribute": "domain",
+      "ui-priority": 0
+    },
+    "filename": {
+      "description": "Filename of the stored capture",
+      "misp-attribute": "filename",
+      "ui-priority": 0
+    },
+    "link": {
+      "description": "Link to the capture as the capturing service publishes it",
+      "misp-attribute": "link",
+      "ui-priority": 1
+    },
+    "text": {
+      "description": "Text extracted from the captured page",
+      "disable_correlation": true,
+      "misp-attribute": "text",
+      "ui-priority": 0
+    },
+    "url": {
+      "description": "URL that was fetched",
+      "misp-attribute": "url",
+      "ui-priority": 1
+    }
+  },
+  "description": "A copy of a page as it was when somebody fetched it: the stored bytes, the text extracted from them, or a link to an archived copy, with the date the capture was taken. Complements `image`, which holds a screenshot and no date, and `domain-crawled`, which holds the URLs a crawl found and not what they returned.",
+  "meta-category": "network",
+  "name": "page-capture",
+  "required": [
+    "url"
+  ],
+  "requiredOneOf": [
+    "attachment",
+    "archive",
+    "text"
+  ],
+  "uuid": "555f0d10-5df6-4e04-bf8a-145156d37ab6",
+  "version": 1
+}

objects/reputation/definition.json

@@ -0,0 +1,75 @@
+{
+  "attributes": {
+    "classification": {
+      "description": "The verdict the source gives, in its own word. `malicious`, `suspicious` and `benign` are the words MISP reads as a verdict; anything else, including `unknown`, is recorded as the source said it and read as no opinion.",
+      "misp-attribute": "text",
+      "sane_default": [
+        "malicious",
+        "suspicious",
+        "benign",
+        "safe",
+        "known",
+        "legitimate",
+        "unknown"
+      ],
+      "ui-priority": 1
+    },
+    "first-seen": {
+      "description": "First time the source saw the value on this list, or first observation behind the verdict",
+      "disable_correlation": true,
+      "misp-attribute": "datetime",
+      "ui-priority": 0
+    },
+    "last-seen": {
+      "description": "Last time the source saw the value on this list, or most recent observation behind the verdict",
+      "disable_correlation": true,
+      "misp-attribute": "datetime",
+      "ui-priority": 0
+    },
+    "link": {
+      "description": "Link to the source's own report for this value",
+      "misp-attribute": "link",
+      "ui-priority": 1
+    },
+    "list-name": {
+      "description": "The specific list or zone the value was found on, where the source publishes more than one (e.g. a DNSBL zone)",
+      "misp-attribute": "text",
+      "ui-priority": 1
+    },
+    "score": {
+      "description": "How sure the source is, on its own scale. State the scale in `text` where it is not 0-100",
+      "disable_correlation": true,
+      "misp-attribute": "float",
+      "ui-priority": 1
+    },
+    "source": {
+      "description": "The service or list that gave the verdict",
+      "misp-attribute": "text",
+      "sane_default": [
+        "AbuseIPDB",
+        "GreyNoise",
+        "CrowdSec",
+        "VirusTotal",
+        "Google Threat Intelligence",
+        "Spamhaus",
+        "SpamCop"
+      ],
+      "ui-priority": 1
+    },
+    "text": {
+      "description": "Anything the source said that the fields above do not hold, including the scale a non-standard score is on",
+      "disable_correlation": true,
+      "misp-attribute": "text",
+      "ui-priority": 0
+    }
+  },
+  "description": "What an outside source thinks of a value: a classification, a score, or both. The generic counterpart to the vendor verdict objects (abuseipdb, greynoise-ip, crowdsec-ip-context, virustotal-report), for the sources that do not warrant a template of their own - blocklists, DNSBLs, scam lists - and a place for vendors to state a verdict beside their own richer object.",
+  "meta-category": "misc",
+  "name": "reputation",
+  "requiredOneOf": [
+    "classification",
+    "score"
+  ],
+  "uuid": "0a606d84-87ea-4a92-9bdb-528f899ff531",
+  "version": 1
+}