From cd9d49b84e5daf637f913e171c40f4d7bd6b1782 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Thirion=20Aur=C3=A9lien?= Date: Thu, 15 Oct 2026 15:23:46 +0200 Subject: [PATCH 1/2] new: [chat] Add chat container object template --- README.md | 1 + objects/chat/definition.json | 98 ++++++++++++++++++++++++++++++++++++ 2 files changed, 99 insertions(+) create mode 100644 objects/chat/definition.json diff --git a/README.md b/README.md index c7e3b44d..0f969f4e 100644 --- a/README.md +++ b/README.md @@ -140,6 +140,7 @@ for a specific attribute. An optional **to_ids** boolean field to disable the ID - [objects/cap-info](https://github.com/MISP/misp-objects/blob/main/objects/cap-info/definition.json) - Common Alerting Protocol Version (CAP) info object. - [objects/cap-resource](https://github.com/MISP/misp-objects/blob/main/objects/cap-resource/definition.json) - Common Alerting Protocol Version (CAP) resource object. - [objects/cert-pl-phishing](https://github.com/MISP/misp-objects/blob/main/objects/cert-pl-phishing/definition.json) - cert.pl phishing object template representing an url along with some metadata as such phash, html-structure or partial-hash. +- [objects/chat](https://github.com/MISP/misp-objects/blob/main/objects/chat/definition.json) - A chat container, a subchannel or a thread on a messaging service. Identifiers are local to their service instance and parent container. Represent hierarchy with part-of object references to separate chat objects. Use native object first_seen and last_seen for observations. - [objects/chat-message](https://github.com/MISP/misp-objects/blob/main/objects/chat-message/definition.json) - A message exchanged on a chat or messaging platform. - [objects/citizenship-document](https://github.com/MISP/misp-objects/blob/main/objects/citizenship-document/definition.json) - A document attesting a person's citizenship or nationality, including citizenship, naturalisation, registration and nationality certificates, and other documents serving as citizenship evidence in the relevant jurisdiction. Supports paper and electronic documents, local naming and numbering conventions, and incomplete records. A residence permit or a place of birth alone does not establish citizenship. - [objects/cloth](https://github.com/MISP/misp-objects/blob/main/objects/cloth/definition.json) - Describes clothes a natural person wears. diff --git a/objects/chat/definition.json b/objects/chat/definition.json new file mode 100644 index 00000000..8046e569 --- /dev/null +++ b/objects/chat/definition.json @@ -0,0 +1,98 @@ +{ + "attributes": { + "address": { + "description": "Recorded service-instance address, when available. Preserve its source form without inventing a hostname or URL.", + "disable_correlation": true, + "misp-attribute": "text", + "to_ids": false, + "ui-priority": 0 + }, + "created": { + "description": "Recorded creation time of this container on the source platform. This is distinct from observation first_seen and last_seen.", + "disable_correlation": true, + "misp-attribute": "datetime", + "to_ids": false, + "ui-priority": 0 + }, + "description": { + "description": "Recorded description of the container.", + "disable_correlation": true, + "misp-attribute": "text", + "to_ids": false, + "ui-priority": 0 + }, + "id": { + "description": "Identifier assigned to this container by the source platform. Preserve it as text; it is scoped to its service instance and parent container.", + "disable_correlation": true, + "misp-attribute": "text", + "to_ids": false, + "ui-priority": 1 + }, + "kind": { + "description": "Container kind. When absent, interpret this object as a chat. A subchannel or thread must specify its kind.", + "disable_correlation": true, + "misp-attribute": "text", + "sane_default": [ + "chat" + ], + "to_ids": false, + "ui-priority": 0, + "values_list": [ + "chat", + "subchannel", + "thread" + ] + }, + "language": { + "description": "Language observed in messages belonging to this container, expressed as a language code.", + "disable_correlation": true, + "misp-attribute": "text", + "multiple": true, + "to_ids": false, + "ui-priority": 0 + }, + "name": { + "description": "Recorded display name of this chat, subchannel or thread.", + "disable_correlation": true, + "misp-attribute": "text", + "to_ids": false, + "ui-priority": 1 + }, + "network": { + "description": "Logical network or deployment name recorded for the service instance. This is not restricted to transport networks such as Tor or I2P.", + "disable_correlation": true, + "misp-attribute": "text", + "to_ids": false, + "ui-priority": 0 + }, + "protocol": { + "description": "Messaging service or protocol, such as rocket-chat, telegram, matrix or discord. Together with network and address, identifies the service instance.", + "disable_correlation": true, + "misp-attribute": "text", + "to_ids": false, + "ui-priority": 0 + }, + "url": { + "description": "Direct URL of this container on the source service, when known. Do not substitute a collector user-interface URL.", + "disable_correlation": false, + "misp-attribute": "url", + "to_ids": false, + "ui-priority": 1 + }, + "username": { + "description": "Platform username assigned to this container, if any. This is not a participant username.", + "disable_correlation": true, + "misp-attribute": "text", + "to_ids": false, + "ui-priority": 1 + } + }, + "description": "A chat container, a subchannel or a thread on a messaging service. Identifiers are local to their service instance and parent container. Represent hierarchy with part-of object references to separate chat objects. Use native object first_seen and last_seen for observations.", + "meta-category": "misc", + "name": "chat", + "required": [ + "id" + ], + "uuid": "c05abee9-1cd2-424e-a670-c1a28a87a55a", + "version": 1 +} \ No newline at end of file From 1f19ed870a2d50b849ebced963af3d9e35a455fd Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Thirion=20Aur=C3=A9lien?= Date: Thu, 15 Oct 2026 15:29:53 +0200 Subject: [PATCH 2/2] chg: [chat] Update object description --- README.md | 2 +- objects/chat/definition.json | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/README.md b/README.md index 0f969f4e..9b60b587 100644 --- a/README.md +++ b/README.md @@ -140,7 +140,7 @@ for a specific attribute. An optional **to_ids** boolean field to disable the ID - [objects/cap-info](https://github.com/MISP/misp-objects/blob/main/objects/cap-info/definition.json) - Common Alerting Protocol Version (CAP) info object. - [objects/cap-resource](https://github.com/MISP/misp-objects/blob/main/objects/cap-resource/definition.json) - Common Alerting Protocol Version (CAP) resource object. - [objects/cert-pl-phishing](https://github.com/MISP/misp-objects/blob/main/objects/cert-pl-phishing/definition.json) - cert.pl phishing object template representing an url along with some metadata as such phash, html-structure or partial-hash. -- [objects/chat](https://github.com/MISP/misp-objects/blob/main/objects/chat/definition.json) - A chat container, a subchannel or a thread on a messaging service. Identifiers are local to their service instance and parent container. Represent hierarchy with part-of object references to separate chat objects. Use native object first_seen and last_seen for observations. +- [objects/chat](https://github.com/MISP/misp-objects/blob/main/objects/chat/definition.json) - A chat, subchannel or discussion thread on a messaging service, including its platform identifier, name, username, description and service context. - [objects/chat-message](https://github.com/MISP/misp-objects/blob/main/objects/chat-message/definition.json) - A message exchanged on a chat or messaging platform. - [objects/citizenship-document](https://github.com/MISP/misp-objects/blob/main/objects/citizenship-document/definition.json) - A document attesting a person's citizenship or nationality, including citizenship, naturalisation, registration and nationality certificates, and other documents serving as citizenship evidence in the relevant jurisdiction. Supports paper and electronic documents, local naming and numbering conventions, and incomplete records. A residence permit or a place of birth alone does not establish citizenship. - [objects/cloth](https://github.com/MISP/misp-objects/blob/main/objects/cloth/definition.json) - Describes clothes a natural person wears. diff --git a/objects/chat/definition.json b/objects/chat/definition.json index 8046e569..29f487cf 100644 --- a/objects/chat/definition.json +++ b/objects/chat/definition.json @@ -87,7 +87,7 @@ "ui-priority": 1 } }, - "description": "A chat container, a subchannel or a thread on a messaging service. Identifiers are local to their service instance and parent container. Represent hierarchy with part-of object references to separate chat objects. Use native object first_seen and last_seen for observations.", + "description": "A chat, subchannel or discussion thread on a messaging service, including its platform identifier, name, username, description and service context.", "meta-category": "misc", "name": "chat", "required": [