diff --git a/README.md b/README.md index 9b60b587..770a1af4 100644 --- a/README.md +++ b/README.md @@ -326,6 +326,7 @@ for a specific attribute. An optional **to_ids** boolean field to disable the ID - [objects/leaked-document](https://github.com/MISP/misp-objects/blob/main/objects/leaked-document/definition.json) - Object describing a leaked document. - [objects/legal-entity](https://github.com/MISP/misp-objects/blob/main/objects/legal-entity/definition.json) - An object to describe a legal entity. - [objects/lnk](https://github.com/MISP/misp-objects/blob/main/objects/lnk/definition.json) - LNK object describing a Windows LNK binary file (aka Windows shortcut). +- [objects/lookyloo-capture](https://github.com/MISP/misp-objects/blob/main/objects/lookyloo-capture/definition.json) - A Lookyloo web capture with instance, UUID, timestamp, redirects, observed infrastructure and raw endpoint responses. - [objects/macho](https://github.com/MISP/misp-objects/blob/main/objects/macho/definition.json) - Object describing a file in Mach-O format. - [objects/macho-section](https://github.com/MISP/misp-objects/blob/main/objects/macho-section/definition.json) - Object describing a section of a file in Mach-O format. - [objects/mactime-timeline-analysis](https://github.com/MISP/misp-objects/blob/main/objects/mactime-timeline-analysis/definition.json) - Mactime template, used in forensic investigations to describe the timeline of a file activity. diff --git a/objects/lookyloo-capture/definition.json b/objects/lookyloo-capture/definition.json new file mode 100644 index 00000000..b126d494 --- /dev/null +++ b/objects/lookyloo-capture/definition.json @@ -0,0 +1,127 @@ +{ + "attributes": { + "capture-date": { + "description": "Timestamp when the capture began.", + "disable_correlation": true, + "misp-attribute": "datetime", + "to_ids": false, + "ui-priority": 1 + }, + "capture-id": { + "description": "Capture UUID assigned by this instance.", + "disable_correlation": true, + "misp-attribute": "text", + "to_ids": false, + "ui-priority": 1 + }, + "download": { + "description": "Link to the capture archive, downloaded files or video. Availability is not guaranteed.", + "disable_correlation": true, + "misp-attribute": "link", + "multiple": true, + "to_ids": false, + "ui-priority": 0 + }, + "error": { + "description": "Capture error or endpoint failure; the comment identifies the endpoint.", + "disable_correlation": true, + "misp-attribute": "text", + "multiple": true, + "to_ids": false, + "ui-priority": 0 + }, + "hostname": { + "description": "Hostname observed among capture resources; no IP mapping is implied.", + "misp-attribute": "hostname", + "multiple": true, + "to_ids": false, + "ui-priority": 0 + }, + "instance": { + "description": "Base URL of the Lookyloo instance.", + "disable_correlation": true, + "misp-attribute": "link", + "to_ids": false, + "ui-priority": 1 + }, + "ip": { + "description": "IPv4 or IPv6 address observed among capture resources.", + "misp-attribute": "ip-dst", + "multiple": true, + "to_ids": false, + "ui-priority": 0 + }, + "permalink": { + "description": "Link to the capture tree.", + "disable_correlation": true, + "misp-attribute": "link", + "to_ids": false, + "ui-priority": 1 + }, + "raw-data": { + "description": "JSON response from an endpoint, named for that endpoint. Includes original node identifiers, third-party results and pagination metadata when available.", + "disable_correlation": true, + "misp-attribute": "attachment", + "multiple": true, + "to_ids": false, + "ui-priority": 0 + }, + "redirect": { + "description": "URL in the redirect chain; the comment records its position.", + "misp-attribute": "url", + "multiple": true, + "to_ids": false, + "ui-priority": 0 + }, + "referer": { + "description": "Referer used for the capture.", + "misp-attribute": "url", + "to_ids": false, + "ui-priority": 0 + }, + "status": { + "description": "Numeric capture status code returned by Lookyloo; this is not a verdict.", + "disable_correlation": true, + "misp-attribute": "integer", + "to_ids": false, + "ui-priority": 0 + }, + "text": { + "description": "Analyst notes, lookup warnings or output truncation notices.", + "disable_correlation": true, + "misp-attribute": "text", + "multiple": true, + "to_ids": false, + "ui-priority": 0 + }, + "title": { + "description": "Title of the captured page.", + "disable_correlation": true, + "misp-attribute": "text", + "to_ids": false, + "ui-priority": 1 + }, + "url": { + "description": "URL originally captured.", + "misp-attribute": "url", + "to_ids": false, + "ui-priority": 1 + }, + "user-agent": { + "description": "User agent used by the capturing browser.", + "disable_correlation": true, + "misp-attribute": "user-agent", + "to_ids": false, + "ui-priority": 0 + } + }, + "description": "A Lookyloo web capture and its provenance, as returned by the public API (https://lookyloo.circl.lu/doc/). Identified by instance and capture-id. Captured resources, files, cookies and screenshots can be linked as separate objects. Presence in a capture is an observation, not a maliciousness verdict. Redirect order is recorded in attribute comments; raw-data attachments preserve endpoint responses and lookup pagination metadata.", + "meta-category": "network", + "name": "lookyloo-capture", + "required": [ + "instance", + "capture-id" + ], + "uuid": "be1227c7-fbee-4e7a-a2d1-3aa1d327d1a8", + "version": 1 +} \ No newline at end of file