Module for handling threat information from MISP.
Fields from MISP threat information.
Fields provide support for specifying information about attack patterns.
-
misp.attack_pattern.id -
Identifier of the threat indicator.
type: keyword
-
misp.attack_pattern.name -
Name of the attack pattern.
type: keyword
-
misp.attack_pattern.description -
Description of the attack pattern.
type: text
-
misp.attack_pattern.kill_chain_phases -
The kill chain phase(s) to which this attack pattern corresponds.
type: keyword
Fields provide support for specifying information about campaigns.
-
misp.campaign.id -
Identifier of the campaign.
type: keyword
-
misp.campaign.name -
Name of the campaign.
type: keyword
-
misp.campaign.description -
Description of the campaign.
type: text
-
misp.campaign.aliases -
Alternative names used to identify this campaign.
type: text
-
misp.campaign.first_seen -
The time that this Campaign was first seen, in RFC3339 format.
type: date
-
misp.campaign.last_seen -
The time that this Campaign was last seen, in RFC3339 format.
type: date
-
misp.campaign.objective -
This field defines the Campaign’s primary goal, objective, desired outcome, or intended effect.
type: keyword
A Course of Action is an action taken either to prevent an attack or to respond to an attack that is in progress.
-
misp.course_of_action.id -
Identifier of the Course of Action.
type: keyword
-
misp.course_of_action.name -
The name used to identify the Course of Action.
type: keyword
-
misp.course_of_action.description -
Description of the Course of Action.
type: text
Identity can represent actual individuals, organizations, or groups, as well as classes of individuals, organizations, or groups.
-
misp.identity.id -
Identifier of the Identity.
type: keyword
-
misp.identity.name -
The name used to identify the Identity.
type: keyword
-
misp.identity.description -
Description of the Identity.
type: text
-
misp.identity.identity_class -
The type of entity that this Identity describes, e.g., an individual or organization. Open Vocab - identity-class-ov
type: keyword
-
misp.identity.labels -
The list of roles that this Identity performs.
type: keyword
example: CEO
-
misp.identity.sectors -
The list of sectors that this Identity belongs to. Open Vocab - industry-sector-ov
type: keyword
-
misp.identity.contact_information -
The contact information (e-mail, phone number, etc.) for this Identity.
type: text
An Intrusion Set is a grouped set of adversary behavior and resources with common properties that is believed to be orchestrated by a single organization.
-
misp.intrusion_set.id -
Identifier of the Intrusion Set.
type: keyword
-
misp.intrusion_set.name -
The name used to identify the Intrusion Set.
type: keyword
-
misp.intrusion_set.description -
Description of the Intrusion Set.
type: text
-
misp.intrusion_set.aliases -
Alternative names used to identify the Intrusion Set.
type: text
-
misp.intrusion_set.first_seen -
The time that this Intrusion Set was first seen, in RFC3339 format.
type: date
-
misp.intrusion_set.last_seen -
The time that this Intrusion Set was last seen, in RFC3339 format.
type: date
-
misp.intrusion_set.goals -
The high level goals of this Intrusion Set, namely, what are they trying to do.
type: text
-
misp.intrusion_set.resource_level -
This defines the organizational level at which this Intrusion Set typically works. Open Vocab - attack-resource-level-ov
type: text
-
misp.intrusion_set.primary_motivation -
The primary reason, motivation, or purpose behind this Intrusion Set. Open Vocab - attack-motivation-ov
type: text
-
misp.intrusion_set.secondary_motivations -
The secondary reasons, motivations, or purposes behind this Intrusion Set. Open Vocab - attack-motivation-ov
type: text
Malware is a type of TTP that is also known as malicious code and malicious software, refers to a program that is inserted into a system, usually covertly, with the intent of compromising the confidentiality, integrity, or availability of the victim’s data, applications, or operating system (OS) or of otherwise annoying or disrupting the victim.
-
misp.malware.id -
Identifier of the Malware.
type: keyword
-
misp.malware.name -
The name used to identify the Malware.
type: keyword
-
misp.malware.description -
Description of the Malware.
type: text
-
misp.malware.labels -
The type of malware being described. Open Vocab - malware-label-ov. adware,backdoor,bot,ddos,dropper,exploit-kit,keylogger,ransomware, remote-access-trojan,resource-exploitation,rogue-security-software,rootkit, screen-capture,spyware,trojan,virus,worm
type: keyword
-
misp.malware.kill_chain_phases -
The list of kill chain phases for which this Malware instance can be used.
type: keyword
format: string
A Note is a comment or note containing informative text to help explain the context of one or more STIX Objects (SDOs or SROs) or to provide additional analysis that is not contained in the original object.
-
misp.note.id -
Identifier of the Note.
type: keyword
-
misp.note.summary -
A brief description used as a summary of the Note.
type: keyword
-
misp.note.description -
The content of the Note.
type: text
-
misp.note.authors -
The name of the author(s) of this Note.
type: keyword
-
misp.note.object_refs -
The STIX Objects (SDOs and SROs) that the note is being applied to.
type: keyword
Fields provide support for specifying information about threat indicators, and related matching patterns.
-
misp.threat_indicator.labels -
list of type open-vocab that specifies the type of indicator.
type: keyword
example: Domain Watchlist
-
misp.threat_indicator.id -
Identifier of the threat indicator.
type: keyword
-
misp.threat_indicator.version -
Version of the threat indicator.
type: keyword
-
misp.threat_indicator.type -
Type of the threat indicator.
type: keyword
-
misp.threat_indicator.description -
Description of the threat indicator.
type: text
-
misp.threat_indicator.feed -
Name of the threat feed.
type: text
-
misp.threat_indicator.valid_from -
The time from which this Indicator should be considered valuable intelligence, in RFC3339 format.
type: date
-
misp.threat_indicator.valid_until -
The time at which this Indicator should no longer be considered valuable intelligence. If the valid_until property is omitted, then there is no constraint on the latest time for which the indicator should be used, in RFC3339 format.
type: date
-
misp.threat_indicator.severity -
Threat severity to which this indicator corresponds.
type: keyword
example: high
format: string
-
misp.threat_indicator.confidence -
Confidence level to which this indicator corresponds.
type: keyword
example: high
-
misp.threat_indicator.kill_chain_phases -
The kill chain phase(s) to which this indicator corresponds.
type: keyword
format: string
-
misp.threat_indicator.mitre_tactic -
MITRE tactics to which this indicator corresponds.
type: keyword
example: Initial Access
format: string
-
misp.threat_indicator.mitre_technique -
MITRE techniques to which this indicator corresponds.
type: keyword
example: Drive-by Compromise
format: string
-
misp.threat_indicator.attack_pattern -
The attack_pattern for this indicator is a STIX Pattern as specified in STIX Version 2.0 Part 5 - STIX Patterning.
type: keyword
example: [destination:ip = 91.219.29.188/32]
-
misp.threat_indicator.attack_pattern_kql -
The attack_pattern for this indicator is KQL query that matches the attack_pattern specified in the STIX Pattern format.
type: keyword
example: destination.ip: "91.219.29.188/32"
-
misp.threat_indicator.negate -
When set to true, it specifies the absence of the attack_pattern.
type: boolean
-
misp.threat_indicator.intrusion_set -
Name of the intrusion set if known.
type: keyword
-
misp.threat_indicator.campaign -
Name of the attack campaign if known.
type: keyword
-
misp.threat_indicator.threat_actor -
Name of the threat actor if known.
type: keyword
Observed data conveys information that was observed on systems and networks, such as log data or network traffic, using the Cyber Observable specification.
-
misp.observed_data.id -
Identifier of the Observed Data.
type: keyword
-
misp.observed_data.first_observed -
The beginning of the time window that the data was observed, in RFC3339 format.
type: date
-
misp.observed_data.last_observed -
The end of the time window that the data was observed, in RFC3339 format.
type: date
-
misp.observed_data.number_observed -
The number of times the data represented in the objects property was observed. This MUST be an integer between 1 and 999,999,999 inclusive.
type: integer
-
misp.observed_data.objects -
A dictionary of Cyber Observable Objects that describes the single fact that was observed.
type: keyword
Reports are collections of threat intelligence focused on one or more topics, such as a description of a threat actor, malware, or attack technique, including context and related details.
-
misp.report.id -
Identifier of the Report.
type: keyword
-
misp.report.labels -
This field is an Open Vocabulary that specifies the primary subject of this report. Open Vocab - report-label-ov. threat-report,attack-pattern,campaign,identity,indicator,malware,observed-data,threat-actor,tool,vulnerability
type: keyword
-
misp.report.name -
The name used to identify the Report.
type: keyword
-
misp.report.description -
A description that provides more details and context about Report.
type: text
-
misp.report.published -
The date that this report object was officially published by the creator of this report, in RFC3339 format.
type: date
-
misp.report.object_refs -
Specifies the STIX Objects that are referred to by this Report.
type: text
Threat Actors are actual individuals, groups, or organizations believed to be operating with malicious intent.
-
misp.threat_actor.id -
Identifier of the Threat Actor.
type: keyword
-
misp.threat_actor.labels -
This field specifies the type of threat actor. Open Vocab - threat-actor-label-ov. activist,competitor,crime-syndicate,criminal,hacker,insider-accidental,insider-disgruntled,nation-state,sensationalist,spy,terrorist
type: keyword
-
misp.threat_actor.name -
The name used to identify this Threat Actor or Threat Actor group.
type: keyword
-
misp.threat_actor.description -
A description that provides more details and context about the Threat Actor.
type: text
-
misp.threat_actor.aliases -
A list of other names that this Threat Actor is believed to use.
type: text
-
misp.threat_actor.roles -
This is a list of roles the Threat Actor plays. Open Vocab - threat-actor-role-ov. agent,director,independent,sponsor,infrastructure-operator,infrastructure-architect,malware-author
type: text
-
misp.threat_actor.goals -
The high level goals of this Threat Actor, namely, what are they trying to do.
type: text
-
misp.threat_actor.sophistication -
The skill, specific knowledge, special training, or expertise a Threat Actor must have to perform the attack. Open Vocab - threat-actor-sophistication-ov. none,minimal,intermediate,advanced,strategic,expert,innovator
type: text
-
misp.threat_actor.resource_level -
This defines the organizational level at which this Threat Actor typically works. Open Vocab - attack-resource-level-ov. individual,club,contest,team,organization,government
type: text
-
misp.threat_actor.primary_motivation -
The primary reason, motivation, or purpose behind this Threat Actor. Open Vocab - attack-motivation-ov. accidental,coercion,dominance,ideology,notoriety,organizational-gain,personal-gain,personal-satisfaction,revenge,unpredictable
type: text
-
misp.threat_actor.secondary_motivations -
The secondary reasons, motivations, or purposes behind this Threat Actor. Open Vocab - attack-motivation-ov. accidental,coercion,dominance,ideology,notoriety,organizational-gain,personal-gain,personal-satisfaction,revenge,unpredictable
type: text
-
misp.threat_actor.personal_motivations -
The personal reasons, motivations, or purposes of the Threat Actor regardless of organizational goals. Open Vocab - attack-motivation-ov. accidental,coercion,dominance,ideology,notoriety,organizational-gain,personal-gain,personal-satisfaction,revenge,unpredictable
type: text
Tools are legitimate software that can be used by threat actors to perform attacks.
-
misp.tool.id -
Identifier of the Tool.
type: keyword
-
misp.tool.labels -
The kind(s) of tool(s) being described. Open Vocab - tool-label-ov. denial-of-service,exploitation,information-gathering,network-capture,credential-exploitation,remote-access,vulnerability-scanning
type: keyword
-
misp.tool.name -
The name used to identify the Tool.
type: keyword
-
misp.tool.description -
A description that provides more details and context about the Tool.
type: text
-
misp.tool.tool_version -
The version identifier associated with the Tool.
type: keyword
-
misp.tool.kill_chain_phases -
The list of kill chain phases for which this Tool instance can be used.
type: text
A Vulnerability is a mistake in software that can be directly used by a hacker to gain access to a system or network.
-
misp.vulnerability.id -
Identifier of the Vulnerability.
type: keyword
-
misp.vulnerability.name -
The name used to identify the Vulnerability.
type: keyword
-
misp.vulnerability.description -
A description that provides more details and context about the Vulnerability.
type: text