Skip to content
MISP decaying models
Shell
Branch: master
Clone or download
Fetching latest commit…
Cannot retrieve the latest commit at this time.
Permalink
Type Name Latest commit message Commit time
Failed to load latest commit information.
models new: [vishing-model] Simple model to rapidly decay voice scamming, vi… Jan 7, 2020
LICENSE.md
README.md
jq_all_the_things.sh chg: [release] add the NIDS decaying model, clarify license and add s… Aug 27, 2019

README.md

MISP Decaying Models

Starting from MISP 2.4.114, a decaying feature is available to apply decaying on attributes in your MISP instance. MISP comes with a set of default decaying models which can be customised by the users. This repository contains all the default models.

For more information about decaying and expiring attributes/indicators in MISP, the training materials MISP and Decaying of Indicators is a good start.

Simulate decaying in MISP threat intelligence platform Overlay of decaying per model in the event/attribute view of MISP

Models

  • nids-simple-model - Simple decaying model for Network Intrusion Detection System (NIDS).
  • phishing-model - Simple model to rapidly decay phishing website.
  • vishing-model - Simple model to rapidly decay voice scamming, vishing relying on phone-numbers.

How to contribute your decaying model?

It's very easy. Fork the repository, create a new JSON file with your model and make a pull-request.

License

The MISP decaying models are dual-licensed under CC-0 and a simple 2-clause BSD license.

You can’t perform that action at this time.