/
definition.json
105 lines (105 loc) · 2.67 KB
/
definition.json
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
{
"attributes": {
"archive": {
"description": "Archive of the original document (Internet Archive, Archive.is, etc).",
"misp-attribute": "link",
"multiple": true,
"ui-priority": 1
},
"creation-date": {
"description": "Initial creation of the blog post.",
"misp-attribute": "datetime",
"ui-priority": 0
},
"embedded-link": {
"description": "Site linked by the blog post.",
"misp-attribute": "url",
"multiple": true,
"ui-priority": 0
},
"embedded-safe-link": {
"description": "Safe site linked by the blog post.",
"misp-attribute": "link",
"multiple": true,
"ui-priority": 0
},
"link": {
"description": "Original link into the blog post (Supposed harmless).",
"misp-attribute": "link",
"ui-priority": 1
},
"modification-date": {
"description": "Last update of the blog post.",
"misp-attribute": "datetime",
"ui-priority": 0
},
"post": {
"description": "Raw post.",
"misp-attribute": "text",
"ui-priority": 1
},
"removal-date": {
"description": "When the blog post was removed.",
"misp-attribute": "datetime",
"ui-priority": 0
},
"title": {
"description": "Title of blog post.",
"misp-attribute": "text",
"ui-priority": 1
},
"type": {
"description": "Type of blog post.",
"disable_correlation": true,
"misp-attribute": "text",
"sane_default": [
"Medium",
"WordPress",
"Blogger",
"Tumbler",
"LiveJournal",
"Forum",
"Other"
],
"ui-priority": 1
},
"url": {
"description": "Original URL location of the blog post (potentially malicious).",
"misp-attribute": "url",
"ui-priority": 1
},
"username": {
"description": "Username who posted the blog post.",
"misp-attribute": "text",
"ui-priority": 0
},
"username-quoted": {
"description": "Username who are quoted into the blog post.",
"misp-attribute": "text",
"multiple": true,
"ui-priority": 0
},
"verified-username": {
"description": "Is the username account verified by the operator of the blog platform.",
"disable_correlation": true,
"misp-attribute": "text",
"ui-priority": 0,
"values_list": [
"Verified",
"Unverified",
"Unknown"
]
}
},
"description": "Blog post like Medium or WordPress.",
"meta-category": "misc",
"name": "blog",
"requiredOneOf": [
"post",
"archive",
"url",
"link"
],
"uuid": "1f165fc0-b158-498f-8bc8-6dc3d2822bb1",
"version": 14
}