Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Added rrname_{ip,domain}, rdata_{ip,domain} fields #314

Merged
merged 3 commits into from
May 3, 2021
Merged

Added rrname_{ip,domain}, rdata_{ip,domain} fields #314

merged 3 commits into from
May 3, 2021

Commits on May 2, 2021

  1. As discussed with @Rafiot, we can't simply add rdata and rrname as 

    text only into MISP objects. Why? Because otherwise we can't use MISP's
correlation engine to correlate attributes (rrname, rdata) inside these
MISP objects with other events. Because "text" would not correlate with
other "ip-src" or "domain" types in other objects/attributes.

Kind of sucks to duplicate the rrname and rdata entries, but that's the
only solution we came up with.

The COF2MISP module will populate both the rrname,rdata as well as the
rrname_{domain,ip} and rdata_{domain,ip} attributes.

Checked with jq_all_the_things.sh.
Thanks for your consideration.
    @aaronkaplan
    aaronkaplan committed May 2, 2021
    Configuration menu
    Copy the full SHA
    7b4c9cd View commit details
    Browse the repository at this point in the history

  2. Merge branch 'main' of https://github.com/MISP/misp-objects

    @aaronkaplan
    aaronkaplan committed May 2, 2021
    Configuration menu
    Copy the full SHA
    bcd1335 View commit details
    Browse the repository at this point in the history

  3. Re-Do the definition.json, according to the results of the discussion in 

    MISP#314

Removing *_ip and *_domain
Keeping bailiwick a domain type
    @aaronkaplan
    aaronkaplan committed May 2, 2021
    Configuration menu
    Copy the full SHA
    b728ed3 View commit details
    Browse the repository at this point in the history