Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

No possibility to classify "malware" itself #1752

Closed
ghost opened this issue Feb 22, 2021 · 2 comments · Fixed by #1917
Closed

No possibility to classify "malware" itself #1752

ghost opened this issue Feb 22, 2021 · 2 comments · Fixed by #1917
Milestone

Comments

@ghost
Copy link

ghost commented Feb 22, 2021

The GitHub parser bot test currently fails as it tries to set classification.type to malware. But there is no malware anymore (in RSIT).

https://github.com/certtools/intelmq/runs/1938485712#step:9:45
https://github.com/enisaeu/Reference-Security-Incident-Taxonomy-Task-Force/blob/5479e71/working_copy/humanv1.md

event.change('classification.taxonomy', 'malicious code')
event.change('classification.type', 'malware')

There are multiple options how to proceed.

-> Discuss on ML

cc @tomas321

@ghost ghost added the data-format label Feb 22, 2021
@ghost ghost added this to the 3.0.0 milestone Feb 22, 2021
@ghost ghost self-assigned this Feb 22, 2021
@ghost
Copy link
Author

ghost commented Apr 29, 2021

The conclusion on the ML was:

use 'classification.taxonomy' = 'other' and 'classification.type' = 'malware'

ghost pushed a commit that referenced this issue May 4, 2021
the classification
malicious code / malware
is replaced by
malcious code / infected system
malcious code / malware-distribution
other / malware for all other cases, i.e. malware itself

fixes #1752
related to #1409
@ghost ghost closed this as completed in #1917 May 4, 2021
ghost pushed a commit that referenced this issue May 4, 2021
the classification
malicious code / malware
is replaced by
malcious code / infected system
malcious code / malware-distribution
other / malware for all other cases, i.e. malware itself

fixes #1752
related to #1409
waldbauer-certat pushed a commit that referenced this issue May 31, 2022
the classification
malicious code / malware
is replaced by
malcious code / infected system
malcious code / malware-distribution
other / malware for all other cases, i.e. malware itself

fixes #1752
related to #1409
This issue was closed.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging a pull request may close this issue.

0 participants