MISP data models - MISP core format - MISP taxonomies

AbuseIPDB

Classifying IP indicators using AbuseIPDB report.

Access method

The access method used to remotely access a system.

Access Now classification to classify an issue (such as security, human rights, youth rights).

Cyber taxonomy for Italian National Cybersecurity Agency (ACN)

The Access Control Specification (ACS) marking type defines the object types required to implement automated access control systems based on the relevant policies governing sharing between participants.

Action taken in the case of a security incident (CSIRT perspective).

The Admiralty Scale or Ranking (also called the NATO System) is used to rank the reliability of a source and the credibility of an information. Reference based on FM 2-22.3 (FM 34-52) HUMAN INTELLIGENCE COLLECTOR OPERATIONS and NATO documents.

An overview and description of the adversary infrastructure

Agent Threat Rules

Agent Threat Rules (ATR) is an open detection standard for AI agent threats published under the MIT licence. The taxonomy organises 713 community-maintained rules across ten attack categories covering prompt injection, tool poisoning, skill compromise, context exfiltration, agent manipulation, privilege escalation, excessive autonomy, model abuse, model security, and data poisoning. Predicates name the category; values are individual rule identifiers in the form ATR-YYYY-NNNNN.

A list of standalone definitions for each type of bias. Aggregate terms that are in common usage or relevance to AI bias. From NIST.SP.1270-draft (2021)

AI Computer Assisted

Taxonomy describing the level of AI assistance and the level of review/update involved in the creation of an intelligence package or event.

AI safety benchmark v0.5, that has been created by the MLCommons AI Safety Working Group (WG)

The AIS Marking Schema implementation is maintained by the National Cybersecurity and Communication Integration Center (NCCIC) of the U.S. Department of Homeland Security (DHS)

Analyst (Self) Assessment

A series of assessment predicates describing the analyst capabilities to perform analysis. These assessment can be assigned by the analyst him/herself or by another party evaluating the analyst.

Taxonomy for anti-piracy

Approved category of action

A pre-approved category of action for indicators being shared with partners (MIMIC).

Artificial satellites taxonomy

This taxonomy was designed to describe artificial satellites

A taxonomy describing security threats or incidents against the aviation sector.

Custom taxonomy for types of binary file.

Classifying content, activities, tools, and actors within carding forums and marketplaces: A categorisation model for law enforcement. Taxonomy updated by MISP Project and extended by the JRC (Joint Research Centre) of the European Commission, and subsequently re-extended by the Cátedra Ada Byron UAH-INCIBE.

CCCS Custom Taxonomy

European Union (EASA) Drone Classification - C0 to C6.

CERT-XLM Security Incident Classification.

CIRCL Taxonomy - Schemes of Classification in Incident Response and Detection.

Cloud Sovereignty Framework

Cloud sovereignty objectives, assurance levels, and scoring weights derived from the European Commission Cloud Sovereignty Framework.

CNSD Taxonomia de Incidentes de Seguridad Digital

La presente taxonomia es la primera versión disponible para el Centro Nacional de Seguridad Digital del Perú.

Course of action taken within organization to discover, detect, deny, disrupt, degrade, deceive and/or destroy an attack.

collaborative intelligence support language

Collaborative intelligence support language is a common language to support analysts to perform their analysis to get crowdsourced support when using threat intelligence sharing platform like MISP. The objective of this language is to advance collaborative analysis and to share earlier than later.

Common Taxonomy for Law enforcement and CSIRTs

Content Classification

Classification taxonomy for labeling the primary subject matter, intent, market context, and thematic domain of online content, including general information, technology, cybersecurity, cybercrime, markets, communities, finance, illegal markets, technical services, and geopolitical or hacktivist material.

COPINE Scale

The COPINE Scale is a rating system created in Ireland and used in the United Kingdom to categorise the severity of images of child sex abuse. The scale was developed by staff at the COPINE (Combating Paedophile Information Networks in Europe) project. The COPINE Project was founded in 1997, and is based in the Department of Applied Psychology, University College Cork, Ireland.

Courses of Action

A Course Of Action analysis considers six potential courses of action for the development of a cyber security capability.

Crowdsec IP address classifications and behaviors taxonomy.

Crypto Market

Crypto Market: A categorisation model for cryptocurrency transactions and risk flags. Taxonomy updated by MISP Project and extended by the JRC (Joint Research Centre) of the European Commission, and subsequently re-extended by the Cátedra Ada Byron UAH-INCIBE.

Threats targeting cryptocurrency, based on CipherTrace report.

Taxonomía CSIRT Américas.

It is critical that the CSIRT provide consistent and timely response to the customer, and that sensitive information is handled appropriately. This document provides the guidelines needed for CSIRT Incident Managers (IM) to classify the case category, criticality level, and sensitivity level for each CSIRT case. This information will be entered into the Incident Tracking System (ITS) when a case is created. Consistent case classification is required for the CSIRT to provide accurate reporting to management on a regular basis. In addition, the classifications will provide CSIRT IM’s with proper case handling procedures and will form the basis of SLA’s between the CSIRT and other Company departments.

The CSSA agreed sharing taxonomy.

Cyber Threat Intelligence cycle to control workflow state of your process.

CTI evaluation

Evaluation taxonomy for cyber threat intelligence (CTI) quality and conversion quality in workflows such as MISP/STIX exchange and CTI Transmute, covering relevance, accuracy, timeliness, clarity, specificity, format validity, conversion fidelity, and usefulness.

Current events - Schemes of Classification in Incident Response and Detection

Cyber Threat Framework

Cyber Threat Framework was developed by the US Government to enable consistent characterization and categorization of cyber threat events, and to identify trends or changes in the activities of cyber adversaries. https://www.dni.gov/index.php/cyber-threat-framework

Universal Cybersecurity Resource Catalogue

Taxonomy used by CyCAT, the Universal Cybersecurity Resource Catalogue, to categorize the namespaces it supports and uses.

Taxonomy to describe desired actions for Cytomic Orion

Dark Web

Criminal motivation and content detection the dark web: A categorisation model for law enforcement. ref: Janis Dalins, Campbell Wilson, Mark Carman. Taxonomy updated by MISP Project and extended by the JRC (Joint Research Centre) of the European Commission.

Data Classification

Data classification for data potentially at risk of exfiltration based on table 2.1 of Solving Cyber Risk book.

Taxonomy defined in the DCSO MISP Event Guide. It provides guidance for the creation and consumption of MISP events in a way that minimises the extra effort for the sending party, while enhancing the usefulness for receiving parties.

Distributed Denial of Service

Distributed Denial of Service - or short: DDoS - taxonomy supports the description of Denial of Service attacks and especially the types they belong too.

German (DE) Government classification markings (VS).

Taxonomy of Death Possibilities

Deception

Deception is an important component of information operations, valuable for both offense and defense.

Detection engineering

Taxonomy related to detection engineering techniques

DFRLab Dichotomies of Disinformation.

Domain-Generation Algorithms

A taxonomy to describe domain-generation algorithms often called DGA. Ref: A Comprehensive Measurement Study of Domain Generating Malware Daniel Plohmann and others.

DHS critical sectors as in https://www.dhs.gov/critical-infrastructure-sectors

Diamond Model for Intrusion Analysis

The Diamond Model for Intrusion Analysis establishes the basic atomic element of any intrusion activity, the event, composed of four core features: adversary, infrastructure, capability, and victim.

The Diamond Model for Influence Operations Analysis

The diamond model for influence operations analysis is a framework that leads analysts and researchers toward a comprehensive understanding of a malign influence campaign by addressing the socio-political, technical, and psychological aspects of the campaign. The diamond model for influence operations analysis consists of 5 components: 4 corners and a core element. The 4 corners are divided into 2 axes: influencer and audience on the socio-political axis, capabilities and infrastructure on the technical axis. Narrative makes up the core of the diamond.

Detection Maturity Level

The Detection Maturity Level (DML) model is a capability maturity model for referencing ones maturity in detecting cyber attacks. It's designed for organizations who perform intel-driven detection and response and who put an emphasis on having a mature detection program.

A subset of Information Security Marking Metadata ISM as required by Executive Order (EO) 13526. As described by DNI.gov as Data Encoding Specifications for Information Security Marking Metadata in Controlled Vocabulary Enumeration Values for ISM

Domain Name Abuse

Domain Name Abuse - taxonomy to tag domain names used for cybercrime.

Doping substances

This taxonomy aims to list doping substances

Primary physical forms of drugs: A categorisation model for narcotics and substances. Taxonomy updated by MISP Project and extended by the JRC (Joint Research Centre) of the European Commission, and subsequently re-extended by the Cátedra Ada Byron UAH-INCIBE.

A taxonomy based on the superclass and class of drugs. Based on https://www.drugbank.ca/releases/latest

Economical Impact

Economic impact refers to a taxonomy used to describe whether financial effects are positive or negative outcomes related to tagged information. For instance, data exfiltration loss represents a positive outcome for an adversary.

Incident Classification by the ecsirt.net version mkVI of 31 March 2015 enriched with IntelMQ taxonomy-type mapping.

ENISA Threat Taxonomy

The present threat taxonomy is an initial version that has been developed on the basis of available ENISA material. This material has been used as an ENISA-internal structuring aid for information collection and threat consolidation purposes. It emerged in the time period 2012-2015.

Official ENSOC (or EU CyberHUB) taxonomy covering all labels used during information exchange.

Estimative languages

Estimative language to describe quality and credibility of underlying sources, data, and methodologies based Intelligence Community Directive 203 (ICD 203) and JP 2-0, Joint Intelligence

Taxonomy for the EU Artificial Intelligence Act (Regulation (EU) 2024/1689). Classifies AI systems by risk level, prohibited practices, high-risk use cases, and incident types for GRC and SOC reporting.

Market operators and public administrations that must comply to some notifications requirements under EU NIS directive

Sectors, subsectors, and digital services as identified by the NIS Directive

EU classified information (EUCI) means any information or material designated by a EU security classification, the unauthorised disclosure of which could cause varying degrees of prejudice to the interests of the European Union or of one or more of the Member States.

Europol type of events taxonomy

This taxonomy was designed to describe the type of events

Europol class of incidents taxonomy

This taxonomy was designed to describe the type of incidents by class.

Event Assessment

A series of assessment predicates describing the event assessment performed to make judgement(s) under a certain level of uncertainty.

Classification of events as seen in tools such as RT/IR, MISP and other

Exercise

Exercise is a taxonomy to describe if the information is part of one or more cyber or crisis exercise.

Reasons why an event has been extended. This taxonomy must be used on the extended event. The competitive analysis aspect is from Psychology of Intelligence Analysis by Richard J. Heuer, Jr. ref:http://www.foo.be/docs/intelligence/PsychofIntelNew.pdf

Failure mode in machine learning.

The purpose of this taxonomy is to jointly tabulate both the of these failure modes in a single place. Intentional failures wherein the failure is caused by an active adversary attempting to subvert the system to attain her goals – either to misclassify the result, infer private training data, or to steal the underlying algorithm. Unintentional failures wherein the failure is because an ML system produces a formally correct but completely unsafe outcome.

False positive

This taxonomy aims to ballpark the expected amount of false positives.

List of known file types.

Financial

Financial taxonomy to describe financial services, infrastructure and financial scope.

Flesch Reading Ease is a revised system for determining the comprehension difficulty of written material. The scoring of the flesh score can have a maximum of 121.22 and there is no limit on how low a score can be (negative score are valid).

The Future of Privacy Forum (FPF) [visual guide to practical de-identification](https://fpf.org/2016/04/25/a-visual-guide-to-practical-data-de-identification/) taxonomy is used to evaluate the degree of identifiability of personal data and the types of pseudonymous data, de-identified data and anonymous data. The work of FPF is licensed under a creative commons attribution 4.0 international license.

French gov information classification system

Taxonomy related to the REGULATION (EU) 2016/679 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation)

Information needed to track or monitor moments, periods or events that occur over time. This type of information is focused on occurrences that must be tracked for business reasons or represent a specific point in the evolution of ‘The Business’.

Information relating to instances of entities or things.

Information relating to authority or governance.

A taxonomy based on NIST AI 600-1 (July 2024), Artificial Intelligence Risk Management Framework: Generative Artificial Intelligence Profile. Covers the risks unique to or exacerbated by Generative AI, their mapped Trustworthy AI Characteristics, and the primary GAI considerations derived from the NIST Generative AI Public Working Group.

Gray Zone of Active defense includes all elements which lay between reactive defense elements and offensive operations. It does fill the gray spot between them. Taxo may be used for active defense planning or modeling.

Taxonomy used by GSMA for their information sharing program with telco describing the attack categories

Taxonomy used by GSMA for their information sharing program with telco describing the various aspects of fraud

Taxonomy used by GSMA for their information sharing program with telco describing the types of infrastructure. WiP

Updated (CIRCL, Seamus Dowling and EURECOM) from Christian Seifert, Ian Welch, Peter Komisarczuk, ‘Taxonomy of Honeypots’, Technical Report CS-TR-06/12, VICTORIA UNIVERSITY OF WELLINGTON, School of Mathematical and Computing Sciences, June 2006, http://www.mcs.vuw.ac.nz/comp/Publications/archive/CS-TR-06/CS-TR-06-12.pdf

Hunt Exchange Taxonomy

High-level, human-readable classification of a hunt's approach, provenance and outcome, designed for cross-organisation search and dashboards at ISAC / sector level. Detailed structured data lives in the threat-hunt-context, threat-hunt-hypothesis, threat-hunt-query and threat-hunt-finding objects; lifecycle uses workflow:state. Vocabulary is compatible with the PEAK framework (Splunk / Cisco Talos) and TaHiTI (NVB / FI-ISAC). Pair with existing taxonomies rather than duplicating them: use tlp and PAP for sharing, admiralty-scale and estimative-language for confidence and source reliability, cti-evaluation for CTI quality, priority-level for triage, DML for detection abstraction level, kill-chain / unified-kill-chain for phase, and the mitre-attack-pattern galaxy for technique mapping.

IAB Tech Lab Ad Product Taxonomy 2.0

IAB Tech Lab Ad Product Taxonomy 2.0 converted from the official TSV. It establishes standardized nomenclature for describing the product or service advertised within a creative unit. Source taxonomy © IAB Tech Lab, licensed under Creative Commons Attribution 3.0.

IAB Tech Lab Audience Taxonomy 1.1

IAB Tech Lab Audience Taxonomy 1.1 converted from the official TSV. It provides common nomenclature for audience segment names to improve comparability across data providers. Source taxonomy © IAB Tech Lab, licensed under Creative Commons Attribution 3.0.

IAB Tech Lab Content Taxonomy 3.0 Descriptive Vectors

IAB Tech Lab Content Taxonomy 3.0 Descriptive Vectors converted from the official TSV. Source taxonomy © IAB Tech Lab, licensed under Creative Commons Attribution 3.0.

IAB Tech Lab Content Taxonomy 3.1

IAB Tech Lab Content Taxonomy 3.1 converted from the official TSV. It provides a common language for describing content or the aboutness of a webpage, application, or video. Source taxonomy © IAB Tech Lab, licensed under Creative Commons Attribution 3.0.

Industrial Control System (ICS)

FIRST.ORG CTI SIG - MISP Proposal for ICS/OT Threat Attribution (IOC) Project

Forum of Incident Response and Security Teams (FIRST) Information Exchange Policy (IEP) framework

Forum of Incident Response and Security Teams (FIRST) Information Exchange Policy (IEP) v2.0 Policy

Forum of Incident Response and Security Teams (FIRST) Information Exchange Policy (IEP) v2.0 Reference

The IFX taxonomy is used to categorise information (MISP events and attributes) to aid in the intelligence vetting process

How an incident is classified in its process to be resolved. The taxonomy is inspired from NASA Incident Response and Management Handbook. https://www.nasa.gov/pdf/589502main_ITS-HBK-2810.09-02%20%5bNASA%20Information%20Security%20Incident%20Management%5d.pdf#page=9

A taxonomy describing information leaks and especially information classified as being potentially leaked. The taxonomy is based on the work by CIRCL on the AIL framework. The taxonomy aim is to be used at large to improve classification of leaked information.

Taxonomy for tagging information by its origin: human-generated or AI-generated.

Taxonomy to classify the information security data sources.

A full set of operational indicators for organizations to use to benchmark their security posture.

Interactive Cyber Training - Audience

Describes the target of cyber training and education.

Interactive Cyber Training - Technical Setup

The technical setup consists of environment structure, deployment, and orchestration.

Interactive Cyber Training - Training Environment

The training environment details the environment around the training, consisting of training type and scenario.

Interactive Cyber Training - Training Setup

The training setup further describes the training itself with the scoring, roles, the training mode as well as the customization level.

Interception method

The interception method used to intercept traffic.

An IOC classification to facilitate automation of malicious and non malicious artifacts

Internet of Things

Internet of Things taxonomy, based on IOT UK report https://iotuk.org.uk/wp-content/uploads/2017/01/IOT-Taxonomy-Report.pdf

Cyber Kill Chain

The Cyber Kill Chain, a phase-based model developed by Lockheed Martin, aims to help categorise and identify the stage of an attack.

Vectors used to deliver malware based on MAEC 5.0

Malware behaviours based on MAEC 5.0

Malware Capabilities based on MAEC 5.0

Obfuscation methods used by malware based on MAEC 5.0

Classification based on different categories. Based on https://www.sans.org/reading-room/whitepapers/incident/malware-101-viruses-32848

METEORSTORM

Multiple Environment Threat Evaluation of Resources Space Threats and Operational Risk to Missions (meteorstorm) taxonomy for modeling space, cyber, and multi-domain threats and resilience across five layers: Primary Capability Environment (PCE), Segment (SEG), Service (SVC), Asset (AST), and Analytic (AN).

classification for the identification of type of misinformation among websites. Source:False, Misleading, Clickbait-y, and/or Satirical News Sources by Melissa Zimdars 2019

MISP

MISP taxonomy to infer with MISP behavior or operation.

MISP workflow

MISP workflow taxonomy to support result of workflow execution.

MONARC Threats

MONARC Threats Taxonomy

Malware Type and Platform classification based on Microsoft's implementation of the Computer Antivirus Research Organization (CARO) Naming Scheme and Malware Terminology. Based on https://www.microsoft.com/en-us/security/portal/mmpc/shared/malwarenaming.aspx, https://www.microsoft.com/security/portal/mmpc/shared/glossary.aspx, https://www.microsoft.com/security/portal/mmpc/shared/objectivecriteria.aspx, and http://www.caro.org/definitions/index.html. Malware families are extracted from Microsoft SIRs since 2008 based on https://www.microsoft.com/security/sir/archive/default.aspx and https://www.microsoft.com/en-us/security/portal/threat/threats.aspx. Note that SIRs do NOT include all Microsoft malware families.

Malware Type and Platform classification based on Microsoft's implementation of the Computer Antivirus Research Organization (CARO) Naming Scheme and Malware Terminology. Based on https://www.microsoft.com/en-us/security/portal/mmpc/shared/malwarenaming.aspx, https://www.microsoft.com/security/portal/mmpc/shared/glossary.aspx, https://www.microsoft.com/security/portal/mmpc/shared/objectivecriteria.aspx, and http://www.caro.org/definitions/index.html. Malware families are extracted from Microsoft SIRs since 2008 based on https://www.microsoft.com/security/sir/archive/default.aspx and https://www.microsoft.com/en-us/security/portal/threat/threats.aspx. Note that SIRs do NOT include all Microsoft malware families.

Malware Database (mwdb) Taxonomy - Tags used across the platform

NATO classification markings.