Introduction

MISP logo

The MISP threat sharing platform is a free and open source software helping information sharing of threat intelligence including cyber security indicators, financial fraud or counter-terrorism information. The MISP project includes multiple sub-projects to support the operational requirements of analysts and improve the overall quality of information shared.

MISP objects are used in MISP (starting from version 2.4.80) system and can be used by other information sharing tool. MISP objects are in addition to MISP attributes to allow advanced combinations of attributes. The creation of these objects and their associated attributes are based on real cyber security use-cases and existing practices in information sharing. The objects are just shared like any other attributes in MISP even if the other MISP instances don’t have the template of the object. The following document is generated from the machine-readable JSON describing the MISP objects.

Funding and Support

The MISP project is financially and resource supported by CIRCL Computer Incident Response Center Luxembourg .

CIRCL logo

A CEF (Connecting Europe Facility) funding under CEF-TC-2016-3 - Cyber Security has been granted from 1st September 2017 until 31th August 2019 as Improving MISP as building blocks for next-generation information sharing.

CEF funding

If you are interested to co-fund projects around MISP, feel free to get in touch with us.

MISP objects

ail-leak

An information leak as defined by the AIL Analysis Information Leak framework.

ail-leak is a MISP object available in JSON format at this location The JSON format can be freely reused in your application or automatically enabled in MISP.
Object attribute MISP attribute type Description Disable correlation Multiple

duplicate

text

Duplicate of the existing leaks.

duplicate_number

counter

Number of known duplicates.

first-seen

datetime

When the leak has been accessible or seen for the first time.

last-seen

datetime

When the leak has been accessible or seen for the last time.

origin

text

The link where the leak is (or was) accessible at first-seen.

original-date

datetime

When the information available in the leak was created. It’s usually before the first-seen.

raw-data

attachment

Raw data as received by the AIL sensor compressed and encoded in Base64.

sensor

text

The AIL sensor uuid where the leak was processed and analysed.

text

text

A description of the leak which could include the potential victim(s) or description of the leak.

ais-info

Automated Indicator Sharing (AIS) Information Source Markings.

ais-info is a MISP object available in JSON format at this location The JSON format can be freely reused in your application or automatically enabled in MISP.
Object attribute MISP attribute type Description Disable correlation Multiple

administrative-area

text

AIS Administrative Area represented using ISO-3166-2.

country

text

AIS Country represented using ISO-3166-1_alpha-2.

industry

text

AIS IndustryType. ['Chemical Sector', 'Commercial Facilities Sector', 'Communications Sector', 'Critical Manufacturing Sector', 'Dams Sector', 'Defense Industrial Base Sector', 'Emergency Services Sector', 'Energy Sector', 'Financial Services Sector', 'Food and Agriculture Sector', 'Government Facilities Sector', 'Healthcare and Public Health Sector', 'Information Technology Sector', 'Nuclear Reactors, Materials, and Waste Sector', 'Transportation Systems Sector', 'Water and Wastewater Systems Sector', 'Other']

organisation

text

AIS Organisation Name.

android-app

Indicators related to an Android app.

android-app is a MISP object available in JSON format at this location The JSON format can be freely reused in your application or automatically enabled in MISP.
Object attribute MISP attribute type Description Disable correlation Multiple

appid

text

Application ID

certificate

sha1

Android certificate

domain

domain

Domain used by the app

name

text

Generic name of the application

sha256

sha256

SHA256 of the APK.

android-permission

A set of android permissions - one or more permission(s) which can be linked to other objects (e.g. malware, app).

android-permission is a MISP object available in JSON format at this location The JSON format can be freely reused in your application or automatically enabled in MISP.
Object attribute MISP attribute type Description Disable correlation Multiple

comment

comment

Comment about the set of android permission(s)

permission

text

Android permission ['ACCESS_CHECKIN_PROPERTIES', 'ACCESS_COARSE_LOCATION', 'ACCESS_FINE_LOCATION', 'ACCESS_LOCATION_EXTRA_COMMANDS', 'ACCESS_NETWORK_STATE', 'ACCESS_NOTIFICATION_POLICY', 'ACCESS_WIFI_STATE', 'ACCOUNT_MANAGER', 'ADD_VOICEMAIL', 'ANSWER_PHONE_CALLS', 'BATTERY_STATS', 'BIND_ACCESSIBILITY_SERVICE', 'BIND_APPWIDGET', 'BIND_AUTOFILL_SERVICE', 'BIND_CARRIER_MESSAGING_SERVICE', 'BIND_CHOOSER_TARGET_SERVICE', 'BIND_CONDITION_PROVIDER_SERVICE', 'BIND_DEVICE_ADMIN', 'BIND_DREAM_SERVICE', 'BIND_INCALL_SERVICE', 'BIND_INPUT_METHOD', 'BIND_MIDI_DEVICE_SERVICE', 'BIND_NFC_SERVICE', 'BIND_NOTIFICATION_LISTENER_SERVICE', 'BIND_PRINT_SERVICE', 'BIND_QUICK_SETTINGS_TILE', 'BIND_REMOTEVIEWS', 'BIND_SCREENING_SERVICE', 'BIND_TELECOM_CONNECTION_SERVICE', 'BIND_TEXT_SERVICE', 'BIND_TV_INPUT', 'BIND_VISUAL_VOICEMAIL_SERVICE', 'BIND_VOICE_INTERACTION', 'BIND_VPN_SERVICE', 'BIND_VR_LISTENER_SERVICE', 'BIND_WALLPAPER', 'BLUETOOTH', 'BLUETOOTH_ADMIN', 'BLUETOOTH_PRIVILEGED', 'BODY_SENSORS', 'BROADCAST_PACKAGE_REMOVED', 'BROADCAST_SMS', 'BROADCAST_STICKY', 'BROADCAST_WAP_PUSH', 'CALL_PHONE', 'CALL_PRIVILEGED', 'CAMERA', 'CAPTURE_AUDIO_OUTPUT', 'CAPTURE_SECURE_VIDEO_OUTPUT', 'CAPTURE_VIDEO_OUTPUT', 'CHANGE_COMPONENT_ENABLED_STATE', 'CHANGE_CONFIGURATION', 'CHANGE_NETWORK_STATE', 'CHANGE_WIFI_MULTICAST_STATE', 'CHANGE_WIFI_STATE', 'CLEAR_APP_CACHE', 'CONTROL_LOCATION_UPDATES', 'DELETE_CACHE_FILES', 'DELETE_PACKAGES', 'DIAGNOSTIC', 'DISABLE_KEYGUARD', 'DUMP', 'EXPAND_STATUS_BAR', 'FACTORY_TEST', 'GET_ACCOUNTS', 'GET_ACCOUNTS_PRIVILEGED', 'GET_PACKAGE_SIZE', 'GET_TASKS', 'GLOBAL_SEARCH', 'INSTALL_LOCATION_PROVIDER', 'INSTALL_PACKAGES', 'INSTALL_SHORTCUT', 'INSTANT_APP_FOREGROUND_SERVICE', 'INTERNET', 'KILL_BACKGROUND_PROCESSES', 'LOCATION_HARDWARE', 'MANAGE_DOCUMENTS', 'MANAGE_OWN_CALLS', 'MASTER_CLEAR', 'MEDIA_CONTENT_CONTROL', 'MODIFY_AUDIO_SETTINGS', 'MODIFY_PHONE_STATE', 'MOUNT_FORMAT_FILESYSTEMS', 'MOUNT_UNMOUNT_FILESYSTEMS', 'NFC', 'PACKAGE_USAGE_STATS', 'PERSISTENT_ACTIVITY', 'PROCESS_OUTGOING_CALLS', 'READ_CALENDAR', 'READ_CALL_LOG', 'READ_CONTACTS', 'READ_EXTERNAL_STORAGE', 'READ_FRAME_BUFFER', 'READ_INPUT_STATE', 'READ_LOGS', 'READ_PHONE_NUMBERS', 'READ_PHONE_STATE', 'READ_SMS', 'READ_SYNC_SETTINGS', 'READ_SYNC_STATS', 'READ_VOICEMAIL', 'REBOOT', 'RECEIVE_BOOT_COMPLETED', 'RECEIVE_MMS', 'RECEIVE_SMS', 'RECEIVE_WAP_PUSH', 'RECORD_AUDIO', 'REORDER_TASKS', 'REQUEST_COMPANION_RUN_IN_BACKGROUND', 'REQUEST_COMPANION_USE_DATA_IN_BACKGROUND', 'REQUEST_DELETE_PACKAGES', 'REQUEST_IGNORE_BATTERY_OPTIMIZATIONS', 'REQUEST_INSTALL_PACKAGES', 'RESTART_PACKAGES', 'SEND_RESPOND_VIA_MESSAGE', 'SEND_SMS', 'SET_ALARM', 'SET_ALWAYS_FINISH', 'SET_ANIMATION_SCALE', 'SET_DEBUG_APP', 'SET_PREFERRED_APPLICATIONS', 'SET_PROCESS_LIMIT', 'SET_TIME', 'SET_TIME_ZONE', 'SET_WALLPAPER', 'SET_WALLPAPER_HINTS', 'SIGNAL_PERSISTENT_PROCESSES', 'STATUS_BAR', 'SYSTEM_ALERT_WINDOW', 'TRANSMIT_IR', 'UNINSTALL_SHORTCUT', 'UPDATE_DEVICE_STATS', 'USE_FINGERPRINT', 'USE_SIP', 'VIBRATE', 'WAKE_LOCK', 'WRITE_APN_SETTINGS', 'WRITE_CALENDAR', 'WRITE_CALL_LOG', 'WRITE_CONTACTS', 'WRITE_EXTERNAL_STORAGE', 'WRITE_GSERVICES', 'WRITE_SECURE_SETTINGS', 'WRITE_SETTINGS', 'WRITE_SYNC_SETTINGS', 'WRITE_VOICEMAIL']

annotation

An annotation object allowing analysts to add annotations, comments, executive summary to a MISP event, objects or attributes.

annotation is a MISP object available in JSON format at this location The JSON format can be freely reused in your application or automatically enabled in MISP.
Object attribute MISP attribute type Description Disable correlation Multiple

attachment

attachment

An attachment to support the annotation

creation-date

datetime

Initial creation of the annotation

format

text

Format of the annotation ['text', 'markdown', 'asciidoctor', 'MultiMarkdown', 'GFM', 'pandoc', 'Fountain', 'CommonWork', 'kramdown-rfc2629', 'rfc7328', 'Extra']

modification-date

datetime

Last update of the annotation

ref

link

Reference(s) to the annotation

text

text

Raw text of the annotation

type

text

Type of the annotation ['Annotation', 'Executive Summary', 'Introduction', 'Conclusion', 'Disclaimer', 'Keywords', 'Acknowledgement', 'Other', 'Copyright', 'Authors', 'Logo', 'Full Report']

anonymisation

Anonymisation object describing an anonymisation technique used to encode MISP attribute values. Reference: https://www.caida.org/tools/taxonomy/anonymization.xml.

anonymisation is a MISP object available in JSON format at this location The JSON format can be freely reused in your application or automatically enabled in MISP.
Object attribute MISP attribute type Description Disable correlation Multiple

description

text

Description of the anonymisation technique or tool used

encryption-function

text

Encryption function or algorithm used to anonymise the attribute ['aes128', 'aes-128-cbc', 'aes-128-cfb', 'aes-128-cfb1', 'aes-128-cfb8', 'aes-128-ctr', 'aes-128-ecb', 'aes-128-ofb', 'aes192', 'aes-192-cbc', 'aes-192-cfb', 'aes-192-cfb1', 'aes-192-cfb8', 'aes-192-ctr', 'aes-192-ecb', 'aes-192-ofb', 'aes-256-cfb', 'aes-256-cfb1', 'aes-256-cfb8', 'aes-256-ctr', 'aes-256-ecb', 'aes-256-ofb', 'bf', 'bf-cbc', 'bf-cfb', 'bf-ecb', 'bf-ofb', 'blowfish', 'camellia128', 'camellia-128-cbc', 'camellia-128-cfb', 'camellia-128-cfb1', 'camellia-128-cfb8', 'camellia-128-ctr', 'camellia-128-ecb', 'camellia-128-ofb', 'camellia192', 'camellia-192-cbc', 'camellia-192-cfb', 'camellia-192-cfb1', 'camellia-192-cfb8', 'camellia-192-ctr', 'camellia-192-ecb', 'camellia-192-ofb', 'camellia256', 'camellia-256-cbc', 'camellia-256-cfb', 'camellia-256-cfb1', 'camellia-256-cfb8', 'camellia-256-ctr', 'camellia-256-ecb', 'camellia-256-ofb', 'cast', 'cast5-cbc', 'cast5-cfb', 'cast5-ecb', 'cast5-ofb', 'cast-cbc', 'des', 'des3', 'des-cbc', 'des-cfb', 'des-ecb', 'des-ede', 'des-ede3', 'des-ede3-cbc', 'des-ede3-cfb', 'des-ede3-ofb', 'des-ede-cbc', 'des-ede-cfb', 'des-ede-ofb', 'des-ofb', 'desx', 'gost89', 'gost89-cnt', 'idea', 'idea-cbc', 'idea-cfb', 'idea-ecb', 'idea-ofb', 'rc2', 'rc2-40-cbc', 'rc2-64-cbc', 'rc2-cbc', 'rc2-cfb', 'rc2-ecb', 'rc2-ofb', 'rc4', 'rc4-40', 'rc4-64', 'rc5', 'rc5-cbc', 'rc5-cfb', 'rc5-ecb', 'rc5-ofb', 'seed', 'seed-cbc', 'seed-cfb', 'seed-ecb', 'seed-ofb', 'sm4', 'sm4-cbc', 'sm4-cfb', 'sm4-ctr', 'sm4-ecb', 'sm4-ofb']

iv

text

Initialisation vector for the encryption function used to anonymise the attribute

key

text

Key (such as a PSK in a keyed-hash-function) used to anonymise the attribute

keyed-hash-function

text

Keyed-hash function used to anonymise the attribute ['hmac-sha1', 'hmac-md5', 'hmac-sha256', 'hmac-sha384', 'hmac-sha512']

level-of-knowledge

text

Level of knowledge of the organisation who created this object ['Only the anonymised data is known', 'Deanonymised data is known']

method

text

Anonymisation (or pseudo-anonymisation) method(s) used ["hiding - Attribute is replaced with a constant value (typically 0) of the same size. Sometimes called 'black marker'.", 'hash - A hash function maps each attribute to a new (not necessarily unique) attribute.', 'permutation - Maps each original value to a unique new value.', "prefix-preserving - Any two values that had the same n-bit prefix before anonymisation will still have the same n-bit prefix as each other after anonymization. (Would be more accurately called 'prefix-relationship-preserving', because the actual prefix values are not preserved.) ", 'shift - Adds a fixed offset to each value/attribute.', 'enumeration - Map each original value to a new value such that their ordering is preserved.', 'partitioning - Possible values are partitioned into meaningful sets; actual values are replaced with a fixed value from the same set. E.g., TCP port numbers 0 to 1023 are replaced with 0, and 1024 to 65535 replaced with 65535.', 'updated - Checksums are recalculated to reflect changes made to other fields.', 'truncation - Field is shortened, losing data at the end.', 'encryption - Attribute is encrypted.']

regexp

text

Regular expression to perfom the anonymisation (reversible or not)

asn

Autonomous system object describing an autonomous system which can include one or more network operators management an entity (e.g. ISP) along with their routing policy, routing prefixes or alike.

asn is a MISP object available in JSON format at this location The JSON format can be freely reused in your application or automatically enabled in MISP.
Object attribute MISP attribute type Description Disable correlation Multiple

asn

AS

Autonomous System Number

country

text

Country code of the main location of the autonomous system

description

text

Description of the autonomous system

export

text

The outbound routing policy of the AS in RFC 2622 – Routing Policy Specification Language (RPSL) format

first-seen

datetime

First time the ASN was seen

import

text

The inbound IPv4 routing policy of the AS in RFC 2622 – Routing Policy Specification Language (RPSL) format

last-seen

datetime

Last time the ASN was seen

mp-export

text

This attribute performs the same function as the export attribute above. The difference is that mp-export allows both IPv4 and IPv6 address families to be specified. The export is described in RFC 4012 – Routing Policy Specification Language next generation (RPSLng), section 4.5. format

mp-import

text

The inbound IPv4 or IPv6 routing policy of the AS in RFC 4012 – Routing Policy Specification Language next generation (RPSLng), section 4.5. format

subnet-announced

ip-src

Subnet announced

attack-pattern

Attack pattern describing a common attack pattern enumeration and classification.

attack-pattern is a MISP object available in JSON format at this location The JSON format can be freely reused in your application or automatically enabled in MISP.
Object attribute MISP attribute type Description Disable correlation Multiple

id

text

CAPEC ID.

name

text

Name of the attack pattern.

prerequisites

text

Prerequisites for the attack pattern to succeed.

references

link

External references

related-weakness

weakness

Weakness related to the attack pattern.

solutions

text

Solutions for the attack pattern to be countered.

summary

text

Summary description of the attack pattern.

authentication-failure-report

Authentication Failure Report.

authentication-failure-report is a MISP object available in JSON format at this location The JSON format can be freely reused in your application or automatically enabled in MISP.
Object attribute MISP attribute type Description Disable correlation Multiple

ip-dst

ip-dst

Destination IP.

ip-src

ip-src

IP address originating the authentication failure.

total

counter

the number of authentication failures reported.

type

text

the type of authentication failure. ['ssh']

username

text

the username used.

authenticode-signerinfo

Authenticode Signer Info.

authenticode-signerinfo is a MISP object available in JSON format at this location The JSON format can be freely reused in your application or automatically enabled in MISP.
Object attribute MISP attribute type Description Disable correlation Multiple

content-type

text

Content type

digest-base64

text

Signature created by the signing certificate’s private key

digest_algorithm

text

Algorithm used to hash the file.

encryption_algorithm

text

Algorithm used to encrypt the digest

issuer

text

Issuer of the certificate

program-name

text

Program name

serial-number

text

Serial number of the certificate

signature_algorithm

text

Signature algorithm ['SHA1_WITH_RSA_ENCRYPTION', 'SHA256_WITH_RSA_ENCRYPTION']

text

text

Free text description of the signer info

url

url

Url

version

text

Version of the certificate

av-signature

Antivirus detection signature.

av-signature is a MISP object available in JSON format at this location The JSON format can be freely reused in your application or automatically enabled in MISP.
Object attribute MISP attribute type Description Disable correlation Multiple

datetime

datetime

Datetime

signature

text

Name of detection signature

software

text

Name of antivirus software

text

text

Free text value to attach to the file

bank-account

An object describing bank account information based on account description from goAML 4.0.

bank-account is a MISP object available in JSON format at this location The JSON format can be freely reused in your application or automatically enabled in MISP.
Object attribute MISP attribute type Description Disable correlation Multiple

aba-rtn

aba-rtn

ABA routing transit number

account

bank-account-nr

Account number

account-name

text

A field to freely describe the bank account details.

balance

text

The balance of the account after the suspicious transaction was processed.

beneficiary

text

Final beneficiary of the bank account.

beneficiary-comment

text

Comment about the final beneficiary.

branch

text

Branch code or name

client-number

text

Client number as seen by the bank.

closed

datetime

When the account was closed.

comments

text

Comments about the bank account.

currency-code

text

Currency of the account. ['USD', 'EUR']

date-balance

datetime

When the balance was reported.

iban

iban

IBAN of the bank account.

institution-code

text

Institution code of the bank.

institution-name

text

Name of the bank or financial organisation.

non-banking-institution

boolean

A flag to define if this account belong to a non-banking organisation. If set to true, it’s a non-banking organisation.

opened

datetime

When the account was opened.

personal-account-type

text

Account type. ['A - Business', 'B - Personal Current', 'C - Savings', 'D - Trust Account', 'E - Trading Account', 'O - Other']

report-code

text

Report code of the bank account. ['CTR Cash Transaction Report', 'STR Suspicious Transaction Report', 'EFT Electronic Funds Transfer', 'IFT International Funds Transfer', 'TFR Terror Financing Report', 'BCR Border Cash Report', 'UTR Unusual Transaction Report', 'AIF Additional Information File – Can be used for example to get full disclosure of transactions of an account for a period of time without reporting it as a CTR.', 'IRI Incoming Request for Information – International', 'ORI Outgoing Request for Information – International', 'IRD Incoming Request for Information – Domestic', 'ORD Outgoing Request for Information – Domestic']

status-code

text

Account status at the time of the transaction processed. ['A - Active', 'B - Inactive', 'C - Dormant']

swift

bic

SWIFT or BIC as defined in ISO 9362.

text

text

A description of the bank account.

bgp-hijack

Object encapsulating BGP Hijack description as specified, for example, by bgpstream.com.

bgp-hijack is a MISP object available in JSON format at this location The JSON format can be freely reused in your application or automatically enabled in MISP.
Object attribute MISP attribute type Description Disable correlation Multiple

country

text

Country code of the main location of the attacking autonomous system

description

text

BGP Hijack details

detected-asn

AS

Detected Autonomous System Number

end

datetime

Last time the Prefix hijack was seen

expected-asn

AS

Expected Autonomous System Number

start

datetime

First time the Prefix hijack was seen

subnet-announced

ip-src

Subnet announced

bgp-ranking

BGP Ranking object describing the ranking of an ASN for a given day, along with its position, 1 being the most malicious ASN of the day, with the highest ranking. This object is meant to have a relationship with the corresponding ASN object and represents its ranking for a specific date.

bgp-ranking is a MISP object available in JSON format at this location The JSON format can be freely reused in your application or automatically enabled in MISP.
Object attribute MISP attribute type Description Disable correlation Multiple

address-family

text

The IP address family concerned by the ranking. ['v4', 'v6']

date

datetime

Date fo the ranking.

position

float

Position of the ASN for a given day.

ranking

float

Ranking of the Autonomous System number.

blog

Blog post like Medium or WordPress.

blog is a MISP object available in JSON format at this location The JSON format can be freely reused in your application or automatically enabled in MISP.
Object attribute MISP attribute type Description Disable correlation Multiple

archive

link

Archive of the original document (Internet Archive, Archive.is, etc).

creation-date

datetime

Initial creation of the blog post.

embedded-link

url

Site linked by the blog post.

embedded-safe-link

link

Safe site linked by the blog post.

link

link

Original link into the blog post (Supposed harmless).

modification-date

datetime

Last update of the blog post.

post

text

Raw post.

removal-date

datetime

When the blog post was removed.

title

text

Title of blog post.

type

text

Type of blog post. ['Medium', 'WordPress', 'Blogger', 'Tumbler', 'LiveJournal', 'Forum', 'Other']

url

url

Original URL location of the blog post (potentially malicious).

username

text

Username who posted the blog post.

username-quoted

text

Username who are quoted into the blog post.

verified-username

text

Is the username account verified by the operator of the blog platform. ['Verified', 'Unverified', 'Unknown']

boleto

A common form of payment used in Brazil.

boleto is a MISP object available in JSON format at this location The JSON format can be freely reused in your application or automatically enabled in MISP.
Object attribute MISP attribute type Description Disable correlation Multiple

beneficiary

text

Final beneficiary of the boleto.

beneficiary-bank-account

bank-account-nr

Recipient bank account number

beneficiary-bank-agency

bank-account-nr

Recipient bank agency number

boleto-number

text

Boleto code numbers

creation-date

datetime

Date the boleto was created

febraban-code

text

Financial institution code in Brazil that created the boleto.

generator-financial-institution

text

Name of the bank or financial organisation that created the boleto.

payment-due-date

datetime

Boleto payment date

payment-status

text

Inform if boleto was as paid or not ['Not Paid', 'Paid']

payment-value

float

The payment boleto value in Brazilian Reais

requester

text

Organisation, service or affiliated person that requested creation of the boleto.

btc-transaction

An object to describe a Bitcoin transaction. Best to be used with bitcoin-wallet.

btc-transaction is a MISP object available in JSON format at this location The JSON format can be freely reused in your application or automatically enabled in MISP.
Object attribute MISP attribute type Description Disable correlation Multiple

btc-address

btc

A Bitcoin transactional address

time

datetime

Date and time of transaction

transaction-number

text

A Bitcoin transaction number in a sequence of transactions

value_BTC

float

Value in BTC at date/time displayed in field 'time'

value_EUR

float

Value in EUR with conversion rate as of date/time displayed in field 'time'

value_USD

float

Value in USD with conversion rate as of date/time displayed in field 'time'

btc-wallet

An object to describe a Bitcoin wallet. Best to be used with bitcoin-transactions.

btc-wallet is a MISP object available in JSON format at this location The JSON format can be freely reused in your application or automatically enabled in MISP.
Object attribute MISP attribute type Description Disable correlation Multiple

BTC_received

float

Value of received BTC

BTC_sent

float

Value of sent BTC

balance_BTC

float

Value in BTC at date/time displayed in field 'time'

time

datetime

Date and time of lookup/conversion

wallet-address

btc

A Bitcoin wallet address

cap-alert

Common Alerting Protocol Version (CAP) alert object.

cap-alert is a MISP object available in JSON format at this location The JSON format can be freely reused in your application or automatically enabled in MISP.
Object attribute MISP attribute type Description Disable correlation Multiple

addresses

text

The group listing of intended recipients of the alert message. (1) Required when <scope> is “Private”, optional when <scope> is “Public” or “Restricted”. (2) Each recipient SHALL be identified by an identifier or an address. (3) Multiple space-delimited addresses MAY be included. Addresses including whitespace MUST be enclosed in double-quotes.

code

text

The code denoting the special handling of the alert message.

identifier

text

The identifier of the alert message in a number or string uniquely identifying this message, assigned by the sender.

incident

text

The group listing naming the referent incident(s) of the alert message. (1) Used to collate multiple messages referring to different aspects of the same incident. (2) If multiple incident identifiers are referenced, they SHALL be separated by whitespace. Incident names including whitespace SHALL be surrounded by double-quotes.

msgType

text

The code denoting the nature of the alert message. ['Alert', 'Update', 'Cancel', 'Ack', 'Error']

note

text

The text describing the purpose or significance of the alert message.

references

text

The group listing identifying earlier message(s) referenced by the alert message. (1) The extended message identifier(s) (in the form sender,identifier,sent) of an earlier CAP message or messages referenced by this one. (2) If multiple messages are referenced, they SHALL be separated by whitespace.

restriction

text

The text describing the rule for limiting distribution of the restricted alert message.

scope

text

The code denoting the intended distribution of the alert message. ['Public', 'Restricted', 'Private']

sender

text

The identifier of the sender of the alert message which identifies the originator of this alert. Guaranteed by assigner to be unique globally; e.g., may be based on an Internet domain name.

sent

datetime

The time and date of the origination of the alert message.

source

text

The text identifying the source of the alert message. The particular source of this alert; e.g., an operator or a specific device.

status

text

The code denoting the appropriate handling of the alert message. ['Actual', 'Exercise', 'System', 'Test', 'Draft']

cap-info

Common Alerting Protocol Version (CAP) info object.

cap-info is a MISP object available in JSON format at this location The JSON format can be freely reused in your application or automatically enabled in MISP.
Object attribute MISP attribute type Description Disable correlation Multiple

audience

text

The text describing the intended audience of the alert message.

category

text

The code denoting the category of the subject event of the alert message. ['Geo', 'Met', 'Safety', 'Security', 'Rescue', 'Fire', 'Health', 'Env', 'Transport', 'Infra', 'CBRNE', 'Other']

certainty

text

The code denoting the certainty of the subject event of the alert message. For backward compatibility with CAP 1.0, the deprecated value of “Very Likely” SHOULD be treated as equivalent to “Likely”. ['Likely', 'Possible', 'Unlikely', 'Unknown']

contact

text

The text describing the contact for follow-up and confirmation of the alert message.

description

text

The text describing the subject event of the alert message.

effective

datetime

The effective time of the information of the alert message.

event

text

The text denoting the type of the subject event of the alert message.

eventCode

text

A system-specific code identifying the event type of the alert message.

expires

datetime

The expiry time of the information of the alert message.

headline

text

The text headline of the alert message.

instruction

text

The text describing the recommended action to be taken by recipients of the alert message.

language

text

The code denoting the language of the info sub-element of the alert message.

onset

datetime

The expected time of the beginning of the subject event of the alert message.

parameter

text

A system-specific additional parameter associated with the alert message.

responseType

text

The code denoting the type of action recommended for the target audience. ['Shelter', 'Evacuate', 'Prepare', 'Execute', 'Avoid', 'Monitor', 'Assess', 'AllClear', 'None']

senderName

text

The text naming the originator of the alert message.

severity

text

The code denoting the severity of the subject event of the alert message. ['Extreme', 'Severe', 'Moderate', 'Minor', 'Unknown']

urgency

text

The code denoting the urgency of the subject event of the alert message. ['Immediate', 'Expected', 'Future', 'Past', 'Unknown']

web

link

The identifier of the hyperlink associating additional information with the alert message.

cap-resource

Common Alerting Protocol Version (CAP) resource object.

cap-resource is a MISP object available in JSON format at this location The JSON format can be freely reused in your application or automatically enabled in MISP.
Object attribute MISP attribute type Description Disable correlation Multiple

derefUri

attachment

The base-64 encoded data content of the resource file.

digest

sha1

The code representing the digital digest (“hash”) computed from the resource file (OPTIONAL).

mimeType

mime-type

The identifier of the MIME content type and sub-type describing the resource file.

resourceDesc

text

The text describing the type and content of the resource file.

size

text

The integer indicating the size of the resource file.

uri

link

The identifier of the hyperlink for the resource file.

coin-address

An address used in a cryptocurrency.

coin-address is a MISP object available in JSON format at this location The JSON format can be freely reused in your application or automatically enabled in MISP.
Object attribute MISP attribute type Description Disable correlation Multiple

address

btc

Bitcoin address used as a payment destination in a cryptocurrency

address-xmr

xmr

Monero address used as a payment destination in a cryptocurrency

current-balance

float

Current balance of address

first-seen

datetime

First time this payment destination address has been seen

last-seen

datetime

Last time this payment destination address has been seen

last-updated

datetime

Last time the balances and totals have been updated

symbol

text

The (uppercase) symbol of the cryptocurrency used. Symbol should be from https://coinmarketcap.com/all/views/all/ ['BTC', 'ETH', 'BCH', 'XRP', 'MIOTA', 'DASH', 'BTG', 'LTC', 'ADA', 'XMR', 'ETC', 'NEO', 'NEM', 'EOS', 'XLM', 'BCC', 'LSK', 'OMG', 'QTUM', 'ZEC', 'USDT', 'HSR', 'STRAT', 'WAVES', 'PPT', 'ETN']

text

text

Free text value

total-received

float

Total balance received

total-sent

float

Total balance sent

total-transactions

text

Total transactions performed

command

Command functionalities related to specific commands executed by a program, whether it is malicious or not. Command-line are attached to this object for the related commands.

command is a MISP object available in JSON format at this location The JSON format can be freely reused in your application or automatically enabled in MISP.
Object attribute MISP attribute type Description Disable correlation Multiple

description

text

Description of the command functionalities

location

text

Location of the command functionality ['Bundled', 'Module', 'Libraries', 'Unknown']

trigger

text

How the commands are triggered ['Local', 'Network', 'Unknown']

command-line

Command line and options related to a specific command executed by a program, whether it is malicious or not.

command-line is a MISP object available in JSON format at this location The JSON format can be freely reused in your application or automatically enabled in MISP.
Object attribute MISP attribute type Description Disable correlation Multiple

description

text

description of the command

value

text

command code

An HTTP cookie (web cookie, browser cookie) is a small piece of data that a server sends to the user’s web browser. The browser may store it and send it back with the next request to the same server. Typically, it’s used to tell if two requests came from the same browser — keeping a user logged-in, for example. It remembers stateful information for the stateless HTTP protocol. (as defined by the Mozilla foundation.

cookie is a MISP object available in JSON format at this location The JSON format can be freely reused in your application or automatically enabled in MISP.
Object attribute MISP attribute type Description Disable correlation Multiple

cookie

cookie

Full cookie

cookie-name

text

Name of the cookie (if splitted)

cookie-value

text

Value of the cookie (if splitted)

expires

datetime

Expiration date/time of the cookie

http-only

boolean

True if send only through HTTP

path

text

Path defined in the cookie

secure

boolean

True if cookie is sent over TLS

text

text

A description of the cookie.

type

text

Type of cookie and how it’s used in this specific object. ['Session management', 'Personalization', 'Tracking', 'Exfiltration', 'Malicious Payload', 'Beaconing']

cortex

Cortex object describing a complete cortex analysis. Observables would be attribute with a relationship from this object.

cortex is a MISP object available in JSON format at this location The JSON format can be freely reused in your application or automatically enabled in MISP.
Object attribute MISP attribute type Description Disable correlation Multiple

full

text

Cortex report object (full report) in JSON

name

text

Cortex analyser/worker name

server-name

text

Name of the cortex server

start-date

datetime

When the Cortex analyser was started

success

boolean

Result of the cortex job

summary

text

Cortex summary object (summary) in JSON

cortex-taxonomy

Cortex object describing an Cortex Taxonomy (or mini report).

cortex-taxonomy is a MISP object available in JSON format at this location The JSON format can be freely reused in your application or automatically enabled in MISP.
Object attribute MISP attribute type Description Disable correlation Multiple

cortex_url

link

URL to the Cortex job

level

text

Cortex Taxonomy Level ['info', 'safe', 'suspicious', 'malicious']

namespace

text

Cortex Taxonomy Namespace

predicate

text

Cortex Taxonomy Predicate

value

text

Cortex Taxonomy Value

course-of-action

An object describing a specific measure taken to prevent or respond to an attack.

course-of-action is a MISP object available in JSON format at this location The JSON format can be freely reused in your application or automatically enabled in MISP.
Object attribute MISP attribute type Description Disable correlation Multiple

cost

text

The estimated cost of applying the course of action. ['High', 'Medium', 'Low', 'None', 'Unknown']

description

text

A description of the course of action.

efficacy

text

The estimated efficacy of applying the course of action. ['High', 'Medium', 'Low', 'None', 'Unknown']

impact

text

The estimated impact of applying the course of action. ['High', 'Medium', 'Low', 'None', 'Unknown']

name

text

The name used to identify the course of action.

objective

text

The objective of the course of action.

stage

text

The stage of the threat management lifecycle that the course of action is applicable to. ['Remedy', 'Response', 'Further Analysis Required']

type

text

The type of the course of action. ['Perimeter Blocking', 'Internal Blocking', 'Redirection', 'Redirection (Honey Pot)', 'Hardening', 'Patching', 'Eradication', 'Rebuilding', 'Training', 'Monitoring', 'Physical Access Restrictions', 'Logical Access Restrictions', 'Public Disclosure', 'Diplomatic Actions', 'Policy Actions', 'Other']

covid19-csse-daily-report

CSSE COVID-19 Daily report.

covid19-csse-daily-report is a MISP object available in JSON format at this location The JSON format can be freely reused in your application or automatically enabled in MISP.
Object attribute MISP attribute type Description Disable correlation Multiple

active

counter

the number of active cases.

confirmed

counter

the number of confirmed cases. For Hubei Province: from Feb 13 (GMT +8), we report both clinically diagnosed and lab-confirmed cases. For lab-confirmed cases only (Before Feb 17), please refer to https://github.com/CSSEGISandData/COVID-19/tree/master/who_covid_19_situation_reports.

country-region

text

country/region name conforming to WHO (will be updated).

county

counter

US County (US Only)

death

counter

the number of deaths.

fips

counter

Federal Information Processing Standard county code (US Only)

latitude

float

Approximate latitude of the entry

longitude

float

Approximate longitude of the entry

province-state

text

province name; US/Canada/Australia/ - city name, state/province name; Others - name of the event (e.g., "Diamond Princess" cruise ship); other countries - blank.

recovered

counter

the number of recovered cases.

update

datetime

Time of the last update that day (UTC)

covid19-dxy-live-city

COVID 19 from dxy.cn - Aggregation by city.

covid19-dxy-live-city is a MISP object available in JSON format at this location The JSON format can be freely reused in your application or automatically enabled in MISP.
Object attribute MISP attribute type Description Disable correlation Multiple

city

text

Name of the Chinese city, in Chinese.

current-confirmed

counter

Current number of confirmed cases

total-confirmed

counter

Total number of confirmed cases.

total-cured

counter

Total number of cured cases.

total-death

counter

Total number of deaths.

update

datetime

Approximate time of the update (~hour)

covid19-dxy-live-province

COVID 19 from dxy.cn - Aggregation by province.

covid19-dxy-live-province is a MISP object available in JSON format at this location The JSON format can be freely reused in your application or automatically enabled in MISP.
Object attribute MISP attribute type Description Disable correlation Multiple

comment

text

Comment, in chinese

current-confirmed

counter

Current number of confirmed cases

province

text

Name of the Chinese province, in Chinese.

total-confirmed

counter

Total number of confirmed cases.

total-cured

counter

Total number of cured cases.

total-death

counter

Total number of deaths.

update

datetime

Approximate time of the update (~hour)

cowrie

Cowrie honeypot object template.

cowrie is a MISP object available in JSON format at this location The JSON format can be freely reused in your application or automatically enabled in MISP.
Object attribute MISP attribute type Description Disable correlation Multiple

compCS

text

SSH compression algorithm supported in the session

dst_ip

ip-dst

Destination IP address of the session

dst_port

port

Destination port of the session

encCS

text

SSH symmetric encryption algorithm supported in the session

eventid

text

Eventid of the session in the cowrie honeypot

hassh

hassh-md5

HASSH of the client SSH session following Salesforce algorithm

input

text

Input of the session

isError

text

isError

keyAlgs

text

SSH public-key algorithm supported in the session

macCS

text

SSH MAC supported in the sesssion

message

text

Message of the cowrie honeypot

password

text

Password

protocol

text

Protocol used in the cowrie honeypot

sensor

text

Cowrie sensor name

session

text

Session id

src_ip

ip-src

Source IP address of the session

src_port

port

Source port of the session

system

text

System origin in cowrie honeypot

timestamp

datetime

When the event happened

username

text

Username related to the password(s)

cpe-asset

An asset which can be defined by a CPE. This can be a generic asset. CPE is a structured naming scheme for information technology systems, software, and packages.

cpe-asset is a MISP object available in JSON format at this location The JSON format can be freely reused in your application or automatically enabled in MISP.
Object attribute MISP attribute type Description Disable correlation Multiple

cpe

cpe

CPE—the well-formed CPE name(WFN). WFNs can be used to describe a set of products or to identify an individual product.

description

text

Complementary description of the asset

edition

text

The edition attribute is considered deprecated in this specification, and it SHOULD be assigned the logical value ANY except where required for backward compatibility with version 2.2 of the CPE specification.This attribute is referred to as the “legacyedition”attribute.If this attribute is used,values for this attribute SHOULD capture edition-related terms applied by the vendor to the product. Values for this attribute SHOULD be selected from an attribute-specific valid-values list, which MAYbe defined by other specifications that utilize this specification. Any character string meeting the requirements for WFNs (cf. 5.3.2) MAY be specified as the value of the attribute.

language

text

Values for thisattribute SHALL be valid language tags as defined by [RFC5646], and SHOULD be used to define the language supported in the user interface of the product being described.Although any valid language tag MAY be used, only tags containing language and region codesSHOULD be used.

other

text

Values for this attribute SHOULD capture any other general descriptive or identifying information which is vendor-or product-specific and which does not logically fit in any other attribute value. Values SHOULD NOT be used for storing instance-specific data (e.g., globally-unique identifiers or Internet Protocol addresses).Values for this attribute SHOULD be selected from a valid-values list that is refined over time; this list MAYbe defined by other specifications that utilize this specification. Any character string meeting the requirements for WFNs (cf. 5.3.2) MAYbe specified as the value of the attribute.

part

text

Part - application, operating systems or hardware devices ['a', 'o', 'h']

product

text

Values for this attribute SHOULD describe or identify the most common and recognizable title or name of the product. Values for this attribute SHOULD be selected from an attribute-specific valid-values list, which MAYbe defined by other specifications that utilize this specification. Any character string meeting the requirements for WFNs(cf. 5.3.2) MAY be specified as the value of the attribute.

sw_edition

text

Values for this attribute SHOULD characterize how the product is tailored to a particular market or class of end users. Values for this attribute SHOULD be selected from an attribute-specific valid-values list, which MAYbe defined by other specifications that utilize this specification. Any character string meeting the requirements for WFNs(cf. 5.3.2) MAYbe specified as the value of the attribute.

target_hw

text

Values for this attribute SHOULD characterize the instruction set architecture (e.g., x86) on which the product being described or identified by the WFN operates. Bytecode-intermediate languages, such as Java bytecode for the Java Virtual Machine or Microsoft Common Intermediate Language for the Common Language Runtime virtual machine, SHALL be considered instruction set architectures. Values for this attribute SHOULD be selected from an attribute-specific valid-values list, which MAYbe defined by other specifications that utilize this specification. Any character string meeting the requirements for WFNs(cf. 5.3.2) MAYbe specified as the value of the attribute.

target_sw

text

Values for this attribute SHOULDi characterize the software computing environment within which the product operates.Values for this attribute SHOULD be selected from an attribute-specific valid-values list, which MAYbe defined by other specifications that utilize this specification. Any character string meeting the requirements for WFNs(cf. 5.3.2) MAYbe specified as the value of the attribute.

update

text

Values for this attribute SHOULD be vendor-specific alphanumeric strings characterizing the particular update, service pack, or point release of the product.Values for this attribute SHOULD be selected from an attribute-specific valid-values list, which MAYbe defined by other specifications that utilize this specification. Any character string meeting the requirements for WFNs (cf. 5.3.2) MAYbe specified as the value of the attribute.

vendor

text

Values for this attribute SHOULD describe or identify the person or organization that manufactured or created the product. Values for this attribute SHOULD be selected from an attribute-specific valid-values list, which MAYbe defined by other specifications that utilize this specification. Any character string meeting the requirements for WFNs (cf. 5.3.2) MAY be specified as the value of the attribute

version

text

Values for this attribute SHOULD be vendor-specific alphanumeric strings characterizing the particular release version of the product.Version information SHOULD be copied directly (with escaping of printable non-alphanumeric characters as required) from discoverable data and SHOULD NOTbe truncated or otherwise modified. Any character string meeting the requirements for WFNs (cf. 5.3.2) MAYbe specified as the value of the attribute.

credential

Credential describes one or more credential(s) including password(s), api key(s) or decryption key(s).

credential is a MISP object available in JSON format at this location The JSON format can be freely reused in your application or automatically enabled in MISP.
Object attribute MISP attribute type Description Disable correlation Multiple

format

text

Format of the password(s) ['clear-text', 'hashed', 'encrypted', 'unknown']

notification

text

Mention of any notification(s) towards the potential owner(s) of the credential(s) ['victim-notified', 'service-notified', 'none']

origin

text

Origin of the credential(s) ['bruteforce-scanning', 'malware-analysis', 'memory-analysis', 'network-analysis', 'leak', 'unknown']

password

text

Password

text

text

A description of the credential(s)

type

text

Type of password(s) ['password', 'api-key', 'encryption-key', 'unknown']

username

text

Username related to the password(s)

credit-card

A payment card like credit card, debit card or any similar cards which can be used for financial transactions.

credit-card is a MISP object available in JSON format at this location The JSON format can be freely reused in your application or automatically enabled in MISP.
Object attribute MISP attribute type Description Disable correlation Multiple

bank_name

text

Name of the bank which have issued the card

card-security-code

text

Card security code (CSC, CVD, CVV, CVC and SPC) as embossed or printed on the card.

cc-number

cc-number

credit-card number as encoded on the card.

comment

comment

A description of the card.

expiration

datetime

Maximum date of validity

iin

text

International Issuer Number (First eight digits of the credit card number

issued

datetime

Initial date of validity or issued date.

name

text

Name of the card owner.

version

text

Version of the card.

crypto-material

Cryptographic materials such as public or/and private keys.

crypto-material is a MISP object available in JSON format at this location The JSON format can be freely reused in your application or automatically enabled in MISP.
Object attribute MISP attribute type Description Disable correlation Multiple

Gx

text

Curve Parameter - Gx in decimal

Gy

text

Curve Parameter - Gy in decimal

b

text

Curve Parameter - B in decimal

curve-length

text

Length of the Curve in bits

e

text

RSA public exponent

ecdsa-type

text

Curve type of the ECDSA cryptographic materials ['Anomalous', 'M-221', 'E-222', 'NIST P-224', 'Curve1174', 'Curve25519', 'BN(2,254)', 'brainpoolP256t1', 'ANSSI FRP256v1', 'NIST P-256', 'secp256k1', 'E-382', 'M-383', 'Curve383187', 'brainpoolP384t1', 'NIST P-384', 'Curve41417', 'Ed448-Goldilocks', 'M-511', 'E-521']

g

text

Curve Parameter - G in decimal

generic-symmetric-key

text

Generic symmetric key (please precise the type)

modulus

text

Modulus Parameter - in hexadecimal - no 0x, no :

n

text

Curve Parameter - N in decimal

origin

text

Origin of the cryptographic materials ['mathematical-attack', 'exhaustive-search', 'bruteforce-attack', 'malware-extraction', 'memory-interception', 'network-interception', 'leak', 'unknown']

p

text

Prime Parameter - P in decimal

private

text

Private part of the cryptographic materials in PEM format

public

text

Public part of the cryptographic materials in PEM format

q

text

Prime Parameter - Q in decimal

rsa-modulus-size

text

RSA modulus size in bits

text

text

A description of the cryptographic materials.

type

text

Type of crytographic materials ['RSA', 'DSA', 'ECDSA', 'RC4', 'XOR', 'unknown']

x

text

Curve Parameter - X in decimal

y

text

Curve Parameter - Y in decimal

cytomic-orion-file

Cytomic Orion File Detection.

cytomic-orion-file is a MISP object available in JSON format at this location The JSON format can be freely reused in your application or automatically enabled in MISP.
Object attribute MISP attribute type Description Disable correlation Multiple

classification

text

File classification - number

classificationName

text

File classification

fileName

filename

Original filename

fileSize

size-in-bytes

Size of the file

first-seen

datetime

First seen timestamp of the file

last-seen

datetime

Last seen timestamp of the file

cytomic-orion-machine

Cytomic Orion File at Machine Detection.

cytomic-orion-machine is a MISP object available in JSON format at this location The JSON format can be freely reused in your application or automatically enabled in MISP.
Object attribute MISP attribute type Description Disable correlation Multiple

clientCreationDateUTC

datetime

Client creation date UTC

clientId

text

Client id

clientName

target-org

Client name

creationDate

datetime

Client creation date

first-seen

datetime

First seen on machine

last-seen

datetime

Last seen on machine

lastSeenUtc

datetime

Client last seen UTC

machineMuid

text

Machine UID

machineName

target-machine

Machine name

machinePath

text

Path of observable

dark-pattern-item

An Item whose User Interface implements a dark pattern.

dark-pattern-item is a MISP object available in JSON format at this location The JSON format can be freely reused in your application or automatically enabled in MISP.
Object attribute MISP attribute type Description Disable correlation Multiple

comment

text

textual comment about the item

gain

text

What is the implementer is gaining by deceiving the user ['registration', 'personal data', 'money', 'contacts', 'audience']

implementer

text

Who is the vendor / holder of the item

location

text

Location where to find the item

screenshot

attachment

A screencapture or a screengrab of the item at work

time

datetime

Date and time when first-seen

user

text

who are the user of the item

ddos

DDoS object describes a current DDoS activity from a specific or/and to a specific target. Type of DDoS can be attached to the object as a taxonomy.

ddos is a MISP object available in JSON format at this location The JSON format can be freely reused in your application or automatically enabled in MISP.
Object attribute MISP attribute type Description Disable correlation Multiple

domain-dst

domain

Destination domain (victim)

dst-port

port

Destination port of the attack

first-seen

datetime

Beginning of the attack

ip-dst

ip-dst

Destination IP (victim)

ip-src

ip-src

IP address originating the attack

last-seen

datetime

End of the attack

protocol

text

Protocol used for the attack ['TCP', 'UDP', 'ICMP', 'IP']

src-port

port

Port originating the attack

text

text

Description of the DDoS

total-bps

counter

Bits per second

total-pps

counter

Packets per second

device

An object to define a device.

device is a MISP object available in JSON format at this location The JSON format can be freely reused in your application or automatically enabled in MISP.
Object attribute MISP attribute type Description Disable correlation Multiple

MAC-address

mac-address

Device MAC address

OS

text

OS of the device

alias

text

Alias of the Device

analysis-date

datetime

Date of device analysis

attachment

attachment

An attachment

description

text

Description of the Device

device-type

text

Type of the device ['PC', 'Mobile', 'Laptop', 'HID', 'TV', 'IoT', 'Hardware', 'Other']

dns-name

text

Device DNS Name

ip-address

ip-src

Device IP address

name

text

Name of the Device

version

text

Version of the device/ OS

diameter-attack

Attack as seen on diameter authentication against a GSM, UMTS or LTE network.

diameter-attack is a MISP object available in JSON format at this location The JSON format can be freely reused in your application or automatically enabled in MISP.
Object attribute MISP attribute type Description Disable correlation Multiple

ApplicationId

text

Application-ID is used to identify for which Diameter application the message is applicable. Application-ID is a decimal representation.

CmdCode

text

A decimal representation of the diameter Command Code.

Destination-Host

text

Destination-Host.

Destination-Realm

text

Destination-Realm.

IdrFlags

text

IDR-Flags.

Origin-Host

text

Origin-Host.

Origin-Realm

text

Origin-Realm.

SessionId

text

Session-ID.

Username

text

Username (in this case, usually the IMSI).

category

text

Category. ['Cat0', 'Cat1', 'Cat2', 'Cat3', 'CatSMS']

first-seen

datetime

When the attack has been seen for the first time.

text

text

A description of the attack seen.

dkim

DomainKeys Identified Mail - DKIM.

dkim is a MISP object available in JSON format at this location The JSON format can be freely reused in your application or automatically enabled in MISP.
Object attribute MISP attribute type Description Disable correlation Multiple

d

domain

DKIM domain used for the selector record

dkim

dkim

DomainKeys Identified Mail - DKIM full DNS TXT record

h

text

DKIM hash type ['sha1', 'md5']

k

text

DKIM key type ['rsa']

n

text

DKIM administrator note

public-key

text

DKIM public key

s

text

DKIM service record

t

text

DKIM domain testing ['y', 's']

version

text

DKIM version ['DKIM1']

dns-record

A set of DNS records observed for a specific domain.

dns-record is a MISP object available in JSON format at this location The JSON format can be freely reused in your application or automatically enabled in MISP.
Object attribute MISP attribute type Description Disable correlation Multiple

a-record

ip-dst

IPv4 address associated with A record

aaaa-record

ip-dst

IPv6 address associated with AAAA record

cname-record

domain

Domain associated with CNAME record

mx-record

domain

Domain associated with MX record

ns-record

domain

Domain associated with NS record

ptr-record

domain

Domain associated with PTR record

queried-domain

domain

Domain name

soa-record

domain

Domain associated with SOA record

spf-record

ip-dst

IP addresses associated with SPF record

srv-record

domain

Domain associated with SRV record

text

text

A description of the records

txt-record

text

Content associated with TXT record

domain-crawled

A domain crawled over time.

domain-crawled is a MISP object available in JSON format at this location The JSON format can be freely reused in your application or automatically enabled in MISP.
Object attribute MISP attribute type Description Disable correlation Multiple

domain

domain

Domain name

text

text

A description of the tuple

url

url

domain url

domain-ip

A domain/hostname and IP address seen as a tuple in a specific time frame.

domain-ip is a MISP object available in JSON format at this location The JSON format can be freely reused in your application or automatically enabled in MISP.
Object attribute MISP attribute type Description Disable correlation Multiple

domain

domain

Domain name

first-seen

datetime

First time the tuple has been seen

hostname

hostname

Hostname related to the IP

ip

ip-dst

IP Address

last-seen

datetime

Last time the tuple has been seen

port

port

Associated TCP port with the domain

registration-date

datetime

Registration date of domain

text

text

A description of the tuple

elf

Object describing a Executable and Linkable Format.

elf is a MISP object available in JSON format at this location The JSON format can be freely reused in your application or automatically enabled in MISP.
Object attribute MISP attribute type Description Disable correlation Multiple

arch

text

Architecture of the ELF file ['None', 'M32', 'SPARC', 'i386', 'ARCH_68K', 'ARCH_88K', 'IAMCU', 'ARCH_860', 'MIPS', 'S370', 'MIPS_RS3_LE', 'PARISC', 'VPP500', 'SPARC32PLUS', 'ARCH_960', 'PPC', 'PPC64', 'S390', 'SPU', 'V800', 'FR20', 'RH32', 'RCE', 'ARM', 'ALPHA', 'SH', 'SPARCV9', 'TRICORE', 'ARC', 'H8_300', 'H8_300H', 'H8S', 'H8_500', 'IA_64', 'MIPS_X', 'COLDFIRE', 'ARCH_68HC12', 'MMA', 'PCP', 'NCPU', 'NDR1', 'STARCORE', 'ME16', 'ST100', 'TINYJ', 'x86_64', 'PDSP', 'PDP10', 'PDP11', 'FX66', 'ST9PLUS', 'ST7', 'ARCH_68HC16', 'ARCH_68HC11', 'ARCH_68HC08', 'ARCH_68HC05', 'SVX', 'ST19', 'VAX', 'CRIS', 'JAVELIN', 'FIREPATH', 'ZSP', 'MMIX', 'HUANY', 'PRISM', 'AVR', 'FR30', 'D10V', 'D30V', 'V850', 'M32R', 'MN10300', 'MN10200', 'PJ', 'OPENRISC', 'ARC_COMPACT', 'XTENSA', 'VIDEOCORE', 'TMM_GPP', 'NS32K', 'TPC', 'SNP1K', 'ST200', 'IP2K', 'MAX', 'CR', 'F2MC16', 'MSP430', 'BLACKFIN', 'SE_C33', 'SEP', 'ARCA', 'UNICORE', 'EXCESS', 'DXP', 'ALTERA_NIOS2', 'CRX', 'XGATE', 'C166', 'M16C', 'DSPIC30F', 'CE', 'M32C', 'TSK3000', 'RS08', 'SHARC', 'ECOG2', 'SCORE7', 'DSP24', 'VIDEOCORE3', 'LATTICEMICO32', 'SE_C17', 'TI_C6000', 'TI_C2000', 'TI_C5500', 'MMDSP_PLUS', 'CYPRESS_M8C', 'R32C', 'TRIMEDIA', 'HEXAGON', 'ARCH_8051', 'STXP7X', 'NDS32', 'ECOG1', 'ECOG1X', 'MAXQ30', 'XIMO16', 'MANIK', 'CRAYNV2', 'RX', 'METAG', 'MCST_ELBRUS', 'ECOG16', 'CR16', 'ETPU', 'SLE9X', 'L10M', 'K10M', 'AARCH64', 'AVR32', 'STM8', 'TILE64', 'TILEPRO', 'CUDA', 'TILEGX', 'CLOUDSHIELD', 'COREA_1ST', 'COREA_2ND', 'ARC_COMPACT2', 'OPEN8', 'RL78', 'VIDEOCORE5', 'ARCH_78KOR', 'ARCH_56800EX', 'BA1', 'BA2', 'XCORE', 'MCHP_PIC', 'INTEL205', 'INTEL206', 'INTEL207', 'INTEL208', 'INTEL209', 'KM32', 'KMX32', 'KMX16', 'KMX8', 'KVARC', 'CDP', 'COGE', 'COOL', 'NORC', 'CSR_KALIMBA', 'AMDGPU']

entrypoint-address

text

Address of the entry point

number-sections

counter

Number of sections

os_abi

text

Header operating system application binary interface (ABI) ['AIX', 'ARM', 'AROS', 'C6000_ELFABI', 'C6000_LINUX', 'CLOUDABI', 'FENIXOS', 'FREEBSD', 'GNU', 'HPUX', 'HURD', 'IRIX', 'MODESTO', 'NETBSD', 'NSK', 'OPENBSD', 'OPENVMS', 'SOLARIS', 'STANDALONE', 'SYSTEMV', 'TRU64']

text

text

Free text value to attach to the ELF

type

text

Type of ELF ['CORE', 'DYNAMIC', 'EXECUTABLE', 'HIPROC', 'LOPROC', 'NONE', 'RELOCATABLE']

elf-section

Object describing a section of an Executable and Linkable Format.

elf-section is a MISP object available in JSON format at this location The JSON format can be freely reused in your application or automatically enabled in MISP.
Object attribute MISP attribute type Description Disable correlation Multiple

entropy

float

Entropy of the whole section

flag

text

Flag of the section ['ALLOC', 'EXCLUDE', 'EXECINSTR', 'GROUP', 'HEX_GPREL', 'INFO_LINK', 'LINK_ORDER', 'MASKOS', 'MASKPROC', 'MERGE', 'MIPS_ADDR', 'MIPS_LOCAL', 'MIPS_MERGE', 'MIPS_NAMES', 'MIPS_NODUPES', 'MIPS_NOSTRIP', 'NONE', 'OS_NONCONFORMING', 'STRINGS', 'TLS', 'WRITE', 'XCORE_SHF_CP_SECTION']

md5

md5

[Insecure] MD5 hash (128 bits)

name

text

Name of the section

sha1

sha1

[Insecure] Secure Hash Algorithm 1 (160 bits)

sha224

sha224

Secure Hash Algorithm 2 (224 bits)

sha256

sha256

Secure Hash Algorithm 2 (256 bits)

sha384

sha384

Secure Hash Algorithm 2 (384 bits)

sha512

sha512

Secure Hash Algorithm 2 (512 bits)

sha512/224

sha512/224

Secure Hash Algorithm 2 (224 bits)

sha512/256

sha512/256

Secure Hash Algorithm 2 (256 bits)

size-in-bytes

size-in-bytes

Size of the section, in bytes

ssdeep

ssdeep

Fuzzy hash using context triggered piecewise hashes (CTPH)

text

text

Free text value to attach to the section

type

text

Type of the section ['NULL', 'PROGBITS', 'SYMTAB', 'STRTAB', 'RELA', 'HASH', 'DYNAMIC', 'NOTE', 'NOBITS', 'REL', 'SHLIB', 'DYNSYM', 'INIT_ARRAY', 'FINI_ARRAY', 'PREINIT_ARRAY', 'GROUP', 'SYMTAB_SHNDX', 'LOOS', 'GNU_ATTRIBUTES', 'GNU_HASH', 'GNU_VERDEF', 'GNU_VERNEED', 'GNU_VERSYM', 'HIOS', 'LOPROC', 'ARM_EXIDX', 'ARM_PREEMPTMAP', 'HEX_ORDERED', 'X86_64_UNWIND', 'MIPS_REGINFO', 'MIPS_OPTIONS', 'MIPS_ABIFLAGS', 'HIPROC', 'LOUSER', 'HIUSER']

email

Email object describing an email with meta-information.

email is a MISP object available in JSON format at this location The JSON format can be freely reused in your application or automatically enabled in MISP.
Object attribute MISP attribute type Description Disable correlation Multiple

attachment

email-attachment

Attachment

cc

email-dst

Carbon copy

email-body

email-body

Body of the email

eml

attachment

Full EML

from

email-src

Sender email address

from-display-name

email-src-display-name

Display name of the sender

from-domain

domain

Sender domain address (when only the source domain is known)

header

email-header

Full headers

ip-src

ip-src

Source IP address of the email sender

message-id

email-message-id

Message ID

mime-boundary

email-mime-boundary

MIME Boundary

msg

attachment

Full MSG

received-header-hostname

hostname

Extracted hostname from parsed headers

received-header-ip

ip-src

Extracted IP address from parsed headers

reply-to

email-reply-to

Email address the reply will be sent to

return-path

email-src

Message return path

screenshot

attachment

Screenshot of email

send-date

datetime

Date the email has been sent

subject

email-subject

Subject

thread-index

email-thread-index

Identifies a particular conversation thread

to

email-dst

Destination email address

to-display-name

email-dst-display-name

Display name of the receiver

user-agent

text

User Agent of the sender

x-mailer

email-x-mailer

X-Mailer generally tells the program that was used to draft and send the original email

employee

An employee and related data points.

employee is a MISP object available in JSON format at this location The JSON format can be freely reused in your application or automatically enabled in MISP.
Object attribute MISP attribute type Description Disable correlation Multiple

business-unit

target-org

the organizational business unit associated with the employee

email-address

target-email

Employee Email Address

employee-type

text

type of employee ['Mid-Level Manager', 'Senior Manager', 'Non-Manager', 'Supervisor', 'First-Line Manager', 'Director']

first-name

first-name

First name of Employee

last-name

last-name

Last name Employee

primary-asset

target-machine

Asset tag of the primary asset assigned to employee

text

text

A description of the person or identity.

userid

target-user

EMployee user identification

exploit-poc

Exploit-poc object describing a proof of concept or exploit of a vulnerability. This object has often a relationship with a vulnerability object.

exploit-poc is a MISP object available in JSON format at this location The JSON format can be freely reused in your application or automatically enabled in MISP.
Object attribute MISP attribute type Description Disable correlation Multiple

author

text

Author of the exploit - proof of concept

description

text

Description of the exploit - proof of concept

poc

attachment

Proof of Concept or exploit (as a script, binary or described process)

references

link

External references

vulnerable_configuration

text

The vulnerable configuration described in CPE format where the exploit/proof of concept is valid

facebook-account

Facebook account.

facebook-account is a MISP object available in JSON format at this location The JSON format can be freely reused in your application or automatically enabled in MISP.
Object attribute MISP attribute type Description Disable correlation Multiple

account-id

text

Account id.

account-name

text

Account name.

archive

link

Archive of the account (Internet Archive, Archive.is, etc).

attachment

attachment

A screen capture or exported list of contacts etc.

description

text

A description of the user.

link

link

Original link to the page (supposed harmless).

url

url

Original URL location of the page (potentially malicious).

user-avatar

attachment

A user profile picture or avatar.

facebook-group

Public or private facebook group.

facebook-group is a MISP object available in JSON format at this location The JSON format can be freely reused in your application or automatically enabled in MISP.
Object attribute MISP attribute type Description Disable correlation Multiple

administrator

text

A user account who is an owner or admin of the group.

archive

link

Archive of the original group (Internet Archive, Archive.is, etc).

attachment

attachment

A screen capture or exported list of contacts, group members, etc.

creator

text

The user account that created the group.

description

text

A description of the group, channel or community.

embedded-link

url

Link embedded in the group description (potentially malicious).

embedded-safe-link

link

Link embedded in the group description (supposed safe).

group-alias

text

Aliases or previous names of group.

group-name

text

The name of the group, channel or community.

group-type

text

Facebook group type, e.g. general, buy and sell etc.

hashtag

text

Hashtag used to identify or promote the group.

link

link

Original link to the group (supposed harmless).

privacy

text

Group privacy: public, closed, secret. ['Public', 'Closed', 'Secret']

url

url

Original URL location of the group (potentially malicious).

facebook-page

Facebook page.

facebook-page is a MISP object available in JSON format at this location The JSON format can be freely reused in your application or automatically enabled in MISP.
Object attribute MISP attribute type Description Disable correlation Multiple

archive

link

Archive of the original page (Internet Archive, Archive.is, etc).

attachment

attachment

A screen capture or exported list of contacts, page members, etc.

contact-detail

url

Contact url listed on about page.

creator

text

The user account that created the page.

description

text

A description of the page.

embedded-link

url

Link embedded in the page description (potentially malicious).

embedded-safe-link

link

Link embedded in the page description (supposed safe).

event

text

Event announcement on page.

hashtag

text

Hashtag used to identify or promote the page.

link

link

Original link to the page (supposed harmless).

page-alias

text

Aliases or previous names of page.

page-id

text

Page id (without the @).

page-name

text

The name of the page.

page-type

text

Facebook page type, e.g. community, product etc.

related-page-id

text

id of a page listed as related to this one (without the @).

related-page-name

text

name of a page listed as related to this one.

team-member

text

A user account who is a member of the page.

url

url

Original URL location of the page (potentially malicious).

facebook-post

Post on a Facebook wall.

facebook-post is a MISP object available in JSON format at this location The JSON format can be freely reused in your application or automatically enabled in MISP.
Object attribute MISP attribute type Description Disable correlation Multiple

archive

link

Archive of the original document (Internet Archive, Archive.is, etc).

attachment

attachment

The facebook post file or screen capture.

embedded-link

url

Link in the facebook post

embedded-safe-link

link

Safe link in the facebook post

hashtag

text

Hashtag embedded in the facebook post

in-reply-to-display-name

text

The user display name of the facebook this post shares.

in-reply-to-status-id

text

The facebook ID of the post that this post shares.

in-reply-to-user-id

text

The user ID of the facebook this post shares.

language

text

The language of the post.

link

link

Original link to the facebook post (supposed harmless).

post

text

Raw text of the post.

post-id

text

The facebook post id.

post-location

text

id of the group, page or wall the post was posted to.

removal-date

datetime

When the facebook post was removed.

url

url

Original URL of the facebook post, e.g. link shortener (potentially malicious).

user-id

text

Id of the account who posted.

user-name

text

Display name of the account who posted.

username

text

Username who posted the facebook post

username-quoted

text

Username who is quoted in the facebook post.

facial-composite

An object which describes a facial composite.

facial-composite is a MISP object available in JSON format at this location The JSON format can be freely reused in your application or automatically enabled in MISP.
Object attribute MISP attribute type Description Disable correlation Multiple

facial-composite

attachment

Facial composite image.

technique

text

Construction technique of the facial composite. ['E-FIT', 'PROfit', 'Sketch', 'Photofit', 'EvoFIT', 'PortraitPad']

text

text

A description of the facial composite.

fail2ban

Fail2ban event.

fail2ban is a MISP object available in JSON format at this location The JSON format can be freely reused in your application or automatically enabled in MISP.
Object attribute MISP attribute type Description Disable correlation Multiple

attack-type

text

Type of the attack

banned-ip

ip-src

IP Address banned by fail2ban

failures

counter

Amount of failures that lead to the ban.

logfile

attachment

Full logfile related to the attack.

logline

text

Example log line that caused the ban.

processing-timestamp

datetime

Timestamp of the report

sensor

text

Identifier of the sensor

victim

text

Identifier of the victim

favicon

A favicon, also known as a shortcut icon, website icon, tab icon, URL icon, or bookmark icon, is a file containing one or more small icons, associated with a particular website or web page. The object template can include the murmur3 hash of the favicon to facilitate correlation.

favicon is a MISP object available in JSON format at this location The JSON format can be freely reused in your application or automatically enabled in MISP.
Object attribute MISP attribute type Description Disable correlation Multiple

favicon

attachment

The raw favicon file.

favicon-mmh3

favicon-mmh3

favicon-mmh3 is the murmur3 hash of a favicon as used in Shodan.

link

link

The original link where the favicon was seen.

file

File object describing a file with meta-information.

file is a MISP object available in JSON format at this location The JSON format can be freely reused in your application or automatically enabled in MISP.
Object attribute MISP attribute type Description Disable correlation Multiple

attachment

attachment

A non-malicious file.

authentihash

authentihash

Authenticode executable signature hash

certificate

x509-fingerprint-sha1

Certificate value if the binary is signed with another authentication scheme than authenticode

compilation-timestamp

datetime

Compilation timestamp

entropy

float

Entropy of the whole file

file-encoding

text

Encoding format of the file ['Adobe-Standard-Encoding', 'Adobe-Symbol-Encoding', 'Amiga-1251', 'ANSI_X3.110-1983', 'ASMO_449', 'Big5', 'Big5-HKSCS', 'BOCU-1', 'BRF', 'BS_4730', 'BS_viewdata', 'CESU-8', 'CP50220', 'CP51932', 'CSA_Z243.4-1985-1', 'CSA_Z243.4-1985-2', 'CSA_Z243.4-1985-gr', 'CSN_369103', 'DEC-MCS', 'DIN_66003', 'dk-us', 'DS_2089', 'EBCDIC-AT-DE', 'EBCDIC-AT-DE-A', 'EBCDIC-CA-FR', 'EBCDIC-DK-NO', 'EBCDIC-DK-NO-A', 'EBCDIC-ES', 'EBCDIC-ES-A', 'EBCDIC-ES-S', 'EBCDIC-FI-SE', 'EBCDIC-FI-SE-A', 'EBCDIC-FR', 'EBCDIC-IT', 'EBCDIC-PT', 'EBCDIC-UK', 'EBCDIC-US', 'ECMA-cyrillic', 'ES', 'ES2', 'EUC-KR', 'Extended_UNIX_Code_Fixed_Width_for_Japanese', 'Extended_UNIX_Code_Packed_Format_for_Japanese', 'GB18030', 'GB_1988-80', 'GB2312', 'GB_2312-80', 'GBK', 'GOST_19768-74', 'greek7', 'greek7-old', 'greek-ccitt', 'HP-DeskTop', 'HP-Legal', 'HP-Math8', 'HP-Pi-font', 'hp-roman8', 'HZ-GB-2312', 'IBM00858', 'IBM00924', 'IBM01140', 'IBM01141', 'IBM01142', 'IBM01143', 'IBM01144', 'IBM01145', 'IBM01146', 'IBM01147', 'IBM01148', 'IBM01149', 'IBM037', 'IBM038', 'IBM1026', 'IBM1047', 'IBM273', 'IBM274', 'IBM275', 'IBM277', 'IBM278', 'IBM280', 'IBM281', 'IBM284', 'IBM285', 'IBM290', 'IBM297', 'IBM420', 'IBM423', 'IBM424', 'IBM437', 'IBM500', 'IBM775', 'IBM850', 'IBM851', 'IBM852', 'IBM855', 'IBM857', 'IBM860', 'IBM861', 'IBM862', 'IBM863', 'IBM864', 'IBM865', 'IBM866', 'IBM868', 'IBM869', 'IBM870', 'IBM871', 'IBM880', 'IBM891', 'IBM903', 'IBM904', 'IBM905', 'IBM918', 'IBM-Symbols', 'IBM-Thai', 'IEC_P27-1', 'INIS', 'INIS-8', 'INIS-cyrillic', 'INVARIANT', 'ISO_10367-box', 'ISO-10646-J-1', 'ISO-10646-UCS-2', 'ISO-10646-UCS-4', 'ISO-10646-UCS-Basic', 'ISO-10646-Unicode-Latin1', 'ISO-10646-UTF-1', 'ISO-11548-1', 'ISO-2022-CN', 'ISO-2022-CN-EXT', 'ISO-2022-JP', 'ISO-2022-JP-2', 'ISO-2022-KR', 'ISO_2033-1983', 'ISO_5427', 'ISO_5427:1981', 'ISO_5428:1980', 'ISO_646.basic:1983', 'ISO_646.irv:1983', 'ISO_6937-2-25', 'ISO_6937-2-add', 'ISO-8859-10', 'ISO_8859-1:1987', 'ISO-8859-13', 'ISO-8859-14', 'ISO-8859-15', 'ISO-8859-16', 'ISO-8859-1-Windows-3.0-Latin-1', 'ISO-8859-1-Windows-3.1-Latin-1', 'ISO_8859-2:1987', 'ISO-8859-2-Windows-Latin-2', 'ISO_8859-3:1988', 'ISO_8859-4:1988', 'ISO_8859-5:1988', 'ISO_8859-6:1987', 'ISO_8859-6-E', 'ISO_8859-6-I', 'ISO_8859-7:1987', 'ISO_8859-8:1988', 'ISO_8859-8-E', 'ISO_8859-8-I', 'ISO_8859-9:1989', 'ISO-8859-9-Windows-Latin-5', 'ISO_8859-supp', 'iso-ir-90', 'ISO-Unicode-IBM-1261', 'ISO-Unicode-IBM-1264', 'ISO-Unicode-IBM-1265', 'ISO-Unicode-IBM-1268', 'ISO-Unicode-IBM-1276', 'IT', 'JIS_C6220-1969-jp', 'JIS_C6220-1969-ro', 'JIS_C6226-1978', 'JIS_C6226-1983', 'JIS_C6229-1984-a', 'JIS_C6229-1984-b', 'JIS_C6229-1984-b-add', 'JIS_C6229-1984-hand', 'JIS_C6229-1984-hand-add', 'JIS_C6229-1984-kana', 'JIS_Encoding', 'JIS_X0201', 'JIS_X0212-1990', 'JUS_I.B1.002', 'JUS_I.B1.003-mac', 'JUS_I.B1.003-serb', 'KOI7-switched', 'KOI8-R', 'KOI8-U', 'KS_C_5601-1987', 'KSC5636', 'KZ-1048', 'latin-greek', 'Latin-greek-1', 'latin-lap', 'macintosh', 'Microsoft-Publishing', 'MNEM', 'MNEMONIC', 'MSZ_7795.3', 'Name', 'NATS-DANO', 'NATS-DANO-ADD', 'NATS-SEFI', 'NATS-SEFI-ADD', 'NC_NC00-10:81', 'NF_Z_62-010', 'NF_Z_62-010_(1973)', 'NS_4551-1', 'NS_4551-2', 'OSD_EBCDIC_DF03_IRV', 'OSD_EBCDIC_DF04_1', 'OSD_EBCDIC_DF04_15', 'PC8-Danish-Norwegian', 'PC8-Turkish', 'PT', 'PT2', 'PTCP154', 'SCSU', 'SEN_850200_B', 'SEN_850200_C', 'Shift_JIS', 'T.101-G2', 'T.61-7bit', 'T.61-8bit', 'TIS-620', 'TSCII', 'UNICODE-1-1', 'UNICODE-1-1-UTF-7', 'UNKNOWN-8BIT', 'US-ASCII', 'us-dk', 'UTF-16', 'UTF-16BE', 'UTF-16LE', 'UTF-32', 'UTF-32BE', 'UTF-32LE', 'UTF-7', 'UTF-8', 'Ventura-International', 'Ventura-Math', 'Ventura-US', 'videotex-suppl', 'VIQR', 'VISCII', 'windows-1250', 'windows-1251', 'windows-1252', 'windows-1253', 'windows-1254', 'windows-1255', 'windows-1256', 'windows-1257', 'windows-1258', 'Windows-31J', 'windows-874']

filename

filename

Filename on disk

fullpath

text

Complete path of the filename including the filename

imphash

imphash

Hash (md5) calculated from the PE import table

malware-sample

malware-sample

The file itself (binary)

md5

md5

[Insecure] MD5 hash (128 bits)

mimetype

mime-type

Mime type

path

text

Path of the filename complete or partial

pattern-in-file

pattern-in-file

Pattern that can be found in the file

sha1

sha1

[Insecure] Secure Hash Algorithm 1 (160 bits)

sha224

sha224

Secure Hash Algorithm 2 (224 bits)

sha256

sha256

Secure Hash Algorithm 2 (256 bits)

sha3-224

sha3-224

Secure Hash Algorithm 3 (224 bits)

sha3-256

sha3-256

Secure Hash Algorithm 3 (256 bits)

sha3-384

sha3-384

Secure Hash Algorithm 3 (384 bits)

sha3-512

sha3-512

Secure Hash Algorithm 3 (512 bits)

sha384

sha384

Secure Hash Algorithm 2 (384 bits)

sha512

sha512

Secure Hash Algorithm 2 (512 bits)

sha512/224

sha512/224

Secure Hash Algorithm 2 (224 bits)

sha512/256

sha512/256

Secure Hash Algorithm 2 (256 bits)

size-in-bytes

size-in-bytes

Size of the file, in bytes

ssdeep

ssdeep

Fuzzy hash using context triggered piecewise hashes (CTPH)

state

text

State of the file ['Malicious', 'Harmless', 'Signed', 'Revoked', 'Expired', 'Trusted']

telfhash

telfhash

telfhash - Symbol hash for ELF files.

text

text

Free text value to attach to the file

tlsh

tlsh

Fuzzy hash by Trend Micro: Locality Sensitive Hash

vhash

vhash

vhash by VirusTotal

forensic-case

An object template to describe a digital forensic case.

forensic-case is a MISP object available in JSON format at this location The JSON format can be freely reused in your application or automatically enabled in MISP.
Object attribute MISP attribute type Description Disable correlation Multiple

additional-comments

text

Comments.

analysis-start-date

datetime

Date when the analysis began.

case-name

text

Name to address the case.

case-number

text

Any unique number assigned to the case for unique identification.

name-of-the-analyst

text

Name(s) of the analyst assigned to the case.

references

link

External references

forensic-evidence

An object template to describe a digital forensic evidence.

forensic-evidence is a MISP object available in JSON format at this location The JSON format can be freely reused in your application or automatically enabled in MISP.
Object attribute MISP attribute type Description Disable correlation Multiple

acquisition-method

text

Method used for acquisition of the evidence. ['Live acquisition', 'Dead/Offline acquisition', 'Physical collection', 'Logical collection', 'File system extraction', 'Chip-off', 'Other']

acquisition-tools

text

Tools used for acquisition of the evidence. ['dd', 'dc3dd', 'dcfldd', 'EnCase', 'FTK Imager', 'FDAS', 'TrueBack', 'Guymager', 'IXimager', 'Other']

additional-comments

text

Comments.

case-number

text

A unique number assigned to the case for unique identification.

evidence-number

text

A unique number assigned to the evidence for unique identification.

name

text

Name of the evidence acquired.

references

link

External references

type

text

Evidence type. ['Computer', 'Network', 'Mobile Device', 'Multimedia', 'Cloud', 'IoT', 'Other']

forged-document

Object describing a forged document.

forged-document is a MISP object available in JSON format at this location The JSON format can be freely reused in your application or automatically enabled in MISP.
Object attribute MISP attribute type Description Disable correlation Multiple

archive

link

Archive of the original document (Internet Archive, Archive.is, etc).

attachment

attachment

The forged document file.

document-name

text

Title of the document.

document-text

text

Raw text of document

document-type

text

The type of document (not the file type). ['email', 'letterhead', 'speech', 'literature', 'blog', 'microblog', 'photo', 'audio', 'invoice', 'receipt', 'other']

first-seen

datetime

When the document has been accessible or seen for the first time.

last-seen

datetime

When the document has been accessible or seen for the last time.

link

link

Original link into the document (Supposed harmless)

objective

text

Objective of the forged document. ['Disinformation', 'Advertising', 'Parody', 'Other']

purpose-of-document

text

What the document is used for. ['Identification', 'Travel', 'Health', 'Legal', 'Financial', 'Government', 'Military', 'Media', 'Communication', 'Other']

url

url

Original URL location of the document (potentially malicious)

ftm-Airplane

.

ftm-Airplane is a MISP object available in JSON format at this location The JSON format can be freely reused in your application or automatically enabled in MISP.
Object attribute MISP attribute type Description Disable correlation Multiple

address

text

Address

alephUrl

url

Aleph URL

alias

text

Other name

amount

float

Amount

amountEur

float

Amount in EUR

amountUsd

float

Amount in USD

buildDate

text

Build Date

country

text

Country

currency

text

Currency

description

text

Description

icaoCode

text

ICAO aircraft type designator

indexText

text

Index text

indexUpdatedAt

text

Index updated at

keywords

text

Keywords

manufacturer

text

Manufacturer

model

text

Model

modifiedAt

text

Modified on

name

text

Name

notes

text

Notes

previousName

text

Previous name

program

text

Program

publisher

text

Publishing source

publisherUrl

url

Publishing source URL

registrationDate

text

Registration Date

registrationNumber

text

Registration Number

retrievedAt

text

Retrieved on

serialNumber

text

Serial Number

sourceUrl

url

Source link

summary

text

Summary

topics

text

Topics

type

text

Type

weakAlias

text

Weak alias

wikidataId

text

Wikidata ID

wikipediaUrl

url

Wikipedia Article

ftm-Assessment

.

ftm-Assessment is a MISP object available in JSON format at this location The JSON format can be freely reused in your application or automatically enabled in MISP.
Object attribute MISP attribute type Description Disable correlation Multiple

address

text

Address

alephUrl

url

Aleph URL

alias

text

Other name

assessmentId

text

Assessment ID

country

text

Country

description

text

Description

indexText

text

Index text

indexUpdatedAt

text

Index updated at

keywords

text

Keywords

modifiedAt

text

Modified on

name

text

Name

notes

text

Notes

previousName

text

Previous name

program

text

Program

publishDate

text

Date of publishing

publisher

text

Publishing source

publisherUrl

url

Publishing source URL

retrievedAt

text

Retrieved on

sourceUrl

url

Source link

summary

text

Summary

topics

text

Topics

weakAlias

text

Weak alias

wikidataId

text

Wikidata ID

wikipediaUrl

url

Wikipedia Article

ftm-Asset

.

ftm-Asset is a MISP object available in JSON format at this location The JSON format can be freely reused in your application or automatically enabled in MISP.
Object attribute MISP attribute type Description Disable correlation Multiple

address

text

Address

alephUrl

url

Aleph URL

alias

text

Other name

amount

float

Amount

amountEur

float

Amount in EUR

amountUsd

float

Amount in USD

country

text

Country

currency

text

Currency

description

text

Description

indexText

text

Index text

indexUpdatedAt

text

Index updated at

keywords

text

Keywords

modifiedAt

text

Modified on

name

text

Name

notes

text

Notes

previousName

text

Previous name

program

text

Program

publisher

text

Publishing source

publisherUrl

url

Publishing source URL

retrievedAt

text

Retrieved on

sourceUrl

url

Source link

summary

text

Summary

topics

text

Topics

weakAlias

text

Weak alias

wikidataId

text

Wikidata ID

wikipediaUrl

url

Wikipedia Article

ftm-Associate

Non-family association between two people.

ftm-Associate is a MISP object available in JSON format at this location The JSON format can be freely reused in your application or automatically enabled in MISP.
Object attribute MISP attribute type Description Disable correlation Multiple

alephUrl

url

Aleph URL

date

text

Date

description

text

Description

endDate

text

End date

indexText

text

Index text

modifiedAt

text

Modified on

publisher

text

Publishing source

publisherUrl

url

Publishing source URL

recordId

text

Record ID

relationship

text

Nature of the association

retrievedAt

text

Retrieved on

sourceUrl

url

Source URL

startDate

text

Start date

summary

text

Summary

ftm-Audio

.

ftm-Audio is a MISP object available in JSON format at this location The JSON format can be freely reused in your application or automatically enabled in MISP.
Object attribute MISP attribute type Description Disable correlation Multiple

address

text

Address

alephUrl

url

Aleph URL

alias

text

Other name

author

text

The original author, not the uploader

authoredAt

text

Authored on

companiesMentioned

text

Detected companies

contentHash

sha1

SHA1 hash of the data

country

text

Country

crawler

text

The crawler used to acquire this file

date

text

If not otherwise specified

description

text

Description

detectedCountry

text

Detected country

detectedLanguage

text

Detected language

duration

float

Duration of the audio in ms

emailMentioned

email-src

Detected e-mail addresses

encoding

text

File encoding

extension

text

File extension

fileName

text

File name

fileSize

float

File size

generator

text

The program used to generate this file

ibanMentioned

iban

Detected IBANs

indexText

text

Index text

indexUpdatedAt

text

Index updated at

ipMentioned

ip-src

Detected IP addresses

keywords

text

Keywords

language

text

Language

locationMentioned

text

Detected locations

messageId

text

Message ID of a document; unique in most cases

mimeType

mime-type

MIME type

modifiedAt

text

Modified on

name

text

Name

namesMentioned

text

Detected names

notes

text

Notes

peopleMentioned

text

Detected people

phoneMentioned

phone-number

Detected phones

previousName

text

Previous name

processingError

text

Processing error

processingStatus

text

Processing status

program

text

Program

publishedAt

text

Published on

publisher

text

Publishing source

publisherUrl

url

Publishing source URL

retrievedAt

text

Retrieved on

samplingRate

float

Sampling rate of the audio in Hz

sourceUrl

url

Source link

summary

text

Summary

title

text

Title

topics

text

Topics

weakAlias

text

Weak alias

wikidataId

text

Wikidata ID

wikipediaUrl

url

Wikipedia Article

ftm-BankAccount

.

ftm-BankAccount is a MISP object available in JSON format at this location The JSON format can be freely reused in your application or automatically enabled in MISP.
Object attribute MISP attribute type Description Disable correlation Multiple

accountNumber

text

Account Number

accountType

text

Account Type

address

text

Address

alephUrl

url

Aleph URL

alias

text

Other name

amount

float

Amount

amountEur

float

Amount in EUR

amountUsd

float

Amount in USD

balance

float

Balance

bankAddress

text

Bank Address

bankName

text

Bank Name

bic

text

Bank Identifier Code

country

text

Country

currency

text

Currency

description

text

Description

iban

iban

IBAN

indexText

text

Index text

indexUpdatedAt

text

Index updated at

keywords

text

Keywords

modifiedAt

text

Modified on

name

text

Name

notes

text

Notes

previousName

text

Previous name

program

text

Program

publisher

text

Publishing source

publisherUrl

url

Publishing source URL

retrievedAt

text

Retrieved on

sourceUrl

url

Source link

summary

text

Summary

topics

text

Topics

weakAlias

text

Weak alias

wikidataId

text

Wikidata ID

wikipediaUrl

url

Wikipedia Article

ftm-Call

.

ftm-Call is a MISP object available in JSON format at this location The JSON format can be freely reused in your application or automatically enabled in MISP.
Object attribute MISP attribute type Description Disable correlation Multiple

alephUrl

url

Aleph URL

callerNumber

phone-number

Caller’s Number

date

text

Date

description

text

Description

duration

float

Call Duration in seconds

endDate

text

End date

indexText

text

Index text

modifiedAt

text

Modified on

publisher

text

Publishing source

publisherUrl

url

Publishing source URL

receiverNumber

phone-number

Receiver’s Number

recordId

text

Record ID

retrievedAt

text

Retrieved on

sourceUrl

url

Source URL

startDate

text

Start date

summary

text

Summary

ftm-Company

.

ftm-Company is a MISP object available in JSON format at this location The JSON format can be freely reused in your application or automatically enabled in MISP.
Object attribute MISP attribute type Description Disable correlation Multiple

address

text

Address

alephUrl

url

Aleph URL

alias

text

Other name

amount

float

Amount

amountEur

float

Amount in EUR

amountUsd

float

Amount in USD

bikCode

text

Russian bank account code

bvdId

text

Bureau van Dijk ID

caemCode

text

(RO) What kind of activity a legal entity is allowed to develop

capital

text

Capital

cikCode

text

US SEC Central Index Key

classification

text

Classification

coatoCode

text

COATO / SOATO / OKATO

country

text

Country

currency

text

Currency

description

text

Description

dissolutionDate

text

The date the legal entity was dissolved, if applicable

dunsCode

text

Dun & Bradstreet identifier

email

email-src

Email address

fnsCode

text

(RU, ФНС) Federal Tax Service related info

fssCode

text

(RU, ФСС) Social Security

ibcRuc

text

ibcRUC

icijId

text

ID according to International Consortium for Investigative Journalists

idNumber

text

ID number of any applicable ID

incorporationDate

text

The date the legal entity was incorporated

indexText

text

Index text

indexUpdatedAt

text

Index updated at

innCode

text

Russian company ID

ipoCode

text

IPO

irsCode

text

US tax ID

jibCode

text

Yugoslavia company ID

jurisdiction

text

Jurisdiction

keywords

text

Keywords

kppCode

text

(RU, КПП) in addition to INN for orgs; reason for registration at FNS

legalForm

text

Legal form

mainCountry

text

Primary country of this entity

mbsCode

text

MBS

modifiedAt

text

Modified on

name

text

Name

notes

text

Notes

ogrnCode

text

Major State Registration Number

okopfCode

text

(RU, ОКОПФ) What kind of business entity

okpoCode

text

Russian industry classifier

oksmCode

text

Russian (ОКСМ) countries classifer

okvedCode

text

(RU, ОКВЭД) Economical activity classifier. OKVED2 is the same but newer

opencorporatesUrl

url

OpenCorporates URL

pfrNumber

text

(RU, ПФР) Pension Fund Registration number. AAA-BBB-CCCCCC, where AAA is organisation region, BBB is district, CCCCCC number at a specific branch

phone

phone-number

Phone number

previousName

text

Previous name

program

text

Program

publisher

text

Publishing source

publisherUrl

url

Publishing source URL

registrationNumber

text

Registration number

retrievedAt

text

Retrieved on

sector

text

Sector

sourceUrl

url

Source link

status

text

Status

summary

text

Summary

swiftBic

text

Bank identifier code

taxNumber

text

Tax identification number

taxStatus

text

Tax status

topics

text

Topics

vatCode

text

(EU) VAT number

voenCode

text

Azerbaijan taxpayer ID

weakAlias

text

Weak alias

website

url

Website address

wikidataId

text

Wikidata ID

wikipediaUrl

url

Wikipedia Article

ftm-Contract

An contract or contract lot issued by an authority. Multiple lots may be awarded to different suppliers (see ContractAward). .

ftm-Contract is a MISP object available in JSON format at this location The JSON format can be freely reused in your application or automatically enabled in MISP.
Object attribute MISP attribute type Description Disable correlation Multiple

address

text

Address

alephUrl

url

Aleph URL

alias

text

Other name

amount

float

Amount

amountEur

float

Amount in EUR

amountUsd

float

Amount in USD

cancelled

text

Cancelled?

classification

text

Classification

contractDate

text

Contract date

country

text

Country

criteria

text

Contract award criteria

currency

text

Currency

description

text

Description

indexText

text

Index text

indexUpdatedAt

text

Index updated at

keywords

text

Keywords

language

text

Language

method

text

Procurement method

modifiedAt

text

Modified on

name

text

Contract name

notes

text

Notes

noticeId

text

Contract Award Notice ID

numberAwards

text

Number of awards

previousName

text

Previous name

procedure

text

Contract procedure

procedureNumber

text

Procedure number

program

text

Program

publisher

text

Publishing source

publisherUrl

url

Publishing source URL

retrievedAt

text

Retrieved on

sourceUrl

url

Source link

status

text

Procurement status

summary

text

Summary

title

text

Contract title

topics

text

Topics

type

text

Type of contract. Potentially W (Works), U (Supplies), S (Services).

weakAlias

text

Weak alias

wikidataId

text

Wikidata ID

wikipediaUrl

url

Wikipedia Article

ftm-ContractAward

A contract or contract lot as awarded to a supplier.

ftm-ContractAward is a MISP object available in JSON format at this location The JSON format can be freely reused in your application or automatically enabled in MISP.
Object attribute MISP attribute type Description Disable correlation Multiple

alephUrl

url

Aleph URL

amended

text

Was this award amended, modified or updated by a subsequent document?

amount

float

Amount

amountEur

float

Amount in EUR

amountUsd

float

Amount in USD

cpvCode

text

Contract Procurement Vocabulary (what type of goods/services, EU)

currency

text

Currency

date

text

Date

decisionReason

text

Decision reason

description

text

Description

documentNumber

text

Document number

documentType

text

Document type

endDate

text

End date

indexText

text

Index text

lotNumber

text

Lot number

modifiedAt

text

Modified on

nutsCode

text

Nomencalture of Territorial Units for Statistics (NUTS)

publisher

text

Publishing source

publisherUrl

url

Publishing source URL

recordId

text

Record ID

retrievedAt

text

Retrieved on

role

text

Role

sourceUrl

url

Source URL

startDate

text

Start date

status

text

Status

summary

text

Summary

ftm-CourtCase

.

ftm-CourtCase is a MISP object available in JSON format at this location The JSON format can be freely reused in your application or automatically enabled in MISP.
Object attribute MISP attribute type Description Disable correlation Multiple

address

text

Address

alephUrl

url

Aleph URL

alias

text

Other name

caseNumber

text

Case number

category

text

Category

closeDate

text

Close date

country

text

Country

court

text

Court

description

text

Description

fileDate

text

File date

indexText

text

Index text

indexUpdatedAt

text

Index updated at

keywords

text

Keywords

modifiedAt

text

Modified on

name

text

Name

notes

text

Notes

previousName

text

Previous name

program

text

Program

publisher

text

Publishing source

publisherUrl

url

Publishing source URL

retrievedAt

text

Retrieved on

sourceUrl

url

Source link

status

text

Status

summary

text

Summary

topics

text

Topics

type

text

Type

weakAlias

text

Weak alias

wikidataId

text

Wikidata ID

wikipediaUrl

url

Wikipedia Article

ftm-CourtCaseParty

.

ftm-CourtCaseParty is a MISP object available in JSON format at this location The JSON format can be freely reused in your application or automatically enabled in MISP.
Object attribute MISP attribute type Description Disable correlation Multiple

alephUrl

url

Aleph URL

date

text

Date

description

text

Description

endDate

text

End date

indexText

text

Index text

modifiedAt

text

Modified on

publisher

text

Publishing source

publisherUrl

url

Publishing source URL

recordId

text

Record ID

retrievedAt

text

Retrieved on

role

text

Role

sourceUrl

url

Source URL

startDate

text

Start date

status

text

Status

summary

text

Summary

ftm-Debt

A monetary debt between two parties.

ftm-Debt is a MISP object available in JSON format at this location The JSON format can be freely reused in your application or automatically enabled in MISP.
Object attribute MISP attribute type Description Disable correlation Multiple

alephUrl

url

Aleph URL

amount

float

Amount

amountEur

float

Amount in EUR

amountUsd

float

Amount in USD

currency

text

Currency

date

text

Date

description

text

Description

endDate

text

End date

indexText

text

Index text

modifiedAt

text

Modified on

publisher

text

Publishing source

publisherUrl

url

Publishing source URL

recordId

text

Record ID

retrievedAt

text

Retrieved on

sourceUrl

url

Source URL

startDate

text

Start date

summary

text

Summary

ftm-Directorship

.

ftm-Directorship is a MISP object available in JSON format at this location The JSON format can be freely reused in your application or automatically enabled in MISP.
Object attribute MISP attribute type Description Disable correlation Multiple

alephUrl

url

Aleph URL

date

text

Date

description

text

Description

endDate

text

End date

indexText

text

Index text

modifiedAt

text

Modified on

publisher

text

Publishing source

publisherUrl

url

Publishing source URL

recordId

text

Record ID

retrievedAt

text

Retrieved on

role

text

Role

secretary

text

Secretary

sourceUrl

url

Source URL

startDate

text

Start date

status

text

Status

summary

text

Summary

ftm-Document

.

ftm-Document is a MISP object available in JSON format at this location The JSON format can be freely reused in your application or automatically enabled in MISP.
Object attribute MISP attribute type Description Disable correlation Multiple

address

text

Address

alephUrl

url

Aleph URL

alias

text

Other name

author

text

The original author, not the uploader

authoredAt

text

Authored on

companiesMentioned

text

Detected companies

contentHash

sha1

SHA1 hash of the data

country

text

Country

crawler

text

The crawler used to acquire this file

date

text

If not otherwise specified

description

text

Description

detectedCountry

text

Detected country

detectedLanguage

text

Detected language

emailMentioned

email-src

Detected e-mail addresses

encoding

text

File encoding

extension

text

File extension

fileName

text

File name

fileSize

float

File size

generator

text

The program used to generate this file

ibanMentioned

iban

Detected IBANs

indexText

text

Index text

indexUpdatedAt

text

Index updated at

ipMentioned

ip-src

Detected IP addresses

keywords

text

Keywords

language

text

Language

locationMentioned

text

Detected locations

messageId

text

Message ID of a document; unique in most cases

mimeType

mime-type

MIME type

modifiedAt

text

Modified on

name

text

Name

namesMentioned

text

Detected names

notes

text

Notes

peopleMentioned

text

Detected people

phoneMentioned

phone-number

Detected phones

previousName

text

Previous name

processingError

text

Processing error

processingStatus

text

Processing status

program

text

Program

publishedAt

text

Published on

publisher

text

Publishing source

publisherUrl

url

Publishing source URL

retrievedAt

text

Retrieved on

sourceUrl

url

Source link

summary

text

Summary

title

text

Title

topics

text

Topics

weakAlias

text

Weak alias

wikidataId

text

Wikidata ID

wikipediaUrl

url

Wikipedia Article

ftm-Documentation

.

ftm-Documentation is a MISP object available in JSON format at this location The JSON format can be freely reused in your application or automatically enabled in MISP.
Object attribute MISP attribute type Description Disable correlation Multiple

alephUrl

url

Aleph URL

date

text

Date

description

text

Description

endDate

text

End date

indexText

text

Index text

modifiedAt

text

Modified on

publisher

text

Publishing source

publisherUrl

url

Publishing source URL

recordId

text

Record ID

retrievedAt

text

Retrieved on

role

text

Role

sourceUrl

url

Source URL

startDate

text

Start date

status

text

Status

summary

text

Summary

ftm-EconomicActivity

A foreign economic activity.

ftm-EconomicActivity is a MISP object available in JSON format at this location The JSON format can be freely reused in your application or automatically enabled in MISP.
Object attribute MISP attribute type Description Disable correlation Multiple

alephUrl

url

Aleph URL

ccdNumber

text

Customs Cargo Declaration Number

ccdValue

text

Declaration Value

customsAmount

text

Customs Value of goods

customsProcedure

text

Customs Procedure — type of customs clearance

date

text

Date

departureCountry

text

Country out of which the goods are transported

description

text

Description

destinationCountry

text

Final destination for the goods

directionOfTransportation

text

Direction of transportation (import/export)

dollarExchRate

text

USD Exchange Rate for the activity

endDate

text

End date

goodsDescription

text

Description of goods

indexText

text

Index text

invoiceAmount

text

Invoice Value of goods

modifiedAt

text

Modified on

originCountry

text

Country of origin of goods

publisher

text

Publishing source

publisherUrl

url

Publishing source URL

recordId

text

Record ID

retrievedAt

text

Retrieved on

sourceUrl

url

Source URL

startDate

text

Start date

summary

text

Summary

tradingCountry

text

Trading Country of the company which transports the goods via Russian border

vedCode

text

(Код ТН ВЭД) Foreign Economic Activity Commodity Code

vedCodeDescription

text

(Описание кода ТН ВЭД) Foreign Economic Activity Commodity Code description

ftm-Email

.

ftm-Email is a MISP object available in JSON format at this location The JSON format can be freely reused in your application or automatically enabled in MISP.
Object attribute MISP attribute type Description Disable correlation Multiple

address

text

Address

alephUrl

url

Aleph URL

alias

text

Other name

author

text

The original author, not the uploader

authoredAt

text

Authored on

bcc

text

Blind carbon copy

bodyHtml

text

HTML

bodyText

text

Text

cc

text

Carbon copy

companiesMentioned

text

Detected companies

contentHash

sha1

SHA1 hash of the data

country

text

Country

crawler

text

The crawler used to acquire this file

date

text

If not otherwise specified

description

text

Description

detectedCountry

text

Detected country

detectedLanguage

text

Detected language

emailMentioned

email-src

Detected e-mail addresses

encoding

text

File encoding

extension

text

File extension

fileName

text

File name

fileSize

float

File size

from

text

From

generator

text

The program used to generate this file

headers

text

Raw headers

ibanMentioned

iban

Detected IBANs

inReplyTo

text

Message ID of the preceding email in the thread

indexText

text

Index text

indexUpdatedAt

text

Index updated at

ipMentioned

ip-src

Detected IP addresses

keywords

text

Keywords

language

text

Language

locationMentioned

text

Detected locations

messageId

text

Message ID of a document; unique in most cases

mimeType

mime-type

MIME type

modifiedAt

text

Modified on

name

text

Name

namesMentioned

text

Detected names

notes

text

Notes

peopleMentioned

text

Detected people

phoneMentioned

phone-number

Detected phones

previousName

text

Previous name

processingError

text

Processing error

processingStatus

text

Processing status

program

text

Program

publishedAt

text

Published on

publisher

text

Publishing source

publisherUrl

url

Publishing source URL

retrievedAt

text

Retrieved on

sender

text

Sender

sourceUrl

url

Source link

subject

text

Subject

summary

text

Summary

threadTopic

text

Thread topic

title

text

Title

to

text

To

topics

text

Topics

weakAlias

text

Weak alias

wikidataId

text

Wikidata ID

wikipediaUrl

url

Wikipedia Article

ftm-Event

.

ftm-Event is a MISP object available in JSON format at this location The JSON format can be freely reused in your application or automatically enabled in MISP.
Object attribute MISP attribute type Description Disable correlation Multiple

address

text

Address

alephUrl

url

Aleph URL

alias

text

Other name

companiesMentioned

text

Detected companies

country

text

Country

date

text

Date

description

text

Description

detectedCountry

text

Detected country

detectedLanguage

text

Detected language

emailMentioned

email-src

Detected e-mail addresses

endDate

text

End date

ibanMentioned

iban

Detected IBANs

important

text

Important

indexText

text

Index text

indexUpdatedAt

text

Index updated at

ipMentioned

ip-src

Detected IP addresses

keywords

text

Keywords

location

text

Location

locationMentioned

text

Detected locations

modifiedAt

text

Modified on

name

text

Name

namesMentioned

text

Detected names

notes

text

Notes

peopleMentioned

text

Detected people

phoneMentioned

phone-number

Detected phones

previousName

text

Previous name

program

text

Program

publisher

text

Publishing source

publisherUrl

url

Publishing source URL

recordId

text

Record ID

retrievedAt

text

Retrieved on

sourceUrl

url

Source link

startDate

text

Start date

summary

text

Summary

topics

text

Topics

weakAlias

text

Weak alias

wikidataId

text

Wikidata ID

wikipediaUrl

url

Wikipedia Article

ftm-Family

Family relationship between two people.

ftm-Family is a MISP object available in JSON format at this location The JSON format can be freely reused in your application or automatically enabled in MISP.
Object attribute MISP attribute type Description Disable correlation Multiple

alephUrl

url

Aleph URL

date

text

Date

description

text

Description

endDate

text

End date

indexText

text

Index text

modifiedAt

text

Modified on

publisher

text

Publishing source

publisherUrl

url

Publishing source URL

recordId

text

Record ID

relationship

text

Nature of the relationship, from the person’s perspective eg. 'mother', where 'relative' is mother of 'person'.

retrievedAt

text

Retrieved on

sourceUrl

url

Source URL

startDate

text

Start date

summary

text

Summary

ftm-Folder

.

ftm-Folder is a MISP object available in JSON format at this location The JSON format can be freely reused in your application or automatically enabled in MISP.
Object attribute MISP attribute type Description Disable correlation Multiple

address

text

Address

alephUrl

url

Aleph URL

alias

text

Other name

author

text

The original author, not the uploader

authoredAt

text

Authored on

companiesMentioned

text

Detected companies

contentHash

sha1

SHA1 hash of the data

country

text

Country

crawler

text

The crawler used to acquire this file

date

text

If not otherwise specified

description

text

Description

detectedCountry

text

Detected country

detectedLanguage

text

Detected language

emailMentioned

email-src

Detected e-mail addresses

encoding

text

File encoding

extension

text

File extension

fileName

text

File name

fileSize

float

File size

generator

text

The program used to generate this file

ibanMentioned

iban

Detected IBANs

indexText

text

Index text

indexUpdatedAt

text

Index updated at

ipMentioned

ip-src

Detected IP addresses

keywords

text

Keywords

language

text

Language

locationMentioned

text

Detected locations

messageId

text

Message ID of a document; unique in most cases

mimeType

mime-type

MIME type

modifiedAt

text

Modified on

name

text

Name

namesMentioned

text

Detected names

notes

text

Notes

peopleMentioned

text

Detected people

phoneMentioned

phone-number

Detected phones

previousName

text

Previous name

processingError

text

Processing error

processingStatus

text

Processing status

program

text

Program

publishedAt

text

Published on

publisher

text

Publishing source

publisherUrl

url

Publishing source URL

retrievedAt

text

Retrieved on

sourceUrl

url

Source link

summary

text

Summary

title

text

Title

topics

text

Topics

weakAlias

text

Weak alias

wikidataId

text

Wikidata ID

wikipediaUrl

url

Wikipedia Article

ftm-HyperText

.

ftm-HyperText is a MISP object available in JSON format at this location The JSON format can be freely reused in your application or automatically enabled in MISP.
Object attribute MISP attribute type Description Disable correlation Multiple

address

text

Address

alephUrl

url

Aleph URL

alias

text

Other name

author

text

The original author, not the uploader

authoredAt

text

Authored on

bodyHtml

text

HTML

bodyText

text

Text

companiesMentioned

text

Detected companies

contentHash

sha1

SHA1 hash of the data

country

text

Country

crawler

text

The crawler used to acquire this file

date

text

If not otherwise specified

description

text

Description

detectedCountry

text

Detected country

detectedLanguage

text

Detected language

emailMentioned

email-src

Detected e-mail addresses

encoding

text

File encoding

extension

text

File extension

fileName

text

File name

fileSize

float

File size

generator

text

The program used to generate this file

ibanMentioned

iban

Detected IBANs

indexText

text

Index text

indexUpdatedAt

text

Index updated at

ipMentioned

ip-src

Detected IP addresses

keywords

text

Keywords

language

text

Language

locationMentioned

text

Detected locations

messageId

text

Message ID of a document; unique in most cases

mimeType

mime-type

MIME type

modifiedAt

text

Modified on

name

text

Name

namesMentioned

text

Detected names

notes

text

Notes

peopleMentioned

text

Detected people

phoneMentioned

phone-number

Detected phones

previousName

text

Previous name

processingError

text

Processing error

processingStatus

text

Processing status

program

text

Program

publishedAt

text

Published on

publisher

text

Publishing source

publisherUrl

url

Publishing source URL

retrievedAt

text

Retrieved on

sourceUrl

url

Source link

summary

text

Summary

title