Document toolboxDocument toolbox

threatintel.misp

Introduction

The tags beginning with threatintel.misp identify events generated by MISP Threat Sharing belonging to MISP Standard Collaborative Intelligence.

Valid tags and data tables 

The full tag must have at least 3 levels. The first two are fixed as threatintel.misp. The third level identifies the type of events sent and the fourth indicates the event subtypes.

These are the valid tags and corresponding data tables that will receive the parsers' data:

Product / Service

Tags

Data tables

Product / Service

Tags

Data tables

MISP Threat Sharing

threatintel.misp.attributenotifications

threatintel.misp.attributenotifications

threatintel.misp.attributes

threatintel.misp.attributes

threatintel.misp.sighting.attributes

threatintel.misp.sighting.attributes

threatintel.misp.sighting.logs

threatintel.misp.sighting.logs

For more information, read more About Devo tags.

Table structure

These are the fields displayed in these tables:

threatintel.misp.attributenotifications

Field

Type

Extra fields

Field

Type

Extra fields

eventdate

timestamp

 

hostname

str

 

attribute_id

str

 

attribute_event_id

str

 

attribute_object_id

str

 

attribute_object_relation

str

 

attribute_category

str

 

attribute_type

str

 

attribute_value1

str

 

attribute_value2

str

 

attribute_to_ids

bool

 

attribute_uuid

str

 

attribute_timestamp

str

 

attribute_distribution

str

 

attribute_sharing_group_id

str

 

attribute_comment

str

 

attribute_deleted

bool

 

attribute_disable_correlation

bool

 

attribute_value

str

 

attribute_sighting

str

 

event_id

str

 

event_date

str

 

event_info

str

 

event_uuid

str

 

event_published

bool

 

event_analysis

str

 

event_threat_level_id

str

 

event_org_id

str

 

event_ref_orgc_id

str

 

event_distribution

str

 

event_sharing_group_id

str

 

event_orgc_id

str

 

event_orgc_uuid

str

 

event_orgc_name

str

 

action

str

 

hostchain

str

✓

tag

str

✓

rawMessage

str

✓

threatintel.misp.attributes

Field

Type

Field Transformation

Source field name

Extra fields

Field

Type

Field Transformation

Source field name

Extra fields

eventdate

timestamp

 

 

 

hostname

str

 

 

 

attribute_id

str

 

 

 

attribute_event_id

str

 

 

 

attribute_object_id

str

 

 

 

attribute_object_relation

str

 

 

 

attribute_category

str

 

 

 

attribute_type

str

 

 

 

attribute_value1

str

 

 

 

attribute_value2

str

 

 

 

attribute_to_ids

bool

 

 

 

attribute_uuid

str

 

 

 

attribute_timestamp

str

 

 

 

attribute_distribution

str

 

 

 

attribute_sharing_group_id

str

 

 

 

attribute_comment

str

 

 

 

attribute_deleted

bool

 

 

 

attribute_disable_correlation

bool

 

 

 

attribute_value

str

 

 

 

attribute_sighting

str

 

 

 

attribute_tag

str

 

 

 

event_id

str

 

 

 

event_date

str

 

 

 

event_info

str

 

 

 

event_uuid

str

 

 

 

event_published

bool

 

 

 

event_analysis

str

 

 

 

event_threat_level_id

str

 

 

 

event_org_id

str

 

 

 

event_orgc_id

str

 

 

 

event_distribution

str

 

 

 

event_sharing_group_id

str

 

 

 

event_ref_orgc_id

str

 

 

 

event_orgc_uuid

str

 

 

 

event_orgc_name

str

 

 

 

event_tag

str

 

 

 

event_publish_timestamp

str

 

 

 

action

str

 

 

 

object_id

str

 

 

 

object_name

str

 

 

 

object_meta_category

str

 

 

 

object_description

str

 

 

 

object_template_uuid

str

 

 

 

object_template_version

str

 

 

 

object_event_id

str

 

 

 

object_uuid

str

 

 

 

object_timestamp

str

 

 

 

object_distribution

str

 

 

 

object_sharing_group_id

str

 

 

 

object_comment

str

 

 

 

object_deleted

str

 

 

 

object_first_seen

str

 

 

 

object_last_seen

str

 

 

 

eventtags_id_str

str

join(eventtags_id, ',')

eventtags_id

 

eventtags_name_str

str

join(eventtags_name, ',')

eventtags_name

 

eventtags_colour_str

str

join(eventtags_colour, ',')

eventtags_colour

 

eventtags_exportable_str

str

eventtags_exportable

 

eventtags_org_id_str

str

eventtags_org_id

 

eventtags_user_id_str

str

eventtags_user_id

 

eventtags_hide_tag_str

str

eventtags_hide_tag

 

eventtags_numerical_value_str

str

eventtags_numerical_value

 

hostchain

str

 

 

✓

tag

str

 

 

✓

rawMessage

str

 

 

✓

threatintel.misp.sighting.attributes

Field

Type

Extra fields

Field

Type

Extra fields

eventdate

timestamp

 

hostname

str

 

eventdate_instance

str

 

level

str

 

trace

str

 

namespace

str

 

value

ip4

 

first_seen

timestamp

 

last_seen

timestamp

 

consensus

int4

 

count

int4

 

tags

str

 

hostchain

str

✓

tag

str

✓

rawMessage

str

 

threatintel.misp.sighting.logs

Field

Type

Extra fields

Field

Type

Extra fields

eventdate

timestamp

 

hostname

str

 

eventdate_instance

str

 

level

str

 

trace

str

 

message

str

 

hostchain

str

✓

tag

str

✓

rawMessage

str

Â