Skip to content

Commit bdcc375

Browse files
adulauadulau
authored
Merge pull request #472 from MISP/th3r3d-main
Th3r3d main (new detection object - clean-up)
2 parents e5b2fc9 + f615c67 commit bdcc375

File tree

1 file changed

+300
-0
lines changed

1 file changed

+300
-0
lines changed

‎objects/detection/definition.json‎

Lines changed: 300 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,300 @@
1+
{
2+
"attributes": {
3+
"alert-severity-default": {
4+
"description": "(Section 6) The default severity level of the alert.",
5+
"disable_correlation": true,
6+
"misp-attribute": "text",
7+
"ui-priority": 31,
8+
"values_list": [
9+
"Low",
10+
"Medium",
11+
"High",
12+
"Critical"
13+
]
14+
},
15+
"alert-trigger-condition": {
16+
"description": "(Section 6) The condition that triggers the automated playbook (e.g., IF 'detection-logic' RETURNS 'true').",
17+
"misp-attribute": "text",
18+
"ui-priority": 30
19+
},
20+
"analytic-robustness-justification": {
21+
"description": "(Section 3) Justification for the chosen robustness level.",
22+
"misp-attribute": "text",
23+
"ui-priority": 14
24+
},
25+
"analytic-robustness-level": {
26+
"description": "(Section 3) The robustness level of the analytic based on the 'Summiting the Pyramid' model.",
27+
"disable_correlation": true,
28+
"misp-attribute": "text",
29+
"ui-priority": 13,
30+
"values_list": [
31+
"Level 1: Ephemeral",
32+
"Level 2: Core to Adversary-Brought Tool",
33+
"Level 3: Core to Pre-Existing Tool",
34+
"Level 4: Core to Some Implementations of a (Sub-)Technique",
35+
"Level 5: Core to a (Sub-)Technique (Invariant Behavior)"
36+
]
37+
},
38+
"analytic-title": {
39+
"description": "(Section 1) A clear, descriptive title of the detection rule (e.g., 'LSASS Memory Access via OpenProcess').",
40+
"disable_correlation": true,
41+
"misp-attribute": "text",
42+
"ui-priority": 1
43+
},
44+
"author": {
45+
"description": "(Section 1) The name or team responsible for creating/maintaining the analytic.",
46+
"disable_correlation": true,
47+
"misp-attribute": "text",
48+
"ui-priority": 5
49+
},
50+
"d3fend-tactic": {
51+
"description": "(Section 7) The D3FEND Tactic this analytic maps to (e.g., Detect (D3-DET)).",
52+
"disable_correlation": true,
53+
"misp-attribute": "text",
54+
"ui-priority": 40
55+
},
56+
"d3fend-technique": {
57+
"description": "(Section 7) The D3FEND Technique this analytic maps to (e.g., Process Spawn Analysis (D3-PSA)).",
58+
"disable_correlation": true,
59+
"misp-attribute": "text",
60+
"ui-priority": 41
61+
},
62+
"data-event": {
63+
"description": "(Section 3) The specific event(s) required (e.g., Sysmon Event ID 10).",
64+
"disable_correlation": true,
65+
"misp-attribute": "text",
66+
"ui-priority": 17
67+
},
68+
"data-platform": {
69+
"description": "(Section 3) The platform where the data is sourced (e.g., Windows, Linux, Network).",
70+
"disable_correlation": true,
71+
"misp-attribute": "text",
72+
"ui-priority": 15
73+
},
74+
"data-source": {
75+
"description": "(Section 3) The specific data source (e.g., EDR, Sysmon, Zeek).",
76+
"disable_correlation": true,
77+
"misp-attribute": "text",
78+
"ui-priority": 16
79+
},
80+
"date-created": {
81+
"description": "(Section 1) The date the analytic was initially created.",
82+
"disable_correlation": true,
83+
"misp-attribute": "datetime",
84+
"ui-priority": 6
85+
},
86+
"date-modified": {
87+
"description": "(Section 1) The date the analytic was last modified.",
88+
"disable_correlation": true,
89+
"misp-attribute": "datetime",
90+
"ui-priority": 7
91+
},
92+
"description": {
93+
"description": "(Section 2) A brief, high-level summary of the detection's purpose. What threat or behavior is this designed to catch? Why is it important?",
94+
"misp-attribute": "text",
95+
"ui-priority": 8
96+
},
97+
"detection-logic": {
98+
"description": "(Section 4) The detection logic, preferably in the vendor-agnostic SIGMA format. Include heavy commenting to explain the logic.",
99+
"misp-attribute": "sigma",
100+
"ui-priority": 21
101+
},
102+
"event-robustness-column": {
103+
"description": "(Section 3) The robustness of the event source telemetry.",
104+
"disable_correlation": true,
105+
"misp-attribute": "text",
106+
"ui-priority": 18,
107+
"values_list": [
108+
"Host-Based: Application (A)",
109+
"Host-Based: User-Mode (U)",
110+
"Host-Based: Kernel-Mode (K)",
111+
"Network-Based: Protocol Payload (P)",
112+
"Network-Based: Protocol Header (H)"
113+
]
114+
},
115+
"event-robustness-justification": {
116+
"description": "(Section 3) Justification for the chosen event robustness column.",
117+
"misp-attribute": "text",
118+
"ui-priority": 19
119+
},
120+
"exclusion-strategy": {
121+
"description": "(Section 4) The strategy for filtering out false positives. Focus on robust, context-rich attributes.",
122+
"misp-attribute": "text",
123+
"ui-priority": 23
124+
},
125+
"final-summiting-score": {
126+
"description": "(Section 3) The combined robustness score (e.g., 4K, 3U).",
127+
"disable_correlation": true,
128+
"misp-attribute": "text",
129+
"ui-priority": 20
130+
},
131+
"hypothesis": {
132+
"description": "(Section 2) The scientific hypothesis for the detection. E.g., 'We hypothesize that an adversary performing will execute [Procedure]. This can be observed through [Observables]...'",
133+
"misp-attribute": "text",
134+
"ui-priority": 9
135+
},
136+
"id": {
137+
"description": "(Section 1) A unique identifier for tracking the analytic (e.g., DE-TA0006-T1003.001-001).",
138+
"disable_correlation": true,
139+
"misp-attribute": "text",
140+
"ui-priority": 2
141+
},
142+
"investigation-steps": {
143+
"description": "(Section 5) A clear, step-by-step checklist for deeper investigation by a responding analyst.",
144+
"misp-attribute": "text",
145+
"ui-priority": 28
146+
},
147+
"known-false-positives": {
148+
"description": "(Section 4) A list of any legitimate activities or tools that may trigger this alert.",
149+
"misp-attribute": "text",
150+
"ui-priority": 22
151+
},
152+
"mitre-attack-subtechnique": {
153+
"description": "(Section 2) The MITRE ATT&CK Sub-technique(s) this analytic addresses (e.g., 'LSASS Memory (T1003.001)'). Use the attack-pattern object for full mapping.",
154+
"misp-attribute": "text",
155+
"multiple": true,
156+
"ui-priority": 12
157+
},
158+
"mitre-attack-tactic": {
159+
"description": "(Section 2) The MITRE ATT&CK Tactic(s) this analytic addresses (e.g., 'Credential Access (TA0006)'). Use the attack-pattern object for full mapping.",
160+
"misp-attribute": "text",
161+
"multiple": true,
162+
"ui-priority": 10
163+
},
164+
"mitre-attack-technique": {
165+
"description": "(Section 2) The MITRE ATT&CK Technique(s) this analytic addresses (e.g., 'OS Credential Dumping (T1003)'). Use the attack-pattern object for full mapping.",
166+
"misp-attribute": "text",
167+
"multiple": true,
168+
"ui-priority": 11
169+
},
170+
"mitre-engage-approach": {
171+
"description": "(Section 7) The MITRE Engage Approach this analytic uses (e.g., Detect (A0001)).",
172+
"disable_correlation": true,
173+
"misp-attribute": "text",
174+
"ui-priority": 39
175+
},
176+
"mitre-engage-goal": {
177+
"description": "(Section 7) The MITRE Engage Goal this analytic supports (e.g., Disrupt (G0009)).",
178+
"disable_correlation": true,
179+
"misp-attribute": "text",
180+
"ui-priority": 38
181+
},
182+
"response-remediation-steps": {
183+
"description": "(Section 5) Immediate, standard response and remediation actions if the activity is confirmed malicious.",
184+
"misp-attribute": "text",
185+
"ui-priority": 29
186+
},
187+
"soar-step-action": {
188+
"description": "(Section 6) The automated action to perform (e.g., Get-UserDetails, Isolate-Host, Create-Ticket).",
189+
"disable_correlation": true,
190+
"misp-attribute": "text",
191+
"multiple": true,
192+
"ui-priority": 33
193+
},
194+
"soar-step-execute-flag": {
195+
"description": "(Section 6) For containment actions, specifies if execution is automatic (true) or requires manual approval (false). Default should be false.",
196+
"disable_correlation": true,
197+
"misp-attribute": "boolean",
198+
"multiple": true,
199+
"ui-priority": 37
200+
},
201+
"soar-step-input": {
202+
"description": "(Section 6) The entity from the alert used as input for the action (e.g., event.AccountName).",
203+
"disable_correlation": true,
204+
"misp-attribute": "text",
205+
"multiple": true,
206+
"ui-priority": 34
207+
},
208+
"soar-step-output": {
209+
"description": "(Section 6) The new information to be added or the expected result (e.g., user.title, host.os).",
210+
"disable_correlation": true,
211+
"misp-attribute": "text",
212+
"multiple": true,
213+
"ui-priority": 35
214+
},
215+
"soar-step-source-system": {
216+
"description": "(Section 6) The source or destination system for the action (e.g., VirusTotal, Jira, ServiceNow).",
217+
"disable_correlation": true,
218+
"misp-attribute": "text",
219+
"multiple": true,
220+
"ui-priority": 36
221+
},
222+
"soar-step-type": {
223+
"description": "(Section 6) The type of SOAR step (Enrichment, Triage, Containment, Notification). Add one full set of 'soar-step-*' attributes for each logical step.",
224+
"disable_correlation": true,
225+
"misp-attribute": "text",
226+
"multiple": true,
227+
"ui-priority": 32,
228+
"values_list": [
229+
"Enrichment",
230+
"Triage Logic",
231+
"Containment",
232+
"Notification"
233+
]
234+
},
235+
"status": {
236+
"description": "(Section 1) The current maturity status of the analytic.",
237+
"disable_correlation": true,
238+
"misp-attribute": "text",
239+
"ui-priority": 4,
240+
"values_list": [
241+
"Experimental",
242+
"Test",
243+
"Production",
244+
"Deprecated"
245+
]
246+
},
247+
"test-case-result": {
248+
"description": "(Section 5) The result of the validation test.",
249+
"disable_correlation": true,
250+
"misp-attribute": "text",
251+
"multiple": true,
252+
"ui-priority": 26,
253+
"values_list": [
254+
"Detected",
255+
"Not Detected"
256+
]
257+
},
258+
"test-case-tool": {
259+
"description": "(Section 5) The tool or procedure used for the validation test.",
260+
"disable_correlation": true,
261+
"misp-attribute": "text",
262+
"multiple": true,
263+
"ui-priority": 25
264+
},
265+
"test-case-type": {
266+
"description": "(Section 5) The type of validation test performed (e.g., Functional Synonym). Add one set of test-case attributes per test.",
267+
"disable_correlation": true,
268+
"misp-attribute": "text",
269+
"multiple": true,
270+
"ui-priority": 24,
271+
"values_list": [
272+
"Functional Synonym",
273+
"Procedural Synonym",
274+
"Sub-Technical Synonym"
275+
]
276+
},
277+
"triage-steps": {
278+
"description": "(Section 5) A clear, step-by-step checklist for initial triage by a responding analyst.",
279+
"misp-attribute": "text",
280+
"ui-priority": 27
281+
},
282+
"version": {
283+
"description": "(Section 1) The semantic version of the analytic (e.g., 1.0, 1.1, 2.0).",
284+
"disable_correlation": true,
285+
"misp-attribute": "text",
286+
"ui-priority": 3
287+
}
288+
},
289+
"description": "A comprehensive object to document a detection analytic, its logic, robustness, validation, and associated response playbooks. It is based on an advanced detection engineering template that integrates concepts like 'Summiting the Pyramid' for robustness scoring and a 'Funnel of Fidelity' for validation, along with structured SOAR automation steps.",
290+
"meta-category": "misc",
291+
"name": "detection",
292+
"required": [
293+
"analytic-title",
294+
"id",
295+
"status",
296+
"hypothesis"
297+
],
298+
"uuid": "7a6a7c8e-4a44-4b0a-8d2a-9e7f8a9b0c1d",
299+
"version": 2
300+
}

0 commit comments

Comments
 (0)