mirror of https://github.com/MISP/misp-galaxy.git synced 2024-11-26 00:37:18 +00:00

Clusters and elements to attach to MISP events or attributes (like threat actors)

adversaries adversary-groups attack-patternon classification information-exchange malware misp misp-galaxy mitre-adversarial-tactics stix threat-actors threat-hunting threat-intelligence

Find a file

Alexandre Dulaunoy 132d8876d3 MISP galaxy screenshot		2016-12-17 10:44:29 +01:00
clusters	Operation Iron Tiger added as synonym	2016-12-17 09:51:13 +01:00
doc/images	MISP galaxy screenshot	2016-12-17 10:44:29 +01:00
galaxies	fix: Naming normalisation	2016-12-07 07:51:27 +01:00
misp	Mapping triples/machine tags with galaxy, clusters and so on	2016-08-12 09:43:26 +02:00
vocabularies	source added as required by MISP 2.4.56	2016-11-27 16:44:43 +01:00
.travis.yml	Add Travis file (validate json files)	2016-04-11 12:49:57 +02:00
README.md	Links fixed	2016-12-10 11:58:37 +01:00

README.md

misp-galaxy

MISP galaxy is a simple method to express a large object called cluster that can be attached to MISP events or attributes. A cluster can be composed of one or more elements. Elements are expressed as key-values. There are default vocabularies available in MISP galaxy but those can be overwritten, replaced or updated as you wish.

Existing clusters and vocabularies can be used as-is or as a template. MISP distribution can be applied to each cluster to permit a limited or broader distribution scheme.

Vocabularies are from existing standards (like STIX, Veris, MISP and so on) or custom ones.

The objective is to have a comment set of clusters for organizations starting analysis but that can be expanded to localized information (which is not shared) or additional information (that can be shared).

Available clusters

clusters/threat-actor.json - Adversary groups - Known or estimated adversary groups targeting organizations and employees. Adversary groups are regularly confused with their initial operation or campaign. MISP
clusters/tool.json - tool is an enumeration of tools used by adversaries. The list includes malware but also common software regularly used by the adversaries. MISP

Available Vocabularies

Common

vocabularies/common/certainty-level.json - Certainty level of an associated element or cluster.

Threat Actor

vocabularies/threat-actor/intended-effect-vocabulary.json - The IntendedEffectVocab is the default STIX vocabulary for expressing the intended effect of a threat actor. STIX 1.2.1
vocabularies/threat-actor/motivation-vocabulary.json - The MotivationVocab is the default STIX vocabulary for expressing the motivation of a threat actor. STIX 1.2.1
vocabularies/threat-actor/planning-and-operational-support-vocabulary.json - The PlanningAndOperationalSupportVocab is the default STIX vocabulary for expressing the planning and operational support functions available to a threat actor.
vocabularies/threat-actor/sophistication.json - The ThreatActorSophisticationVocab enumeration is used to define the default STIX vocabulary for expressing the subjective level of sophistication of a threat actor.
vocabularies/threat-actor/type.json - The ThreatActorTypeVocab enumeration is used to define the default STIX vocabulary for expressing the subjective type of a threat actor.

How to contribute?

Fork the project, update or create elements or clusters and make a pull-request.

We recommend to validate the JSON file using jq before doing a pull-request.

License

MISP galaxy is licensed under CC0 1.0 Universal (CC0 1.0) - Public Domain Dedication.