mirror of https://github.com/MISP/misp-galaxy.git synced 2024-11-22 23:07:19 +00:00

Clusters and elements to attach to MISP events or attributes (like threat actors)

adversaries adversary-groups attack-patternon classification information-exchange malware misp misp-galaxy mitre-adversarial-tactics stix threat-actors threat-hunting threat-intelligence

Find a file

Andras Iklody 66e7d6bdae Merge pull request #1 from rotanid/patch-1 fix small grammatical errors in README.md		2016-02-29 22:25:28 +01:00
cluster	Adversary groups instead of APT	2016-02-29 09:44:21 +01:00
elements	Deleted old APT groups	2016-02-29 09:44:50 +01:00
README.md	fix small grammatical errors in README.md	2016-02-29 22:17:03 +01:00

README.md

misp-galaxy

MISP galaxy is a simple method to express a large object called cluster that can be attached to MISP events or attributes. A cluster can be composed of one or more elements. Elements are expressed as key-values. There are default elements available in MISP galaxy but those can be overwritten, replaced or updated as you wish.

Existing clusters and elements can be used as-is or as a template. MISP distribution can be applied to each cluster to permit a limited or broader distribution scheme.

Available clusters

cluster/threat-actor.json - Threat Actor

Available Elements

elements/adversary-groups.json - Adversary groups - Known or estimated adversary groups targeting organizations and employees. Adversary groups are regularly confused with their initial operation or campaign.
elements/threat-actor-motivation-vocabulary.json - The MotivationVocab is the default STIX vocabulary for expressing the motivation of a threat actor. STIX 1.2.1
elements/threat-actor-intended-effect-vocabulary.json - The IntendedEffectVocab is the default STIX vocabulary for expressing the intended effect of a threat actor. STIX 1.2.1

How to contribute?

Fork the project, update or create elements or clusters and make a pull-request.