{
    "type": "bundle",
    "id": "bundle--588dc8e3-8530-4b69-b71c-45ab02de0b81",
    "objects": [
        {
            "type": "identity",
            "spec_version": "2.1",
            "id": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-01-29T11:16:29.000Z",
            "modified": "2017-01-29T11:16:29.000Z",
            "name": "CIRCL",
            "identity_class": "organization"
        },
        {
            "type": "report",
            "spec_version": "2.1",
            "id": "report--588dc8e3-8530-4b69-b71c-45ab02de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-01-29T11:16:29.000Z",
            "modified": "2017-01-29T11:16:29.000Z",
            "name": "OSINT - Spotlight on Shamoon",
            "published": "2017-01-29T11:17:08Z",
            "object_refs": [
                "observed-data--588dc908-c720-44cd-ac77-48ba02de0b81",
                "url--588dc908-c720-44cd-ac77-48ba02de0b81",
                "x-misp-attribute--588dc921-8708-4d83-bd8d-427c02de0b81",
                "indicator--588dc968-bb78-4c41-96f1-408b02de0b81",
                "indicator--588dc969-8bdc-486c-9926-418a02de0b81",
                "x-misp-attribute--588dcc50-9730-4404-8bf4-433e02de0b81",
                "indicator--588dcdf5-4d30-4209-a9dc-42da02de0b81",
                "indicator--588dcdf6-29fc-40c5-8cb4-49f602de0b81",
                "indicator--588dcdf7-80bc-40f7-9b7b-4cf802de0b81",
                "indicator--588dcdf7-d8e4-4c84-a739-4a5702de0b81",
                "indicator--588dce3e-8374-40a5-8022-4b9302de0b81",
                "indicator--588dce3f-ac54-47f8-8b58-460b02de0b81",
                "observed-data--588dce40-8284-43bc-9271-480b02de0b81",
                "url--588dce40-8284-43bc-9271-480b02de0b81",
                "indicator--588dce40-69b4-44af-a9c6-4cee02de0b81",
                "indicator--588dce41-08fc-43e9-a174-4f7302de0b81",
                "observed-data--588dce42-8154-46d5-8412-447f02de0b81",
                "url--588dce42-8154-46d5-8412-447f02de0b81",
                "indicator--588dce43-c0f0-4c74-b4ef-4a9702de0b81",
                "indicator--588dce43-d4d8-4cc6-9df0-42af02de0b81",
                "observed-data--588dce44-56e4-463c-af1d-422402de0b81",
                "url--588dce44-56e4-463c-af1d-422402de0b81",
                "x-misp-attribute--588dce8a-7690-4918-9ab5-4b9302de0b81",
                "x-misp-attribute--588dce8b-51a0-4787-85a9-490802de0b81",
                "x-misp-attribute--588dce8c-fc80-44b6-bd92-41b502de0b81",
                "observed-data--588dcf0d-7bac-4f3c-aae3-40a602de0b81",
                "network-traffic--588dcf0d-7bac-4f3c-aae3-40a602de0b81",
                "ipv4-addr--588dcf0d-7bac-4f3c-aae3-40a602de0b81"
            ],
            "labels": [
                "Threat-Report",
                "misp:tool=\"MISP-STIX-Converter\"",
                "osint:source-type=\"blog-post\"",
                "misp-galaxy:tool=\"Shamoon\""
            ],
            "object_marking_refs": [
                "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
            ]
        },
        {
            "type": "observed-data",
            "spec_version": "2.1",
            "id": "observed-data--588dc908-c720-44cd-ac77-48ba02de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-01-29T11:16:06.000Z",
            "modified": "2017-01-29T11:16:06.000Z",
            "first_observed": "2017-01-29T11:16:06Z",
            "last_observed": "2017-01-29T11:16:06Z",
            "number_observed": 1,
            "object_refs": [
                "url--588dc908-c720-44cd-ac77-48ba02de0b81"
            ],
            "labels": [
                "misp:type=\"link\"",
                "misp:category=\"External analysis\"",
                "osint:source-type=\"blog-post\"",
                "admiralty-scale:source-reliability=\"b\""
            ]
        },
        {
            "type": "url",
            "spec_version": "2.1",
            "id": "url--588dc908-c720-44cd-ac77-48ba02de0b81",
            "value": "https://securingtomorrow.mcafee.com/mcafee-labs/spotlight-on-shamoon/"
        },
        {
            "type": "x-misp-attribute",
            "spec_version": "2.1",
            "id": "x-misp-attribute--588dc921-8708-4d83-bd8d-427c02de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-01-29T10:51:13.000Z",
            "modified": "2017-01-29T10:51:13.000Z",
            "labels": [
                "misp:type=\"text\"",
                "misp:category=\"External analysis\""
            ],
            "x_misp_category": "External analysis",
            "x_misp_type": "text",
            "x_misp_value": "All of the initial analysis pointed to Shamoon emerging in the Middle East.  There were a number of similarities that we highlighted in our earlier blogs (on McAfee.com). This however was not the end of the story since the campaign continues to target organizations in the Middle East from a variety of verticals. Indeed reports suggested that a further 15 \u00e2\u20ac\u02dcShamoon incidents\u00e2\u20ac\u2122 had been reported from public to private sector."
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--588dc968-bb78-4c41-96f1-408b02de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-01-29T10:52:24.000Z",
            "modified": "2017-01-29T10:52:24.000Z",
            "description": "hash 146a112cb01cd4b8e06d36304f6bdf7b and bf4b07c7b4a4504c4192bd68476d63b5 were connecting to this site",
            "pattern": "[domain-name:value = 'winappupdater.com']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-01-29T10:52:24Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"domain\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--588dc969-8bdc-486c-9926-418a02de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-01-29T10:52:25.000Z",
            "modified": "2017-01-29T10:52:25.000Z",
            "description": "hash 146a112cb01cd4b8e06d36304f6bdf7b and bf4b07c7b4a4504c4192bd68476d63b5 were connecting to this site",
            "pattern": "[domain-name:value = 'update.winupdater.com']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-01-29T10:52:25Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"hostname\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "x-misp-attribute",
            "spec_version": "2.1",
            "id": "x-misp-attribute--588dcc50-9730-4404-8bf4-433e02de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-01-29T11:04:48.000Z",
            "modified": "2017-01-29T11:04:48.000Z",
            "labels": [
                "misp:type=\"whois-registrant-email\"",
                "misp:category=\"Attribution\"",
                "misp:to_ids=\"True\""
            ],
            "x_misp_category": "Attribution",
            "x_misp_comment": "winappupdater.com domain registered on 2016-11-25 by benyamin987@mail.com",
            "x_misp_type": "whois-registrant-email",
            "x_misp_value": "benyamin987@mail.com"
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--588dcdf5-4d30-4209-a9dc-42da02de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-01-29T11:11:49.000Z",
            "modified": "2017-01-29T11:11:49.000Z",
            "pattern": "[file:hashes.MD5 = '146a112cb01cd4b8e06d36304f6bdf7b']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-01-29T11:11:49Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"md5\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--588dcdf6-29fc-40c5-8cb4-49f602de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-01-29T11:11:50.000Z",
            "modified": "2017-01-29T11:11:50.000Z",
            "pattern": "[file:hashes.MD5 = 'bf4b07c7b4a4504c4192bd68476d63b5']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-01-29T11:11:50Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"md5\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--588dcdf7-80bc-40f7-9b7b-4cf802de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-01-29T11:11:51.000Z",
            "modified": "2017-01-29T11:11:51.000Z",
            "pattern": "[file:hashes.MD5 = 'a96d211795852b6b14e61327bbcc3473']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-01-29T11:11:51Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"md5\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--588dcdf7-d8e4-4c84-a739-4a5702de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-01-29T11:11:51.000Z",
            "modified": "2017-01-29T11:11:51.000Z",
            "pattern": "[file:hashes.SHA1 = '1507a4fdf65952dfa439e32480f42ccf1460b96f']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-01-29T11:11:51Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"sha1\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--588dce3e-8374-40a5-8022-4b9302de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-01-29T11:13:02.000Z",
            "modified": "2017-01-29T11:13:02.000Z",
            "description": "- Xchecked via VT: a96d211795852b6b14e61327bbcc3473",
            "pattern": "[file:hashes.SHA256 = '6b28a43eda5b6f828a65574e3f08a6d00e0acf84cbb94aac5cec5cd448a4649d']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-01-29T11:13:02Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"sha256\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--588dce3f-ac54-47f8-8b58-460b02de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-01-29T11:13:03.000Z",
            "modified": "2017-01-29T11:13:03.000Z",
            "description": "- Xchecked via VT: a96d211795852b6b14e61327bbcc3473",
            "pattern": "[file:hashes.SHA1 = '4c85c5062ece9aec26b6bf6a785ec7e60c824b0b']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-01-29T11:13:03Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"sha1\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "observed-data",
            "spec_version": "2.1",
            "id": "observed-data--588dce40-8284-43bc-9271-480b02de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-01-29T11:13:04.000Z",
            "modified": "2017-01-29T11:13:04.000Z",
            "first_observed": "2017-01-29T11:13:04Z",
            "last_observed": "2017-01-29T11:13:04Z",
            "number_observed": 1,
            "object_refs": [
                "url--588dce40-8284-43bc-9271-480b02de0b81"
            ],
            "labels": [
                "misp:type=\"link\"",
                "misp:category=\"External analysis\""
            ]
        },
        {
            "type": "url",
            "spec_version": "2.1",
            "id": "url--588dce40-8284-43bc-9271-480b02de0b81",
            "value": "https://www.virustotal.com/file/6b28a43eda5b6f828a65574e3f08a6d00e0acf84cbb94aac5cec5cd448a4649d/analysis/1485493393/"
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--588dce40-69b4-44af-a9c6-4cee02de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-01-29T11:13:04.000Z",
            "modified": "2017-01-29T11:13:04.000Z",
            "description": "- Xchecked via VT: bf4b07c7b4a4504c4192bd68476d63b5",
            "pattern": "[file:hashes.SHA256 = '7f16824e7ad9ee1ad2debca2a22413cde08f02ee9f0d08d64eb4cb318538be9c']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-01-29T11:13:04Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"sha256\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--588dce41-08fc-43e9-a174-4f7302de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-01-29T11:13:05.000Z",
            "modified": "2017-01-29T11:13:05.000Z",
            "description": "- Xchecked via VT: bf4b07c7b4a4504c4192bd68476d63b5",
            "pattern": "[file:hashes.SHA1 = 'd843a65ad0e3c2f2fd87c30c6cb0f6b66d6355d1']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-01-29T11:13:05Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"sha1\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "observed-data",
            "spec_version": "2.1",
            "id": "observed-data--588dce42-8154-46d5-8412-447f02de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-01-29T11:13:06.000Z",
            "modified": "2017-01-29T11:13:06.000Z",
            "first_observed": "2017-01-29T11:13:06Z",
            "last_observed": "2017-01-29T11:13:06Z",
            "number_observed": 1,
            "object_refs": [
                "url--588dce42-8154-46d5-8412-447f02de0b81"
            ],
            "labels": [
                "misp:type=\"link\"",
                "misp:category=\"External analysis\""
            ]
        },
        {
            "type": "url",
            "spec_version": "2.1",
            "id": "url--588dce42-8154-46d5-8412-447f02de0b81",
            "value": "https://www.virustotal.com/file/7f16824e7ad9ee1ad2debca2a22413cde08f02ee9f0d08d64eb4cb318538be9c/analysis/1485493795/"
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--588dce43-c0f0-4c74-b4ef-4a9702de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-01-29T11:13:06.000Z",
            "modified": "2017-01-29T11:13:06.000Z",
            "description": "- Xchecked via VT: 146a112cb01cd4b8e06d36304f6bdf7b",
            "pattern": "[file:hashes.SHA256 = '319a001d09ee9d754e8789116bbb21a3c624c999dae9cf83fde90a3fbe67ee6c']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-01-29T11:13:06Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"sha256\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--588dce43-d4d8-4cc6-9df0-42af02de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-01-29T11:13:07.000Z",
            "modified": "2017-01-29T11:13:07.000Z",
            "description": "- Xchecked via VT: 146a112cb01cd4b8e06d36304f6bdf7b",
            "pattern": "[file:hashes.SHA1 = '0e47a027651133ab980dd040d3347d2028ffd32d']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-01-29T11:13:07Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"sha1\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "observed-data",
            "spec_version": "2.1",
            "id": "observed-data--588dce44-56e4-463c-af1d-422402de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-01-29T11:13:08.000Z",
            "modified": "2017-01-29T11:13:08.000Z",
            "first_observed": "2017-01-29T11:13:08Z",
            "last_observed": "2017-01-29T11:13:08Z",
            "number_observed": 1,
            "object_refs": [
                "url--588dce44-56e4-463c-af1d-422402de0b81"
            ],
            "labels": [
                "misp:type=\"link\"",
                "misp:category=\"External analysis\""
            ]
        },
        {
            "type": "url",
            "spec_version": "2.1",
            "id": "url--588dce44-56e4-463c-af1d-422402de0b81",
            "value": "https://www.virustotal.com/file/319a001d09ee9d754e8789116bbb21a3c624c999dae9cf83fde90a3fbe67ee6c/analysis/1485491896/"
        },
        {
            "type": "x-misp-attribute",
            "spec_version": "2.1",
            "id": "x-misp-attribute--588dce8a-7690-4918-9ab5-4b9302de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-01-29T11:14:18.000Z",
            "modified": "2017-01-29T11:14:18.000Z",
            "labels": [
                "misp:type=\"pdb\"",
                "misp:category=\"Artifacts dropped\"",
                "misp:to_ids=\"True\""
            ],
            "x_misp_category": "Artifacts dropped",
            "x_misp_type": "pdb",
            "x_misp_value": "F:\\Projects\\Bot Fresh\\Release\\Bot Fresh.pdb"
        },
        {
            "type": "x-misp-attribute",
            "spec_version": "2.1",
            "id": "x-misp-attribute--588dce8b-51a0-4787-85a9-490802de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-01-29T11:14:19.000Z",
            "modified": "2017-01-29T11:14:19.000Z",
            "labels": [
                "misp:type=\"pdb\"",
                "misp:category=\"Artifacts dropped\"",
                "misp:to_ids=\"True\""
            ],
            "x_misp_category": "Artifacts dropped",
            "x_misp_type": "pdb",
            "x_misp_value": "F:\\Projects\\Bot\\Bot\\Release\\Ism.pdb"
        },
        {
            "type": "x-misp-attribute",
            "spec_version": "2.1",
            "id": "x-misp-attribute--588dce8c-fc80-44b6-bd92-41b502de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-01-29T11:14:20.000Z",
            "modified": "2017-01-29T11:14:20.000Z",
            "labels": [
                "misp:type=\"pdb\"",
                "misp:category=\"Artifacts dropped\"",
                "misp:to_ids=\"True\""
            ],
            "x_misp_category": "Artifacts dropped",
            "x_misp_type": "pdb",
            "x_misp_value": "G:\\Projects\\Bot\\Bots\\Bot5\\Release\\Ism.pdb"
        },
        {
            "type": "observed-data",
            "spec_version": "2.1",
            "id": "observed-data--588dcf0d-7bac-4f3c-aae3-40a602de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-01-29T11:16:29.000Z",
            "modified": "2017-01-29T11:16:29.000Z",
            "first_observed": "2017-01-29T11:16:29Z",
            "last_observed": "2017-01-29T11:16:29Z",
            "number_observed": 1,
            "object_refs": [
                "network-traffic--588dcf0d-7bac-4f3c-aae3-40a602de0b81",
                "ipv4-addr--588dcf0d-7bac-4f3c-aae3-40a602de0b81"
            ],
            "labels": [
                "misp:type=\"ip-src\"",
                "misp:category=\"Network activity\""
            ]
        },
        {
            "type": "network-traffic",
            "spec_version": "2.1",
            "id": "network-traffic--588dcf0d-7bac-4f3c-aae3-40a602de0b81",
            "src_ref": "ipv4-addr--588dcf0d-7bac-4f3c-aae3-40a602de0b81",
            "protocols": [
                "tcp"
            ]
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--588dcf0d-7bac-4f3c-aae3-40a602de0b81",
            "value": "58.158.177.102"
        },
        {
            "type": "marking-definition",
            "spec_version": "2.1",
            "id": "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9",
            "created": "2017-01-20T00:00:00.000Z",
            "definition_type": "tlp",
            "name": "TLP:WHITE",
            "definition": {
                "tlp": "white"
            }
        }
    ]
}