MISP taxonomy format
draft-dulaunoy-misp-taxonomy-format-05

• Status
• IESG evaluation record
• IESG writeups
• Email expansions
• History

• Versions
• 00
• 01
• 02
• 03
• 04
• 05

Network Working Group                                        A. Dulaunoy
Internet-Draft                                                 A. Iklody
Intended status: Informational                                     CIRCL
Expires: December 3, 2018                                  June 01, 2018

                          MISP taxonomy format
                 draft-dulaunoy-misp-taxonomy-format-05

Abstract

   This document describes the MISP taxonomy format which describes a
   simple JSON format to represent machine tags (also called triple
   tags) vocabularies.  A public directory of common vocabularies MISP
   taxonomies is available and relies on the MISP taxonomy format.  MISP
   taxonomies are used to classify cyber security events, threats or
   indicators.

Status of This Memo

   This Internet-Draft is submitted in full conformance with the
   provisions of BCP 78 and BCP 79.

   Internet-Drafts are working documents of the Internet Engineering
   Task Force (IETF).  Note that other groups may also distribute
   working documents as Internet-Drafts.  The list of current Internet-
   Drafts is at https://datatracker.ietf.org/drafts/current/.

   Internet-Drafts are draft documents valid for a maximum of six months
   and may be updated, replaced, or obsoleted by other documents at any
   time.  It is inappropriate to use Internet-Drafts as reference
   material or to cite them other than as "work in progress."

   This Internet-Draft will expire on December 3, 2018.

Copyright Notice

   Copyright (c) 2018 IETF Trust and the persons identified as the
   document authors.  All rights reserved.

   This document is subject to BCP 78 and the IETF Trust's Legal
   Provisions Relating to IETF Documents
   (https://trustee.ietf.org/license-info) in effect on the date of
   publication of this document.  Please review these documents
   carefully, as they describe your rights and restrictions with respect
   to this document.  Code Components extracted from this document must
   include Simplified BSD License text as described in Section 4.e of

Dulaunoy & Iklody       Expires December 3, 2018                [Page 1]
Internet-Draft            MISP taxonomy format                 June 2018

   the Trust Legal Provisions and are provided without warranty as
   described in the Simplified BSD License.

Table of Contents

   1.  Introduction  . . . . . . . . . . . . . . . . . . . . . . . .   2
     1.1.  Conventions and Terminology . . . . . . . . . . . . . . .   3
   2.  Format  . . . . . . . . . . . . . . . . . . . . . . . . . . .   3
     2.1.  Overview  . . . . . . . . . . . . . . . . . . . . . . . .   3
     2.2.  predicates  . . . . . . . . . . . . . . . . . . . . . . .   4
     2.3.  values  . . . . . . . . . . . . . . . . . . . . . . . . .   4
     2.4.  optional fields . . . . . . . . . . . . . . . . . . . . .   4
       2.4.1.  colour  . . . . . . . . . . . . . . . . . . . . . . .   4
       2.4.2.  description . . . . . . . . . . . . . . . . . . . . .   5
       2.4.3.  numerical_value . . . . . . . . . . . . . . . . . . .   5
   3.  Directory . . . . . . . . . . . . . . . . . . . . . . . . . .   6
     3.1.  Sample Manifest . . . . . . . . . . . . . . . . . . . . .   7
   4.  Sample Taxonomy in MISP taxonomy format . . . . . . . . . . .   7
     4.1.  Admiralty Scale Taxonomy  . . . . . . . . . . . . . . . .   7
     4.2.  Open Source Intelligence - Classification . . . . . . . .   9
   5.  JSON Schema . . . . . . . . . . . . . . . . . . . . . . . . .  11
   6.  Acknowledgements  . . . . . . . . . . . . . . . . . . . . . .  14
   7.  References  . . . . . . . . . . . . . . . . . . . . . . . . .  15
     7.1.  Normative References  . . . . . . . . . . . . . . . . . .  15
     7.2.  Informative References  . . . . . . . . . . . . . . . . .  15
   Authors' Addresses  . . . . . . . . . . . . . . . . . . . . . . .  15

1.  Introduction

   Sharing threat information became a fundamental requirements on the
   Internet, security and intelligence community at large.  Threat
   information can include indicators of compromise, malicious file
   indicators, financial fraud indicators or even detailed information
   about a threat actor.  While sharing such indicators or information,
   classification plays an important role to ensure adequate
   distribution, understanding, validation or action of the shared
   information.  MISP taxonomies is a public repository of known
   vocabularies that can be used in threat information sharing.

   Machine tags were introduced in 2007 [machine-tags] to allow users to
   be more precise when tagging their pictures with geolocation.  So a
   machine tag is a tag which uses a special syntax to provide more
   information to users and machines.  Machine tags are also known as
   triple tags due to their format.

   In the MISP taxonomy context, machine tags help analysts to classify
   their cybersecurity events, indicators or threats.  MISP taxonomies
   can be used for classification, filtering, triggering actions or