diff --git a/README.md b/README.md index 80dd881f..5f107a49 100644 --- a/README.md +++ b/README.md @@ -407,6 +407,7 @@ for a specific attribute. An optional **to_ids** boolean field to disable the ID - [objects/rmm](https://github.com/MISP/misp-objects/blob/main/objects/rmm/definition.json) - An object describing a RMM agent. - [objects/rogue-dns](https://github.com/MISP/misp-objects/blob/main/objects/rogue-dns/definition.json) - Rogue DNS as defined by CERT.br. - [objects/rtir](https://github.com/MISP/misp-objects/blob/main/objects/rtir/definition.json) - RTIR - Request Tracker for Incident Response. +- [objects/rule-validation](https://github.com/MISP/misp-objects/blob/main/objects/rule-validation/definition.json) - Result of the syntax validation of a detection rule (YARA, Sigma, Suricata, Zeek...). - [objects/sandbox-report](https://github.com/MISP/misp-objects/blob/main/objects/sandbox-report/definition.json) - Sandbox report. - [objects/sb-signature](https://github.com/MISP/misp-objects/blob/main/objects/sb-signature/definition.json) - Sandbox detection signature. - [objects/scan-result](https://github.com/MISP/misp-objects/blob/main/objects/scan-result/definition.json) - Scan result object to add meta-data and the output of the scan result by itself. diff --git a/objects/rule-validation/definition.json b/objects/rule-validation/definition.json new file mode 100644 index 00000000..3f118b9d --- /dev/null +++ b/objects/rule-validation/definition.json @@ -0,0 +1,67 @@ +{ + "attributes": { + "error": { + "description": "Syntax error reported by the validator", + "misp-attribute": "text", + "multiple": true, + "ui-priority": 1 + }, + "format": { + "description": "Format of the validated rule", + "misp-attribute": "text", + "sane_default": [ + "yara", + "sigma", + "suricata", + "zeek", + "wazuh", + "nse", + "crs", + "nova", + "splunk", + "elastic", + "sagan", + "kql", + "atr", + "plum", + "kunai" + ], + "ui-priority": 1 + }, + "valid": { + "description": "Whether the rule is syntactically valid", + "misp-attribute": "boolean", + "ui-priority": 1 + }, + "validation-date": { + "description": "Date of the validation", + "misp-attribute": "datetime", + "ui-priority": 0 + }, + "validator": { + "description": "Name of the validator used", + "misp-attribute": "text", + "ui-priority": 0 + }, + "validator-url": { + "description": "URL of the validator instance used", + "misp-attribute": "link", + "ui-priority": 0 + }, + "warning": { + "description": "Warning reported by the validator", + "misp-attribute": "text", + "multiple": true, + "ui-priority": 0 + } + }, + "description": "Result of the syntax validation of a detection rule (YARA, Sigma, Suricata, Zeek...).", + "meta-category": "misc", + "name": "rule-validation", + "required": [ + "format", + "valid" + ], + "uuid": "55712239-ddd6-4235-9848-5f103ebde55b", + "version": 1 +} \ No newline at end of file diff --git a/relationships/definition.json b/relationships/definition.json index eeb5e90a..2e4589ab 100644 --- a/relationships/definition.json +++ b/relationships/definition.json @@ -2418,7 +2418,23 @@ ], "name": "manufactured-by", "opposite": "manufactures" + }, + { + "description": "The source object holds the validation result of the target object (e.g. the syntax validation of a detection rule).", + "format": [ + "misp" + ], + "name": "validates", + "opposite": "validated-by" + }, + { + "description": "The source object is validated by the target object, which holds the validation result.", + "format": [ + "misp" + ], + "name": "validated-by", + "opposite": "validates" } ], - "version": 54 + "version": 55 } \ No newline at end of file