Skip to content

Add ptrclassify MISP object template #538

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
adulau merged 1 commit into from
Oct 12, 2026
Merged

Add ptrclassify MISP object template #538

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -374,6 +374,7 @@ for a specific attribute. An optional **to_ids** boolean field to disable the ID
- [objects/postal-address](https://github.com/MISP/misp-objects/blob/main/objects/postal-address/definition.json) - A postal address.
- [objects/probabilistic-data-structure](https://github.com/MISP/misp-objects/blob/main/objects/probabilistic-data-structure/definition.json) - Probabilistic data structure object describe a space-efficient data structure such as Bloom filter or similar structure.
- [objects/process](https://github.com/MISP/misp-objects/blob/main/objects/process/definition.json) - Object describing a system process.
- [objects/ptrclassify](https://github.com/MISP/misp-objects/blob/main/objects/ptrclassify/definition.json) - Heuristic classification of one PTR-style hostname, including labels, confidence, evidence, rule IDs and potential location hints. Repeated classification fields are grouped by machine-tag comments; location fields are grouped by rule-ID/code comments. PTR names are operator-controlled and inferred locations are not verified geolocation.
- [objects/publication](https://github.com/MISP/misp-objects/blob/main/objects/publication/definition.json) - An object to describe a book, journal, or academic publication.
- [objects/python-evtx-event-log](https://github.com/MISP/misp-objects/blob/main/objects/python-evtx-event-log/definition.json) - Event log object template to share information of the activities conducted on a system. The object template is mapped with the python-etvx module. https://github.com/williballenthin/python-evtx.
- [objects/query](https://github.com/MISP/misp-objects/blob/main/objects/query/definition.json) - An object describing a query, along with its format.
Expand Down
183 changes: 183 additions & 0 deletions objects/ptrclassify/definition.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,183 @@
{
"attributes": {
"category": {
"description": "Classification category; the attribute comment identifies its classification machine tag.",
"disable_correlation": true,
"misp-attribute": "text",
"multiple": true,
"to_ids": false,
"ui-priority": 1
},
"classification": {
"description": "Full ptrclassify taxonomy machine tag for a matched label. Related classification fields use this tag as their attribute comment.",
"disable_correlation": true,
"misp-attribute": "text",
"multiple": true,
"to_ids": false,
"ui-priority": 1
},
"classification-description": {
"description": "Explanation of a classification; the attribute comment identifies its classification machine tag.",
"disable_correlation": true,
"misp-attribute": "text",
"multiple": true,
"to_ids": false,
"ui-priority": 0
},
"classifier-version": {
"description": "Version of the ptrclassify library used for classification.",
"disable_correlation": true,
"misp-attribute": "text",
"to_ids": false,
"ui-priority": 0
},
"cloud-region": {
"description": "Cloud region inferred from the hostname; not verified geolocation.",
"disable_correlation": true,
"misp-attribute": "text",
"to_ids": false,
"ui-priority": 1
},
"confidence": {
"description": "Classification confidence from 0 to 1; the attribute comment identifies its classification machine tag.",
"disable_correlation": true,
"misp-attribute": "float",
"multiple": true,
"to_ids": false,
"ui-priority": 1
},
"conflict": {
"description": "Conflicting classification labels reported by the classifier.",
"disable_correlation": true,
"misp-attribute": "text",
"multiple": true,
"to_ids": false,
"ui-priority": 1
},
"embedded-ip": {
"description": "IPv4 address found encoded in the hostname.",
"disable_correlation": false,
"misp-attribute": "ip-dst",
"to_ids": false,
"ui-priority": 1
},
"evidence": {
"description": "Matched text supporting a classification; the attribute comment identifies its classification machine tag.",
"disable_correlation": true,
"misp-attribute": "text",
"multiple": true,
"to_ids": false,
"ui-priority": 1
},
"hostname": {
"description": "PTR-style hostname classified by ptrclassify.",
"disable_correlation": false,
"misp-attribute": "hostname",
"to_ids": false,
"ui-priority": 1
},
"ip": {
"description": "Queried IPv4 or IPv6 address used as context for classification.",
"disable_correlation": false,
"misp-attribute": "ip-dst",
"to_ids": false,
"ui-priority": 1
},
"label": {
"description": "Classification label; the attribute comment identifies its classification machine tag.",
"disable_correlation": true,
"misp-attribute": "text",
"multiple": true,
"to_ids": false,
"ui-priority": 1
},
"location-city": {
"description": "Possible city; the attribute comment identifies the candidate by its rule ID and code. Location hints are heuristic, not verified geolocation.",
"disable_correlation": true,
"misp-attribute": "text",
"multiple": true,
"to_ids": false,
"ui-priority": 1
},
"location-code": {
"description": "Original geographic code; the attribute comment identifies the candidate by its rule ID and code. Location hints are heuristic, not verified geolocation.",
"disable_correlation": true,
"misp-attribute": "text",
"multiple": true,
"to_ids": false,
"ui-priority": 1
},
"location-confidence": {
"description": "Location confidence from 0 to 1; the attribute comment identifies the candidate by its rule ID and code. Location hints are heuristic, not verified geolocation.",
"disable_correlation": true,
"misp-attribute": "float",
"multiple": true,
"to_ids": false,
"ui-priority": 1
},
"location-country": {
"description": "Possible ISO 3166-1 alpha-2 country; the attribute comment identifies the candidate by its rule ID and code. Location hints are heuristic, not verified geolocation.",
"disable_correlation": true,
"misp-attribute": "text",
"multiple": true,
"to_ids": false,
"ui-priority": 1
},
"location-description": {
"description": "Explanation and limitations of the location hint; the attribute comment identifies the candidate by its rule ID and code. Location hints are heuristic, not verified geolocation.",
"disable_correlation": true,
"misp-attribute": "text",
"multiple": true,
"to_ids": false,
"ui-priority": 1
},
"location-evidence": {
"description": "Matched text supporting the location; the attribute comment identifies the candidate by its rule ID and code. Location hints are heuristic, not verified geolocation.",
"disable_correlation": true,
"misp-attribute": "text",
"multiple": true,
"to_ids": false,
"ui-priority": 1
},
"location-region": {
"description": "Possible region; the attribute comment identifies the candidate by its rule ID and code. Location hints are heuristic, not verified geolocation.",
"disable_correlation": true,
"misp-attribute": "text",
"multiple": true,
"to_ids": false,
"ui-priority": 1
},
"location-rule-id": {
"description": "Rule producing the location; the attribute comment identifies the candidate by its rule ID and code. Location hints are heuristic, not verified geolocation.",
"disable_correlation": true,
"misp-attribute": "text",
"multiple": true,
"to_ids": false,
"ui-priority": 1
},
"matched": {
"description": "Whether at least one classification label matched this hostname.",
"disable_correlation": true,
"misp-attribute": "boolean",
"to_ids": false,
"ui-priority": 1
},
"rule-id": {
"description": "Rule producing a classification; the attribute comment identifies its classification machine tag.",
"disable_correlation": true,
"misp-attribute": "text",
"multiple": true,
"to_ids": false,
"ui-priority": 1
}
},
"description": "Heuristic classification of one PTR-style hostname, including labels, confidence, evidence, rule IDs and potential location hints. Repeated classification fields are grouped by machine-tag comments; location fields are grouped by rule-ID/code comments. PTR names are operator-controlled and inferred locations are not verified geolocation.",
"meta-category": "network",
"name": "ptrclassify",
"required": [
"hostname",
"matched"
],
"uuid": "da14cf16-0274-4cb2-9b5f-bbe07281ac19",
"version": 1
}
Loading