Skip to content

Commit 86930fb

Browse files
niraj-crestniraj-crest
committed
Add fields.yml to pass system test
1 parent 5b9647f commit 86930fb

20 files changed

+5280
-0
lines changed

‎packages/ti_google_threat_intelligence/elasticsearch/transform/domain_ioc/fields/linux_fields.yml‎

Lines changed: 264 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,264 @@
1+
- name: gti
2+
type: group
3+
fields:
4+
- name: linux
5+
type: group
6+
fields:
7+
- name: attributes
8+
type: group
9+
fields:
10+
- name: as_owner
11+
type: keyword
12+
description: The owner of the autonomous system to which the IP belongs.
13+
- name: as_number
14+
type: long
15+
description: The autonomous system number to which the IP belongs.
16+
- name: categories
17+
type: keyword
18+
description: Categories based on the predefined criteria.
19+
- name: continent
20+
type: keyword
21+
description: The continent where the IP is placed (ISO-3166 continent code).
22+
- name: country
23+
type: keyword
24+
description: The country where the IP is placed (ISO-3166 country code).
25+
- name: creation_date
26+
type: date
27+
description: The date when the IOC was created.
28+
- name: first_submission_date
29+
type: date
30+
description: The UTC timestamp of the date when the URL was first submitted to Google Threat Intelligence.
31+
- name: gti_assessment
32+
type: group
33+
fields:
34+
- name: severity
35+
type: keyword
36+
description: The threat severity level.
37+
- name: threat_score
38+
type: long
39+
description: The Google Threat Intelligence score is a function of the verdict and severity, and leverages additional internal factors to generate the score.
40+
- name: verdict
41+
type: keyword
42+
description: Indicates the assessed threat verdict, which can be benign, undetected, suspicious, malicious, or unknown.
43+
- name: jarm
44+
type: keyword
45+
description: A JARM hash representing the entity's TLS fingerprint, used for identifying and classifying servers.
46+
- name: last_analysis_date
47+
type: date
48+
description: The most recent scan date.
49+
- name: last_analysis_results
50+
type: group
51+
fields:
52+
- name: engine
53+
type: keyword
54+
description: The name of the security engine that performed the analysis.
55+
- name: result
56+
type: keyword
57+
description: The outcome of the analysis performed by the security engine.
58+
- name: last_analysis_stats
59+
type: group
60+
fields:
61+
- name: harmless
62+
type: long
63+
description: Number of reports saying that is harmless.
64+
- name: malicious
65+
type: long
66+
description: Number of reports saying that is malicious.
67+
- name: suspicious
68+
type: long
69+
description: Number of reports saying that is suspicious.
70+
- name: timeout
71+
type: long
72+
description: Number of reports saying that is timeout.
73+
- name: undetected
74+
type: long
75+
description: Number of reports saying that is undetected.
76+
- name: last_final_url
77+
type: keyword
78+
description: The URL if the original URL redirects, where does it end.
79+
- name: last_http_response_code
80+
type: long
81+
description: The HTTP response code of the last response.
82+
- name: last_modification_date
83+
type: date
84+
description: The date when the object itself was last modified.
85+
- name: last_submission_date
86+
type: date
87+
description: The most recent date the entity was submitted for analysis.
88+
- name: md5
89+
type: keyword
90+
description: The file's MD5 hash.
91+
- name: meaningful_name
92+
type: keyword
93+
description: The most interesting name out of all file's names.
94+
- name: names
95+
type: keyword
96+
description: All file names associated with the file.
97+
- name: network
98+
type: keyword
99+
description: The IPv4 network range to which the IP belongs.
100+
- name: outgoing_links
101+
type: keyword
102+
description: Containing links to different domains.
103+
- name: positives
104+
type: long
105+
description: The number of security engines that flagged the entity as malicious.
106+
- name: regional_internet_registry
107+
type: keyword
108+
description: One of the current RIRs.
109+
- name: tags
110+
type: keyword
111+
description: A list of representative attributes.
112+
- name: times_submitted
113+
type: long
114+
description: The number of times the entity has been submitted for analysis.
115+
- name: title
116+
type: keyword
117+
description: The webpage title.
118+
- name: top_level_domain
119+
type: keyword
120+
description: The highest level of the domain name (e.g., .com, .org).
121+
- name: type_tags
122+
type: keyword
123+
description: The broader tags related to the specific file type.
124+
- name: url
125+
type: keyword
126+
description: The original URL to be scanned.
127+
- name: vhash
128+
type: keyword
129+
description: An in-house similarity clustering algorithm value, based on a simple structural feature hash allows you to find similar files.
130+
- name: id
131+
type: keyword
132+
description: The unique ID associated with the entity.
133+
- name: relationships
134+
type: group
135+
fields:
136+
- name: campaigns
137+
type: group
138+
fields:
139+
- name: attributes
140+
type: group
141+
fields:
142+
- name: collection_type
143+
type: keyword
144+
description: Identifies the type of the object.
145+
- name: name
146+
type: keyword
147+
description: Campaign's name.
148+
- name: id
149+
type: keyword
150+
description: The unique identifier associated with a specific relationship entry.
151+
- name: type
152+
type: keyword
153+
description: The category of relationship.
154+
- name: collections
155+
type: group
156+
fields:
157+
- name: attributes
158+
type: group
159+
fields:
160+
- name: collection_type
161+
type: keyword
162+
description: Identifies the type of the object.
163+
- name: name
164+
type: keyword
165+
description: Collection's name.
166+
- name: id
167+
type: keyword
168+
description: Unique identifier for the collection grouping related entities.
169+
- name: type
170+
type: keyword
171+
description: The category of relationship.
172+
- name: malware_families
173+
type: group
174+
fields:
175+
- name: attributes
176+
type: group
177+
fields:
178+
- name: collection_type
179+
type: keyword
180+
description: Identifies the type of the object.
181+
- name: name
182+
type: keyword
183+
description: Malware family's name.
184+
- name: id
185+
type: keyword
186+
description: Unique identifier for the malware family associated with the entity.
187+
- name: type
188+
type: keyword
189+
description: The category of relationship.
190+
- name: reports
191+
type: group
192+
fields:
193+
- name: attributes
194+
type: group
195+
fields:
196+
- name: collection_type
197+
type: keyword
198+
description: Identifies the type of the object.
199+
- name: name
200+
type: keyword
201+
description: Report's title.
202+
- name: id
203+
type: keyword
204+
description: Unique identifier for the report detailing the entity's analysis.
205+
- name: type
206+
type: keyword
207+
description: The category of relationship.
208+
- name: software_toolkits
209+
type: group
210+
fields:
211+
- name: attributes
212+
type: group
213+
fields:
214+
- name: collection_type
215+
type: keyword
216+
description: Identifies the type of the object.
217+
- name: name
218+
type: keyword
219+
description: Software or toolkit's name.
220+
- name: id
221+
type: keyword
222+
description: Unique identifier for the software or toolkit associated with the entity.
223+
- name: type
224+
type: keyword
225+
description: The category of relationship.
226+
- name: threat_actors
227+
type: group
228+
fields:
229+
- name: attributes
230+
type: group
231+
fields:
232+
- name: collection_type
233+
type: keyword
234+
description: Identifies the type of the object.
235+
- name: name
236+
type: keyword
237+
description: Threat actor's name.
238+
- name: id
239+
type: keyword
240+
description: Unique identifier for the threat actor associated with the entity.
241+
- name: type
242+
type: keyword
243+
description: The category of relationship.
244+
- name: vulnerabilities
245+
type: group
246+
fields:
247+
- name: attributes
248+
type: group
249+
fields:
250+
- name: collection_type
251+
type: keyword
252+
description: Identifies the type of the object.
253+
- name: name
254+
type: keyword
255+
description: Vulnerability's name.
256+
- name: id
257+
type: keyword
258+
description: Unique identifier for the vulnerability associated with the entity.
259+
- name: type
260+
type: keyword
261+
description: The category of relationship.
262+
- name: type
263+
type: keyword
264+
description: Specifies the nature of the entity, such as file, domain, IP, or URL.

0 commit comments

Comments
 (0)