Liking cljdoc? Tell your friends :D

Verdict Object

Verdict A Verdict is chosen from all of the Judgements on that Observable which have not yet expired. The highest priority Judgement becomes the active verdict. If there is more than one Judgement with that priority, then Clean disposition has priority over all others, then Malicious disposition, and so on down to Unknown.

The ID of a verdict is a a str of the form "observable.type:observable.value" for example, "ip:1.1.1.1"

PropertyTypeDescriptionRequired?
dispositionDispositionNumberInteger
observableObservable Object
typeVerdictTypeIdentifierString
valid_timeValidTime Object
disposition_nameDispositionNameStringThe disposition_name field is optional, but is intended to be shown to a user. Applications must therefore remember the mapping of numbers to human words, as in: {1 "Clean", 2 "Malicious", 3 "Suspicious", 4 "Common", 5 "Unknown"}
judgement_idString

Property disposition ∷ DispositionNumberInteger

  • This entry is required

    • DispositionNumber Numeric verdict identifiers
    • Allowed Values:
      • 1
      • 2
      • 3
      • 4
      • 5

Property disposition_name ∷ DispositionNameString

The disposition_name field is optional, but is intended to be shown to a user. Applications must therefore remember the mapping of numbers to human words, as in: {1 "Clean", 2 "Malicious", 3 "Suspicious", 4 "Common", 5 "Unknown"}

  • This entry is optional

    • DispositionName String verdict identifiers
    • Allowed Values:
      • Clean
      • Common
      • Malicious
      • Suspicious
      • Unknown

Property judgement_id ∷ String

  • This entry is optional

    • A URI leading to a judgement

Property observable ∷ Observable Object

  • This entry is required

Property type ∷ VerdictTypeIdentifierString

  • This entry is required

    • Must equal: "verdict"

Property valid_time ∷ ValidTime Object

  • This entry is required

Observable Object

Observable A simple, atomic value which has a consistent identity, and is stable enough to be attributed an intent or nature. This is the classic 'indicator' which might appear in a data feed of bad IPs, or bad Domains. These do not exist as objects within the CTIA storage model, so you never create an observable.

PropertyTypeDescriptionRequired?
typeObservableTypeIdentifierString
valueString

Property type ∷ ObservableTypeIdentifierString

  • This entry is required

    • ObservableTypeIdentifier Observable type names
    • Allowed Values:
      • amp_computer_guid
      • certificate_common_name
      • certificate_issuer
      • certificate_serial
      • cisco_mid
      • device
      • domain
      • email
      • email_messageid
      • email_subject
      • file_name
      • file_path
      • hostname
      • imei
      • imsi
      • ip
      • ipv6
      • mac_address
      • md5
      • mutex
      • ngfw_id
      • ngfw_name
      • odns_identity
      • odns_identity_label
      • orbital_node_id
      • pki_serial
      • process_name
      • registry_key
      • registry_name
      • registry_path
      • sha1
      • sha256
      • swc_device_id
      • url
      • user
      • user_agent

Property value ∷ String

  • This entry is required

ValidTime Object

ValidTime Period of time when a cyber observation is valid.

PropertyTypeDescriptionRequired?
end_timeInst (Date)If end_time is not present, then the valid time position of the object does not have an upper bound.
start_timeInst (Date)If not present, the valid time position of the indicator does not have an upper bound

Property end_time ∷ Inst (Date)

If end_time is not present, then the valid time position of the object does not have an upper bound.

  • This entry is optional

    • ISO8601 Timestamp Schema definition for all date or timestamp values. Serialized as a string, the field should follow the rules of the ISO8601 standard.

Property start_time ∷ Inst (Date)

If not present, the valid time position of the indicator does not have an upper bound

  • This entry is optional

    • ISO8601 Timestamp Schema definition for all date or timestamp values. Serialized as a string, the field should follow the rules of the ISO8601 standard.

Can you improve this documentation? These fine people already did:
Stephen Sloan, Guillaume Buisson, Ambrose Bonnaire-Sergeant, jyoverma, Matthieu Sprunck, Craig Brozefsky, Yann Esposito & Yann Esposito (Yogsototh)
Edit on GitHub

cljdoc is a website building & hosting documentation for Clojure/Script libraries

× close