misp-objects
misp-objects copied to clipboard
Allow an array of possible vocabularies to be used for values_list/sane_default
Add an option for vocabularies (from misp-galaxies) to populate an attributes values from if they are present. This would make it far easier to have consistent text values in objects.
Having all an attributes possible values options hard-coded in in MISP objects can make the object structure much longer than it needs to be. Moving these options to vocabularies fits with the current model you have in place while also encouraging the use of more consistently correlate-able object properties.
A good example of where this would work is in the sectors
property in the current victim
object. If this were implemented as a separate optional values defaults_vocabulary
and values_vocabulary
which would populate the sane_defaults
and values_list
arrays with all of the options provided in vocabulary which is specified.
{
"name": "victim"
"description": "Victim object describes the target of an attack or abuse.",
...
"sectors": {
...
"defaults_vocabulary": ["common/sector"]
"values_vocabulary": ["common/sector"]
...
}