wehub-resource-sync
297 lines
8.2 KiB
JSON
297 lines
8.2 KiB
JSON
{
|
|
"$schema": "http://json-schema.org/draft-07/schema#",
|
|
"definitions": {
|
|
"ParserLogEntry": {
|
|
"type": "object",
|
|
"properties": {
|
|
"blob": {
|
|
"description": "The text of the log entry, can be a command input or output",
|
|
"type": "string"
|
|
},
|
|
"filepath": {
|
|
"description": "Local path to the file that the log entry was found in",
|
|
"type": "string"
|
|
},
|
|
"lineNumber": {
|
|
"description": "The starting line number of the log entry in the file",
|
|
"type": "number"
|
|
},
|
|
"lineType": {
|
|
"description": "The type of log line if the logType is 'BEACON'",
|
|
"enum": ["CHECKIN", "ERROR", "INDICATOR", "INPUT", "METADATA", "MODE", "OUTPUT", "TASK"],
|
|
"type": "string"
|
|
},
|
|
"logType": {
|
|
"description": "The type of log entry",
|
|
"enum": ["BEACON", "DOWNLOAD", "EVENT", "KEYSTROKES", "UNKNOWN", "WEBLOG"],
|
|
"type": "string"
|
|
},
|
|
"dateTime": {
|
|
"description": "The date and time the log entry was created",
|
|
"type": "string",
|
|
"format": "date-time"
|
|
}
|
|
},
|
|
"required": ["blob", "logType"]
|
|
},
|
|
"ParserCommand": {
|
|
"type": "object",
|
|
"properties": {
|
|
"operator": {
|
|
"description": "Name of the operator that sent the command\nShould match the name of an operator in the operators object",
|
|
"type": "string"
|
|
},
|
|
"beacon": {
|
|
"description": "Name of the beacon that the command was run from\nShould match the name of a beacon in the beacons object",
|
|
"type": "string"
|
|
},
|
|
"input": {
|
|
"$ref": "#/definitions/ParserLogEntry",
|
|
"description": "The input that initialized the command"
|
|
},
|
|
"commandFailed": {
|
|
"description": "Whether the command was successful",
|
|
"default": false,
|
|
"type": "boolean"
|
|
},
|
|
"output": {
|
|
"description": "The output of the command",
|
|
"$ref": "#/definitions/ParserLogEntry"
|
|
},
|
|
"attackIds": {
|
|
"description": "A list of the MITRE ATT&CK techniques used by the command",
|
|
"default": [],
|
|
"type": "array",
|
|
"items": {
|
|
"type": "string"
|
|
}
|
|
}
|
|
},
|
|
"required": ["beacon", "input"]
|
|
},
|
|
"ParserLink": {
|
|
"type": "object",
|
|
"properties": {
|
|
"from": {
|
|
"description": "The origin of the link, can be a beacon or server",
|
|
"type": "string"
|
|
},
|
|
"to": {
|
|
"description": "The destination of the link, can be a beacon",
|
|
"type": "string"
|
|
}
|
|
},
|
|
"required": ["from", "to"]
|
|
},
|
|
"ParserOperator": {
|
|
"type": "object",
|
|
"properties": {
|
|
"name": {
|
|
"description": "The name of the operator",
|
|
"type": "string"
|
|
},
|
|
"startTime": {
|
|
"description": "The date and time the operator first sent a command",
|
|
"type": "string",
|
|
"format": "date-time"
|
|
},
|
|
"endTime": {
|
|
"description": "The date and time the operator last sent a command",
|
|
"type": "string",
|
|
"format": "date-time"
|
|
}
|
|
},
|
|
"required": ["name"]
|
|
},
|
|
"ParserServer": {
|
|
"type": "object",
|
|
"properties": {
|
|
"name": {
|
|
"description": "The name of the server",
|
|
"type": "string"
|
|
},
|
|
"type": {
|
|
"description": "The type of server",
|
|
"enum": ["dns", "http", "https", "smb"],
|
|
"default": "'http'",
|
|
"type": "string"
|
|
}
|
|
},
|
|
"required": ["name"]
|
|
},
|
|
"ParserHost": {
|
|
"type": "object",
|
|
"properties": {
|
|
"name": {
|
|
"description": "The name of the host",
|
|
"type": "string"
|
|
},
|
|
"server": {
|
|
"description": "The name of the server that first ran a command or spawned a beacon on the host\nThis should match the name of a server in the servers object",
|
|
"type": "string"
|
|
},
|
|
"os": {
|
|
"description": "The operating system of the host",
|
|
"type": "string"
|
|
},
|
|
"osVersion": {
|
|
"description": "The version of the operating system of the host",
|
|
"type": "string"
|
|
},
|
|
"ip": {
|
|
"description": "The IP address of the host",
|
|
"type": "string"
|
|
},
|
|
"type": {
|
|
"description": "The type of host",
|
|
"type": "string"
|
|
}
|
|
},
|
|
"required": ["name", "server"]
|
|
},
|
|
"ParserBeacon": {
|
|
"type": "object",
|
|
"properties": {
|
|
"name": {
|
|
"description": "The name of the beacon",
|
|
"type": "string"
|
|
},
|
|
"server": {
|
|
"description": "The name of the server that spawned this beacon\nThis should match the name of a server in the servers object",
|
|
"type": "string"
|
|
},
|
|
"host": {
|
|
"description": "The name of the host that this beacon is running on\nThis should match the name of a host in the hosts object",
|
|
"type": "string"
|
|
},
|
|
"ip": {
|
|
"description": "The IP address of the host as reported by the beacon",
|
|
"type": "string"
|
|
},
|
|
"type": {
|
|
"description": "The type of beacon",
|
|
"enum": ["dns", "http", "https", "smb"],
|
|
"type": "string"
|
|
},
|
|
"port": {
|
|
"description": "The port that the beacon is communicating over",
|
|
"type": "number"
|
|
},
|
|
"process": {
|
|
"description": "The process name of the beacon",
|
|
"type": "string"
|
|
},
|
|
"processId": {
|
|
"description": "The process identifier of the beacon",
|
|
"type": "number"
|
|
},
|
|
"startTime": {
|
|
"description": "The date time the beacon was initialized or ran it's first command",
|
|
"type": "string",
|
|
"format": "date-time"
|
|
},
|
|
"endTime": {
|
|
"description": "The date time the beacon ran it's last command or was terminated",
|
|
"type": "string",
|
|
"format": "date-time"
|
|
},
|
|
"images": {
|
|
"description": "A list of images that the beacon has downloaded",
|
|
"type": "array",
|
|
"items": {
|
|
"$ref": "#/definitions/ParserImage"
|
|
}
|
|
},
|
|
"files": {
|
|
"description": "A list of files that the beacon has uploaded or downloaded",
|
|
"type": "array",
|
|
"items": {
|
|
"$ref": "#/definitions/ParserFile"
|
|
}
|
|
}
|
|
},
|
|
"required": ["host", "name", "server"]
|
|
},
|
|
"ParserImage": {
|
|
"type": "object",
|
|
"properties": {
|
|
"fileType": {
|
|
"description": "The type of image",
|
|
"enum": "*",
|
|
"type": "string"
|
|
},
|
|
"filePath": {
|
|
"description": "Path to the image that RedEye can access",
|
|
"type": "string"
|
|
},
|
|
"fileName": {
|
|
"description": "The name of the image if the local file name is different from the name of the image",
|
|
"type": "string"
|
|
}
|
|
},
|
|
"required": ["filePath", "fileType"]
|
|
},
|
|
"ParserFile": {
|
|
"type": "object",
|
|
"properties": {
|
|
"fileName": {
|
|
"description": "The name of the file if the local file name is different from the name of the file",
|
|
"type": "string"
|
|
},
|
|
"filePath": {
|
|
"description": "Path to the file that RedEye can access",
|
|
"type": "string"
|
|
},
|
|
"dateTime": {
|
|
"description": "The date time the file was created or modified",
|
|
"type": "string",
|
|
"format": "date-time"
|
|
},
|
|
"md5": {
|
|
"description": "The MD5 hash of the file",
|
|
"type": "string"
|
|
},
|
|
"fileFlag": {
|
|
"description": "Was this file uploaded to the host or downloaded from the host",
|
|
"enum": ["DOWNLOAD", "UPLOAD"],
|
|
"type": "string"
|
|
}
|
|
},
|
|
"required": ["dateTime", "fileFlag", "filePath"]
|
|
},
|
|
"ParserOutput": {
|
|
"type": "object",
|
|
"properties": {
|
|
"servers": {
|
|
"description": "A key-value pair of server names and their metadata",
|
|
"type": "{ [serverName: string] : ParserServer }"
|
|
},
|
|
"hosts": {
|
|
"description": "A key-value pair of host names and their metadata",
|
|
"type": "{ [hostName: string] : ParserHost }"
|
|
},
|
|
"beacons": {
|
|
"description": "A key-value pair of beacon names and their metadata",
|
|
"type": "{ [beaconName: string] : ParserBeacon }"
|
|
},
|
|
"operators": {
|
|
"description": "A key-value pair of operator names and the time range of their first and last command",
|
|
"type": "{ [operatorName: string] : ParserOperator }"
|
|
},
|
|
"commands": {
|
|
"description": "A key-value pair of unique command identifiers and commands with inputs and outputs, sent by operators to beacons",
|
|
"type": "{ [commandName: string] : ParserCommand }"
|
|
},
|
|
"links": {
|
|
"description": "A key-value pair of '<from>-<to>' and links from servers to beacons and beacons to beacons",
|
|
"type": "object",
|
|
"additionalProperties": {
|
|
"$ref": "#/definitions/ParserLink"
|
|
}
|
|
}
|
|
},
|
|
"required": ["beacons", "commands", "hosts", "links", "operators", "servers"]
|
|
}
|
|
}
|
|
}
|