Re: [cti-users] "Data Marking" syntaxes

[Alexandre Dulaunoy <Alexandre.Dulaunoy@circl.lu>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On 09/11/15 17:03, Jordan, Bret wrote:
> So something along the lines of the following?  We can obviously rename "extra" to be something better suited for this use case, I just used that instead of TLP=BLACK.  This is meant to get us
> talking and working to consensus on something that will make things better.
> 
> 
> { "type": "indicator", "marking": { "tlp": "white || green || amber || red", "extra": "true || false", "share": "public || limited || no", "jurisdiction": [ "EU", "Safe Harbour" ], "anonymize":
> "true || false", "details": "some really long detailed text with extra context", "handling": { "encrypt-at-rest": "true || false", "encrypt-in-transit": "true || false" } } }

Just for your information, we maintain a machine-readable taxonomy (triple-tags) for the Traffic Light Protocol:

https://github.com/MISP/misp-taxonomies/blob/master/tlp/machinetag.json

It's currently used in MISP 2.4 for the taxonomy tagging but can be used by any other information sharing tool.

https://github.com/MISP/misp-taxonomies/

If you see any other potential extension to the TLP taxonomy or other. Feel free to open an issue or/and a pull request.

Cheers.

- -- 
Alexandre Dulaunoy
CIRCL - Computer Incident Response Center Luxembourg
41, avenue de la gare L-1611 Luxembourg
info@circl.lu - www.circl.lu
-----BEGIN PGP SIGNATURE-----

iEYEARECAAYFAlZVZcQACgkQCeLNSUTmy81wDwCaAqrBAD18qFhuA77XwMZmtzY+
yW4AniPRva5tV5e1OaTzMMaZ1Yp8dn21
=KSdx
-----END PGP SIGNATURE-----