Skip to content

XDR-432 new relation for hashes from same file #448

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
samwagg wants to merge 2 commits into
base: master
Choose a base branch
from
Open

XDR-432 new relation for hashes from same file #448

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
ce8d20b
Add Derived_From_Same observable relation.
samwagg Jun 11, 2024
324a41d
Misc. documentation updates.
samwagg Jun 11, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
9 changes: 9 additions & 0 deletions doc/structures/bundle.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9664,6 +9664,7 @@ Time of the observation. If the observation was made over a period of time, than
* Deleted
* Deleted_By
* Deleted_From
* Derived_From_Same
* Downloaded
* Downloaded_By
* Downloaded_From
Expand Down Expand Up @@ -9849,6 +9850,7 @@ Time of the observation. If the observation was made over a period of time, than
* process_hash
* process_name
* process_path
* process_uid
* process_username
* processor_id
* registry_key
Expand Down Expand Up @@ -9930,6 +9932,7 @@ Time of the observation. If the observation was made over a period of time, than
* process_hash
* process_name
* process_path
* process_uid
* process_username
* processor_id
* registry_key
Expand Down Expand Up @@ -10026,6 +10029,7 @@ Time of the observation. If the observation was made over a period of time, than
* process_hash
* process_name
* process_path
* process_uid
* process_username
* processor_id
* registry_key
Expand Down Expand Up @@ -10234,6 +10238,7 @@ Time of the observation. If the observation was made over a period of time, than
* process_hash
* process_name
* process_path
* process_uid
* process_username
* processor_id
* registry_key
Expand Down Expand Up @@ -10399,6 +10404,7 @@ Time of the observation. If the observation was made over a period of time, than
* process_hash
* process_name
* process_path
* process_uid
* process_username
* processor_id
* registry_key
Expand Down Expand Up @@ -10990,6 +10996,7 @@ If not present, the valid time position of the indicator does not have an upper
* process_hash
* process_name
* process_path
* process_uid
* process_username
* processor_id
* registry_key
Expand Down Expand Up @@ -11487,6 +11494,7 @@ Time of the observation. If the observation was made over a period of time, than
* process_hash
* process_name
* process_path
* process_uid
* process_username
* processor_id
* registry_key
Expand Down Expand Up @@ -12091,6 +12099,7 @@ If not present, the valid time position of the indicator does not have an upper
* process_hash
* process_name
* process_path
* process_uid
* process_username
* processor_id
* registry_key
Expand Down
9 changes: 9 additions & 0 deletions doc/structures/casebook.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8082,6 +8082,7 @@ Time of the observation. If the observation was made over a period of time, than
* Deleted
* Deleted_By
* Deleted_From
* Derived_From_Same
* Downloaded
* Downloaded_By
* Downloaded_From
Expand Down Expand Up @@ -8267,6 +8268,7 @@ Time of the observation. If the observation was made over a period of time, than
* process_hash
* process_name
* process_path
* process_uid
* process_username
* processor_id
* registry_key
Expand Down Expand Up @@ -8348,6 +8350,7 @@ Time of the observation. If the observation was made over a period of time, than
* process_hash
* process_name
* process_path
* process_uid
* process_username
* processor_id
* registry_key
Expand Down Expand Up @@ -8444,6 +8447,7 @@ Time of the observation. If the observation was made over a period of time, than
* process_hash
* process_name
* process_path
* process_uid
* process_username
* processor_id
* registry_key
Expand Down Expand Up @@ -8652,6 +8656,7 @@ Time of the observation. If the observation was made over a period of time, than
* process_hash
* process_name
* process_path
* process_uid
* process_username
* processor_id
* registry_key
Expand Down Expand Up @@ -8817,6 +8822,7 @@ Time of the observation. If the observation was made over a period of time, than
* process_hash
* process_name
* process_path
* process_uid
* process_username
* processor_id
* registry_key
Expand Down Expand Up @@ -10320,6 +10326,7 @@ If not present, the valid time position of the indicator does not have an upper
* process_hash
* process_name
* process_path
* process_uid
* process_username
* processor_id
* registry_key
Expand Down Expand Up @@ -12794,6 +12801,7 @@ Observable types that can be acted upon.
* process_hash
* process_name
* process_path
* process_uid
* process_username
* processor_id
* registry_key
Expand Down Expand Up @@ -14466,6 +14474,7 @@ For each asset, we allow for the assertion of time bound properties.This gives u
* process_hash
* process_name
* process_path
* process_uid
* process_username
* processor_id
* registry_key
Expand Down
2 changes: 1 addition & 1 deletion doc/structures/judgement.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -391,8 +391,8 @@ A URL reference to an external resource.
* process_hash
* process_name
* process_path
* process_username
* process_uid
* process_username
* processor_id
* registry_key
* registry_name
Expand Down
1 change: 1 addition & 0 deletions doc/structures/sighting.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1136,6 +1136,7 @@ Time of the observation. If the observation was made over a period of time, than
* Deleted
* Deleted_By
* Deleted_From
* Derived_From_Same
* Downloaded
* Downloaded_By
* Downloaded_From
Expand Down
1 change: 1 addition & 0 deletions src/ctim/schemas/common.cljc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -496,6 +496,7 @@
"Deleted" "Specifies that this object deleted the related object."
"Deleted_By" "Specifies that this object was deleted by the related object."
"Deleted_From" "Specifies that this object was deleted from the related object."
"Derived_From_Same" "Specifies that this observable is a property of, or otherwise derived from, the same underlying object as the related observable. An Example is hashes for the same file."
"Downloaded" "Specifies that this object downloaded the related object."
"Downloaded_By" "Specifies that this object was downloaded by the related object."
"Downloaded_From" "Specifies that this object was downloaded from the related object."
Expand Down