diff --git a/documentation/misp_events_to_stix1.md b/documentation/misp_events_to_stix1.md index bb0b4f30..18252c61 100644 --- a/documentation/misp_events_to_stix1.md +++ b/documentation/misp_events_to_stix1.md @@ -1,4 +1,4 @@ -# Events mapping +# MISP Events to STIX1 mapping MISP Events are exported within STIX packages, where some of the metadata fields are embedded within incidents: - Base event diff --git a/documentation/misp_events_to_stix20.md b/documentation/misp_events_to_stix20.md index d2aaa4d3..f257653d 100644 --- a/documentation/misp_events_to_stix20.md +++ b/documentation/misp_events_to_stix20.md @@ -1,4 +1,4 @@ -# Events mapping +# MISP Events to STIX 2.0 mapping MISP Events are exported within STIX Bundles and some of the metadata fields are embedded within Report objects: - Base event diff --git a/documentation/misp_events_to_stix21.md b/documentation/misp_events_to_stix21.md index cc308546..81edcd38 100644 --- a/documentation/misp_events_to_stix21.md +++ b/documentation/misp_events_to_stix21.md @@ -1,4 +1,4 @@ -# Events mapping +# MISP Events to STIX 2.1 mapping MISP Events are exported within STIX packages, where some of the metadata fields are embedded within incidents: - Base event diff --git a/documentation/misp_objects_to_stix20.md b/documentation/misp_objects_to_stix20.md index e228b43e..56d9771c 100644 --- a/documentation/misp_objects_to_stix20.md +++ b/documentation/misp_objects_to_stix20.md @@ -1,4 +1,4 @@ -# MISP Objects to STIX1 mapping +# MISP Objects to STIX 2.0 mapping MISP Objects are containers of single MISP attributes that are grouped together to highlight their meaning in a real use case scenario. For instance, if you want to share a report with suspicious files, without object templates you would end up with a list of file names, hashes, and other attributes that are all mixed together, making the differentiation of each file difficult. In this case with the file object template, we simply group together all the attributes which belong to each file. diff --git a/documentation/misp_objects_to_stix21.md b/documentation/misp_objects_to_stix21.md index c26276b7..902e9a60 100644 --- a/documentation/misp_objects_to_stix21.md +++ b/documentation/misp_objects_to_stix21.md @@ -1,4 +1,4 @@ -# MISP Objects to STIX1 mapping +# MISP Objects to STIX 2.1 mapping MISP Objects are containers of single MISP attributes that are grouped together to highlight their meaning in a real use case scenario. For instance, if you want to share a report with suspicious files, without object templates you would end up with a list of file names, hashes, and other attributes that are all mixed together, making the differentiation of each file difficult. In this case with the file object template, we simply group together all the attributes which belong to each file.