Skip to content

Commit 3729654

Browse files
AlteredCoderAlteredCoder
committed
Add CTI confidence documentation
1 parent 30b5144 commit 3729654

File tree

1 file changed

+175
-159
lines changed

1 file changed

+175
-159
lines changed

‎crowdsec-docs/unversioned/cti_api/taxonomy/cti_fields.md‎

Lines changed: 175 additions & 159 deletions
Original file line numberDiff line numberDiff line change
@@ -9,155 +9,155 @@ sidebar_position: 2
99

1010
```json
1111
{
12-
"ip_range_score": 5,
13-
"ip": "[CENSORED]",
14-
"ip_range": "[CENSORED]",
15-
"as_name": "[CENSORED]",
16-
"reputation": "malicious",
17-
"ip_range_24": "[CENSORED]",
18-
"ip_range_24_reputation": "suspicious",
19-
"ip_range_24_score": 3,
20-
"background_noise_score": 10,
21-
"background_noise": "high",
22-
"as_num": 0,
23-
"location": {
24-
"country": "FR",
25-
"city": "",
26-
"latitude": 0.0,
27-
"longitude": 0.0
28-
},
29-
"reverse_dns": "[CENSORED]",
30-
"behaviors": [
31-
{
32-
"name": "http:scan",
33-
"label": "HTTP Scan",
34-
"description": "IP has been reported for performing actions related to HTTP vulnerability scanning and discovery."
35-
},
36-
{
37-
"name": "ssh:bruteforce",
38-
"label": "SSH Bruteforce",
39-
"description": "IP has been reported for performing brute force on ssh services."
40-
},
41-
{
42-
"name": "http:exploit",
43-
"label": "HTTP Exploit",
44-
"description": "IP has been reported for attempting to exploit a vulnerability in a web application."
45-
},
46-
{
47-
"name": "generic:exploit",
48-
"label": "Exploitation attempt",
49-
"description": "IP has been reported trying to exploit known vulnerability/CVE on unspecified protocols."
50-
}
51-
],
52-
"history": {
53-
"first_seen": "2022-05-28T16:00:00+00:00",
54-
"last_seen": "2023-10-15T05:45:00+00:00",
55-
"full_age": 507,
56-
"days_age": 505
57-
},
58-
"classifications": {
59-
"false_positives": [],
60-
"classifications": []
61-
},
62-
"attack_details": [
63-
{
64-
"name": "crowdsecurity/http-probing",
65-
"label": "HTTP Probing",
66-
"description": "Detect site scanning/probing from a single ip",
67-
"references": []
68-
},
69-
{
70-
"name": "crowdsecurity/ssh-bf",
71-
"label": "SSH Bruteforce",
72-
"description": "Detect ssh bruteforce",
73-
"references": []
74-
},
75-
{
76-
"name": "crowdsecurity/ssh-slow-bf",
77-
"label": "SSH Bruteforce",
78-
"description": "Detect slow ssh bruteforce",
79-
"references": []
80-
},
81-
{
82-
"name": "crowdsecurity/http-bad-user-agent",
83-
"label": "detection of bad user-agents",
84-
"description": "Detect bad user-agents",
85-
"references": []
86-
},
87-
{
88-
"name": "crowdsecurity/suricata-major-severity",
89-
"label": "Suricata Severity 1 Event",
90-
"description": "Detect exploit attempts via emerging threat rules",
91-
"references": []
12+
"ip_range_score": 5,
13+
"ip": "[CENSORED]",
14+
"ip_range": "[CENSORED]",
15+
"as_name": "[CENSORED]",
16+
"reputation": "malicious",
17+
"ip_range_24": "[CENSORED]",
18+
"ip_range_24_reputation": "suspicious",
19+
"ip_range_24_score": 3,
20+
"background_noise_score": 10,
21+
"background_noise": "high",
22+
"as_num": 0,
23+
"location": {
24+
"country": "FR",
25+
"city": "",
26+
"latitude": 0.0,
27+
"longitude": 0.0
9228
},
93-
{
94-
"name": "crowdsecurity/modsecurity",
95-
"label": "Modsecurity Alert",
96-
"description": "Web exploitation via modsecurity",
97-
"references": []
98-
}
99-
],
100-
"target_countries": {
101-
"AT": 0,
102-
"AU": 2,
103-
"BR": 0,
104-
"CA": 4,
105-
"CH": 0,
106-
"CN": 0,
107-
"DE": 79,
108-
"DK": 0,
109-
"ES": 0,
110-
"FI": 12
111-
},
112-
"mitre_techniques": [
113-
{
114-
"name": "T1595",
115-
"label": "Active Scanning",
116-
"description": "Adversaries may execute active reconnaissance scans to gather information that can be used during targeting. Active scans are those where the adversary probes victim infrastructure via network traffic, as opposed to other forms of reconnaissance that do not involve direct interaction.\n\nAdversaries may perform different forms of active scanning depending on what information they seek to gather. These scans can also be performed in various ways, including using native features of network protocols such as ICMP.(Citation: Botnet Scan)(Citation: OWASP Fingerprinting) Information from these scans may reveal opportunities for other forms of reconnaissance (ex: [Search Open Websites/Domains](https://attack.mitre.org/techniques/T1593) or [Search Open Technical Databases](https://attack.mitre.org/techniques/T1596)), establishing operational resources (ex: [Develop Capabilities](https://attack.mitre.org/techniques/T1587) or [Obtain Capabilities](https://attack.mitre.org/techniques/T1588)), and/or initial access (ex: [External Remote Services](https://attack.mitre.org/techniques/T1133) or [Exploit Public-Facing Application](https://attack.mitre.org/techniques/T1190))."
29+
"reverse_dns": "[CENSORED]",
30+
"behaviors": [
31+
{
32+
"name": "http:scan",
33+
"label": "HTTP Scan",
34+
"description": "IP has been reported for performing actions related to HTTP vulnerability scanning and discovery."
35+
},
36+
{
37+
"name": "ssh:bruteforce",
38+
"label": "SSH Bruteforce",
39+
"description": "IP has been reported for performing brute force on ssh services."
40+
},
41+
{
42+
"name": "http:exploit",
43+
"label": "HTTP Exploit",
44+
"description": "IP has been reported for attempting to exploit a vulnerability in a web application."
45+
},
46+
{
47+
"name": "generic:exploit",
48+
"label": "Exploitation attempt",
49+
"description": "IP has been reported trying to exploit known vulnerability/CVE on unspecified protocols."
50+
}
51+
],
52+
"history": {
53+
"first_seen": "2022-05-28T16:00:00+00:00",
54+
"last_seen": "2023-10-15T05:45:00+00:00",
55+
"full_age": 507,
56+
"days_age": 505
11757
},
118-
{
119-
"name": "T1110",
120-
"label": "Brute Force",
121-
"description": "Adversaries may use brute force techniques to gain access to accounts when passwords are unknown or when password hashes are obtained. Without knowledge of the password for an account or set of accounts, an adversary may systematically guess the password using a repetitive or iterative mechanism. Brute forcing passwords can take place via interaction with a service that will check the validity of those credentials or offline against previously acquired credential data, such as password hashes.\n\nBrute forcing credentials may take place at various points during a breach. For example, adversaries may attempt to brute force access to [Valid Accounts](https://attack.mitre.org/techniques/T1078) within a victim environment leveraging knowledge gathered from other post-compromise behaviors such as [OS Credential Dumping](https://attack.mitre.org/techniques/T1003), [Account Discovery](https://attack.mitre.org/techniques/T1087), or [Password Policy Discovery](https://attack.mitre.org/techniques/T1201). Adversaries may also combine brute forcing activity with behaviors such as [External Remote Services](https://attack.mitre.org/techniques/T1133) as part of Initial Access."
58+
"classifications": {
59+
"false_positives": [],
60+
"classifications": []
12261
},
123-
{
124-
"name": "T1190",
125-
"label": "Exploit Public-Facing Application",
126-
"description": "Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network. The weakness in the system can be a software bug, a temporary glitch, or a misconfiguration.\n\nExploited applications are often websites/web servers, but can also include databases (like SQL), standard services (like SMB or SSH), network device administration and management protocols (like SNMP and Smart Install), and any other system with Internet accessible open sockets.(Citation: NVD CVE-2016-6662)(Citation: CIS Multiple SMB Vulnerabilities)(Citation: US-CERT TA18-106A Network Infrastructure Devices 2018)(Citation: Cisco Blog Legacy Device Attacks)(Citation: NVD CVE-2014-7169) Depending on the flaw being exploited this may also involve [Exploitation for Defense Evasion](https://attack.mitre.org/techniques/T1211). \n\nIf an application is hosted on cloud-based infrastructure and/or is containerized, then exploiting it may lead to compromise of the underlying instance or container. This can allow an adversary a path to access the cloud or container APIs, exploit container host access via [Escape to Host](https://attack.mitre.org/techniques/T1611), or take advantage of weak identity and access management policies.\n\nAdversaries may also exploit edge network infrastructure and related appliances, specifically targeting devices that do not support robust host-based defenses.(Citation: Mandiant Fortinet Zero Day)(Citation: Wired Russia Cyberwar)\n\nFor websites and databases, the OWASP top 10 and CWE top 25 highlight the most common web-based vulnerabilities.(Citation: OWASP Top 10)(Citation: CWE top 25)"
127-
}
128-
],
129-
"cves": [],
130-
"scores": {
131-
"overall": {
132-
"aggressiveness": 5,
133-
"threat": 2,
134-
"trust": 4,
135-
"anomaly": 0,
136-
"total": 4
62+
"attack_details": [
63+
{
64+
"name": "crowdsecurity/http-probing",
65+
"label": "HTTP Probing",
66+
"description": "Detect site scanning/probing from a single ip",
67+
"references": []
68+
},
69+
{
70+
"name": "crowdsecurity/ssh-bf",
71+
"label": "SSH Bruteforce",
72+
"description": "Detect ssh bruteforce",
73+
"references": []
74+
},
75+
{
76+
"name": "crowdsecurity/ssh-slow-bf",
77+
"label": "SSH Bruteforce",
78+
"description": "Detect slow ssh bruteforce",
79+
"references": []
80+
},
81+
{
82+
"name": "crowdsecurity/http-bad-user-agent",
83+
"label": "detection of bad user-agents",
84+
"description": "Detect bad user-agents",
85+
"references": []
86+
},
87+
{
88+
"name": "crowdsecurity/suricata-major-severity",
89+
"label": "Suricata Severity 1 Event",
90+
"description": "Detect exploit attempts via emerging threat rules",
91+
"references": []
92+
},
93+
{
94+
"name": "crowdsecurity/modsecurity",
95+
"label": "Modsecurity Alert",
96+
"description": "Web exploitation via modsecurity",
97+
"references": []
98+
}
99+
],
100+
"target_countries": {
101+
"AT": 0,
102+
"AU": 2,
103+
"BR": 0,
104+
"CA": 4,
105+
"CH": 0,
106+
"CN": 0,
107+
"DE": 79,
108+
"DK": 0,
109+
"ES": 0,
110+
"FI": 12
137111
},
138-
"last_day": {
139-
"aggressiveness": 0,
140-
"threat": 0,
141-
"trust": 0,
142-
"anomaly": 0,
143-
"total": 0
112+
"mitre_techniques": [
113+
{
114+
"name": "T1595",
115+
"label": "Active Scanning",
116+
"description": "Adversaries may execute active reconnaissance scans to gather information that can be used during targeting. Active scans are those where the adversary probes victim infrastructure via network traffic, as opposed to other forms of reconnaissance that do not involve direct interaction.\n\nAdversaries may perform different forms of active scanning depending on what information they seek to gather. These scans can also be performed in various ways, including using native features of network protocols such as ICMP.(Citation: Botnet Scan)(Citation: OWASP Fingerprinting) Information from these scans may reveal opportunities for other forms of reconnaissance (ex: [Search Open Websites/Domains](https://attack.mitre.org/techniques/T1593) or [Search Open Technical Databases](https://attack.mitre.org/techniques/T1596)), establishing operational resources (ex: [Develop Capabilities](https://attack.mitre.org/techniques/T1587) or [Obtain Capabilities](https://attack.mitre.org/techniques/T1588)), and/or initial access (ex: [External Remote Services](https://attack.mitre.org/techniques/T1133) or [Exploit Public-Facing Application](https://attack.mitre.org/techniques/T1190))."
117+
},
118+
{
119+
"name": "T1110",
120+
"label": "Brute Force",
121+
"description": "Adversaries may use brute force techniques to gain access to accounts when passwords are unknown or when password hashes are obtained. Without knowledge of the password for an account or set of accounts, an adversary may systematically guess the password using a repetitive or iterative mechanism. Brute forcing passwords can take place via interaction with a service that will check the validity of those credentials or offline against previously acquired credential data, such as password hashes.\n\nBrute forcing credentials may take place at various points during a breach. For example, adversaries may attempt to brute force access to [Valid Accounts](https://attack.mitre.org/techniques/T1078) within a victim environment leveraging knowledge gathered from other post-compromise behaviors such as [OS Credential Dumping](https://attack.mitre.org/techniques/T1003), [Account Discovery](https://attack.mitre.org/techniques/T1087), or [Password Policy Discovery](https://attack.mitre.org/techniques/T1201). Adversaries may also combine brute forcing activity with behaviors such as [External Remote Services](https://attack.mitre.org/techniques/T1133) as part of Initial Access."
122+
},
123+
{
124+
"name": "T1190",
125+
"label": "Exploit Public-Facing Application",
126+
"description": "Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network. The weakness in the system can be a software bug, a temporary glitch, or a misconfiguration.\n\nExploited applications are often websites/web servers, but can also include databases (like SQL), standard services (like SMB or SSH), network device administration and management protocols (like SNMP and Smart Install), and any other system with Internet accessible open sockets.(Citation: NVD CVE-2016-6662)(Citation: CIS Multiple SMB Vulnerabilities)(Citation: US-CERT TA18-106A Network Infrastructure Devices 2018)(Citation: Cisco Blog Legacy Device Attacks)(Citation: NVD CVE-2014-7169) Depending on the flaw being exploited this may also involve [Exploitation for Defense Evasion](https://attack.mitre.org/techniques/T1211). \n\nIf an application is hosted on cloud-based infrastructure and/or is containerized, then exploiting it may lead to compromise of the underlying instance or container. This can allow an adversary a path to access the cloud or container APIs, exploit container host access via [Escape to Host](https://attack.mitre.org/techniques/T1611), or take advantage of weak identity and access management policies.\n\nAdversaries may also exploit edge network infrastructure and related appliances, specifically targeting devices that do not support robust host-based defenses.(Citation: Mandiant Fortinet Zero Day)(Citation: Wired Russia Cyberwar)\n\nFor websites and databases, the OWASP top 10 and CWE top 25 highlight the most common web-based vulnerabilities.(Citation: OWASP Top 10)(Citation: CWE top 25)"
127+
}
128+
],
129+
"cves": [],
130+
"scores": {
131+
"overall": {
132+
"aggressiveness": 5,
133+
"threat": 2,
134+
"trust": 4,
135+
"anomaly": 0,
136+
"total": 4
137+
},
138+
"last_day": {
139+
"aggressiveness": 0,
140+
"threat": 0,
141+
"trust": 0,
142+
"anomaly": 0,
143+
"total": 0
144+
},
145+
"last_week": {
146+
"aggressiveness": 5,
147+
"threat": 2,
148+
"trust": 4,
149+
"anomaly": 0,
150+
"total": 4
151+
},
152+
"last_month": {
153+
"aggressiveness": 5,
154+
"threat": 2,
155+
"trust": 4,
156+
"anomaly": 0,
157+
"total": 4
158+
}
144159
},
145-
"last_week": {
146-
"aggressiveness": 5,
147-
"threat": 2,
148-
"trust": 4,
149-
"anomaly": 0,
150-
"total": 4
151-
},
152-
"last_month": {
153-
"aggressiveness": 5,
154-
"threat": 2,
155-
"trust": 4,
156-
"anomaly": 0,
157-
"total": 4
158-
}
159-
},
160-
"references": []
160+
"references": []
161161
}
162162
```
163163

@@ -195,11 +195,11 @@ The reputation of the IP address.
195195

196196
The possible values are:
197197

198-
- `malicious` : The IP address is malicious
199-
- `suspicious` : Many CrowdSec users have reported the IP, but it is not aggressive enough to be considered malicious
200-
- `known` : At this time, the CrowdSec network has identified the IP, but we still require additional information to make a decision
201-
- `safe` : The IP address is safe and can be trusted (ex: Google DNS, Cloudflare DNS ...)
202-
- `unknown`: The IP address is either unknown or its last report is from more than three months ago
198+
- `malicious` : The IP address is malicious
199+
- `suspicious` : Many CrowdSec users have reported the IP, but it is not aggressive enough to be considered malicious
200+
- `known` : At this time, the CrowdSec network has identified the IP, but we still require additional information to make a decision
201+
- `safe` : The IP address is safe and can be trusted (ex: Google DNS, Cloudflare DNS ...)
202+
- `unknown`: The IP address is either unknown or its last report is from more than three months ago
203203

204204
## `ip_range_24`
205205

@@ -223,10 +223,10 @@ For range reputation, only the IPs in the immediate proximity of the requested I
223223

224224
The possible values for the /24 network prefix are:
225225

226-
- `malicious` : The range is considered malicious
227-
- `suspicious` : The IP range contains several IPs that have been reported by the CrowdSec network
228-
- `known` : The IP range is recognized in the CrowdSec network, but we lack sufficient sightings of its IP addresses
229-
- `unknown`: The last report for IP range is either unknown or over 3 months old
226+
- `malicious` : The range is considered malicious
227+
- `suspicious` : The IP range contains several IPs that have been reported by the CrowdSec network
228+
- `known` : The IP range is recognized in the CrowdSec network, but we lack sufficient sightings of its IP addresses
229+
- `unknown`: The last report for IP range is either unknown or over 3 months old
230230

231231
## `ip_range_24_score`
232232

@@ -261,10 +261,10 @@ The level of background noise of an IP address is an indicator of its internet a
261261

262262
The possible values are:
263263

264-
- `high` : IP is very noisy, validated as an untargeted mild-threat mass-attacks
265-
- `medium` : IP has been reported by many members of the CrowdSec network, but not enough to be considered as background noise
266-
- `low` : IP has been reported by a few members of the CrowdSec network
267-
- `none` : IP has never been reported or only by a very few members of the CrowdSec network
264+
- `high` : IP is very noisy, validated as an untargeted mild-threat mass-attacks
265+
- `medium` : IP has been reported by many members of the CrowdSec network, but not enough to be considered as background noise
266+
- `low` : IP has been reported by a few members of the CrowdSec network
267+
- `none` : IP has never been reported or only by a very few members of the CrowdSec network
268268

269269
## `background_noise_score`
270270

@@ -276,6 +276,22 @@ The possible values are:
276276

277277
CrowdSec intelligence calculated score: a high background noise scores highlights untargeted mild-threat mass-attacks.
278278

279+
## `confidence`
280+
281+
> type: **string**
282+
283+
```json
284+
confidence: "high"
285+
```
286+
287+
The confidence level about the reports used to compute the reputation and scores.
288+
289+
The possible values are:
290+
291+
- `high`
292+
- `medium`
293+
- `low`
294+
- `none`
279295

280296
## `ip_range_score`
281297

@@ -1026,8 +1042,8 @@ The score of the _anomaly_ component (see [more here](cti_api/taxonomy/scores.md
10261042

10271043
Only present for the `fire` route.
10281044

1029-
- `validated` means IP is currently part of community blocklist
1030-
- `refused` means it was part of the community blocklist, but was manually purged (ie. false positive)
1045+
- `validated` means IP is currently part of community blocklist
1046+
- `refused` means it was part of the community blocklist, but was manually purged (ie. false positive)
10311047

10321048
## `expiration`
10331049

0 commit comments

Comments
 (0)