abuse_bot-infection_0.2.0_unstable.json

{
    "description":"A report for systems which are infected with a bot",
    "type":"object",
    "properties":{
        "Reported-From":{
            "type":"string",
            "format":"email"
        },
        "Report-ID":{
            "type":"string",
            "format":"email"
        },
        "User-Agent":{
            "description":"This field describes the software which generated this report email, this is not necessarily software used on the targeted system",
            "type":"string"
        },
        "Category":{
            "type":"string",
            "enum":["abuse"]
        },
        "Report-Type":{
            "type":"string",
            "enum":["bot-infection"]
        },
        "Date":{
            "type":"string",
            "format":"date-time"
        },
        "Destination":{
            "type":"string",
            "optional":true,
            "requires":"Destination-Type"
        },
        "Destination-Type":{
            "type":"string",
            "enum":["ipv4","ipv6","ip-address"],
            "optional":true
        },
        "Destination-Port":{
            "type":"integer",
            "optional":true
        },
        "Destination-ASN":{
            "type": "integer",
            "optional": true
        },
        "Source":{
            "description":"This field describes the source-ip where the bot infection is hosted",
            "type":"string"
        },
        "Source-Type":{
            "type":"string",
            "enum":["ipv4","ipv6","ip-address"]
        },
        "Source-Port":{
            "description":"This field describes the source-port from which the bot infected host communicated",
            "type":"integer",
            "optional":true
        },
        "Source-ASN":{
            "type": "integer",
            "optional": true
        },
        "Transport-Protocol":{
            "type": "string",
            "optional": true
        },
        "Classification-Taxonomy": {
            "type": "string",
            "optional": true
        },
        "Classification-Type": {
            "type": "string",
            "optional": true
        },
        "Classification-Identifier": {
            "type": "string",
            "optional": true
        },
        "Malware-Name":{
            "type":"string",
            "optional": true
        },
        "Malware-MD5":{
             "type":"string",
             "optional":true
        },
        "Feedback-Link":{
            "description":"May provide a feedback link for the receiver",
            "type":"string",
            "format":"uri",
            "optional":true
        },
        "Attachment":{
            "type":"string",
            "enum":["none","text/plain"]
        },
        "Schema-URL":{
            "type":"string",
            "format":"uri"
        },
        "Version":{
            "type":"number",
            "optional":true
        },
        "Occurrences":{
            "type":"integer",
            "optional":true
        },
        "TLP":{
            "type":"string",
            "enum":["white","green","amber","red"],
            "optional":true
        }
    }
}