repository·main·Indexed 43 days ago
https://github.com/misp/misp-taxonomiesA collection of standardized classification libraries used to tag and organize security information within MISP and other information-sharing platforms. It utilizes a 'Machine Tag' (Triple Tag) format consisting of a namespace, predicate, and optional value to ensure interoperability. Included taxonomies cover diverse domains such as the Admiralty Scale (NATO System) for intelligence reliability, Malware Classification, FIRST CSIRT Case Classification, the NIS Cybersecurity Incident Taxonomy, and Agent Threat Rules (ATR) for AI agent detection.
The NIS Cybersecurity Incident Taxonomy is designed for categorizing large-scale cybersecurity incidents as defined by the Commission Recommendation of 13 September 2017 (the 'blueprint').
The taxonomy is structured into two core components:
MISP_DopingSubstanceTaxonomy project provides a structured taxonomy of prohibited sports doping substances. The data is sourced from the World Anti-Doping Agency (WADA) prohibited list. This taxonomy is designed to be imported into MISP to assist sports organizations in identifying and managing information related to doping substances.state-responsibility taxonomy provides a framework for categorizing national responsibility for cyber attacks. It is inspired by the work of Jason Healey in the Atlantic Council article "Beyond Attribution: Seeking National Responsibility for Cyber Attacks".The FIRST CSIRT Case Classification taxonomy provides a standardized framework for CSIRTs to categorize incidents, determine criticality, and manage sensitivity. It is designed to assist Incident Managers (IM) in defining response times, communication requirements, and 'need to know' access controls.
The taxonomy is divided into three main dimensions:
The misp-taxonomies repository contains a wide variety of classification schemes used to enrich MISP events with structured metadata. These taxonomies cover diverse domains including security incident classification, AI threat detection, industry-specific threats (aviation, satellites), and intelligence reliability scales.
Developers can use these taxonomies to standardize how threat intelligence is described, enabling better filtering, correlation, and automated response across different MISP instances.
incident-disposition taxonomy classifies how an incident is processed toward resolution. It is inspired by the NASA Incident Response and Management Handbook.fr-classif taxonomy implements the French government's information classification system.financial taxonomy is used to describe financial services, infrastructure, and financial scope.The agent-threat-rules taxonomy is an open detection standard for AI agent threats (under Apache 2.0). It organizes 330 community-maintained rules across ten attack categories.
When using this taxonomy, predicates represent the attack category, and values are individual rule identifiers following the format ATR-YYYY-NNNNN.
Attack Categories include:
Example rule identifier: ATR-2024-12345The retention taxonomy allows you to add a retention time to events. This is used to automatically remove the IDS-flag on ip-dst or ip-src attributes based on the elapsed time since the event date.
Supported time units:
d (days)w (weeks)m (months)y (years)Note: The numerical_value field is used for sorting in the web interface and does not affect the actual time calculations.
ioc (Indicator of Compromise) taxonomy facilitates the automation of classifying artifacts as either malicious or non-malicious.