definition.json

{
  "attributes": {
    "ApplicationId": {
      "description": "Application-ID is used to identify for which Diameter application the message is applicable. Application-ID is a decimal representation.",
      "misp-attribute": "text",
      "ui-priority": 0
    },
    "CmdCode": {
      "description": "A decimal representation of the diameter Command Code.",
      "disable_correlation": true,
      "misp-attribute": "text",
      "ui-priority": 0
    },
    "Destination-Host": {
      "description": "Destination-Host.",
      "misp-attribute": "text",
      "multiple": true,
      "ui-priority": 0
    },
    "Destination-Realm": {
      "description": "Destination-Realm.",
      "misp-attribute": "text",
      "multiple": true,
      "ui-priority": 0
    },
    "IdrFlags": {
      "description": "IDR-Flags.",
      "disable_correlation": true,
      "misp-attribute": "text",
      "ui-priority": 0
    },
    "Origin-Host": {
      "description": "Origin-Host.",
      "misp-attribute": "text",
      "multiple": true,
      "ui-priority": 0
    },
    "Origin-Host-CountryISO2": {
      "description": "Origin-Host Country ISO2",
      "misp-attribute": "text",
      "multiple": true,
      "ui-priority": 0
    },
    "Origin-Host-OperatorName": {
      "description": "Origin-Host Operator Name",
      "misp-attribute": "text",
      "multiple": true,
      "ui-priority": 0
    },
    "Origin-Host-TADIG": {
      "description": "Origin-Host Operator TADIG",
      "misp-attribute": "text",
      "multiple": true,
      "ui-priority": 0
    },
    "Origin-Realm": {
      "description": "Origin-Realm.",
      "misp-attribute": "text",
      "multiple": true,
      "ui-priority": 0
    },
    "Origin-Realm-CountryISO2": {
      "description": "Origin-Realm Country ISO2",
      "misp-attribute": "text",
      "multiple": true,
      "ui-priority": 0
    },
    "Origin-Realm-OperatorName": {
      "description": "Origin-Realm Operator Name",
      "misp-attribute": "text",
      "multiple": true,
      "ui-priority": 0
    },
    "Origin-Realm-TADIG": {
      "description": "Origin-Realm Operator TADIG",
      "misp-attribute": "text",
      "multiple": true,
      "ui-priority": 0
    },
    "SessionId": {
      "description": "Session-ID.",
      "misp-attribute": "text",
      "ui-priority": 0
    },
    "Username": {
      "description": "Username (in this case, usually the IMSI).",
      "misp-attribute": "text",
      "multiple": true,
      "ui-priority": 0
    },
    "category": {
      "description": "Category.",
      "disable_correlation": true,
      "misp-attribute": "text",
      "sane_default": [
        "Cat0",
        "Cat1",
        "Cat2",
        "Cat3",
        "CatSMS"
      ],
      "ui-priority": 0
    },
    "first-seen": {
      "description": "When the attack has been seen for the first time.",
      "disable_correlation": true,
      "misp-attribute": "datetime",
      "ui-priority": 0
    },
    "text": {
      "description": "A description of the attack seen.",
      "disable_correlation": true,
      "misp-attribute": "text",
      "ui-priority": 0
    }
  },
  "description": "Attack as seen on the diameter signaling protocol supporting LTE networks.",
  "meta-category": "network",
  "name": "diameter-attack",
  "requiredOneOf": [
    "text"
  ],
  "uuid": "a3fdce4c-8e21-4acc-ab8e-9976e9165a12",
  "version": 2
}