Skip to content

Add ruleset-metadata MISP object template#510

Merged
adulau merged 1 commit intomainfrom
codex/add-misp-object-template-for-rulezet-metadata
Apr 10, 2026
Merged

Add ruleset-metadata MISP object template#510
adulau merged 1 commit intomainfrom
codex/add-misp-object-template-for-rulezet-metadata

Conversation

@adulau
Copy link
Copy Markdown
Member

@adulau adulau commented Apr 10, 2026

Motivation

  • Provide a reusable object to capture rule-set metadata (UUIDs, authoring, timestamps, votes, CVE links, source paths) so it can be linked to rule content objects such as YARA, NSE, Sigma.

Description

  • Add a new object template at objects/ruleset-metadata/definition.json named ruleset-metadata that maps fields from the provided SQL-style metadata into MISP attributes (e.g., title, uuid, original-uuid, format, author, creation-date, last-modif, github-path, cve-id, vote-up, vote-down, is-favorited).
  • Design attributes for linking and tracking by including identity/source fields (uuid, original-uuid, source, github-path, user-id, editor) and descriptive/versioning fields (title, description, format, license, version, to-string).
  • Require title and uuid as core fields and set appropriate MISP attribute types and UI priorities for each attribute.

Testing

  • Ran the repository validation script ./validate_all.sh; the run produced environment warnings about a missing uuidparse binary but did not report object-specific schema errors for the new ruleset-metadata template before tool output was truncated.
  • The new file objects/ruleset-metadata/definition.json was checked by the repository validation pass that iterates over all object templates with no schema failures observed for this template.

Codex Task

@adulau adulau merged commit 17aadad into main Apr 10, 2026
7 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant