rule.yml

title: Advanced Rule
uuid: 56722e01-7d19-4c49-ace3-6212f8370047
related:
  - uuid: 28ebfa51-952d-4b67-b67a-33d638d29b98
    type: derives
status: production
description: |
  This is an advanced rule.
  I tried to use every field in order to create a good example file.
author: Nils Kuhnert
created: 2020-10-07
modified: 2020-10-07
classification:
  - type: tlp
    value: green
  - type: pap
    value: green
condition:
  - AND:
    - OR:
      - AND:
        - AND:
          - type: "shodan"
            query: "HTTP/1.1 418 teapot"
          - NOT:
              type: "shodan"
              query: "HTTP/1.1 200 OK"
        - type: "shodan"
          query: "SSH-2.0-OpenSSH_7.4p1 Ubuntu-10"
      - type: "shodan"
        query: "HTTP/2 418 teapot"
    - type: "passivedns"
      query: "domain:*.site"
threatactor: EvilSloth
malwarefamily: Generic
references:
  - https://github.com/3c7/infrastructure-tracking-schema
# Example for the custom key
custom:
  alerts:
    mattermost:
      - team: my-team
        channel: notifications
  ingest:
    elasticsearch: myindex
    misp: myeventuuid