{"action":"created","issue":{"url":"https://api.github.com/repos/ReconJSON/ReconJSON/issues/21","repository_url":"https://api.github.com/repos/ReconJSON/ReconJSON","labels_url":"https://api.github.com/repos/ReconJSON/ReconJSON/issues/21/labels{/name}","comments_url":"https://api.github.com/repos/ReconJSON/ReconJSON/issues/21/comments","events_url":"https://api.github.com/repos/ReconJSON/ReconJSON/issues/21/events","html_url":"https://github.com/ReconJSON/ReconJSON/issues/21","id":353070375,"node_id":"MDU6SXNzdWUzNTMwNzAzNzU=","number":21,"title":"Add fields to schema: tags, notes, source","user":{"login":"deadbits","id":1332757,"node_id":"MDQ6VXNlcjEzMzI3NTc=","avatar_url":"https://avatars1.githubusercontent.com/u/1332757?v=4","gravatar_id":"","url":"https://api.github.com/users/deadbits","html_url":"https://github.com/deadbits","followers_url":"https://api.github.com/users/deadbits/followers","following_url":"https://api.github.com/users/deadbits/following{/other_user}","gists_url":"https://api.github.com/users/deadbits/gists{/gist_id}","starred_url":"https://api.github.com/users/deadbits/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/deadbits/subscriptions","organizations_url":"https://api.github.com/users/deadbits/orgs","repos_url":"https://api.github.com/users/deadbits/repos","events_url":"https://api.github.com/users/deadbits/events{/privacy}","received_events_url":"https://api.github.com/users/deadbits/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":0,"created_at":"2018-08-22T18:26:20Z","updated_at":"2018-08-25T05:33:54Z","closed_at":null,"author_association":"NONE","body":"For use in OSINT apps, adding fields such as `tags`, `notes`, and `source` would be quite useful.\r\n- **Tag:** It's common to tag similar artifacts and then later search by tag to find them\r\n- **Notes:** If the artifact is used for an investigation, perhaps you want a simple note or two like \"Suspected to be involved in APT28 activity\" - which again could later be searched for or provide info to other analysts viewing the document\r\n- **Source:** Information is all good and well, but knowing where it came from helps give validity to that info and confidence that the information is accurate. Source might be just a URL of a website, the name of a tool, etc.\r\n\r\nUsing the contents from `host.md`, an example of these fields filled out would look like this:\r\n```\r\n[\r\n\t{\r\n\t\t\"type\":\"Host\",\r\n\t\t\"fqdn\":\"example.acme.com\",\r\n\t\t\"ip\":\"192.168.0.1\",\r\n\t\t\"domain\":\"acme.com\",\r\n\t\t\"company\":\"Acme\",\r\n                 \"tags\": [\"APT28\", \"cyber-espionage\"],\r\n                 \"notes\": [\"RT Incident #419\", \"Believed to be associated with Campaign X\"],\r\n                 \"source\": [\"Internal Research\", \"Splunk Alert\"],\r\n\t\t\"dns\":{...},\r\n\t\t\"ports\":{\r\n\t\t\t\"tcp\":[...],\r\n\t\t\t\"udp\":[...]\r\n\t\t}\r\n\t}\r\n]\r\n```"},"comment":{"url":"https://api.github.com/repos/ReconJSON/ReconJSON/issues/comments/415939658","html_url":"https://github.com/ReconJSON/ReconJSON/issues/21#issuecomment-415939658","issue_url":"https://api.github.com/repos/ReconJSON/ReconJSON/issues/21","id":415939658,"node_id":"MDEyOklzc3VlQ29tbWVudDQxNTkzOTY1OA==","user":{"login":"0xdevalias","id":753891,"node_id":"MDQ6VXNlcjc1Mzg5MQ==","avatar_url":"https://avatars1.githubusercontent.com/u/753891?v=4","gravatar_id":"","url":"https://api.github.com/users/0xdevalias","html_url":"https://github.com/0xdevalias","followers_url":"https://api.github.com/users/0xdevalias/followers","following_url":"https://api.github.com/users/0xdevalias/following{/other_user}","gists_url":"https://api.github.com/users/0xdevalias/gists{/gist_id}","starred_url":"https://api.github.com/users/0xdevalias/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/0xdevalias/subscriptions","organizations_url":"https://api.github.com/users/0xdevalias/orgs","repos_url":"https://api.github.com/users/0xdevalias/repos","events_url":"https://api.github.com/users/0xdevalias/events{/privacy}","received_events_url":"https://api.github.com/users/0xdevalias/received_events","type":"User","site_admin":false},"created_at":"2018-08-25T05:33:54Z","updated_at":"2018-08-25T05:33:54Z","author_association":"COLLABORATOR","body":"If these get added, I feel like they should be defined in a common `metadata` type structure which MAY contain each individually, and the `metadata` structure MAY be present on any of the other main types. This way we define support for it in a standard way, but it isn't required where tools don't want to implement it."}}
{"actor":{"display_login":"0xdevalias"}}