definition.json

{
  "attributes": {
    "classification": {
      "description": "Classification of the RTIR ticket",
      "misp-attribute": "text",
      "multiple": true,
      "ui-priority": 1
    },
    "constituency": {
      "description": "Constituency of the RTIR ticket",
      "misp-attribute": "text",
      "ui-priority": 0
    },
    "ip": {
      "description": "IPs automatically extracted from the RTIR ticket",
      "misp-attribute": "ip-dst",
      "multiple": true,
      "ui-priority": 0
    },
    "queue": {
      "description": "Queue of the RTIR ticket",
      "misp-attribute": "text",
      "sane_default": [
        "incident",
        "investigations",
        "blocks",
        "incident reports"
      ],
      "ui-priority": 0
    },
    "status": {
      "description": "Status of the RTIR ticket",
      "disable_correlation": true,
      "misp-attribute": "text",
      "sane_default": [
        "new",
        "open",
        "stalled",
        "resolved",
        "rejected",
        "deleted"
      ],
      "ui-priority": 0
    },
    "subject": {
      "description": "Subject of the RTIR ticket",
      "misp-attribute": "text",
      "ui-priority": 0
    },
    "ticket-number": {
      "description": "ticket-number of the RTIR ticket",
      "misp-attribute": "text",
      "ui-priority": 0
    }
  },
  "description": "RTIR - Request Tracker for Incident Response",
  "meta-category": "misc",
  "name": "rtir",
  "requiredOneOf": [
    "ticket-number"
  ],
  "uuid": "7534ee19-0a1f-4f46-a197-e6e73e457943",
  "version": 2
}