misp-objects/objects/nova-rule/definition.json at main · MISP/misp-objects · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
{
  "attributes": {
    "author": {
      "description": "Rule author from the meta section.",
      "disable_correlation": true,
      "misp-attribute": "text",
      "ui-priority": 2
    },
    "category": {
      "description": "Rule category from the meta section, such as jailbreak, injection, unicode, OWASP LLM, or incident.",
      "misp-attribute": "text",
      "multiple": true,
      "ui-priority": 1
    },
    "condition": {
      "description": "Boolean condition expression defining when the rule matches.",
      "disable_correlation": true,
      "misp-attribute": "text",
      "ui-priority": 1
    },
    "description": {
      "description": "Human-readable description from the meta section.",
      "misp-attribute": "text",
      "ui-priority": 1
    },
    "file": {
      "description": "Source .nov filename containing the rule.",
      "disable_correlation": true,
      "misp-attribute": "filename",
      "ui-priority": 2
    },
    "keyword": {
      "description": "Keyword selector from the keywords section, including exact strings or regex patterns.",
      "misp-attribute": "text",
      "multiple": true,
      "ui-priority": 2
    },
    "keyword-id": {
      "description": "Identifier of a keyword selector, such as $keyword1.",
      "disable_correlation": true,
      "misp-attribute": "text",
      "multiple": true,
      "ui-priority": 3
    },
    "llm-check": {
      "description": "Natural-language LLM evaluation prompt from the llm section.",
      "misp-attribute": "text",
      "multiple": true,
      "ui-priority": 2
    },
    "llm-threshold": {
      "description": "Threshold associated with an LLM selector.",
      "disable_correlation": true,
      "misp-attribute": "float",
      "multiple": true,
      "ui-priority": 2
    },
    "raw-rule": {
      "description": "Original raw NOVA rule content.",
      "disable_correlation": true,
      "misp-attribute": "text",
      "ui-priority": 3
    },
    "reference": {
      "description": "Reference URL for the NOVA rule, repository, documentation, or related detection category.",
      "disable_correlation": true,
      "misp-attribute": "link",
      "multiple": true,
      "ui-priority": 3
    },
    "rule-name": {
      "description": "Name of the NOVA rule declared after the rule keyword.",
      "disable_correlation": true,
      "misp-attribute": "text",
      "ui-priority": 1
    },
    "semantic-pattern": {
      "description": "Semantic selector text from the semantics section.",
      "misp-attribute": "text",
      "multiple": true,
      "ui-priority": 2
    },
    "semantic-threshold": {
      "description": "Threshold associated with a semantic selector.",
      "disable_correlation": true,
      "misp-attribute": "float",
      "multiple": true,
      "ui-priority": 2
    },
    "severity": {
      "description": "Rule severity from the meta section.",
      "disable_correlation": true,
      "misp-attribute": "text",
      "ui-priority": 1,
      "values_list": [
        "low",
        "medium",
        "high",
        "critical"
      ]
    }
  },
  "description": "NOVA prompt detection rule metadata and logic for a single NOVA rule.",
  "meta-category": "detection",
  "name": "nova-rule",
  "requiredOneOf": [
    "keyword",
    "semantic-pattern",
    "llm-check",
    "raw-rule",
    "file",
    "description"
  ],
  "uuid": "3c4669ee-c659-40c7-93ea-d4149bded584",
  "version": 1
}