Taxonomies used in MISP taxonomy system and can be used by other information sharing tool.
MISP Taxonomies is a set of common classification libraries to tag, classify and organise information. Taxonomy allows to express the same vocabulary among a distributed set of users and organisations.
Taxonomies that can be used in MISP and other information sharing tool, are expressed in Machine Tags (Triple Tags). A machine tag is composed of a namespace (MUST), a predicate (MUST) and an (OPTIONAL) value. Machine tags are often called triple tag due to their format.
The following taxonomies can be used in MISP (as local or distributed tags) or in other tools and software willing to share common taxonomies among security information sharing tools.
CERT-XLM : CERT-XLM Security Incident Classification. Overview
DFRLab-dichotomies-of-disinformation : DFRLab Dichotomies of Disinformation. Overview
DML : The Detection Maturity Level (DML) model is a capability maturity model for referencing ones maturity in detecting cyber attacks. It's designed for organizations who perform intel-driven detection and response and who put an emphasis on having a mature detection program. Overview
GrayZone : Gray Zone of Active defense includes all elements which lay between reactive defense elements and offensive operations. It does fill the gray spot between them. Taxo may be used for active defense planning or modeling. Overview
PAP : The Permissible Actions Protocol - or short: PAP - was designed to indicate how the received information can be used. Overview
access-method : The access method used to remotely access a system. Overview
accessnow : Access Now classification to classify an issue (such as security, human rights, youth rights). Overview
acn : Cyber taxonomy for Italian National Cybersecurity Agency (ACN) Overview
acs-marking : The Access Control Specification (ACS) marking type defines the object types required to implement automated access control systems based on the relevant policies governing sharing between participants. Overview
action-taken : Action taken in the case of a security incident (CSIRT perspective). Overview
admiralty-scale : The Admiralty Scale or Ranking (also called the NATO System) is used to rank the reliability of a source and the credibility of an information. Reference based on FM 2-22.3 (FM 34-52) HUMAN INTELLIGENCE COLLECTOR OPERATIONS and NATO documents. Overview
adversary : An overview and description of the adversary infrastructure Overview
agent-threat-rules : Agent Threat Rules (ATR) is an open detection standard for AI agent threats published under Apache 2.0. The taxonomy organises 330 community-maintained rules across ten attack categories covering prompt injection, tool poisoning, skill compromise, context exfiltration, agent manipulation, privilege escalation, excessive autonomy, model abuse, model security, and data poisoning. Predicates name the category; values are individual rule identifiers in the form ATR-YYYY-NNNNN. Overview
ai-bias-terminology : A list of standalone definitions for each type of bias. Aggregate terms that are in common usage or relevance to AI bias. From NIST.SP.1270-draft (2021) Overview
ai-computer-assisted : Taxonomy describing the level of AI assistance and the level of review/update involved in the creation of an intelligence package or event. Overview
ai-safety-benchmark : AI safety benchmark v0.5, that has been created by the MLCommons AI Safety Working Group (WG) Overview
ais-marking : The AIS Marking Schema implementation is maintained by the National Cybersecurity and Communication Integration Center (NCCIC) of the U.S. Department of Homeland Security (DHS) Overview
analyst-assessment : A series of assessment predicates describing the analyst capabilities to perform analysis. These assessment can be assigned by the analyst him/herself or by another party evaluating the analyst. Overview
anti-piracy : Taxonomy for anti-piracy Overview
approved-category-of-action : A pre-approved category of action for indicators being shared with partners (MIMIC). Overview
artificial-satellites : This taxonomy was designed to describe artificial satellites Overview
