$ show MISP/misp-taxonomies
This repository is a comprehensive library of machine-readable taxonomies (machine tags) for threat intelligence and information sharing, primarily designed for the MISP platform. It contains over 200 taxonomy definitions in a standardized JSON format, each defining a namespace with predicates and values for tagging events, attributes, and indicators. The taxonomies cover a wide range of domains including cyber incident classification, malware analysis, information handling policies (TLP, PAP, IEP), regulatory compliance (GDPR, NIS2, EU AI Act), attack modeling (kill chain, Diamond Model), and specialized areas like disinformation, AI safety, and drone classification. While the core content is data, the repository also includes a set of reusable Python tools for validation, generation, and conversion of taxonomies, as well as CI/CD pipelines and a JSON schema. The hybrid nature is evident: it is primarily a data library but with significant application-like tooling for maintaining and extending the taxonomy collection.
The LLM identified 5 files worth highlighting for reuse:
A standalone Python script that parses all taxonomy JSON files, validates their structure, and can dump all valid machine tags or generate AsciiDoc documentation. It demonstrates a reusable pattern for consuming the taxonomy schema and can be adapted for any project that needs to process or export machine tags.
The JSON Schema definition that all machinetag.json files must conform to. It defines the structure (namespace, predicates, values, UUIDs) and constraints. This schema is reusable for validating any new taxonomy or for building tools that generate or consume machine tags.
A cross-taxonomy mapping file that aligns equivalent terms across different classification schemes (e.g., mapping 'ransomware' across ECSIRT, malware_classification, VERIS, etc.). This pattern is reusable for any project that needs to reconcile multiple controlled vocabularies or enable interoperability between taxonomies.
A Python script that converts IAB Tech Lab's TSV-based content and audience taxonomies into MISP machine tag format. It demonstrates a clean, parameterized ETL pattern for ingesting external standards and generating structured taxonomy JSON files. The approach is reusable for converting any tabular data into the machine tag schema.
A validation script that checks all taxonomy JSON files against the schema, verifies predicate consistency, and ensures the MANIFEST.json is up-to-date. It is designed to be run in CI (GitHub Actions, Travis) and can be reused as a template for validating any collection of structured data files.