Taxonomies in MISP are a triple of
(namespace, predicate, value) referred to as "machinetags".
Galaxies seem to be similar. The MISP galaxy docs state that
MISP galaxy is a simple method to express a large object called cluster that can be attached to MISP events or attributes.
Objects in MISP allow combinations of attributes, and the format definitions provide a common set of formats for modeling complex objects. Objects can also model relationships to other objects.
Taxonomies, galaxies, and objects are all defined via a set of open JSON definitions.
What is not clear is when should I use a tag from a taxonomy, a galaxy cluster, or an object to model some attribute about an event. The overlap between machine tags in a taxonomy and clusters in a galaxy is particularly unclear to me
The JSON definitions of events for all these types can be found here:
- Taxonomies: https://github.com/MISP/misp-taxonomies
- Galaxy: https://github.com/MISP/misp-galaxy
- Objects: https://github.com/MISP/misp-objects
According to the docs, "galaxy" is a reserved namespace within the MISP taxonomy.
The docs for all 3 invite contributions of additional elements
The RFCs for the core format, taxonomy, galaxy, and objects can be found here:
This topic (when to use taxonomy vs galaxy vs object) is not addressed in recent training materials: https://www.circl.lu/assets/files/misp-training/luxembourg2018/6-taxonomies.pdf
Objects vs attributes
Both of different from tags since they allow the user to set values. So for the attribute
Artifacts dropped: md5 the user can set the value of the
md5 hash. Tags are just binary flags.
Objects are different from attributes since they can model a bundle of tags that can describe a single concept, like a user or a bank account, and they can then model relationships between these tag bundles.
Perhaps the difference between taxonomy and galaxy is related to the complexity of the definitions?
Each machine tag in a taxonomy usually just has
expanded defined: https://github.com/MISP/misp-taxonomies/blob/master/veris/machinetag.json
Each machine tag in a galaxy has
meta (which is a nested object containing more details:
The sample galaxy from the core format RFC adds significantly more details than a tag: https://tools.ietf.org/html/draft-dulaunoy-misp-core-format-03#section-2.10.1