digital-forensics-labs/digital-forensics-lab
1
0
Fork 0
mirror of https://github.com/frankwxu/digital-forensics-lab.git synced 2026-04-10 12:13:44 +00:00
Code Issues Packages Projects Releases Wiki Activity

add cloud storage object

Browse Source
This commit is contained in:
Frank Xu
2021-02-15 08:46:35 -05:00
parent a8cf1edd91
commit 4f2c32327f
4 changed files with 631 additions and 398 deletions
Download Patch File Download Diff File Expand all files Collapse all files

989
STIX_for_digital_forensics/CFO_intro.svg
View File

File diff suppressed because it is too large Load Diff
Side by Side Swipe Overlay

Before

Width:  |  Height:  |  Size: 59 KiB

After

Width:  |  Height:  |  Size: 72 KiB

BIN
STIX_for_digital_forensics/CFO_intro.vsdx Normal file
View File

Binary file not shown.

40
STIX_for_digital_forensics/readme.md
View File

@@ -778,14 +778,38 @@ Specify a partition with NTFS
Cloud Storage object represent a cloud space to store data.
| Property Name | Type | Description |
| --------------- | ----------------- | -------------------------------------------------------------------------------------- |
| type (required) | string | The value of this property MUST be x-cloud-storage. |
| app_ref | identifier | Specifier the software. The value MUST be an ID reference to Software. |
| url_ref | identifier | Specifier the url to the storage. The value MUST be an ID reference to URL. |
| local_directory | identifier | Specifier the local storage directory. The value MUST be an ID reference to Directory. |
| contains_refs | list of type file | Specifier a list of Files. |
| size | integer | Specifier the size of storage in MB. |
| Property Name | Type | Description |
| ------------------- | ----------------- | -------------------------------------------------------------------------------------- |
| type (required) | string | The value of this property MUST be x-cloud-storage. |
| software_ref | identifier | Specifier the software. The value MUST be an ID reference to Software. |
| cloud_url_ref | identifier | Specifier the url to the storage. The value MUST be an ID reference to URL. |
| cloud_file_refs | list of type file | Specifier a list of Files on the cloud. |
| local_directory_ref | identifier | Specifier the local storage directory. The value MUST be an ID reference to Directory. |
| size | integer | Specifier the size of cloud storage in MB. |
### Relationships
| Source | Relationship Type | Target | Description |
| --------------- | ----------------- | ------------ | ------------------------------------------------------------------------- |
| x-cloud-storage | requires | user-account | This Relationship describes that a Cloud Storage requires a User Account. |
### Example 1: describes a "logon" event recorded in the security event file.
```json
{
"type": "x-cloud-storage",
"spec_version": "2.1",
"id": " x-cloud-storage--771c2a9a-db0c-4328-bfa0-5d1b5359da45",
"software_ref": "software--fe5b3c0d-810c-4e08-bdff-de9084aff90d",
"cloud_url_ref": "url--26164fad-f2c1-4aee-b517-bbedb84094ec",
"cloud_file_refs": [
"file--39f88548-ff7f-4377-a79e-bd95aa92bf0b",
"file--dc2771e8-5b45-4e39-a162-a1465e80850f"
],
"local_directory_ref": "directory--2c1f4e62-c6c7-48cc-b682-cbc04dc7c27b",
"size": 150000
}
```
## Windows Event Object

BIN
STIX_for_digital_forensics/~$$CFO_intro.~vsdx Normal file
View File

Binary file not shown.