definition.json

{
  "attributes": {
    "Source": {
      "description": "Source of the message.(Contact details)",
      "disable_correlation": true,
      "misp-attribute": "text",
      "ui-priority": 0
    },
    "additional-comments": {
      "categories": [
        "External analysis"
      ],
      "description": "Comments.",
      "disable_correlation": true,
      "misp-attribute": "text",
      "ui-priority": 0
    },
    "app-used": {
      "description": "Application used to send the message.",
      "disable_correlation": true,
      "misp-attribute": "text",
      "ui-priority": 0
    },
    "attachments": {
      "categories": [
        "External analysis"
      ],
      "description": "External references",
      "misp-attribute": "link",
      "multiple": true,
      "ui-priority": 0
    },
    "datetime-received": {
      "description": "date and time when the message was received.",
      "disable_correlation": true,
      "misp-attribute": "datetime",
      "multiple": true,
      "ui-priority": 0
    },
    "datetime-sent": {
      "description": "date and the time when the message was sent.",
      "disable_correlation": true,
      "misp-attribute": "datetime",
      "ui-priority": 0
    },
    "destination": {
      "description": "Destination of the message.(Contact details)",
      "disable_correlation": true,
      "misp-attribute": "text",
      "ui-priority": 0
    },
    "message": {
      "description": "Message exchanged.",
      "misp-attribute": "text",
      "ui-priority": 0
    },
    "message-type": {
      "description": "the type of message extracted from the forensic-evidence.",
      "disable_correlation": true,
      "misp-attribute": "text",
      "sane_default": [
        "SMS",
        "MMS",
        "Instant Message (IM)",
        "Voice Message"
      ],
      "ui-priority": 0
    },
    "subject": {
      "description": "Subject of the message if any.",
      "misp-attribute": "text",
      "ui-priority": 0
    }
  },
  "description": "An Object Template to gather information from evidential or interesting exchange of messages identified during a digital forensic investigation.",
  "meta-category": "misc",
  "name": "tsk-chats",
  "required": [
    "message-type",
    "message"
  ],
  "uuid": "6b71f231-c502-467f-bc67-1423cd5bf800",
  "version": 1
}