MISP-Taxonomies "code" reference removed

[pboccaletto]

In the last commit to MISP-Taxonomies (3a19202), the code field has been removed from the JSON.

This field is actively used by external tooling to help end users generate the taxonomy vector, so its removal has a direct impact on existing integrations and workflows.

@CSIRT-IT is there a specific reason for dropping the code field, and is there a recommended alternative or migration path for tools that depend on it?

[adulau]

"code" is not a standard field in the JSON schema of MISP taxonomy format.

[pboccaletto]

I fully acknowledge that code is not part of the standard MISP taxonomy schema.
That said, this specific JSON file is referenced by ACN as the authoritative source for their cyber taxonomy, so it is reasonable to expect that the corresponding code values defined in the ACN documentation would also be represented here.

If code cannot be reinstated because of schema constraints, an alternative field could be leveraged. For instance, the value field could carry the actual taxonomy code, as illustrated below.

Current format:

{
  "value": "impact",
  "expanded": "Impact",
  "uuid": "3232fe10-c03f-5d4d-b35f-6c8977f893ca"
}

Proposed format:

{
  "value": "IM",
  "expanded": "Impact",
  "uuid": "3232fe10-c03f-5d4d-b35f-6c8977f893ca"
}

This would keep the taxonomy compliant with the MISP schema while preserving alignment with the ACN reference taxonomy, as detailed in their official publication:
https://www.acn.gov.it/portale/documents/20119/552690/ACN_Tassonomia_Cyber_CLEAR.pdf/9595cc35-1c0b-4007-07b2-8f0468e5b82e?t=1762269780518

Would it be acceptable to open a pull request that should be reviewed by @CSIRT-IT implementing this structure?

[adulau]

Good point. Thank you very much.

This is up to @CSIRT-IT to update their taxonomy and make a pull-request with the changes.