Metadata
Shared metadata block present on all Tide objects (threat, objective, rule). Provides identity, schema routing, versioning, provenance, and classification.
Requirements
- Every core object MUST include a
metadataobject. metadata.schemaMUST be a registered schema identifier; unknown identifiers are invalid.metadata.uuidMUST be a UUIDv4 string.metadata.versionMUST be present (semver string or integer).metadata.createdandmetadata.modifiedMUST be ISO 8601 date or datetime strings (coerced to string on load).metadata.tlpMUST be a valid Traffic Light Protocol value from thetlpvocabulary.metadata.pap, when present, MUST be apapvocabularyname(white,green,amber,red).metadata.author,metadata.contributors, andmetadata.organisationMAY be omitted.metadata.reviewed, when present, MUST be an ISO 8601 date or datetime string (coerced to string on load). A date-only value denotes 00:00:00Z on that date. The field is defined only formetadata.schema: rule::1.1.threat::1.0,objective::1.0, andrule::1.0MUST reject it.
Definition
metadata (ObjectMetadata)
| Field | Type | Required | Description |
|---|---|---|---|
uuid | string (UUIDv4) | yes | Globally unique object identifier |
schema | string | yes | Schema identifier, e.g. rule::1.0 (alias: schema_id in Pydantic) |
version | string | integer | yes | Business version of this instance |
created | string | yes | Creation date |
modified | string | yes | Last modification date |
tlp | string | yes | Traffic Light Protocol classification |
pap | string | no | Permissible Actions Protocol classification. Omitted means no PAP tag on share. |
author | string | no | Primary author |
contributors | list[string] | no | Additional contributors |
organisation | Organisation | no | Owning organisation |
reviewed | string | no | Last human review of a detection rule. Defined only for rule::1.1. Omitted means no recorded review. Staleness is defined in rule-1.1.md. |
organisation (Organisation)
| Field | Type | Required | Description |
|---|---|---|---|
uuid | string | yes | Organisation UUID. Sharing uses it as the default publishing organisation. |
name | string | yes | Organisation display name |
references (ObjectReferences)
Optional on threat, objective, and rule objects.
| Field | Type | Required | Description |
|---|---|---|---|
public | map[integer, string] | no | Public reference IDs to URLs (YAML int keys coerced on load) |
internal | map[string, string] | no | Internal reference keys to URLs |
reports | list[string] | no | Report links |
Relationships
- versioning.md —
metadata.schemaandmetadata.versionsemantics - specs/vocabularies/catalog.md —
tlpandpapvocabularies - sharing/misp-1.0.md — consumes
metadata.tlp, optionalmetadata.pap, andmetadata.organisation.uuidas the publishing organisation unless the[[misp]]block overrides it - Object specs — embed
metadataas required top-level block - objects/rule-1.1.md — optional
metadata.reviewedand the unreviewed-rule predicate
Defaults & overrides
No client overrides for metadata structure. Template generation MAY pre-fill dates and placeholder UUIDs via opentide generate templates.
Examples
metadata:
uuid: 00000000-0000-4000-8003-000000000001 # UUIDv4, unique across the repo
schema: rule::1.0 # registered schema identifier
version: 1 # instance content version
created: "2026-01-01"
modified: "2026-01-02"
tlp: clear # from the `tlp` vocabulary- Valid metadata on a rule: fixtures/valid/rule-1.0.yaml
- Invalid UUID: fixtures/invalid/rule-bad-uuid.yaml
History
Versioning
`metadata.schema` says which shape an object has. `metadata.version` says how that object's content has changed. They are not interchangeable.
Workspace layout
Defines the standard detection-repository directory layout scaffolded by `opentide setup` and used for object storage, generated artifacts, documentation mirrors, and client configuration overrides.