Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[RFC] Cyber Threat Intelligence Fields Stage 1 #1037

Merged
merged 8 commits into from
Nov 9, 2020
Merged

[RFC] Cyber Threat Intelligence Fields Stage 1 #1037

Changes from 1 commit
Commits
Show all changes
8 commits
Select commit Hold shift + click to select a range
d3a93da
Update 0008-threat-intel.md
shimonmodi Oct 19, 2020
566f47f
Update rfcs/text/0008-threat-intel.md
shimonmodi Oct 21, 2020
9ae14d6
Update rfcs/text/0008-threat-intel.md
shimonmodi Oct 21, 2020
a1444a0
Update 0008-threat-intel.md
shimonmodi Oct 27, 2020
5169502
Update 0008-threat-intel.md
shimonmodi Nov 3, 2020
ecf81c7
Update 0008-threat-intel.md
shimonmodi Nov 3, 2020
17e311f
Update rfcs/text/0008-threat-intel.md
shimonmodi Nov 5, 2020
f85db96
Update 0008-threat-intel.md
shimonmodi Nov 5, 2020
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions rfcs/text/0008-threat-intel.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
# 0008: Cyber Threat Intelligence Fields
<!-- Leave this ID at 0000. The ECS team will assign a unique, contiguous RFC number upon merging the initial stage of this RFC. -->

- Stage: **0 (strawperson)** <!-- Update to reflect target stage. See https://elastic.github.io/ecs/stages.html -->
- Stage: **1 (strawperson)** <!-- Update to reflect target stage. See https://elastic.github.io/ecs/stages.html -->
shimonmodi marked this conversation as resolved.
Show resolved Hide resolved
- Date: **2020-10-15** <!-- The ECS team sets this date at merge time. This is the date of the latest stage advancement. -->

Elastic Security Solution will be adding the capability to ingest, process and utilize threat intelligence information for increasing detection coverage and helping analysts making quicker investigation decisions. Threat intelligence can be collected from a number of sources with a variety of structured and semi-structured data representations. This makes threat intelligence an ideal candidate for ECS mappings. Threat intelligence data will require ECS mappings to normalize it and make it usable in our security solution. This RFC is focused on identifying new field sets and values that need to be created for threat intelligence data. Existing ECS field reuse will be prioritized where possible. If new fields are required we will utilize [STIX Cyber Observable data model](https://docs.oasis-open.org/cti/stix/v2.1/cs01/stix-v2.1-cs01.html#_mlbmudhl16lr) as guidance.
Expand Down Expand Up @@ -111,7 +111,7 @@ e.g.:

<!-- An RFC should link to the PRs for each of it stage advancements. -->

* Stage 0: https://github.com/elastic/ecs/pull/986
* Stage 1: https://github.com/elastic/ecs/pull/986
shimonmodi marked this conversation as resolved.
Show resolved Hide resolved

<!--
* Stage 1: https://github.com/elastic/ecs/pull/NNN
Expand Down