Expand OSINT, add threat_intelligence
#1255
Closed
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
jonrau-at-queryai
requested review from
floydtree,
pagbabian-splunk,
Aniak5,
mikeradka,
zschmerber and
davemcatcisco
as code owners
Signed-off-by: Jonathan Rau <[email protected]>
mikeradka
added
v1.4.0 or later
davemcatcisco
requested changes
Nov 21, 2024
| @@ -3232,6 +3232,11 @@ | |||
| "description": "The number of the entity. See specific usage.", | |||
| "type": "integer_t" | |||
| }, | |||
| "objective": { | |||
There was a problem hiding this comment.
Term very general. Suggest: threat_objective
| "type_id":{ | ||
| "caption":"Indicator Type ID", | ||
| "description":"The OSINT indicator type ID.", | ||
| "requirement":"required", | ||
| "requirement":"recommended", |
There was a problem hiding this comment.
This is a breaking change. A consumer could previously assume this attribute to be present but, if made optional, it can no longer make that assumption.
| "value":{ | ||
| "caption":"Indicator", | ||
| "description":"The actual indicator value in scope, e.g., a SHA-256 hash hexdigest or a domain name.", | ||
| "requirement":"required" | ||
| }, | ||
| "tlp":{ |
There was a problem hiding this comment.
Any reason why these attrbutes have been moved in the file? It makes it difficult for reviewers to see what has been deleted, which would be a breaking change. Would you be able to re-submit this without the movement of attributes?
| "description": "The latest time of a given subject of the threat intelligence analysis was encountered, if known.", | ||
| "requirement": "optional" | ||
| }, | ||
| "name": { |
There was a problem hiding this comment.
You editor is inserting tabs. You need to change to spaces.
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Description of changes:
Since there was not any appetite for STIX in the past, but there have been asks in the slack channel around more "traditional" elements of cyber threat intelligence such as reporting on the threat actor, campaign, behaviors, or otherwise I took another stab at it.
The Threat Intelligence object is purposely light meant to capture a lot of strings that can be adapted from several platforms. For instance, Crowdstrike Detects from the API provide an array of objects that describe
behaviorsand within each of these a behavior, MITRE tactics and techniques (or internal CRWD ones), scenarios, objective, and description is included (https://assets.falcon.crowdstrike.com/support/api/swagger.html#/detects/GetDetectSummaries)Additionally, other CTI and OSINT tools such as MISP, Shodan Monitor, AlienVault, and Recorded Future provide some other related strings that describe an indicator and its relationships.
This new object is within the overall
osintobject which is intended to be related to the indicator itself, and not the other way around. I can switch this around instead, but then we would have issues with the profile being swapped out.type_idenums toosint: Reg Key, Reg Value, Command Line (these all come from Crowdstrikeioc_type, specifically) but also are present in MDE.related_analyticstoosintthreat_intelligenceobject with a newobjectiveentry in the dictionary