I thought I’d provide some context of how everyday threat intelligence analysts share IP addresses. On one fairly popular email list with ~650 active participants, there were about 5,370 messages that contained tens of thousands of indicators of compromise (IOCs). In these messages:
· Analysts shared individual IP addresses 4,695 times
· Analysts shared a CIDR block 124 times
· Of these 124 times, only 6 times were they referring to an individual IP address
· Of these 6 individual CIDR blocks with /32, they were only one analyst ever referred to an IP this way
I continue to believe that, while it’s certainly a fine way to represent an individual IP address, most analysts don’t think to add it at the end when they’re talking about an individual IP. My personal preference would be for the language to assume that if an IP address object doesn’t have a slash in the address or a CIDR property that it is assumed to be an individual IP address and neither the user nor the tool needs to know to write /32 at the end of it.
I’m not intentionally trying to start a flame war, but I do continue to believe that (at least as long as people are still developing the tools that use CybOX / STIX) we will have humans making it or consuming it manually / by hand.
Alex