relationships

["Jordan, Bret" <bret.jordan@bluecoat.com>]

All,

Here are the currently relationships that we have defined on the TLOs... I know this is not all that needs to be there... PLEASE help us figure out what is missing...

NOTE: these are all sorted as source relationships:

attack-pattern uses malware
attack-pattern uses tool
attack-pattern targets identity

campaign attributed-to threat-actor
campaign uses attack-pattern
campaign uses malware
campaign uses tool
campaign targets identity

identity evidenced-by observation

indicator indicates threat-actor
indicator indicates malware
indicator indicates tool
indicator indicates campaign
indicator indicates attack-pattern

malware variant-of malware

threat-actor attributed-to identity
threat-actor uses-persona identity
threat-actor impersonates identity
threat-actor uses malware
threat-actor uses attack-pattern
threat-actor uses tool
threat-actor targets identity

Thanks,

Bret

Bret Jordan CISSP

Director of Security Architecture and Standards | Office of the CTO

Blue Coat Systems

PGP Fingerprint: 63B4 FC53 680A 6B7D 1447  F2C0 74F8 ACAE 7415 0050

"Without cryptography vihv vivc ce xhrnrw, however, the only thing that can not be unscrambled is an egg." 

Attachment: signature.asc
Description: Message signed with OpenPGP using GPGMail