Threat Actor and Identity

["Wunder, John A." <jwunder@mitre.org>]

Hey all,

 

In an effort to kick-start the identity and threat actor discussion, a few of us got together yesterday and spent some time fleshing out a first shot at them. Please take a look in the document and see if what we have will work for MVP:

 

Identity: https://docs.google.com/document/d/1F1c05GgYaJFV1Z04B8c_T3vEE-LRQTPExF24LvOQAsk/edit#heading=h.ja9ea729i9rh

Threat Actor: https://docs.google.com/document/d/1F1c05GgYaJFV1Z04B8c_T3vEE-LRQTPExF24LvOQAsk/edit#heading=h.m7vja8o49dq0

 

I know that Identity in particular probably doesn’t have all of the fields we eventually want to add. We included fields for usernames, addresses, and phone numbers as RESERVED so we can talk through them for 2.1. Our worry was that if we tried to completely flesh out indicator for 2.0 we would either get it wrong or run out of time, so the set we have included now is intended to cover just the primary use cases.

 

John