for tomorrow's CTI STIX working call

[Allan Thomson <athomson@lookingglasscyber.com>]

Last week we discussed an action to update the existing Event object to describe broader use cases than purely investigation notification.

 

This included events that may have

 

• Notifications (textual and IOC based)
• Observed networks (blacklists…etc) that should be associated with COA or not
• Recommended COA vs Taken COA

 

Please find attached some modifications as *proposed* changes to Event SDO for discussion and review tomorrow.

 

Allan

 

 

Attachment: stix-events.docx
Description: stix-events.docx