Re: [cti-users] Indicator Type / Vocabulary Implementation Questions

[John-Mark Gurney <jmg@newcontext.com>]

I have created an issue for this as when I was reviewing the vocab list, it did not cover our use case.

The issue I created:

https://github.com/STIXProject/specifications/issues/35

I believe that this will help people use the Vocab better, and may reduce the need for custom vocabs.

Please comment on this issue to provide feed back.

Thanks.

I have included the text of the issue here for reference:

There is a discussion on cti-users and cti-stix about improving the IndicatorTypeVocab.

I believe that having a vocab is a useful thing. But I believe the existing vocab needs to be improved.

First off, type information, like e-mail, ip, file hash, domain, etc. should be removed. You should/must be able to get this information from the Observable that is part of the Indicator.

For one, there is no vocab to describe a malicious observiable, say network packet, stream, or other activity. Though if the e-mail type is removed from Malicious E-mail, and it just became Malicious (Observable), then we would have something.

Removing type information would reduce the IndicatorTypeVocab down to:

Compromised

Malicious

Watchlist

C2

Anonymization

Exfiltration

The first three are interesting, Compromised means that this Observable indicates that you ARE compromised. The Malicious means that you WILL be compromised by this Observable and Watchlist means that you MAY get compromised by this Observable.

Arguably, C2 should fall under Compromised, but as it probably requires further investigation to figure out the original compromised host, I'm fine leaving this as it's own separate type.

On Fri, Oct 23, 2015 at 7:19 AM, Barnum, Sean D. <sbarnum@mitre.org> wrote:

I think the first step would be to enter an issue in the tracker for this so that we can get it on the table. I also agree with an earlier statement that the issue of default vocab values has clear overlap with the interoperability SC so while we need to work internally within the STIX SC for ensuring our default vocabs have the appropriate values for STIX use cases it probably also makes sense to work at a higher level on the process by which we define and manage the various default controlled vocabs.