Help me

[Sotirios Raptis <sraptis@uom.edu.gr>]

Hi, 

I am currently investigating(PhD student) using STIX and TAXII to facilitate sharing data 

from a wide range of Darknet(as honeypot). 

One fact I find confusing is how one is expected to nest the different 

types of observables, indicators, incidents, etc. 

I would like to create a “use case” or some desired action. Is it a big issue? Is the CTI community hoping for an analysis like this?

Any hints or guidance would be highly appreciated. 

regards, 

Sotiris

-- 

Σωτήριος Μ. Ράπτης

--

Sotirios M. Raptis

ICT Security Researcher

Member of Information Security Research Group (InfoSec) (http://infosec.uom.gr)

University of Macedonia (UOM), 156 Egnatia str, 54006 Thessaloniki, Greece

tel: +302310891841 | fax: +302310891812 | email: sraptis@uom.edu.gr, sraptis@uom.gr