Threat Actor DB Working Group

[JG <jg@ctin.us>]

CTI TC:

Recently there has been some discussion on the Slack #general channel about the need for a Threat Actor database using STIX 2.1 as a community-wide resource. A working group on this topic will be convened on Friday, August 2nd at 11:00 a.m. US Eastern Daylight Time (15:00 UTC). The call-in information is on the Kavi calendar, as given below.Â

The impetus for this discussion came from a recent report published by Thai CERT, which I have attached here (i.e., Threat Group Cards). It has been noted by various TC members that, in addition to this, there are currently multiple open source resources that CTI analysts rely on including, but not limited to, the following:

• Florian Roth et. al. Matrix ( https://docs.google.com/spreadsheets/u/1/d/1H9_xaxQHpWaa4O_Son4Gx0YOIzlcBWMsdvePFX68EKU/pubhtml
  
• ATT&CK 'Groups' ( https://attack.mitre.org/groups/ )
• MISP-Galaxy ( https://github.com/MISP/misp-galaxy/blob/master/clusters/threat-actor.json )
• Others???

Furthermore, CERT.be is currently working on an OpenCTI version which they hope to make available soon.

As everyone is aware the naming conventions are different in the various frameworks which leads to confusion when reporting on Threat Actor activity. This is one of the problem sets we hope to discuss in this Working Group.Â

Please join the call if you have an interest in this topic. If you are unable to join the call, but would like to be included in future calls, please let me know and I'll add you to the distribution list for this Working Group.

******************************************************

Threat Actor DB Working Group

Friday, August 2ÂÂ |Â 11:00am â Noon US EDT (15:00 UTC)

ÂÂÂ Zoom | https://newcontext.zoom.us/j/332585406

ÂÂÂ Agenda:
ÂÂ ÂÂ Â Discuss need for harmonizing various Threat Actor taxonomies as community resource
ÂÂ ÂÂ Â Discuss framework & coordination
ÂÂÂ Â Â Discuss resources for accomplishing task

*****************************************************

Best regards,

-- 
*****************************
Jane Ginn, MSIA, MRP
Secretary, OASIS CTI TC
jg@ctin.us
001 (928) 399-0509
*****************************

Attachment: Threat Group Cards.pdf
Description: Adobe PDF document