← Prev in month ← Prev in thread

STIX 2.0 - Sightings object

From
Aharon Chernin
Date
2015-08-20T12:25:00+00:00
ID
Thread
STIX 2.0 - Sightings object
This should be "sightings object rethought". While coming up with a proposal, I spotted a different way of thinking about Sightings. In my opinion, the most important thing is determining which STIX object is being sighted. However, there is some other bits  of information that is useful: sightings producer and date/time of sighting.
Now take a look at the recent relationship object discussions:
Relationship Object Discussion:
ID  [1]: The ID of the  relationship , a simple random GUID
Marking [1]:  The ID of the marking  object  that you should reference
Version  [1]: The version of the  relationship ; a simple number to be used with the ID for version control
Type  [1]: The “type” of  relationship  being expressed.  (Not sure of how this works yet)

Description  [1]: A single simple and short description
Source  [1] : The ID of one or more source entities in the  relationship  as a URI (not QName)

Targets  [1..N]: The ID of one or more targets in the  relationship  as a URI (not QName)

Start  [1]: A timestamp in UTC stating when the  relationship  between the  object s  started, or the text 'unknown'.
End  [1]: A timestamp in UTC stating when the  relationship  between the  object s ended,  or the text 'ongoing', or the text 'unknown'.
Reliability/Confidence  [1]: A measure of confidence in the  relationship  using the Information Reliability scale.
Producer  [1]:  A simple producer  object  like what John calls out
Timestamp  [1]: A timestamp in UTC stating when the  relationship   object  was created.
Idea:
Could a sighting be a type of Relationship?
Relationship Object Discussion:
ID  [1]: <GUID>
Marking [1]:  TLP Green
Version  [1]: 1
Type  [1]: Sighting
Description  [1]: Soltra Edge reported Sighting
Source  [1] : Soltra
Targets  [1..N]: soltra:indicator-<GUID>
Start  [1]:
End  [1]:
Reliability/Confidence  [1]:
Producer  [1]:  Soltra
Timestamp  [1]: <timestamp>
Or is there more meta data we need to collect regarding sightings that a sighting deserves it's own object?
Aharon Chernin  CTO
SOLTRA
An FS-ISAC & DTCC Company
18301 Bermuda green Dr
Tampa, fl 33647
813.470.2173

www.soltra.com
← Prev in month ← Prev in thread