STIX MVP

Capability

2.0

2.x

Never

Relationships

Standardized Relationships

Relationships pre-defined in STIX

X

User-Defined Relationships

Ability to use relationships that
 were not pre-defined in STIX

X

Indicator
 Use Cases

Indicators

Basic indicator object

X

CybOX Indicator Patterns

Use of "native" CybOX patterning for indicator patterns

x

Third-Party Indicator Patterns

Use of Snort, Yara, OpenIOC, and other signature formats as patterns

X

Sightings

Ability to create and share sightings of indicators, however it's
 done

X

Incident
 Use Cases

Incident Basics

Just the basics needed to track incidents

X

Asset Stub

A stub of an asset model, abstracted out of Incident, likely a pointer

X if basic definition

X if this means only a ext ref

Complete Asset Model

A more complete asset model that defines many fields

X

Advanced Incident

Impacts, detailed analytics, etc.

X if this means incident as in 1.2
X if above an beyond

"Investigation" (pre-incident)

Something to track "events", "investigations", and other activity
 that may not be an incident yet.

X

Analysis
 Objects

Attack Patterns

See STIX 1.2
AttackPatternType

X

Exploits

See STIX 1.2
ExploitType
(note: NOT ExploitTargetType)

X

Kill Chains

See STIX 1.2
KillChainType
 and KillChainPhaseType

X

Malicious Infrastructure

See STIX 1.2
InfrastructureType

X

Malicious Tool

See STIX 1.2
ToolType

X

Malware

See STIX 1.2
MalwareType

X

Persona

See STIX 1.2
PersonasType
 (was just an identity)

X

Victim Targeting

See STIX 1.2
VictimTargetingType

X

Need more than basic identity

Configuration/Misconfiguration

See STIX 1.2
ConfigurationType

X

Vulnerability

See STIX 1.2
VulnerabilityType

X

Weakness

See STIX 1.2
WeaknessType

X

Attribution
 & Tracking

Threat Actor

See STIX 1.2
ThreatActorType

X

Campaign

See STIX 1.2
CampaignType

X

Intrusion Set

Representation of intrusion sets, separate from actors and campaigns

?

Response
 Actions

Course of Action

See STIX 1.2
CourseOfActionType

X

Automated Course of Action

Structured representation for automating courses of action

X

Data Markings

Object-Level Markings

Markings applied to a complete top-level object (Level 1 Markings)

X

Field-Level Markings

Markings applied to individual fields within objects (Level 2 Markings)

X

TLP Marking Definition

Representation of a TLP marking

X

Copyright/TOU Marking Definition

Representation of Copyright/TOU markings

X

Consensus "STIX Default" Marking Definition

Representation of a more complete, consensus, "better than TLP" marking

X

Cross-Cutting
 Capabilities

Packaging around TLOs (Package object)

STIX "package" object, whatever that turns into

X

Reports

Report object

X

Internationalization

Support for STIX content in multiple languages/localizations

X

Basic Identity

Small set of critical properties

X

Full Identity

Extensive identity representation, similar to CIQ

X

Don’t need all of CIQ but relevant portions

References/Sources

References to non-STIX content and information sources

X

Defensive Tools

Representation of information about tools used for defense or to
 create content.

X

At least use Tool 

Rich Text

HTML, Markdown, or some other rich text format for descriptions

X

Versioning

Ability to version and revoke content

X

Vendor-Defined Fields

Definition and conformance for how vendors can extend STIX

X

Representing Confidence

Representation of confidence in the accuracy of information

X

Representing Impact / Potential Impact

Representations of actual or potential impact of threats (e.g. for
 malware)

X

Custom Vocabularies

Ability to use custom (non-standard) vocabularies in places we have
 standard vocabularies defined

X

Opinion/Assert Object

Ability to represent opinions / assertions about STIX content created
 by others

X

STIX Request/Response

Ability to create asynchronous STIX requests and responses for information
 beyond a single TAXII server

X

Generic Tagging

Ability to tag STIX top-level objects with generic text

X