Liking cljdoc? Tell your friends :D

Indicator Object

An indicator is a test, or a collection of judgements that define criteria for identifying the activity, or presence of malware, or other unwanted software.

We follow the STiX IndicatorType closely, with the exception of not including observables within the indicator, and preferring a specification object encoded in JSON as opposed to an opaque implementation block.

Additional, you will want to either define judgements against Observables that are linked to this indicator, with the ID in the indicators field of those Judgements, or you can provide a specification value.

PropertyTypeDescriptionRequired?
idStringGlobally unique URI identifying this object.✓
producerShortString String ✓
schema_versionStringCTIM schema version for this entity✓
typeIndicatorTypeIdentifier StringThe fixed value indicator✓
valid_timeValidTime ObjectThe time range during which this Indicator is considered valid.✓
composite_indicator_expressionCompositeIndicatorExpression Object
confidenceHighMedLow Stringlevel of confidence held in the accuracy of this Indicator
descriptionMarkdown StringA description of object, which may be detailed.
external_idsString List
external_referencesExternalReference Object ListSpecifies a list of external references which refers to non-CTIM information. This property is used to provide one or more URLs, descriptions, or IDs to records in other systems.
indicator_typeIndicatorType String ListSpecifies the type or types for this Indicator
kill_chain_phasesKillChainPhase Object Listrelevant kill chain phases indicated by this Indicator
languageShortString StringThe human language this object is specified in.
likely_impactLongString Stringlikely potential impact within the relevant context if this Indicator were to occur
negateBooleanspecifies the absence of the pattern
revisionIntegerA monotonically increasing revision, incremented each time the object is changed.
severityHighMedLow String
short_descriptionMedString StringA single line, short summary of the object.
sourceMedString String
source_uriString
specificationJudgementSpecification Object
tagsShortString String ListDescriptors for this indicator
test_mechanismsMedString String ListTest Mechanisms effective at identifying the cyber Observables specified in this cyber threat Indicator
timestampInst (Date)The time this object was created at, or last modified.
titleShortString StringA short title for this object, used as primary display and reference value
tlpTLP StringSpecification for how, and to whom, this object can be shared.

Property composite_indicator_expression ∷ CompositeIndicatorExpression Object

  • This entry is optional

Property confidence ∷ HighMedLow String

level of confidence held in the accuracy of this Indicator

  • This entry is optional

Property description ∷ Markdown String

A description of object, which may be detailed.

  • This entry is optional

    • Markdown string with at most 5000 characters

Property external_ids ∷ String List

  • This entry is optional
  • This entry's type is sequential (allows zero or more values)

Property external_references ∷ ExternalReference Object List

Specifies a list of external references which refers to non-CTIM information. This property is used to provide one or more URLs, descriptions, or IDs to records in other systems.

  • This entry is optional
  • This entry's type is sequential (allows zero or more values)

Property id ∷ String

Globally unique URI identifying this object.

  • This entry is required

    • IDs are URIs, for example https://www.domain.com/ctia/judgement/judgement-de305d54-75b4-431b-adb2-eb6b9e546014 for a Judgement. This ID type compares to the STIX id field. The optional STIX idref field is not used.

Property indicator_type ∷ IndicatorType String List

Specifies the type or types for this Indicator

  • This entry is optional

  • This entry's type is sequential (allows zero or more values)

    • Allowed Values:
      • Anonymization
      • C2
      • Compromised PKI Certificate
      • Domain Watchlist
      • Exfiltration
      • File Hash Watchlist
      • Host Characteristics
      • IMEI Watchlist
      • IMSI Watchlist
      • IP Watchlist
      • Login Name
      • Malicious E-mail
      • Malware Artifacts
      • URL Watchlist
    • Reference: IndicatorTypeVocab

Property kill_chain_phases ∷ KillChainPhase Object List

relevant kill chain phases indicated by this Indicator

  • This entry is optional
  • This entry's type is sequential (allows zero or more values)
  • Dev Notes: simplified

Property language ∷ ShortString String

The human language this object is specified in.

  • This entry is optional

    • String with at most 1024 characters

Property likely_impact ∷ LongString String

likely potential impact within the relevant context if this Indicator were to occur

  • This entry is optional

    • String with at most 5000 characters

Property negate ∷ Boolean

specifies the absence of the pattern

  • This entry is optional

Property producer ∷ ShortString String

  • This entry is required

  • Dev Notes: TODO - Document what is supposed to be in this field!

    • String with at most 1024 characters

Property revision ∷ Integer

A monotonically increasing revision, incremented each time the object is changed.

  • This entry is optional

    • Zero, or a positive integer

Property schema_version ∷ String

CTIM schema version for this entity

  • This entry is required

    • A semantic version matching the CTIM version against which this object should be valid.

Property severity ∷ HighMedLow String

  • This entry is optional

Property short_description ∷ MedString String

A single line, short summary of the object.

  • This entry is optional

    • String with at most 2048 characters

Property source ∷ MedString String

  • This entry is optional

    • String with at most 2048 characters

Property source_uri ∷ String

  • This entry is optional

    • A URI

Property specification ∷ Either

  • This entry is optional

    • Only one of the following schemas will match

Property tags ∷ ShortString String List

Descriptors for this indicator

  • This entry is optional

  • This entry's type is sequential (allows zero or more values)

    • String with at most 1024 characters

Property test_mechanisms ∷ MedString String List

Test Mechanisms effective at identifying the cyber Observables specified in this cyber threat Indicator

  • This entry is optional

  • This entry's type is sequential (allows zero or more values)

  • Dev Notes: simplified

    • String with at most 2048 characters

Property timestamp ∷ Inst (Date)

The time this object was created at, or last modified.

  • This entry is optional

    • Schema definition for all date or timestamp values. Serialized as a string, the field should follow the rules of the ISO8601 standard.

Property title ∷ ShortString String

A short title for this object, used as primary display and reference value

  • This entry is optional

    • String with at most 1024 characters

Property tlp ∷ TLP String

Specification for how, and to whom, this object can be shared.

  • This entry is optional

    • TLP stands for Traffic Light Protocol, which indicates precisely how this resource is intended to be shared, replicated, copied, etc.
    • Default: green
    • Allowed Values:
      • amber
      • green
      • red
      • white

Property type ∷ IndicatorTypeIdentifier String

The fixed value indicator

  • This entry is required

    • The fixed value "indicator"
    • Must equal: "indicator"

Property valid_time ∷ ValidTime Object

The time range during which this Indicator is considered valid.

  • This entry is required

ExternalReference Object

External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material.

PropertyTypeDescriptionRequired?
source_nameMedString StringThe source within which the external-reference is defined (system, registry, organization, etc.)✓
descriptionMarkdown String
external_idStringAn identifier for the external reference content.
hashesString ListSpecifies a dictionary of hashes for the contents of the url.
urlStringA URL reference to an external resource

Property description ∷ Markdown String

  • This entry is optional

    • Markdown string with at most 5000 characters

Property external_id ∷ String

An identifier for the external reference content.

  • This entry is optional

Property hashes ∷ String List

Specifies a dictionary of hashes for the contents of the url.

  • This entry is optional
  • This entry's type is sequential (allows zero or more values)

Property source_name ∷ MedString String

The source within which the external-reference is defined (system, registry, organization, etc.)

  • This entry is required

    • String with at most 2048 characters

Property url ∷ String

A URL reference to an external resource

  • This entry is optional

    • A URI

ValidTime Object

Period of time when a cyber observation is valid.

PropertyTypeDescriptionRequired?
end_timeInst (Date)If end_time is not present, then the valid time position of the object does not have an upper bound.
start_timeInst (Date)If not present, the valid time position of the indicator does not have an upper bound

Property end_time ∷ Inst (Date)

If end_time is not present, then the valid time position of the object does not have an upper bound.

  • This entry is optional

    • Schema definition for all date or timestamp values. Serialized as a string, the field should follow the rules of the ISO8601 standard.

Property start_time ∷ Inst (Date)

If not present, the valid time position of the indicator does not have an upper bound

  • This entry is optional

    • Schema definition for all date or timestamp values. Serialized as a string, the field should follow the rules of the ISO8601 standard.

CompositeIndicatorExpression Object

PropertyTypeDescriptionRequired?
indicator_idsString List ✓
operatorBooleanOperator String ✓

Property indicator_ids ∷ String List

  • This entry is required

  • This entry's type is sequential (allows zero or more values)

    • A URI leading to an indicator

Property operator ∷ BooleanOperator String

  • This entry is required

    • Allowed Values:
      • and
      • not
      • or

KillChainPhase Object

The kill-chain-phase represents a phase in a kill chain, which describes the various phases an attacker may undertake in order to achieve their objectives.

PropertyTypeDescriptionRequired?
kill_chain_nameStringThe name of the kill chain.✓
phase_nameStringThe name of the phase in the kill chain.✓

Property kill_chain_name ∷ String

The name of the kill chain.

  • This entry is required

    • SHOULD be all lowercase (where lowercase is defined by the locality conventions) and SHOULD use hyphens instead of spaces or underscores as word separators.
    • Must equal: "lockheed-martin-cyber-kill-chain"
    • Reference: Open Vocabulary

Property phase_name ∷ String

The name of the phase in the kill chain.

  • This entry is required

    • SHOULD be all lowercase (where lowercase is defined by the locality conventions) and SHOULD use hyphens instead of spaces or underscores as word separators.
    • Allowed Values:
      • actions-on-objective
      • command-and-control
      • delivery
      • exploitation
      • installation
      • reconnaissance
      • weaponization
    • Reference: Open Vocabulary

JudgementSpecification Object

An indicator based on a list of judgements. If any of the Observables in it's judgements are encountered, than it may be matches against. If there are any required judgements, they all must be matched in order for the indicator to be considered a match.

PropertyTypeDescriptionRequired?
judgementsString List ✓
required_judgementsRelatedJudgement Object List ✓
typeJudgementSpecificationType String ✓

Property judgements ∷ String List

  • This entry is required

  • This entry's type is sequential (allows zero or more values)

    • A URI leading to a judgement

Property required_judgements ∷ RelatedJudgement Object List

  • This entry is required
  • This entry's type is sequential (allows zero or more values)

Property type ∷ JudgementSpecificationType String

  • This entry is required

    • Must equal: "Judgement"

RelatedJudgement Object

PropertyTypeDescriptionRequired?
judgement_idString ✓
confidenceHighMedLow String
relationshipString
sourceString

Property confidence ∷ HighMedLow String

  • This entry is optional

Property judgement_id ∷ String

  • This entry is required

    • A URI leading to a judgement

Property relationship ∷ String

  • This entry is optional

Property source ∷ String

  • This entry is optional

ThreatBrainSpecification Object

An indicator which runs in threatbrain...

PropertyTypeDescriptionRequired?
typeThreatBrainSpecificationType String ✓
variablesString List ✓
queryString

Property query ∷ String

  • This entry is optional

Property type ∷ ThreatBrainSpecificationType String

  • This entry is required

    • Must equal: "ThreatBrain"

Property variables ∷ String List

  • This entry is required
  • This entry's type is sequential (allows zero or more values)

SnortSpecification Object

An indicator which runs in snort...

PropertyTypeDescriptionRequired?
snort_sigString ✓
typeSnortSpecificationType String ✓

Property snort_sig ∷ String

  • This entry is required

Property type ∷ SnortSpecificationType String

  • This entry is required

    • Must equal: "Snort"

SIOCSpecification Object

An indicator which runs in snort...

PropertyTypeDescriptionRequired?
SIOCString ✓
typeSIOCSpecificationType String ✓

Property SIOC ∷ String

  • This entry is required

Property type ∷ SIOCSpecificationType String

  • This entry is required

    • Must equal: "SIOC"

OpenIOCSpecification Object

An indicator which contains an XML blob of an openIOC indicator..

PropertyTypeDescriptionRequired?
open_IOCString ✓
typeOpenIOCSpecificationType String ✓

Property open_IOC ∷ String

  • This entry is required

Property type ∷ OpenIOCSpecificationType String

  • This entry is required

    • Must equal: "OpenIOC"
❮*Incident* Object*Judgement* Object❯

Can you improve this documentation? These fine people already did:
Stephen Sloan, Yann Esposito (Yogsototh), Guillaume Buisson, Craig Brozefsky, Matthieu Sprunck & Yann EspositoEdit on GitHub

cljdoc is a website building & hosting documentation for Clojure/Script libraries

Keyboard shortcutsReport a problemcljdoc on GitHub
× close