## 5 Conclusions  
With this work, we explored the possibility of collecting, storing and sharing cyber-threat intelligence in the context of active buildings, which can be briefly described as smart buildings capable of distributing energy among connected energy peers through renewable energy resources. We base our contribution over STIX modelling, a popular ad-hoc notation for storing and sharing CTI across trustful counterparts. For this work, we have employed a tool based on STIX called cyberaCTIve[30], that offers two functionalities: a dashboard visualiser that is clear when managing complex models, as active buildings require, and a timed event list of model changes for basic forensic analysis. As active buildings are potential target of cyber-attacks that have serious repercussions to the power grid (a critical infrastructure), security officers would benefit from using IDS. These systems could potentially be automated to create feeds that incorporate detected incidents into a STIX model of an active building. cyberaCTIve does not provide facilities to actually feed the STIX model. This work provides one viable solution to the problem of timely collecting _real-time_ feeds for the model by implementing an extension of cyberaCTIve that accepts (authenticated) feeds from an external system, that can well be an intrusion-detection system. Having such real-time automated feed is crucial to provide a timely response to ongoing incidents. _Future Work and Outlook_  
Modelling efforts cannot hinder the reasoning or the ability of addressing cyber-attacks quickly, just to strictly follow the standard. Analysts should be able to describe odd circumstances with as little information as they have at that moment, and only care about modelling details and its constraints afterwards. In early indications of potential malicious incursions, very little is known about the attacks. As they unfold and systems gather and compile more evidence, analysts may append and curate preexisting models with this data combined with exterior data sources for full contexts. We developed here a STIX model for active buildings, where users may interact with the parameters required by the set of STIX Domain Objects (SDO), STIX Relationship Objects (SRO), or STIX Cyber-observable Objects (SCO). The idea was to enrich active buildings' analysis and allow users to perceive the expected requirements for devising more shareable models to broader audiences. Under these settings, timeliness plays a crucial factor in cyber-attacks because one should be able to share possible exposure and vulnerabilities with trusted peers as soon as possible. We envision adding more features in future versions of the tool such as integrating cyberaCTIve with the ATT&CK framework's TTPs and Matrices (provide a static instance of some STIX elements inspired by it, such as existing Threat Actors or mitigations). We could also accommodate features for analysts such as time-based analysis and to devise ways of tracking the 'life-time' of families of cyber-attacks (those focusing on specific assets) and also improving the 'Model visualizer' feature. For instance, we could allow the selection of groups of assets (e.g., all renewable energy resources, or all information systems) and thencreating empty objects that will be filled out in another moment. Because we expect analysts to deploy our tool in their workspaces, we will need to review our features proposition with input from power-based domain experts. In this evaluation they may specify new streams to look at that are considered essential when inspecting cyber-attacks. Also, we shall conduct usability testing subjecting users to the tool and inspecting learning curves, whether expectations were met, and incorporating suggestions to improve the tool.