crits/crits — pull request #183 by mgoffin (2014-08-07 17:59:50+00:00)
Title: Actor Top-Level Object

This PR adds Actors as a TLO. Some of the features are:

* Name (real name, nick name, whatever you wish for them to go by)
* Can be modified at any time.
* Aliases (list of names that other organizations refer to them by)
* Can be modified at any time.
* Description
* Can be modified at any time.
* Motivations (based on STIX)
* Intended Effects (based on STIX)
* Sophistications (based on STIX)
* Threat Types (based on STIX)
* Identifier Attribution (not supported in STIX but actively working with them on it)
* Identifiers consist of a type (to provide context) and a value which if discovered or noticed through analysis would indicate the presence or activity of this Actor.

Actors can be individuals or groups. There is a good use-case for defining an Actor by a group, and then relating the individual Actors within the group through Relationships. This is a good way to graph out organizations. Actors can also be related to any other content in CRITs through Relationships. If you feel that an Actor is involved in an Event or a Campaign you can relate them. If you feel like a specific Actor is involved in the development or use of a Sample, Domain, IP, or Email you can relate them.

The workflow for working with Actor Identifiers is the following:

* Add your Identifier Types to the system (through nav menu or Control Panel).
* Add Actor Identifiers leveraging those types.
* You do not need to have an Actor to attribute these values to! You can add them if you think it is indicative of an Actor before giving them a name and do the attribution at a later time.
* Identifiers track source information so you can track who provided that information to you (and limit the Identifiers analysts can use based on source restrictions).

You can then attribute those Identifiers to existing Actors or add a new Actor to attribute to.

Actor names and aliases are *not* unique. This allows you to add content and then resolve conflicts as you need to. In the event another organization uses a name you already have you can adjust accordingly if you wish.