"created": "2016-05-01T06:13:14.000Z", "modified": "revoked": true } 5 { "type": "example", "id": "example--1", "created": "2016-05-01T06:13:14.000Z", "modified": "2016-05-10T17:28:54.000Z" } Consumer ignores this object because they already have a newer version of the object (the revoked version). Example object creator workflow This section describes an example workflow where a object creator publishes multiple updates to a particular object. This scenario assumes a human using a STIX implementation. (In this example, the STIX Objects have been truncated for brevity.) Step # STIX Object User Action 1 N/A – STIX is not involved in this scenario. (Tools could choose to create and track STIX versions for internal changes, but it is not required by the specification.) User clicks a create button in the user interface, creates a SDO, then clicks save. This action causes information to be stored in the product’s database. 2 { "type": "example", "id": "example--2", "created": "modified": "2016-05-01T06:13:14.000Z" } The user clicks the “share” button, delivering the intelligence to sharing partners. 3 N/A – STIX is not involved in this scenario. could choose to create and track STIX versions for internal changes, but it is not required by the specification.) The user performs additional analysis within the STIX implementation, performing multiple modifications and saving their work multiple times. 4 { "type": "example", "id": "example--2", "created": "2016-05-01T06:13:14.000Z", "modified": "2016-05-03T16:33:51.000Z" The user, happy with the status of their work, decides to provide an update to some properties of the previously published object (not shown).
Vocabulary Summary individual, club, contest, team, organization, government Vocabulary Value Description individual Resources limited to the average individual; Threat acts independently. club Members interact on a social and volunteer basis, often with little personal interest in the specific target. An example might be a core group of unrelated activists who regularly exchange tips on a particular blog. Group persists long term. contest A short-lived and perhaps anonymous interaction that concludes when the participants have achieved a single goal. For example, people who break into systems just for thrills or prestige may hold a contest to see who can break into a specific target first. It also includes announced "operations" to achieve a specific goal, such as the original "OpIsrael" call for volunteers to disrupt all of Israel's Internet functions for a day. team A formally organized group with a leader, typically motivated by a specific goal and organized around that goal. Group persists long term and typically operates within a single geography. organization Larger and better resourced than a team; typically a company or crime syndicate. Usually operates in multiple geographic areas and persists long term. government Controls public assets and functions within a jurisdiction; very well resourced and persists long term. Hashing Algorithm Vocabulary Vocabulary Name: hash-algorithm-ov An open vocabulary of hashing algorithms. When specifying a hashing algorithm not already defined within the hash-algorithm-ov, wherever an authoritative name for a hashing algorithm name is defined, it should be used as the value. In cases where no authoritative name exists and/or where there is variance in the naming of a particular hashing algorithm, producers should exercise their best judgement. Vocabulary Summary