Terminology The key “MUST”, “MUST NOT”, “REQUIRED”, “SHALL”, “SHALL NOT”, “SHOULD”, “SHOULD NOT”, “RECOMMENDED”, “MAY”, and “OPTIONAL” in this document are to be interpreted as described in [RFC2119]. Normative References [RFC2119] Bradner, S., “Key words for use in RFCs to Indicate Requirement Levels”, BCP 14, RFC 2119, March 1997. .
patterns.” Observable instances represent actual specific observations that took place in the cyber domain. The property details of this observation are specific and unambiguous. Observable patterns represent conditions for a potential observation that may occur in the future or may have already occurred and exists in a body of observable instances. These conditions may be anything from very specific concrete patterns that would match very specific observable instances to more abstract generalized patterns that have the potential to match against a broad range of potential observable instances. The Incident data model leverages the Observable data model to specify the observable instances that were observed in relation to the Incident. Tactics, Techniques and Procedures (TTP) A STIX Tactics, Techniques, and Procedures (TTP) is used to represent the behavior or modus operandi of cyber adversaries. Please see for details. The Incident data references the TTP data model as a means to identify sets of specific TTPs that are asserted as having been leveraged in the Incident. Threat Actor A STIX Threat Actor is a characterization of a malicious actor (i.e., adversary) that represents a cyber attack threat. A variety of information can be captured in a Threat Actor construct, including identity, motivations, intended effect, and sophistication level. Please see for details. The Incident data model references the Threat Actor data model as a means to characterize the Threat Actors that have been attributed to the Incident.
Status stixCommon: VocabularyStringType 0..1 The Status property specifies the or disposition of the Incident. Examples of potential statuses are new, open, and closed (these specific values are only provided to help explain the property: they are neither recommended values nor necessarily part of any existing vocabulary). The content creator may choose any arbitrary value or may constrain the set of possible values by referencing an externally-defined vocabulary or leveraging a formally defined vocabulary extending from the stixCommon:ControlledVocabularyStringType class. The STIX default vocabulary class for use in the Status property is ‘IncidentStatusVocab-1.0’. Related_Indicators RelatedIndicatorsType 0..1 The Related_Indicators property specifies a set of one or more other Indicators relevant to the Incident whether they were the triggers that initiated the incident response or they are a result of the incident investigation analysis and may be of value in detecting the adversary TTPs leveraged in the incident. Related_Observables RelatedObservablesType 0..1 The Related_Observables property specifies a set of one or more observable instances that were observed in relation to the Incident. Leveraged_TTPs LeveragedTTPsType 0..1 The Leveraged_TTPs property specifies a set of one or more TTPs that are asserted as having been leveraged in the Incident. Attributed_Threat_Actors AttributedThreatActorsType 0..1 The Attributed_Threat_Actors property specifies a set of one or more other Threat Actors that have been attributed to the Incident.
Name Type Multiplicity Description First_Malicious_Action stixCommon: DateTimeWithPrecisionType 0..1 The First_Malicious_Action property specifies the time that the first malicious action related to the Incident occured. Initial_Compromise stixCommon: DateTimeWithPrecisionType 0..1 The Initial_Compromise property specifies the time that the initial compromise occured for the Incident. First_Data_Exfiltration stixCommon: DateTimeWithPrecisionType 0..1 The First_Data_Exfiltration property specifies the first time at which non-public data was taken from the victim environment. Incident_Discovery stixCommon: DateTimeWithPrecisionType 0..1 The Incident_Discovery property specifies the first time at which the organization learned the Incident had occurred. Incident_Opened stixCommon: DateTimeWithPrecisionType 0..1 The Incident_Opened property specifies the time at which the Incident was officially opened. Containment_Achieved stixCommon: DateTimeWithPrecisionType 0..1 The Containment_Achieved property specifies the time at which the Incident is contained (e.g., the “bleeding is stopped”). Restoration_Achieved stixCommon: DateTimeWithPrecisionType 0..1 The Restoration_Achieved property specifies the first time at which the incident's assets are restored (e.g., fully functional). Incident_Reported stixCommon: DateTimeWithPrecisionType 0..1 The Incident_Reported property specifies the time at which the Incident was reported. Incident_Closed stixCommon: DateTimeWithPrecisionType 0..1 The Incident_Closed property specifies the time at which the Incident was officially closed. CategoriesType The CategoriesType class specifies one or more category labels for the Incident. The properties of the TimeType class are given in Table 35. Table . Properties of the CategoriesType class
Increased_Operating_Costs stixCommon: VocabularyStringType 0..1 The Increased_Operating_Costs property specifies if increased operating costs occured in the Incident. The impact could include: cost of additional audits, new hires or training, mandatory action, higher insurance, etc. Examples of potential statuses are yes, no and suspected (these specific values are only provided to help explain the property: they are neither recommended values nor necessarily part of any existing vocabulary). The content creator may choose any arbitrary value or may constrain the set of possible values by referencing an externally-defined vocabulary or leveraging a formally defined vocabulary extending from the stixCommon:ControlledVocabularyStringType class. The STIX default vocabulary class for use in this property is ‘SecurityCompromiseVocab-1.0’. Legal_And_Regulatory_Costs stixCommon: VocabularyStringType 0..1 The Legal_And_Regulatory_Costs property specifies if legal and regulatory costs occured in the Incident. This includes legal fees, lawsuits, customer damages, contract violations, etc. Examples of potential statuses are yes, no and suspected (these specific values are only provided to help explain the property: they are neither recommended values nor necessarily part of any existing vocabulary). The content creator may choose any arbitrary value or may constrain the set of possible values by referencing an vocabulary or leveraging a formally defined vocabulary extending from the stixCommon:ControlledVocabularyStringType class. The STIX default vocabulary class for use in this property is ‘SecurityCompromiseVocab-1.0’. TotalLossEstimationType Class The TotalLossEstimationType class characterizes both the initial reported and actual estimated financial losses for this Incident. Table . Properties of the TotalLossEstimationType class Name Type Multiplicity Description Initial_Reported_Total_Loss_Estimation LossEstimationType 0..1 The Initial_Reported_Total_Loss_Estimation property specifies the initially reported level of total estimated financial loss for the Incident.