Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

GA threat.enrichments.indicator #1928

Merged
merged 9 commits into from
Jul 19, 2022
Merged

GA threat.enrichments.indicator #1928

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
9 commits
Select commit Hold shift + click to select a range
2f724ab
threat.enrichments.indicator re-uses and fields GA
kgeller May 23, 2022
c181013
artifacts
kgeller May 23, 2022
a48487c
changelog
kgeller May 23, 2022
7a0e369
Merge branch 'main' into threat-enrichments-indicator-reuses-ga
djptek May 24, 2022
6bc0a90
bringing up to date
kgeller Jul 5, 2022
edb134b
changelog
kgeller Jul 5, 2022
5f84012
Merge branch 'main' into threat-enrichments-indicator-reuses-ga
kgeller Jul 6, 2022
68a5a7a
Merge branch 'main' into threat-enrichments-indicator-reuses-ga
kgeller Jul 6, 2022
95d524b
Merge branch 'main' into threat-enrichments-indicator-reuses-ga
kgeller Jul 18, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 2 additions & 0 deletions CHANGELOG.next.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,6 +18,8 @@ Thanks, you're awesome :-) -->

#### Improvements

* Advances `threat.enrichments.indicator` to GA. #1928

#### Deprecated

### Tooling and Artifact Changes
Expand Down
114 changes: 33 additions & 81 deletions docs/fields/field-details.asciidoc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9089,9 +9089,7 @@ These fields are for users to classify alerts from all of their sources (e.g. ID
[[field-threat-enrichments]]
<<field-threat-enrichments, threat.enrichments>>

a| beta:[ This field is beta and subject to change. ]

A list of associated indicators objects enriching the event, and the context of that association/enrichment.
a| A list of associated indicators objects enriching the event, and the context of that association/enrichment.

type: nested

Expand All @@ -9110,9 +9108,7 @@ Note: this field should contain an array of values.
[[field-threat-enrichments-indicator]]
<<field-threat-enrichments-indicator, threat.enrichments.indicator>>

a| beta:[ This field is beta and subject to change. ]

Object containing associated indicators enriching the event.
a| Object containing associated indicators enriching the event.

type: object

Expand All @@ -9128,9 +9124,7 @@ type: object
[[field-threat-enrichments-indicator-confidence]]
<<field-threat-enrichments-indicator-confidence, threat.enrichments.indicator.confidence>>

a| beta:[ This field is beta and subject to change. ]

Identifies the vendor-neutral confidence rating using the None/Low/Medium/High scale defined in Appendix A of the STIX 2.1 framework. Vendor-specific confidence scales may be added as custom fields.
a| Identifies the vendor-neutral confidence rating using the None/Low/Medium/High scale defined in Appendix A of the STIX 2.1 framework. Vendor-specific confidence scales may be added as custom fields.

Expected values for this field:

Expand All @@ -9154,9 +9148,7 @@ example: `Medium`
[[field-threat-enrichments-indicator-description]]
<<field-threat-enrichments-indicator-description, threat.enrichments.indicator.description>>

a| beta:[ This field is beta and subject to change. ]

Describes the type of action conducted by the threat.
a| Describes the type of action conducted by the threat.

type: keyword

Expand All @@ -9172,9 +9164,7 @@ example: `IP x.x.x.x was observed delivering the Angler EK.`
[[field-threat-enrichments-indicator-email-address]]
<<field-threat-enrichments-indicator-email-address, threat.enrichments.indicator.email.address>>

a| beta:[ This field is beta and subject to change. ]

Identifies a threat indicator as an email address (irrespective of direction).
a| Identifies a threat indicator as an email address (irrespective of direction).

type: keyword

Expand All @@ -9190,9 +9180,7 @@ example: `[email protected]`
[[field-threat-enrichments-indicator-first-seen]]
<<field-threat-enrichments-indicator-first-seen, threat.enrichments.indicator.first_seen>>

a| beta:[ This field is beta and subject to change. ]

The date and time when intelligence source first reported sighting this indicator.
a| The date and time when intelligence source first reported sighting this indicator.

type: date

Expand All @@ -9208,9 +9196,7 @@ example: `2020-11-05T17:25:47.000Z`
[[field-threat-enrichments-indicator-ip]]
<<field-threat-enrichments-indicator-ip, threat.enrichments.indicator.ip>>

a| beta:[ This field is beta and subject to change. ]

Identifies a threat indicator as an IP address (irrespective of direction).
a| Identifies a threat indicator as an IP address (irrespective of direction).

type: ip

Expand All @@ -9226,9 +9212,7 @@ example: `1.2.3.4`
[[field-threat-enrichments-indicator-last-seen]]
<<field-threat-enrichments-indicator-last-seen, threat.enrichments.indicator.last_seen>>

a| beta:[ This field is beta and subject to change. ]

The date and time when intelligence source last reported sighting this indicator.
a| The date and time when intelligence source last reported sighting this indicator.

type: date

Expand All @@ -9244,9 +9228,7 @@ example: `2020-11-05T17:25:47.000Z`
[[field-threat-enrichments-indicator-marking-tlp]]
<<field-threat-enrichments-indicator-marking-tlp, threat.enrichments.indicator.marking.tlp>>

a| beta:[ This field is beta and subject to change. ]

Traffic Light Protocol sharing markings.
a| Traffic Light Protocol sharing markings.

Expected values for this field:

Expand All @@ -9269,9 +9251,7 @@ example: `WHITE`
[[field-threat-enrichments-indicator-modified-at]]
<<field-threat-enrichments-indicator-modified-at, threat.enrichments.indicator.modified_at>>

a| beta:[ This field is beta and subject to change. ]

The date and time when intelligence source last modified information for this indicator.
a| The date and time when intelligence source last modified information for this indicator.

type: date

Expand All @@ -9287,9 +9267,7 @@ example: `2020-11-05T17:25:47.000Z`
[[field-threat-enrichments-indicator-port]]
<<field-threat-enrichments-indicator-port, threat.enrichments.indicator.port>>

a| beta:[ This field is beta and subject to change. ]

Identifies a threat indicator as a port number (irrespective of direction).
a| Identifies a threat indicator as a port number (irrespective of direction).

type: long

Expand All @@ -9305,9 +9283,7 @@ example: `443`
[[field-threat-enrichments-indicator-provider]]
<<field-threat-enrichments-indicator-provider, threat.enrichments.indicator.provider>>

a| beta:[ This field is beta and subject to change. ]

The name of the indicator's provider.
a| The name of the indicator's provider.

type: keyword

Expand All @@ -9323,9 +9299,7 @@ example: `lrz_urlhaus`
[[field-threat-enrichments-indicator-reference]]
<<field-threat-enrichments-indicator-reference, threat.enrichments.indicator.reference>>

a| beta:[ This field is beta and subject to change. ]

Reference URL linking to additional information about this indicator.
a| Reference URL linking to additional information about this indicator.

type: keyword

Expand All @@ -9341,9 +9315,7 @@ example: `https://system.example.com/indicator/0001234`
[[field-threat-enrichments-indicator-scanner-stats]]
<<field-threat-enrichments-indicator-scanner-stats, threat.enrichments.indicator.scanner_stats>>

a| beta:[ This field is beta and subject to change. ]

Count of AV/EDR vendors that successfully detected malicious file or URL.
a| Count of AV/EDR vendors that successfully detected malicious file or URL.

type: long

Expand All @@ -9359,9 +9331,7 @@ example: `4`
[[field-threat-enrichments-indicator-sightings]]
<<field-threat-enrichments-indicator-sightings, threat.enrichments.indicator.sightings>>

a| beta:[ This field is beta and subject to change. ]

Number of times this indicator was observed conducting threat activity.
a| Number of times this indicator was observed conducting threat activity.

type: long

Expand All @@ -9377,9 +9347,7 @@ example: `20`
[[field-threat-enrichments-indicator-type]]
<<field-threat-enrichments-indicator-type, threat.enrichments.indicator.type>>

a| beta:[ This field is beta and subject to change. ]

Type of indicator as represented by Cyber Observable in STIX 2.0.
a| Type of indicator as represented by Cyber Observable in STIX 2.0.

Expected values for this field:

Expand Down Expand Up @@ -9415,9 +9383,7 @@ example: `ipv4-addr`
[[field-threat-enrichments-matched-atomic]]
<<field-threat-enrichments-matched-atomic, threat.enrichments.matched.atomic>>

a| beta:[ This field is beta and subject to change. ]

Identifies the atomic indicator value that matched a local environment endpoint or network event.
a| Identifies the atomic indicator value that matched a local environment endpoint or network event.

type: keyword

Expand All @@ -9433,9 +9399,7 @@ example: `bad-domain.com`
[[field-threat-enrichments-matched-field]]
<<field-threat-enrichments-matched-field, threat.enrichments.matched.field>>

a| beta:[ This field is beta and subject to change. ]

Identifies the field of the atomic indicator that matched a local environment endpoint or network event.
a| Identifies the field of the atomic indicator that matched a local environment endpoint or network event.

type: keyword

Expand All @@ -9451,9 +9415,7 @@ example: `file.hash.sha256`
[[field-threat-enrichments-matched-id]]
<<field-threat-enrichments-matched-id, threat.enrichments.matched.id>>

a| beta:[ This field is beta and subject to change. ]

Identifies the _id of the indicator document enriching the event.
a| Identifies the _id of the indicator document enriching the event.

type: keyword

Expand All @@ -9469,9 +9431,7 @@ example: `ff93aee5-86a1-4a61-b0e6-0cdc313d01b5`
[[field-threat-enrichments-matched-index]]
<<field-threat-enrichments-matched-index, threat.enrichments.matched.index>>

a| beta:[ This field is beta and subject to change. ]

Identifies the _index of the indicator document enriching the event.
a| Identifies the _index of the indicator document enriching the event.

type: keyword

Expand Down Expand Up @@ -9503,9 +9463,7 @@ example: `2021-10-05T17:00:58.326Z`
[[field-threat-enrichments-matched-type]]
<<field-threat-enrichments-matched-type, threat.enrichments.matched.type>>

a| beta:[ This field is beta and subject to change. ]

Identifies the type of match that caused the event to be enriched with the given indicator
a| Identifies the type of match that caused the event to be enriched with the given indicator

type: keyword

Expand Down Expand Up @@ -10263,49 +10221,43 @@ example: `https://attack.mitre.org/techniques/T1059/001/`


| `threat.enrichments.indicator.as.*`
| <<ecs-as,as>>| beta:[ Reusing the `as` fields in this location is currently considered beta.]

Fields describing an Autonomous System (Internet routing prefix).
| <<ecs-as,as>>
| Fields describing an Autonomous System (Internet routing prefix).

// ===============================================================


| `threat.enrichments.indicator.file.*`
| <<ecs-file,file>>| beta:[ Reusing the `file` fields in this location is currently considered beta.]

Fields describing files.
| <<ecs-file,file>>
| Fields describing files.

// ===============================================================


| `threat.enrichments.indicator.geo.*`
| <<ecs-geo,geo>>| beta:[ Reusing the `geo` fields in this location is currently considered beta.]

Fields describing a location.
| <<ecs-geo,geo>>
| Fields describing a location.

// ===============================================================


| `threat.enrichments.indicator.registry.*`
| <<ecs-registry,registry>>| beta:[ Reusing the `registry` fields in this location is currently considered beta.]

Fields related to Windows Registry operations.
| <<ecs-registry,registry>>
| Fields related to Windows Registry operations.

// ===============================================================


| `threat.enrichments.indicator.url.*`
| <<ecs-url,url>>| beta:[ Reusing the `url` fields in this location is currently considered beta.]

Fields that let you store URLs in various forms.
| <<ecs-url,url>>
| Fields that let you store URLs in various forms.

// ===============================================================


| `threat.enrichments.indicator.x509.*`
| <<ecs-x509,x509>>| beta:[ Reusing the `x509` fields in this location is currently considered beta.]

These fields contain x509 certificate metadata.
| <<ecs-x509,x509>>
| These fields contain x509 certificate metadata.

// ===============================================================

Expand Down
Loading