-
Notifications
You must be signed in to change notification settings - Fork 21
Documentation Sitemap
johnwunder edited this page Nov 18, 2014
·
1 revision
- Getting Started
- Security Considerations
- Suggested Practices
- Profiles Overview
- Utilities
- Validation
-
Concepts
- Composition of Observables and Indicators
- Controlled Vocabularies
- Marking Data
- STIX Concepts
- [Observable Instances vs Observable Patterns](http://stixproject.github.io/documentation/concepts/observable- patterns-vs-instances/)
- STIX Relationships
- TTP vs. Indicator
- Versioning in STIX
- xsi:type
-
Idioms
- Assets Affected in an Incident
- COA to Block Network Traffic
- Indicator for C2 IP Address
- Command and Control IP List
- Defining Campaigns vs Threat Actors
- CVE in an Exploit Target
- Working with Identity
- Identifying a Threat Actor Group
- Malware Used During an Incident
- Incident Lifecycle Timestamps
- Incident vs. Indicator
- Indicator to Campaign Relationship
- Victim Targeting by Sector
- Kill Chains in STIX
- Threat Actor Leveraging Attack Patterns and Malware
- Malware Characterization using MAEC
- Malicious E-mail Attachment
- Indicator for Malicious URL
- Malware Indicator for File Hash
- OpenIOC Test Mechanism
- Incident with Related Observables
- Barebones Incident Description
- Snort Test Mechanism
- Victim Targeting for a Campaign
- Plain Wrapper Around Multiple Reports
- Yara Test Mechanism