Single indicator with two primary indicator fields

[pbenzoni]

So I've worked around this for now in the tests, but when converting from KV to STIX, you can have both a FQDN and an IP address, but the resultant schema can only represent one. How should we handle that?

[ChrisStrasburg]

Long term our intention is to include support for both in STIX; this
should probably be an 'issue' that we tackle (soon).

On Mon, May 16, 2016 at 02:33:17PM -0700, pbenzoni wrote:

So I've worked around this for now in the tests, but when converting from KV to
STIX, you can have both a FQDN and an IP address, but the resultant schema can
only represent one. How should we handle that?

—
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub*

[dharknessANL]

I thought we were handling it by including both indicators with a relationship of "resolves to" or something like that? (Assuming they are related)

At least thats what happens when going CFM13 to STIX for back office. Check with Mary Ann.

Sent from Ninehttp://www.9folders.com/

---

From: Chris Strasburg notifications@github.com
Sent: May 17, 2016 8:27 AM
To: anl-cyberscience/FlexTransform
Subject: Re: [anl-cyberscience/FlexTransform] Single indicator with two primary indicator fields (#9)

Long term our intention is to include support for both in STIX; this
should probably be an 'issue' that we tackle (soon).

On Mon, May 16, 2016 at 02:33:17PM -0700, pbenzoni wrote:

So I've worked around this for now in the tests, but when converting from KV to
STIX, you can have both a FQDN and an IP address, but the resultant schema can
only represent one. How should we handle that?

—
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub*

—
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHubhttps://github.com//issues/9#issuecomment-219753452

[mabitz]

Yes. I think that is correct. I have not looked at a lot of STIX files yet. But in the CFM 1.3 alert for 1-2-2120975 , it gets converted by FlexT to Json using STIX as an intermediary and we have this:

"observable": {
"id": "CFM:Observable-b623bdca-7999-57b9-ad27-10f67655b28f",
"keywords": [
"Scanning"
],
"object": {
"id": "CFM:Object-46ddd7c1-dec0-555d-8525-66d99046c9e2",
"properties": {
"address_value": {
"condition": "Equals",
"value": "106.184.4.52"
},
"category": "ipv4-addr",
"xsi:type": "AddressObjectType"
},
"related_objects": [
{
"id": "CFM:Object-3f1d240e-ab9e-565d-af2d-a5339f3a6294",
"properties": {
"layer4_protocol": "TCP",
"port_value": 81,
"xsi:type": "PortObjectType"
},
"relationship": "Connected_To"
},
{
"id": "CFM:Object-f60c794b-8b98-58f1-b204-ecf9e5ab6773",
"properties": {
"layer4_protocol": "TCP",
"port_value": 102,
"xsi:type": "PortObjectType"
},
"relationship": "Connected_To"
}
]
}
},

I think we have seen Connected_To and Resolves_To as relationships.

Mary Ann

From: Dan Harkness [mailto:notifications@github.com]
Sent: Tuesday, May 17, 2016 10:48 AM
To: anl-cyberscience/FlexTransform FlexTransform@noreply.github.com
Subject: Re: [anl-cyberscience/FlexTransform] Single indicator with two primary indicator fields (#9)

I thought we were handling it by including both indicators with a relationship of "resolves to" or something like that? (Assuming they are related)

At least thats what happens when going CFM13 to STIX for back office. Check with Mary Ann.

Sent from Ninehttp://www.9folders.com/

---

From: Chris Strasburg <notifications@github.commailto:notifications@github.com>
Sent: May 17, 2016 8:27 AM
To: anl-cyberscience/FlexTransform
Subject: Re: [anl-cyberscience/FlexTransform] Single indicator with two primary indicator fields (#9)

Long term our intention is to include support for both in STIX; this
should probably be an 'issue' that we tackle (soon).

On Mon, May 16, 2016 at 02:33:17PM -0700, pbenzoni wrote:

So I've worked around this for now in the tests, but when converting from KV to
STIX, you can have both a FQDN and an IP address, but the resultant schema can
only represent one. How should we handle that?

—
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub*

—
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHubhttps://github.com//issues/9#issuecomment-219753452

—
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHubhttps://github.com//issues/9#issuecomment-219761517

[pbenzoni]

To demonstrate what I mean, here are the input and outputs I'm using. The ####ed sections show what I mean. Both are valid representations of the input data, but each loses something of the other. I'm not sure if this clarifies adequately, but I hope you can see what I mean.
Input (KV)
timestamp=1325401200&ipv4=10.11.12.14&fqdn=bad.scanning.dom&direction=ingress&comment='Attacker scanning for SSH
Output (STIX)

    <stix:STIX_Header>
        <stix:Package_Intent xsi:type="stixVocabs:PackageIntentVocab-1.0">Indicators</stix:Package_Intent>
        <stix:Handling>
            <marking:Marking>
                <marking:Controlled_Structure>//node() | //@*</marking:Controlled_Structure>
                <marking:Marking_Structure xsi:type='tlpMarking:TLPMarkingStructureType' color="GREEN"/>
            </marking:Marking>
        </stix:Handling>
    </stix:STIX_Header>
    <stix:Indicators>
        <stix:Indicator id="CFM:Indicator-b21b6538-e648-599a-91c6-b67bf7fa32fb" timestamp="2016-05-17T17:35:49+00:00" xsi:type='indicator:IndicatorType' version="2.1.1">
            <indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
            <indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
            <indicator:Description>Attacker scanning for SSH, direction:ingress, confidence:0, severity:unknown</indicator:Description>
            <indicator:Observable id="CFM:Observable-71c63384-8ed0-593f-9316-554f4354da0f">
                <cybox:Object id="CFM:Object-1abdacd7-a092-556c-adc0-5577d77ae73a">
                    <cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr">
                        ########<AddressObj:Address_Value condition="Equals">10.11.12.14</AddressObj:Address_Value>########
                    </cybox:Properties>
                </cybox:Object>
            </indicator:Observable>
            <indicator:Sightings>
                <indicator:Sighting timestamp="2012-01-01T07:00:00+00:00" timestamp_precision="second"/>
            </indicator:Sightings>
        </stix:Indicator>
    </stix:Indicators>

and with the domain:

<stix:STIX_Header>
        <stix:Package_Intent xsi:type="stixVocabs:PackageIntentVocab-1.0">Indicators</stix:Package_Intent>
        <stix:Handling>
            <marking:Marking>
                <marking:Controlled_Structure>//node() | //@*</marking:Controlled_Structure>
                <marking:Marking_Structure xsi:type='tlpMarking:TLPMarkingStructureType' color="GREEN"/>
            </marking:Marking>
        </stix:Handling>
    </stix:STIX_Header>
    <stix:Indicators>
        <stix:Indicator id="CFM:Indicator-30427f1b-7083-517e-acb9-4393f68f9f94" timestamp="2016-05-17T17:39:09+00:00" xsi:type='indicator:IndicatorType' version="2.1.1">
            <indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
            <indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
            <indicator:Description>Attacker scanning for SSH, direction:ingress, confidence:0, severity:unknown</indicator:Description>
            <indicator:Observable id="CFM:Observable-92c55162-8481-5ea7-b32b-2f6d3dea3303">
                <cybox:Object id="CFM:Object-547f483f-94cd-5d19-8f2e-928760e2c810">
                    <cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType" type="FQDN">
                        ##############<DomainNameObj:Value condition="Equals">bad.scanning.dom</DomainNameObj:Value>###############
                    </cybox:Properties>
                </cybox:Object>
            </indicator:Observable>
            <indicator:Sightings>
                <indicator:Sighting timestamp="2012-01-01T07:00:00+00:00" timestamp_precision="second"/>
            </indicator:Sightings>
        </stix:Indicator>
    </stix:Indicators>