athiasjerome
commented
9 years ago Consider "Threat Agent" on top of Threat Actor: that could allow STIX extension, for future use in incident management (and disaster recovery), for example: natural incident
Consider creating a new Actor top-level construct to act as a basis for extension for Threat Actor but also enabling characterization of defender and third party actors.
This would allow for consistent specification of actor-type information regardless of whether the actor is a threat actor, defender, or third-party.