idaholab / STIG

Structured Threat Intelligence Graph
BSD 3-Clause "New" or "Revised" License
87 stars 29 forks source link

Update running and schema #133

Closed wrbrant closed 2 months ago

wrbrant commented 2 months ago

Changes:

Known issues:

object titles added for other changes for proper parsing
campaign first_seen, last_seen
indicator valid_from, valid_until
infrastructure first_seen, last_seen
intrusion-set first_seen, last_seen
language-content contents, object_ref, object_modified
location all conditionally required properties removed
malware-analysis submitted, analysis_started, analysis_ended, host_vm_ref, operating_system_ref, sample_ref pattern of sample_ref was combined ; conditional requirement of either result or analysis_sco_refs was removed
malware first_seen, last_seen required property was reduced to just is_family, ignoring conditional requirement for name
observed-data first_observed, last_observed conditional requirement of either objects or object_refs was removed
report published
sighting* sighting_of_ref
threat-actor first_seen, last_seen

* sighting isn't actually included as an option in STIG, but was edited for the sake of compatibility

Closes #121