search

oasis-open / cti-stix-common-objects

OASIS Cyber Threat Intelligence (CTI) TC: A repository for commonly used STIX objects in order to avoid needless duplication. https://github.com/oasis-open/cti-stix-common-objects
BSD 3-Clause "New" or "Revised" License
84 stars 36 forks source link

Incident Core Extension 1.2.0 #28

Closed dc3-tsd closed 1 year ago

dc3-tsd commented 1 year ago

Update the Incident Core Extension with the following:

  1. availability_impact is now availability_impacts and is a list of objects
  2. external_impacts is now a list of objects instead of a list of strings
  3. All lists of impact objects now include the following common fields: criticality, description, impacted_refs, labels
  4. defender-activity timestamp is is broken into two parts like with attacker-activity and these are optional. Sequence information has been added which is shared between both activity types.
  5. Outcome is now required for defender-activity with an additional options for "occurred" and "pending". This is shared with attacker-activity. This property is required for both.
  6. Updated schema and examples to conform with these changes
rpiazza commented 1 year ago

LGTM