OSINT

Any pertinent DNS answers information related to an indicator or OSINT analysis.

MITRE ATT&CK Tactics, Techniques, and/or Procedures (TTPs) pertinent to an indicator or OSINT analysis.

Any pertinent autonomous system information related to an indicator or OSINT analysis.

Analyst commentary or source commentary about an indicator or OSINT analysis.

The confidence of an indicator being malicious and/or pertinent, normalized to the caption of the confidence_id value. In the case of 'Other', it is defined by the event source or analyst.

The normalized confidence refers to the accuracy of collected information related to the OSINT or how pertinent an indicator or analysis is to a specific event or finding. A low confidence means that the information collected or analysis conducted lacked detail or is not accurate enough to qualify an indicator as fully malicious.

• 0: Unknown (UNKNOWN)
• 1: Low (LOW)
• 2: Medium (MEDIUM)
• 3: High (HIGH)
• 99: Other (OTHER)

Entity:EMAIL
Any email information pertinent to an indicator or OSINT analysis.

Any email authentication information pertinent to an indicator or OSINT analysis.

Entity:FILE
Any pertinent file information related to an indicator or OSINT analysis.

Lockheed Martin Kill Chain Phases pertinent to an indicator or OSINT analysis.

Entity:GEO_LOCATION
Any pertinent geolocation information related to an indicator or OSINT analysis.

The name of the entity.

Group:context
The event data as received from the event source.

Group:primary
Unique identifier for the object

Any analytics related to an indicator or OSINT analysis.

Related reputational analysis from third-party engines and analysts for a given indicator or OSINT analysis.

Any pertinent script information related to an indicator or OSINT analysis.

Any digital signatures or hashes related to an indicator or OSINT analysis.

Entity:URL_STRING
The source URL of an indicator or OSINT analysis, e.g., a URL back to a TIP, report, or otherwise.

Any pertinent subdomain information - such as those generated by a Domain Generation Algorithm - related to an indicator or OSINT analysis.

Entity:SUBNET
A CIDR or network block related to an indicator or OSINT analysis.

The Traffic Light Protocol was created to facilitate greater sharing of potentially sensitive information and more effective collaboration. TLP provides a simple and intuitive schema for indicating with whom potentially sensitive information can be shared.

• AMBER: TLP:AMBER (TLPAMBER)
• AMBER STRICT: TLP:AMBER+STRICT (TLPAMBER+STRICT)
• CLEAR: TLP:CLEAR (TLPCLEAR)
• GREEN: TLP:GREEN (TLPGREEN)
• RED: TLP:RED (TLPRED)
• WHITE: TLP:WHITE (TLPWHITE)

The OSINT indicator type.

The OSINT indicator type ID.

• 0: Unknown (UNKNOWN)
• 1: IP Address (IP_ADDRESS)
• 10: Vulnerability (VULNERABILITY)
• 11: File (FILE)
• 12: Registry Key (REGISTRY_KEY)
• 13: Registry Value (REGISTRY_VALUE)
• 14: Command Line (COMMAND_LINE)
• 2: Domain (DOMAIN)
• 3: Hostname (HOSTNAME)
• 4: Hash (HASH)
• 5: URL (URL)
• 6: User Agent (USER_AGENT)
• 7: Digital Certificate (DIGITAL_CERTIFICATE)
• 8: Email (EMAIL)
• 9: Email Address (EMAIL_ADDRESS)
• 99: Other (OTHER)

The unique identifier of the entity.

Data from the source that was not mapped into the schema.

The actual indicator value in scope, e.g., a SHA-256 hash hexdigest or a domain name.

The vendor name of a tool which generates intelligence or provides indicators.

Any vulnerabilities related to an indicator or OSINT analysis.

Any pertinent WHOIS information related to an indicator or OSINT analysis.