Incident with Related Observables

Observable Icon

During the course of an incident investigation it’s useful to record the pieces of observable data that led to the discovery of the incident or that were detected and presumed to be related to the incident. These can be captured in a vendor-independent manner using CybOX and then related into STIX incident records.


This scenario consists of an incident where during the investigation, it was determined that 2 files discovered on end user systems were malicious. The idiom describes representing the incident itself with just a title and the set of related files.

Data model

Observables related to an incident

This idiom is represented as a relationship between the Incident component and the CybOX Observable component. The incident describes information specific to the incident itself while the observable instance components each contain a file object with the name, size, and hash that were found for that file. The Related Observables relationship is used to link the observed files to the incident.


The observables are represented using CybOX Observables that leverage the File Object. Each file has three fields that are filled out: the Hash field (within a hash structure) is the hash of the file, the File_Name field contains the name (not path) of the file, and the Size field contains the size in bytes of the file. In the case of this scenario, the two files observed share the same name and size but differing hashes.

Notice that, unlike when working with indicators, these are CybOX instance objects rather than patterns. Therefore the CybOX patterning capabilities such as conditions and apply conditions are not leveraged.

For simplicity sake of this idiom, the Observable structures were kept to a minimum. Observables detected during an incident investigation would also typically include a Observable Source structure to convey when, how and by whom the observable was observed.


Given the constrained scenario, the incident construct is fairly limited: it contains a Title to identify the incident and a set of Related Observables. The observable references point to the individual observables defined above each relationship is characterized as “Malicious Artifact Detected”.


Full XML Python Producer Python Consumer

Further Reading

See the full documentation for the relevant types for further information that may be provided: