During the course of an incident investigation it’s useful to record the pieces of observable data that led to the discovery of the incident or that were detected and presumed to be related to the incident. These can be captured in a vendor-independent manner using CybOX and then related into STIX incident records.
This scenario consists of an incident where during the investigation, it was determined that 2 files discovered on end user systems were malicious. The idiom describes representing the incident itself with just a title and the set of related files.
This idiom is represented as a relationship between the Incident component and the CybOX Observable component. The incident describes information specific to the incident itself while the observable instance components each contain a file object with the name, size, and hash that were found for that file. The
Related Observables relationship is used to link the observed files to the incident.
The observables are represented using CybOX Observables that leverage the File Object. Each file has three fields that are filled out: the
Hash field (within a hash structure) is the hash of the file, the
File_Name field contains the name (not path) of the file, and the
Size field contains the size in bytes of the file. In the case of this scenario, the two files observed share the same name and size but differing hashes.
Notice that, unlike when working with indicators, these are CybOX instance objects rather than patterns. Therefore the CybOX patterning capabilities such as conditions and apply conditions are not leveraged.
For simplicity sake of this idiom, the Observable structures were kept to a minimum. Observables detected during an incident investigation would also typically include a
Observable Source structure to convey when, how and by whom the observable was observed.
Given the constrained scenario, the incident construct is fairly limited: it contains a
Title to identify the incident and a set of
Related Observables. The observable references point to the individual observables defined above each relationship is characterized as “Malicious Artifact Detected”.
|Full XML||Python Producer||Python Consumer|
See the full documentation for the relevant types for further information that may be provided: