Skip to content

Latest commit

 

History

History
200 lines (143 loc) · 6.05 KB

verdict.md

File metadata and controls

200 lines (143 loc) · 6.05 KB
Raw

Verdict Object

Verdict A Verdict is chosen from all of the Judgements on that Observable which have not yet expired. The highest priority Judgement becomes the active verdict. If there is more than one Judgement with that priority, then Clean disposition has priority over all others, then Malicious disposition, and so on down to Unknown.

The ID of a verdict is a a str of the form "observable.type:observable.value" for example, "ip:1.1.1.1"

Property Type Description Required?
disposition DispositionNumberInteger ✓
observable Observable Object ✓
type VerdictTypeIdentifierString ✓
valid_time ValidTime Object ✓
disposition_name DispositionNameString The disposition_name field is optional, but is intended to be shown to a user. Applications must therefore remember the mapping of numbers to human words, as in: {1 "Clean", 2 "Malicious", 3 "Suspicious", 4 "Common", 5 "Unknown"}
judgement_id String

Property disposition ∷ DispositionNumberInteger

  • This entry is required

    • DispositionNumber Numeric verdict identifiers.
    • Allowed Values:
      • 1
      • 2
      • 3
      • 4
      • 5

Property disposition_name ∷ DispositionNameString

The disposition_name field is optional, but is intended to be shown to a user. Applications must therefore remember the mapping of numbers to human words, as in: {1 "Clean", 2 "Malicious", 3 "Suspicious", 4 "Common", 5 "Unknown"}

  • This entry is optional

    • DispositionName String verdict identifiers.
    • Allowed Values:
      • Clean
      • Common
      • Malicious
      • Suspicious
      • Unknown

Property judgement_id ∷ String

  • This entry is optional

    • A URI leading to a judgement.

Property observable ∷ Observable Object

  • This entry is required

Property type ∷ VerdictTypeIdentifierString

  • This entry is required

    • Must equal: "verdict"

Property valid_time ∷ ValidTime Object

  • This entry is required

Observable Object

Observable A simple, atomic value which has a consistent identity, and is stable enough to be attributed an intent or nature. This is the classic 'indicator' which might appear in a data feed of bad IPs, or bad Domains. These do not exist as objects within the CTIA storage model, so you never create an observable.

Property Type Description Required?
type ObservableTypeIdentifierString The type of observable. ✓
value String The value of the observable. ✓

Property type ∷ ObservableTypeIdentifierString

The type of observable.

  • This entry is required

    • ObservableTypeIdentifier Observable type names
    • Allowed Values:
      • amp_computer_guid
      • certificate_common_name
      • certificate_issuer
      • certificate_serial
      • cisco_cm_id
      • cisco_mid
      • cisco_uc_id
      • cortex_agent_id
      • crowdstrike_id
      • cybereason_id
      • darktrace_id
      • device
      • domain
      • email
      • email_messageid
      • email_subject
      • file_name
      • file_path
      • hostname
      • imei
      • imsi
      • ip
      • ipv6
      • mac_address
      • md5
      • meraki_network_id
      • meraki_node_sn
      • meraki_org_id
      • ms_machine_id
      • mutex
      • ngfw_id
      • ngfw_name
      • odns_identity
      • odns_identity_label
      • orbital_node_id
      • pki_serial
      • process_args
      • process_hash
      • process_name
      • process_path
      • process_uid
      • process_username
      • processor_id
      • registry_key
      • registry_name
      • registry_path
      • s1_agent_id
      • serial_number
      • sha1
      • sha256
      • swc_device_id
      • trend_micro_id
      • url
      • user
      • user_agent

Property value ∷ String

The value of the observable.

  • This entry is required

ValidTime Object

ValidTime Period of time when a cyber observation is valid.

Property Type Description Required?
end_time Inst (Date) If end_time is not present, then the valid time position of the object does not have an upper bound.
start_time Inst (Date) If not present, the valid time position of the indicator does not have an upper bound.

Property end_time ∷ Inst (Date)

If end_time is not present, then the valid time position of the object does not have an upper bound.

  • This entry is optional

    • ISO8601 Timestamp Schema definition for all date or timestamp values. Serialized as a string, the field should follow the rules of the ISO8601 standard.

Property start_time ∷ Inst (Date)

If not present, the valid time position of the indicator does not have an upper bound.

  • This entry is optional

    • ISO8601 Timestamp Schema definition for all date or timestamp values. Serialized as a string, the field should follow the rules of the ISO8601 standard.