STIX/TAXII 2.1 - Data Structure The TAXII 2.1 server provided by ticura is fully compatible with the TAXII 2.1 and STIX 2.1 standards.
To support the integration of the data we have another dedicated article with guides for specific product integrations as well as some general recommendations
The following STIX object types are used for the following purposes:
kind type purpose SDO indicator matching content SDO malware indicator related malware information SDO identity CTI sources, organizations, reporters SDO observed-data DNS resolution SDO threat-actor indicator related threat actor SDO report connecting multiple indicators of same detonation SDO location related countries given by CTI sources SDO vulnerability related vulnerability SRO relationship SRO sighting SCO domain-name DNS: Nameserver, PTR SCO ipv4-addr DNS resolvement SCO ipv6-addr DNS resolvement SCO file indicator related file information SCO autonomous-system indicator related ASN information SMO marking-definition TLP 1.0/2.0 SMO extension-definition TLP 2.0
Following diagram shows how selected enrichments of a subscription affect the STIX 2.1 objects created.
property filled by / meaning pattern describes IOC value(s) to be matched to, see STIX patterns section pattern_type either stix pattern or pcre pattern_version refers to 2.0 if STIX pattern is used spec_version refers to 2.1 type "indicator"id reproducible ID according to guideline description contains origins, licenses and reporters of the IOC name [IOC value]created_by_ref identifier of the ticura identity object created timestamp of initial object creation due to initial subscription export modified timestamp of last change valid_from timestamp the IOC was defined to become valid (e.g. DGA domains) or was first seen in CTI sources valid_until timestamp the IOC is valid to, only if exists CTI source (e.g. DGA domains) revoked true, if the IOC needs to be removed from the targeted product. Is used by Ticura for IOC aging to prevent object overflowing labels labels/tags describing the IOC and allowing the customer a first understanding (e.g. threat type, mitre IDs, online/offline) kill_chain_phases list of kill chain phase according to given MITRE IDs external_references refers to CTI source reports, MITRE descriptions, project pages of sinkholes, scanners, infrastructre, or third party info object_marking_refs used to refer to TLP markings
The malware object is mainly used for pivoting purpose.
property filled by / meaning created timestamp of initial object creation due to initial subscription export modified timestamp of last change spec_version refers to 2.1 type "malware"id reproducible ID according to guideline created_by_ref identifier of this ticura identity object name malware name aliases malware aliases is_family true, sources always refer to families revoked true, if malware isn´t referenced anymore
The identity object is only used for the creator identity. We initially used that kind of object also for CTI sources, reporters, sinkholes etc., but decided to add this as tags/description due to the overhead of relationships/objects.
property filled by / meaning created timestamp of initial object creation due to initial subscription export modified timestamp of last change spec_version refers to 2.1 type "identity"id reproducible ID according to guideline created_by_ref identifier of this ticura identity object description explaining the Ticura feed identity_class "organization"sectors ["cybersecurity" ]contact_information ["support@ticura.io"]roles ["CTI source optimizer and provider"]x_opencti_organization_type "Vendor", product specific custom property
This kind of object is used by Ticura to show current DNS resolutions of the urls/domains. By pivoting data, it enables analysis of linked threats.
property filled by / meaning created timestamp of initial object creation due to initial subscription export modified timestamp of last change spec_version refers to 2.1 type "observed-data"id reproducible ID according to guideline created_by_ref identifier of this ticura identity object revoked true in case of no current DNS resolution first_observed first seen of this DNS resolution last_observed first seen of this DNS resolution number_observed always set to 1 object_refs refers to object of DNS resolution such as ips and nameservers labels ["dns resolution", "updates on changes"]
Used to show PTR records which resulted from a DNS request.
property filled by / meaning type "domain-name"id reproducible ID according to guideline spec_version refers to 2.1 value domain name
property filled by / meaning type "ipv4-addr"id reproducible ID according to guideline spec_version refers to 2.1 value IPv4
property filled by / meaning type "ipv6-addr"id reproducible ID according to guideline spec_version refers to 2.1 value IPv6
property filled by / meaning type "file"id reproducible ID according to guideline spec_version refers to 2.1 hashes dictionary of file specific md5, sha1, sha256, sha512,ssdeep, tlsh mime_type file mime type size file size, in bytes name filenames concatenated by OR
property filled by / meaning type "autonomous-system"id reproducible ID according to guideline spec_version refers to 2.1 number AS number of the object referring to this object name name of this AS
The location object is mainly used for pivoting purpose.
property filled by / meaning created timestamp of initial object creation due to initial subscription export modified timestamp of last change spec_version refers to 2.1 type "location"id reproducible ID according to guideline created_by_ref identifier of this ticura identity object revoked true in case the relationship was dropped country ISO 3166-1 ALPHA-2 code of country name name of the country description description
The vulnerability object is mainly used for pivoting purpose.
property filled by / meaning created timestamp of initial object creation due to initial subscription export modified timestamp of last change spec_version refers to 2.1 type "vulnerability"id reproducible ID according to guideline created_by_ref identifier of this ticura identity object revoked true in case relationship was dropped name name of the vulnerability
The threat actor object is mainly used for pivoting purpose.
property filled by / meaning created timestamp of initial object creation due to initial subscription export modified timestamp of last change spec_version refers to 2.1 type "threat-actor"created_by_ref identifier of this ticura identity object revoked true in case of relationship was dropped name name of the threat actor
This kind of object is used to keep the relationship in between multiple IOCs resulting from a common analysis such as a malware sandbox detonation. It also refers to all other objects which were created out of the specific IOCs.
property filled by / meaning created timestamp of initial object creation due to initial subscription export modified timestamp of last change spec_version refers to 2.1 type "report"id reproducible ID according to guideline created_by_ref identifier of this ticura identity object revoked true in case all IOCs were dropped report_types "observed-data"external_references combining all external references of all objects referenced by this report published timestamp of initial object creation due to initial subscription export object_refs referring to all objects related to this common analysis name name of the report
property filled by / meaning created timestamp of initial object creation due to initial subscription export modified timestamp of last change spec_version refers to 2.1 type "relationship"id reproducible ID according to guideline created_by_ref identifier of this ticura identity object revoked true in case of dropped relationship source_ref source identifier target_ref target identifier relationship_type relationship type defines the semantical relation source<->target description details about the relation start_time only for some relations: timestamp of first observation of this relation
property filled by / meaning created timestamp of initial object creation due to initial subscription export modified timestamp of last change spec_version refers to 2.1 type "sighting"id reproducible ID according to guideline created_by_ref identifier of ticura identity object revoked true in case of dropped relationship first_seen start of the period of this measurement last_seen end of the period of this measurement count # observations of referenced indicator for specified period and specified countries sighting_of_ref identifier of observed indicator description details about the sighting context where_sighted_refs list of countries included in observations summary true if this is the initial sighting object of the indicator, summing up all previous sightings
Ticura takes care to keep the number of marking definition objects as low as possible in order to avoid inconsistent data due to missing references on the target machines. For this reason the only used marking definitions are
The STIX standard defines indicator matches by use of matching patterns . This also allows the description of complex behavioral schemes of malicious software. Ticura uses the following STIX/pcre patterns for the respective IOC types:
IOC main type IOC sub type Pattern(example) URL DOMAIN [ url:value = 'http://example.com' ]URL IPV4 [ url:value = 'http://172.1.1.1' ]URL IPV6 [ url:value = 'http://[2001:0db8:3333:4444:5555:6666:7777:8888]/abc' ]URL IPV4PORT [ url:value = 'http://172.1.1.1:8080/abc' ]URL IPV6PORT [ url:value = 'http://[2001:0db8:3333:4444:5555:6666:7777:8888]:8080/abc' ]DOMAIN DOMAIN [ domain-name:value = 'sakir.hack-free.net' ]IPV4 IPV4 [ ipv4-addr:value = '172.1.1.1' ]IPV4 IPV4RANGE [ ipv4-addr:value = '172.0.0.0/8' ]IPV4 IPV4PORT [ ipv4-addr:value = '172.1.1.1:8080' ]IPV6 IPV6 [ ipv6-addr:value = '[2001:db8:3333:4444:5555:6666:7777:8888]' ]IPV6 IPV6RANGE [ ipv6-addr:value = '[2001:db8:3333:4444:5555:6666:7777:8888]/64' ]IPV6 IPV6PORT [ ipv6-addr:value = '[2001:db8:3333:4444:5555:6666:7777:8888]:8080' ]HASH HASHMD5 [ file:hashes.'MD5' = '838ece1033bf7c7468e873e79ba2a3ec' ]HASH HASHSHA1 ____OR [ file:hashes.'SHA-1' = '1257ee4cb238affd46ef15d06714525c2c7c9018' ] HASH HASHSHA256 ____OR [ file:hashes.'SHA-256' = '20f679a763b8f8dd853dd617d3fb102faf087735c9e3bed31396d87186939db2' ] HASH HASHSHA512 ____OR [ file:hashes.'SHA-512' = '9d4224dba01771e56fe29e620cb713a2d30ed03a015504455781569b6d6979f69d8fbf40e005533666bfeea11f4807d7cd0a459ba2934dc970a50bf48fd0c84a' ] HASH HASHSSDEEP ____OR [ file:hashes.'SSDEEP' = '24:Ol9rFBzwjx5ZKvBBi8RuM4Pp6rG5Yg+q8wIXhMC:qrFBzKx5L8sM4grq8wIXht' ] HASH TLSH ____OR [ file:hashes.'TLSH' = 'T1E0A022C8330203338E88008038882A80FF820A0C203203222C00000023030200022C88' ] EMAIL EMAIL test@test.deCRYPTOCURRENCYADRESS BITCOIN (?i) bc1q5lm8v27uf9v8nz6yczg3gxraflxlas4jvr0zuf (uses pattern type pcre) CRYPTOCURRENCYADRESS ETHEREUM (?i) 0x52908400098527886E0F7030069857D2E4169EE7 (uses pattern type pcre) CRYPTOCURRENCYADRESS MONERO (?i) 888tNkZrPN6JsEgekjMnABU4TBzc2Dt29EPAvkRxbANsAnjyPbb3iQ1YBRk1UXcdRsiKc9dhwMVgN5S9cQUiyoogDavup3H (uses pattern type pcre)
