Sightings and Observations

Use Cases UC1: Basic Sighting, +1: no count, times, CybOX I’ve seen this indicator UC2: Sighting w/ count I saw this indicator 154 times UC3: Sighting w/ what was seen I saw this indicator [154 times], and here’s the network capture from it UC4: Observation for some other use case (e.g. artifacts captured during IR, logs triggered by analytics or heuristics) I saw this network capture

Definitions Observation: The fact that something in cyber was seen Network traffic, File, etc. was observed Sighting: A cyber threat object was sighted Indicator, Malware, Tool, etc. was sighted, potentially X number of times Observation + Sighting: Indicator, Malware, Tool, etc. was sighted in the given cyber observations

Option 1: Current Approach UC1: +1 UC2: Sighting Counts UC3: Sighting Counts+CybOX UC4: Observation Indicator Indicator Indicator Observation Count = 154 Start = … End = … CybOX = {} sighting_of_ref sighting_of_ref sighting_of_ref Sighting Sighting Sighting observation_ref observation_ref Observation Count = 154 Start = … End = … Observation Count = 154 Start = … End = … CybOX = {}

Opt 2: Count on Sightings (required fields) UC1: +1 UC2: Sighting Counts UC3: Sighting Counts+CybOX UC4: Observation Indicator Indicator Indicator Observation Count = 154 Start = … End = … CybOX = {} sighting_of_ref sighting_of_ref sighting_of_ref Sighting Count = 154 Start = … End = … Sighting Sighting Count = 154 Start = … End = … observation_ref Observation Count = 154 Start = … End = … CybOX = {}

Opt 2: Count on Sightings (optional fields) UC1: +1 UC2: Sighting Counts UC3: Sighting Counts+CybOX UC4: Observation Indicator Indicator Indicator Observation Count = 154 Start = … End = … CybOX = {} sighting_of_ref sighting_of_ref sighting_of_ref Sighting Sighting Sighting Count = 154 Start = … End = … observation_ref Observation Count = 154 Start = … End = … CybOX = {}

Opt 2: Count on Sightings (optional fields) UC1: +1 UC2: Sighting Counts UC3: Sighting Counts+CybOX UC4: Observation Indicator Indicator Indicator Observation Count = 154 Start = … End = … CybOX = {} sighting_of_ref sighting_of_ref sighting_of_ref Sighting Count = 154 Start = … End = … Sighting Sighting Count = 154 Start = … End = … observation_ref Observation CybOX = {}

Option 3: Merge Sighting and Observation UC1: +1 UC2: Sighting Counts UC3: Sighting Counts+CybOX UC4: Observation Indicator Indicator Indicator Sighting Count = 154 Start = … End = … CybOX = {} sighting_of_ref sighting_of_ref sighting_of_ref Sighting Count = 154 Start = … End = … CybOX = {} Sighting Sighting Count = 154 Start = … End = …

Opt 4: Count on Sighting, not Observation UC1: +1 UC2: Sighting Counts UC3: Sighting Counts+CybOX UC4: Observation Not possible, requires multiple observations Indicator Indicator Indicator sighting_of_ref sighting_of_ref sighting_of_ref Sighting Count = 154 Start = … End = … Sighting Sighting Count = 154 Start = … End = … observation_ref Observation Start = … End = … CybOX = {}

Decisions Is it important that CybOX be required on an Observation? Are there any use cases other than sightings where you need to report an observation without a count? Is it important to be able to have a count on Observation? Are there use cases other than sightings where you need a count on Observations? Can we come up with coherent semantics if count is on both Sighting and Observation?