1. Sightings and Observations

2. Use Cases UC1: Basic Sighting, +1: no count, times, CybOX
I’ve seen this indicator
UC2: Sighting w/ count
I saw this indicator 154 times
UC3: Sighting w/ what was seen
I saw this indicator [154 times], and here’s the network capture from it
UC4: Observation for some other use case (e.g. artifacts captured during IR, logs triggered by analytics or heuristics)
I saw this network capture

3. Definitions Observation: The fact that something in cyber was seen
Network traffic, File, etc. was observed
Sighting: A cyber threat object was sighted
Indicator, Malware, Tool, etc. was sighted, potentially X number of times
Observation + Sighting:
Indicator, Malware, Tool, etc. was sighted in the given cyber observations

4. Option 1: Current Approach
UC1: +1
UC2: Sighting Counts
UC3: Sighting Counts+CybOX
UC4: Observation
Indicator
Indicator
Indicator
Observation
Count = 154
Start = …
End = …
CybOX = {}
sighting_of_ref
sighting_of_ref
sighting_of_ref
Sighting
Sighting
Sighting
observation_ref
observation_ref
Observation
Count = 154
Start = …
End = …
Observation
Count = 154
Start = …
End = …
CybOX = {}

5. Opt 2: Count on Sightings (required fields)
UC1: +1
UC2: Sighting Counts
UC3: Sighting Counts+CybOX
UC4: Observation
Indicator
Indicator
Indicator
Observation
Count = 154
Start = …
End = …
CybOX = {}
sighting_of_ref
sighting_of_ref
sighting_of_ref
Sighting
Count = 154
Start = …
End = …
Sighting
Sighting
Count = 154
Start = …
End = …
observation_ref
Observation
Count = 154
Start = …
End = …
CybOX = {}

6. Opt 2: Count on Sightings (optional fields)
UC1: +1
UC2: Sighting Counts
UC3: Sighting Counts+CybOX
UC4: Observation
Indicator
Indicator
Indicator
Observation
Count = 154
Start = …
End = …
CybOX = {}
sighting_of_ref
sighting_of_ref
sighting_of_ref
Sighting
Sighting
Sighting
Count = 154
Start = …
End = …
observation_ref
Observation
Count = 154
Start = …
End = …
CybOX = {}

7. Opt 2: Count on Sightings (optional fields)
UC1: +1
UC2: Sighting Counts
UC3: Sighting Counts+CybOX
UC4: Observation
Indicator
Indicator
Indicator
Observation
Count = 154
Start = …
End = …
CybOX = {}
sighting_of_ref
sighting_of_ref
sighting_of_ref
Sighting
Count = 154
Start = …
End = …
Sighting
Sighting
Count = 154
Start = …
End = …
observation_ref
Observation
CybOX = {}

8. Option 3: Merge Sighting and Observation
UC1: +1
UC2: Sighting Counts
UC3: Sighting Counts+CybOX
UC4: Observation
Indicator
Indicator
Indicator
Sighting
Count = 154
Start = …
End = …
CybOX = {}
sighting_of_ref
sighting_of_ref
sighting_of_ref
Sighting
Count = 154
Start = …
End = …
CybOX = {}
Sighting
Sighting
Count = 154
Start = …
End = …

9. Opt 4: Count on Sighting, not Observation
UC1: +1
UC2: Sighting Counts
UC3: Sighting Counts+CybOX
UC4: Observation
Not possible, requires
multiple observations
Indicator
Indicator
Indicator
sighting_of_ref
sighting_of_ref
sighting_of_ref
Sighting
Count = 154
Start = …
End = …
Sighting
Sighting
Count = 154
Start = …
End = …
observation_ref
Observation
Start = …
End = …
CybOX = {}

10. Decisions Is it important that CybOX be required on an Observation?
Are there any use cases other than sightings where you need to report an observation without a count?
Is it important to be able to have a count on Observation?
Are there use cases other than sightings where you need a count on Observations?
Can we come up with coherent semantics if count is on both Sighting and Observation?