{"action":"created","issue":{"url":"https://api.github.com/repos/STIXProject/specifications/issues/35","labels_url":"https://api.github.com/repos/STIXProject/specifications/issues/35/labels{/name}","comments_url":"https://api.github.com/repos/STIXProject/specifications/issues/35/comments","events_url":"https://api.github.com/repos/STIXProject/specifications/issues/35/events","html_url":"https://github.com/STIXProject/specifications/issues/35","id":113078826,"number":35,"title":"IndicatorTypeVocab needs to be improved","user":{"login":"jmgnc","id":11578757,"avatar_url":"https://avatars.githubusercontent.com/u/11578757?v=3","gravatar_id":"","url":"https://api.github.com/users/jmgnc","html_url":"https://github.com/jmgnc","followers_url":"https://api.github.com/users/jmgnc/followers","following_url":"https://api.github.com/users/jmgnc/following{/other_user}","gists_url":"https://api.github.com/users/jmgnc/gists{/gist_id}","starred_url":"https://api.github.com/users/jmgnc/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jmgnc/subscriptions","organizations_url":"https://api.github.com/users/jmgnc/orgs","repos_url":"https://api.github.com/users/jmgnc/repos","events_url":"https://api.github.com/users/jmgnc/events{/privacy}","received_events_url":"https://api.github.com/users/jmgnc/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":4,"created_at":"2015-10-23T18:50:13Z","updated_at":"2015-10-30T18:30:45Z","closed_at":null,"body":"There is a discussion on cti-users and cti-stix about improving the IndicatorTypeVocab.\r\n\r\nI believe that having a vocab is a useful thing.  But I believe the existing vocab needs to be improved.\r\n\r\nFirst off, type information, like e-mail, ip, file hash, domain, etc. should be removed.  You should/must be able to get this information from the Observable that is part of the Indicator.\r\n\r\nFor one, there is no vocab to describe a malicious observiable, say network packet, stream, or other activity.  Though if the e-mail type is removed from Malicious E-mail, and it just became Malicious (Observable), then we would have something.\r\n\r\nRemoving type information would reduce the IndicatorTypeVocab down to:\r\nCompromised\r\nMalicious\r\nWatchlist\r\nC2\r\nAnonymization\r\nExfiltration\r\n\r\nThe first three are interesting,  Compromised means that this Observable indicates that you ARE compromised.  The Malicious means that you WILL be compromised by this Observable and Watchlist means that you MAY get compromised by this Observable.\r\n\r\nArguably, C2 should fall under Compromised, but as it probably requires further investigation to figure out the original compromised host, I'm fine leaving this as it's own separate type."},"comment":{"url":"https://api.github.com/repos/STIXProject/specifications/issues/comments/152610647","html_url":"https://github.com/STIXProject/specifications/issues/35#issuecomment-152610647","issue_url":"https://api.github.com/repos/STIXProject/specifications/issues/35","id":152610647,"user":{"login":"jmgnc","id":11578757,"avatar_url":"https://avatars.githubusercontent.com/u/11578757?v=3","gravatar_id":"","url":"https://api.github.com/users/jmgnc","html_url":"https://github.com/jmgnc","followers_url":"https://api.github.com/users/jmgnc/followers","following_url":"https://api.github.com/users/jmgnc/following{/other_user}","gists_url":"https://api.github.com/users/jmgnc/gists{/gist_id}","starred_url":"https://api.github.com/users/jmgnc/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jmgnc/subscriptions","organizations_url":"https://api.github.com/users/jmgnc/orgs","repos_url":"https://api.github.com/users/jmgnc/repos","events_url":"https://api.github.com/users/jmgnc/events{/privacy}","received_events_url":"https://api.github.com/users/jmgnc/received_events","type":"User","site_admin":false},"created_at":"2015-10-30T18:30:45Z","updated_at":"2015-10-30T18:30:45Z","body":"Compromise - I agree a difference between simple activity vs compromise.  We don't have a normal activity vocab, and I think that is fine, since why would you want to alert on that.\r\n\r\nFor Quantified Risk:  in the case of a port opened, why isn't that Anomalous Activity instead?  Pretty much anything in an Indicator is a Risk, otherwise we wouldn't be looking for it.\r\n\r\nI'd still like to know how Privilege Escalation differs from Compromise or Known Vulnerability in your midset, though we should probably take this part of the discussion to something like slack."}}