A judgement about the intent or nature of an observable. For example, is it malicious, meaning is is malware and subverts system operations? It could also be clean and be from a known benign, or trusted source. It could also be common, something so widespread that it's not likely to be malicious.
Since a core goal of the CTIA is to provide a simple verdict service, these judgements are the basis for the returned verdicts. These are also the primary means by which users of the CTIA go from observables on their system, to the indicators and threat intelligence data in CTIA.
| Property | Type | Description | Required? |
|---|---|---|---|
| confidence | HighMedLow String | ✓ | |
| disposition | DispositionNumberInteger | Matches :disposition_name as in {1 "Clean", 2 "Malicious", 3 "Suspicious", 4 "Common", 5 "Unknown"} | ✓ |
| disposition_name | DispositionName String | ✓ | |
| id | String | Globally unique URI identifying this object. | ✓ |
| observable | Observable Object | ✓ | |
| priority | Integer | ✓ | |
| schema_version | String | CTIM schema version for this entity | ✓ |
| severity | HighMedLow String | ✓ | |
| source | MedString String | ✓ | |
| type | JudgementTypeIdentifier String | ✓ | |
| valid_time | ValidTime Object | ✓ | |
| external_ids | String List | ||
| external_references | ExternalReference Object List | Specifies a list of external references which refers to non-CTIM information. This property is used to provide one or more URLs, descriptions, or IDs to records in other systems. | |
| language | ShortString String | The human language this object is specified in. | |
| reason | ShortString String | ||
| reason_uri | String | ||
| revision | Integer | A monotonically increasing revision, incremented each time the object is changed. | |
| source_uri | String | ||
| timestamp | Inst (Date) | The time this object was created at, or last modified. | |
| tlp | TLP String | Specification for how, and to whom, this object can be shared. |
-
This entry is required
- Allowed Values:
- High
- Info
- Low
- Medium
- None
- Unknown
- Reference: HighMedLowVocab
- Allowed Values:
Matches :disposition_name as in {1 "Clean", 2 "Malicious", 3 "Suspicious", 4 "Common", 5 "Unknown"}
-
This entry is required
- Numeric verdict identifiers
- Allowed Values:
- 1
- 2
- 3
- 4
- 5
-
This entry is required
- String verdict identifiers
- Allowed Values:
- Clean
- Common
- Malicious
- Suspicious
- Unknown
- This entry is optional
- This entry's type is sequential (allows zero or more values)
Specifies a list of external references which refers to non-CTIM information. This property is used to provide one or more URLs, descriptions, or IDs to records in other systems.
- This entry is optional
- This entry's type is sequential (allows zero or more values)
- ExternalReference Object Value
- Details: ExternalReference Object
Globally unique URI identifying this object.
-
This entry is required
- IDs are URIs, for example
https://www.domain.com/ctia/judgement/judgement-de305d54-75b4-431b-adb2-eb6b9e546014for a Judgement. This ID type compares to the STIX id field. The optional STIX idref field is not used.
- IDs are URIs, for example
The human language this object is specified in.
-
This entry is optional
- String with at most 1024 characters
- This entry is required
- Observable Object Value
- Details: Observable Object
-
This entry is required
- A value 0-100 that determine the priority of a judgement. Curated feeds of black/white lists, for example known good products within your organizations, should use a 95. All automated systems should use a priority of 90, or less. Human judgements should have a priority of 100, so that humans can always override machines.
-
This entry is optional
- String with at most 1024 characters
-
This entry is optional
- A URI
A monotonically increasing revision, incremented each time the object is changed.
-
This entry is optional
- Zero, or a positive integer
CTIM schema version for this entity
-
This entry is required
- A semantic version matching the CTIM version against which this object should be valid.
-
This entry is required
- Allowed Values:
- High
- Info
- Low
- Medium
- None
- Unknown
- Reference: HighMedLowVocab
- Allowed Values:
-
This entry is required
- String with at most 2048 characters
-
This entry is optional
- A URI
The time this object was created at, or last modified.
-
This entry is optional
- Schema definition for all date or timestamp values. Serialized as a string, the field should follow the rules of the ISO8601 standard.
Specification for how, and to whom, this object can be shared.
-
This entry is optional
- TLP stands for Traffic Light Protocol, which indicates precisely how this resource is intended to be shared, replicated, copied, etc.
- Default: green
- Allowed Values:
- amber
- green
- red
- white
-
This entry is required
- Must equal: "judgement"
- This entry is required
- ValidTime Object Value
- Details: ValidTime Object
External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material.
| Property | Type | Description | Required? |
|---|---|---|---|
| source_name | MedString String | The source within which the external-reference is defined (system, registry, organization, etc.) | ✓ |
| description | Markdown String | ||
| external_id | String | An identifier for the external reference content. | |
| hashes | String List | Specifies a dictionary of hashes for the contents of the url. | |
| url | String | A URL reference to an external resource |
- Reference: External Reference
-
This entry is optional
- Markdown string with at most 5000 characters
An identifier for the external reference content.
- This entry is optional
Specifies a dictionary of hashes for the contents of the url.
- This entry is optional
- This entry's type is sequential (allows zero or more values)
The source within which the external-reference is defined (system, registry, organization, etc.)
-
This entry is required
- String with at most 2048 characters
A URL reference to an external resource
-
This entry is optional
- A URI
A simple, atomic value which has a consistent identity, and is stable enough to be attributed an intent or nature. This is the classic 'indicator' which might appear in a data feed of bad IPs, or bad Domains. These do not exist as objects within the CTIA storage model, so you never create an observable.
| Property | Type | Description | Required? |
|---|---|---|---|
| type | ObservableTypeIdentifier String | ✓ | |
| value | String | ✓ |
-
This entry is required
- Observable type names
- Allowed Values:
- amp_computer_guid
- cisco_mid
- device
- domain
- email_messageid
- email_subject
- file_name
- file_path
- hostname
- imei
- imsi
- ip
- ipv6
- mac_address
- md5
- mutex
- ngfw_id
- ngfw_name
- odns_identity
- odns_identity_label
- pki_serial
- sha1
- sha256
- url
- user
- This entry is required
Period of time when a cyber observation is valid.
| Property | Type | Description | Required? |
|---|---|---|---|
| end_time | Inst (Date) | If end_time is not present, then the valid time position of the object does not have an upper bound. | |
| start_time | Inst (Date) | If not present, the valid time position of the indicator does not have an upper bound |
- Reference: ValidTimeType
If end_time is not present, then the valid time position of the object does not have an upper bound.
-
This entry is optional
- Schema definition for all date or timestamp values. Serialized as a string, the field should follow the rules of the ISO8601 standard.
If not present, the valid time position of the indicator does not have an upper bound
-
This entry is optional
- Schema definition for all date or timestamp values. Serialized as a string, the field should follow the rules of the ISO8601 standard.