Skip to content

Latest commit

 

History

History
167 lines (112 loc) · 5.24 KB

verdict.md

File metadata and controls

167 lines (112 loc) · 5.24 KB

Verdict Object

A Verdict is chosen from all of the Judgements on that Observable which have not yet expired. The highest priority Judgement becomes the active verdict. If there is more than one Judgement with that priority, then Clean disposition has priority over all others, then Malicious disposition, and so on down to Unknown.

The ID of a verdict is a a str of the form "observable.type:observable.value" for example, "ip:1.1.1.1"

Property Type Description Required?
disposition DispositionNumberInteger ✓
observable Observable Object ✓
type VerdictTypeIdentifier String ✓
valid_time ValidTime Object ✓
disposition_name DispositionName String The disposition_name field is optional, but is intended to be shown to a user. Applications must therefore remember the mapping of numbers to human words, as in: {1 "Clean", 2 "Malicious", 3 "Suspicious", 4 "Common", 5 "Unknown"}
judgement_id String

Property disposition ∷ DispositionNumberInteger

  • This entry is required

    • Numeric verdict identifiers
    • Allowed Values:
      • 1
      • 2
      • 3
      • 4
      • 5

Property disposition_name ∷ DispositionName String

The disposition_name field is optional, but is intended to be shown to a user. Applications must therefore remember the mapping of numbers to human words, as in: {1 "Clean", 2 "Malicious", 3 "Suspicious", 4 "Common", 5 "Unknown"}

  • This entry is optional

    • String verdict identifiers
    • Allowed Values:
      • Clean
      • Common
      • Malicious
      • Suspicious
      • Unknown

Property judgement_id ∷ String

  • This entry is optional

    • A URI leading to a judgement

Property observable ∷ Observable Object

  • This entry is required

Property type ∷ VerdictTypeIdentifier String

  • This entry is required

    • Must equal: "verdict"

Property valid_time ∷ ValidTime Object

  • This entry is required

Observable Object

A simple, atomic value which has a consistent identity, and is stable enough to be attributed an intent or nature. This is the classic 'indicator' which might appear in a data feed of bad IPs, or bad Domains. These do not exist as objects within the CTIA storage model, so you never create an observable.

Property Type Description Required?
type ObservableTypeIdentifier String ✓
value String ✓

Property type ∷ ObservableTypeIdentifier String

  • This entry is required

    • Observable type names
    • Allowed Values:
      • amp_computer_guid
      • cisco_mid
      • device
      • domain
      • email
      • email_messageid
      • email_subject
      • file_name
      • file_path
      • hostname
      • imei
      • imsi
      • ip
      • ipv6
      • mac_address
      • md5
      • mutex
      • ngfw_id
      • ngfw_name
      • odns_identity
      • odns_identity_label
      • pki_serial
      • sha1
      • sha256
      • url
      • user

Property value ∷ String

  • This entry is required

ValidTime Object

Period of time when a cyber observation is valid.

Property Type Description Required?
end_time Inst (Date) If end_time is not present, then the valid time position of the object does not have an upper bound.
start_time Inst (Date) If not present, the valid time position of the indicator does not have an upper bound

Property end_time ∷ Inst (Date)

If end_time is not present, then the valid time position of the object does not have an upper bound.

  • This entry is optional

    • Schema definition for all date or timestamp values. Serialized as a string, the field should follow the rules of the ISO8601 standard.

Property start_time ∷ Inst (Date)

If not present, the valid time position of the indicator does not have an upper bound

  • This entry is optional

    • Schema definition for all date or timestamp values. Serialized as a string, the field should follow the rules of the ISO8601 standard.