Instructor: As we mentioned before, 2 2
threat research can be delivered as narrative reports 3 3
or automated feeds 4 4
designed to correlate local security information 5 5
with cyber threat intelligence data. 6 6
Now, sharing is caring in the threat intelligence world, 7 7
so to make it easier to share data, 8 8
there are lots of different formats out there 9 9
that could be used. 10 10
In this lesson, 11 11
we're going to discuss the four most common formats 12 12
and processes, 13 13
known as STIX, TAXII, OpenIOC, and MISP. 14 14
The first one we want to talk about is STIX, 15 15
which is the Structured Threat Information eXpression. 16 16
Now, this is a standard terminology for IoCs 17 17
and ways of indicating relationships between them 18 18
that's included as part 19 19
of the OASIS Cyber Threat Intelligence, or CTI, framework. 20 20
Now, STIX is designed as a format for automated feeds 21 21
so organizations can share this information on the fly. 22 22
STIX does a great job 23 23
of sharing information between systems, 24 24
and it's expressed 25 25
in JavaScript object notation, or JSON, format. 26 26
With JSON, 27 27
you get an attribute and value paired together 28 28
inside of the language, 29 29
and essentially, it's going to look like this. 30 30
Notice here how we start 31 31
with a curly bracket at the beginning 32 32
and a curly bracket at the end. 33 33
And then, we have a lot of different pairs, 34 34
such as type, observed-data, 35 35
id, with some-unique-string, 36 36
created, and some date, 37 37
the number_observed, and a number. 38 38
And you can see how these attributes and values 39 39
are paired together inside this language. 40 40
If you see something that looks like this, 41 41
this is JSON format, 42 42
and on the exam, 43 43
if you see something in JSON format 44 44
it's most likely going to be referring to STIX. 45 45
Now, STIX is built 46 46
from higher-level STIX domain objects, or SDOs, 47 47
and these can contain multiple attributes and values. 48 48
We put all these things together 49 49
to get the information we're looking for. 50 50
Now, what are some of these SDOs? 51 51
Well, we have things like observed data 52 52
which is going to be a stateful property 53 53
of your computer system 54 54
and what you've actually seen the event occurring in. 55 55
This might be something like an IP address 56 56
or an executable file or something like that. 57 57
We also have indicators. 58 58
Indicators are a pattern of observables 59 59
that are of interest, 60 60
something that you want to do some further analysis on. 61 61
Anytime you have an indicator, 62 62
this is something that's been observed 63 63
and you may want to dig a little deeper on 64 64
to figure out if it's an indicator of past compromise 65 65
or a TTP. 66 66
And then, we have attack patterns. 67 67
When we deal with attack patterns, 68 68
these are known adversary behaviors, 69 69
starting with the overall goal 70 70
of what they're trying to attack 71 71
and then elaborating down 72 72
to some kind of specific technique or procedure. 73 73
Then we have campaigns and threat actors. 74 74
When we talk about this, 75 75
these are the people who are trying to attack you. 76 76
Who are these people? 77 77
What are their goals? 78 78
What is their campaign? 79 79
That's what we're talking about 80 80
when we talk about the campaign and threat actors. 81 81
And finally, we have courses of action. 82 82
Now, we deal with courses of action. 83 83
This is the mitigating actions or security controls 84 84
that you can use to reduce the risk 85 85
from these different attacks 86 86
and how to resolve these incidents. 87 87
By taking all these SDOs together, 88 88
you start creating a connection 89 89
of this relationship of objects. 90 90
And this can do a lot of different things for you 91 91
as you start indicating what it was, 92 92
what the targets were, 93 93
and what things were attributed to it. 94 94
For example, you can see here on the screen, 95 95
we have a vulnerability, 96 96
we have a campaign, 97 97
and we have a threat actor. 98 98
And you can see how STIX has all these relationships. 99 99
When we have a single indicator, 100 100
this indicates a campaign. 101 101
It indicates a threat actor. 102 102
The campaign is attributed to the threat actor 103 103
and the campaign can be attributed over to the target, 104 104
which was the vulnerability. 105 105
And the way STIX works is it creates this language 106 106
for us to describe these things in a very easy way 107 107
to share them automatically across our systems. 108 108
Now, one quick note for the exam. 109 109
STIX version one is an XML-version-based format 110 110
but the exam is only going to talk about STIX version two. 111 111
Everything I've talked about up to this point in this lesson 112 112
was talking about STIX version two, 113 113
which uses JSON, not XML. 114 114
Keep that in mind for the exam. 115 115
If they're asking about STIX, 116 116
they're talking about version two 117 117
and they're going to be talking about JSON. 118 118
The next one we want to talk about 119 119
is the Trusted Automated Exchange of Indicator Information, 120 120
or TAXII. 121 121
Now, TAXII is a protocol for supplying codified information 122 122
to automate incident detection and analysis. 123 123
What TAXII is used for 124 124
is to transmit this data back and forth 125 125
between servers and clients 126 126
over some kind of a secure connection, 127 127
like a secure web connection, HTTPS, 128 128
using something like a REST API. 129 129
So for example, 130 130
if you have a cyber threat intelligence subscription 131 131
with some service provider, 132 132
they're going to maintain their data repository, 133 133
but you as a subscriber 134 134
need to get the information from them. 135 135
And so, the way you do this 136 136
is you're going to obtain this update 137 137
to all of your data for your analysis tools using TAXII. 138 138
TAXII is really the connection mechanism, 139 139
and you can actually take STIX 140 140
and provide it over TAXII as well. 141 141
The third area we want to talk about is OpenIOC 142 142
and this is a framework that was developed by Mandiant 143 143
that uses XML-formatted files 144 144
for supplying codified information 145 145
to automate incident detection and analysis. 146 146
When we talk about OpenIOC, 147 147
this is an open source tool 148 148
and so, it has a lot of different information 149 149
for each entry. 150 150
Each entry is going to have 151 151
a lot of different metadata there, 152 152
such as the author, 153 153
the category information, 154 154
the confidence level, 155 155
the usage license, 156 156
plus a description and a definition. 157 157
All of these definitions that are built-in here 158 158
are going to be built using logical statements 159 159
such as DNS host names, 160 160
or a string pattern for a file name, 161 161
or something like that 162 162
so we can build these indicators together. 163 163
By doing this, we all learn more 164 164
and we can share these indicators amongst ourselves. 165 165
The fourth and final one we're going to talk about is MISP, 166 166
which is the Malware Information Sharing Project. 167 167
MISP is going to provide a server platform 168 168
for cyber threat intelligence sharing, 169 169
a proprietary format, 170 170
and supports OpenIOC definitions as well, 171 171
and it can also import export STIX over TAXII. 172 172
So when you start dealing with MISP, 173 173
you can start putting all of this information together. 174 174
We can get the definitions from OpenIOC, 175 175
we can get the indicators from STIX, 176 176
and we can transmit all that information back to us 177 177
over TAXII. 178 178
And so, using all these together gives us a lot of benefits 179 179
inside of MISP. 180 180
And again, 181 181
MISP is an open source project that is free to use. 182 182
Now, here's a quick exam tip. 183 183
For the exam, 184 184
notice where I spent most of my time in this lesson. 185 185
We talked a lot about STIX, 186 186
and so, STIX is going to be much more important 187 187
than the other three when it comes time for the exam. 188 188
The big takeaway for this 189 189
is I want you to remember what that format looks like. 190 190
You don't have to memorize it, 191 191
but you should know 192 192
that when you see a JSON format like that, 193 193
your mind should trigger that this is STIX 194 194
and STIX is probably going to be the answer on the exam.