patterns.” Observable instances represent actual specific observations that took place in the cyber domain. The property details of this observation are specific and unambiguous. Observable patterns represent conditions for a potential observation that may occur in the future or may have already occurred and exists in a body of observable instances. These conditions may be anything from very specific concrete patterns that would match very specific observable instances to more abstract generalized patterns that have the potential to match against a broad range of potential observable instances. The Incident data model leverages the Observable data model to specify the observable instances that were observed in relation to the Incident. Tactics, Techniques and Procedures (TTP) A STIX Tactics, Techniques, and Procedures (TTP) is used to represent the behavior or modus operandi of cyber adversaries. Please see for details. The Incident data references the TTP data model as a means to identify sets of specific TTPs that are asserted as having been leveraged in the Incident. Threat Actor A STIX Threat Actor is a characterization of a malicious actor (i.e., adversary) that represents a cyber attack threat. A variety of information can be captured in a Threat Actor construct, including identity, motivations, intended effect, and sophistication level. Please see for details. The Incident data model references the Threat Actor data model as a means to characterize the Threat Actors that have been attributed to the Incident.
patterns.” Observable instances represent actual specific observations that took place in the cyber domain. The property details of this observation are specific and unambiguous. Observable patterns represent conditions for a potential observation that may occur in the future or may have already occurred and exists in a body of observable instances. These conditions may be anything from very specific concrete patterns that would match very specific observable instances to more abstract generalized patterns that have the potential to match against a broad range of potential observable instances. The Incident data model leverages the Observable data model to specify the observable instances that were observed in relation to the Incident. Tactics, Techniques and Procedures (TTP) A STIX Tactics, Techniques, and Procedures (TTP) is used to represent the behavior or modus operandi of cyber adversaries. Please see for details. The Incident data references the TTP data model as a means to identify sets of specific TTPs that are asserted as having been leveraged in the Incident. Threat Actor A STIX Threat Actor is a characterization of a malicious actor (i.e., adversary) that represents a cyber attack threat. A variety of information can be captured in a Threat Actor construct, including identity, motivations, intended effect, and sophistication level. Please see for details. The Incident data model references the Threat Actor data model as a means to characterize the Threat Actors that have been attributed to the Incident.
stix-v1.2.1-csd01-part6-incident.docx