Documentation Sitemap

• Getting Started
  • Analyst Exercise
  • Authoring Tutorial
  • Sample Walkthrough
• Security Considerations
• Suggested Practices
• Profiles Overview
  • Authoring profiles
  • Profile representation
  • Profile validation
• Utilities
• Validation
• Concepts
  • Composition of Observables and Indicators
  • Controlled Vocabularies
  • Marking Data
  • STIX Concepts
  • [Observable Instances vs Observable Patterns](http://stixproject.github.io/documentation/concepts/observable- patterns-vs-instances/)
  • STIX Relationships
  • TTP vs. Indicator
  • Versioning in STIX
  • xsi:type
• Idioms
  • Assets Affected in an Incident
  • COA to Block Network Traffic
  • Indicator for C2 IP Address
  • Command and Control IP List
  • Defining Campaigns vs Threat Actors
  • CVE in an Exploit Target
  • Working with Identity
  • Identifying a Threat Actor Group
  • Malware Used During an Incident
  • Incident Lifecycle Timestamps
  • Incident vs. Indicator
  • Indicator to Campaign Relationship
  • Victim Targeting by Sector
  • Kill Chains in STIX
  • Threat Actor Leveraging Attack Patterns and Malware
  • Malware Characterization using MAEC
  • Malicious E-mail Attachment
  • Indicator for Malicious URL
  • Malware Indicator for File Hash
  • OpenIOC Test Mechanism
  • Incident with Related Observables
  • Barebones Incident Description
  • Snort Test Mechanism
  • Victim Targeting for a Campaign
  • Plain Wrapper Around Multiple Reports
  • Yara Test Mechanism