Home - STIXProject/use-cases GitHub Wiki

High Level Use cases identified for STIX include:

  1. Analyzing Cyber Threats
  2. Incident Analysis
  3. TTP Analysis 1. Attack Pattern Analysis and Characterization 1. Malware Analysis and Characterization 1. Exploit Analysis and Characterization 1. Attack Tool Analysis and Characterization 1. Attack Infrastructure Analysis and Characterization 1. Victim Targeting Analysis and Characterization
  4. Indicator Analysis 1. Indicator Extraction 1. Specifying Indicator Patterns for Cyber Threats 1. Indicator Contextualization 1. COA Selection 1. Sighting Analysis (replaces Indicator Sighting Analysis) 1. Indicator Comparative Analysis
  5. Threat Actor Characterization
  6. Campaign Analysis
  7. Exploit Target Analysis
  8. COA Analysis
  9. CTI Report Scoping and Aggregation
  10. Identifying Relationships Between Content
  11. Asserting Relationships Between Content
  12. Cyber Breach Analysis and Categorization
  13. Managing Cyber Threat Response Activities
  14. Cyber Threat Prevention
  15. Cyber Threat Detection
  16. Incident Response
  17. Prioritizing Cyber Threats
  18. Managing Situational Awareness
  19. Management of Content Over Time
  20. Create new content
  21. Update content
  22. Share Cyber Threat Information
  23. Negotiation/Agreement on Technical Factors for Cyber Threat Information Exchange
  24. Management of Content Sharing Over Time 1. Publish content 1. Receive content 1. Content Comparative Analysis 1. Reshare content
  25. Cyber Threat Indicator Sharing
  26. Indicator Sighting Reporting
  27. Malware Analysis Sharing
  28. Holistic Threat Intelligence Report Sharing
  29. Shared Content Source Assessment
  30. Managing Content Control
  31. Security Tool Integration

Detailed Use cases identified for STIX include:

  1. Analyzing Cyber Threats
  2. Threat Actor Characterization 1. Threat Actor Identity Analysis 1. Threat Actor Motivation Analysis 1. Threat Actor Capability Analysis 1. Threat Actor Modus Operandi Analysis
    1. Threat Actor Kill Chain Analysis
    2. TTP-to-KillChain Mapping Analysis
    3. Kill Chain Temporal Analysis 1. Threat Actor Predictive Intent Analysis 1. Attribution Analysis
    4. Incident Attribution
    5. Campaign Attribution Analysis
  3. TTP Analysis 1. Attack Pattern Analysis and Characterization
    1. Attack Pattern Comparative Analysis 1. Malware Analysis and Characterization
    2. Malware structural analysis
    3. Malware behavioral analysis
    4. Malware Reverse Engineering
    5. Malware Comparative Analysis
    6. Malware Family/Lineage Analysis
    7. Collaborative Malware Analysis 1. Exploit Analysis and Characterization
    8. Exploit Reverse Engineering 1. Attack Tool Analysis and Characterization
    9. Attack Tool Characterization
    10. Attack Tool Attribution Analysis
    11. Attack Tool Comparative Analysis
    12. Attack Tool Family/Lineage Analysis 1. Attack Infrastructure Analysis and Characterization
    13. Attack Infrastructure Characterization
    14. Attack Infrastructure Attribution Analysis
    15. Attack Infrastructure Comparative Analysis
    16. Attack Infrastructure Family/Lineage Analysis 1. Attacker Persona Analysis and Characterization 1. Victim Targeting Analysis and Characterization
    17. Victim Targeting by Identity Characterization
    18. Victim Targeting by System Type Characterization
    19. Victim Targeting by Information Type Characterization
    20. Victim Targeting by Technical Context Characterization 1. TTP Exploit Targeting Analysis and Characterization
    21. TTP Targeted Vulnerability Identification
    22. TTP Targeted Weakness Identification
    23. TTP Targeted Confifguration Identification 1. Kill Chain Analysis
    24. Kill Chain Characterization
    25. Kill Chain Temporal Analysis
    26. TTP-to-KillChain Mapping Analysis
  4. Indicator Analysis 1. Indicator Extraction from Digital Forensics Analysis 1. Indicator Extraction from Malware Analysis 1. Indicator Extraction from Sensor or Log Data 1. Indicator Extraction from CTI 1. Indicator Composition Analysis 1. Indicator-to-KillChain Mapping Analysis 1. Indicator Comparative Analysis
    1. Indicator Duplication Identification
    2. Indicator Deduplication 1. Indicator Sighting Analysis
    3. Victim Targeting Analysis and Characterization 1. COA Selection
    4. Automated COA Selection
    5. Automated COA Transformation
    6. Automated COA Deployment
  5. Campaign Analysis 1. Campaign TTP Mapping Analysis 1. Campaign Incident Mapping Analysis 1. Campaign Attribution Analysis 1. Campaign Motivation Analysis 1. Campaign Victim Targeting Analysis
  6. Incident Analysis 1. Incident Timeline Analysis 1. Incident Categorization Analysis 1. Asset Risk Analysis
    1. Asset Risk Characterization 1. Incident Impact Assessment 1. Incident Victim Targeting Analysis 1. Incident Indicator Analysis
    2. Indicator Extraction
    3. Indicator Efficacy Analysis 1. Incident TTP Analysis 1. Incident Attribution Analysis 1. Intended Effect Analysis 1. Incident Comparative Analysis 1. COA Selection
  7. Exploit Target Analysis 1. Vulnerability Characterization 1. Weakness Characterization 1. Configuration Characterization 1. Exploit Target Susceptibility Analysis 1. COA Selection
  8. COA Analysis 1. COA Characterization
    1. COA Structured Characterization 1. COA Mapping to Purpose
  9. CTI Report Scoping and Aggregation
  10. Identifying Relationships Between Content 1. Identifying Duplicate Content
    1. Identifying Exact Duplicate Content from the Same Producer
    2. Identifying Exact Duplicate Content from a different Producer
    3. Identifying Partially Duplicate Content
  11. Asserting Relationships Between Content 1. Qualifying Asserted Relationship Confidence
  12. Cyber Breach Analysis and Categorization
  13. Specifying Indicator Patterns for Cyber Threats
  14. Specifying Network Indicator Patterns for Cyber Threats
  15. Specifying Host/Endpoint Indicator Patterns for Cyber Threats
  16. Specifying Composite/Complex Indicator Patterns for Cyber Threats 1. Specifying Relational Composite/Complex Indicator Patterns for Cyber Threats 1. Specifying Logical Composite/Complex Indicator Patterns for Cyber Threats
  17. CES-21 MMATRS project
  18. Managing Cyber Threat Response Activities
  19. Cyber Threat Prevention 1. Deploying Indicator Patterns for Cyber Threats
    1. Deploying COAs for Cyber Threats
    2. Deploying Decomposed Indicator Patterns for Cyber Threats
  20. Cyber Threat Detection 1. Deploying Indicator Patterns for Cyber Threats
    1. Deploying Decomposed Indicator Patterns for Cyber Threats 1. Event/Log (SIEM) Analysis 1. Hunting
  21. Incident Response 1. Incident Analysis 1. Digital Forensics Investigation
    1. Digital Forensic Information Containment
    2. Forensic examination
    3. Network forensic examination
    4. System forensic examination 1. File forensic examination 1. Memory forensic examination
    5. Media forensic examination
    6. Digital Trace Analysis and Capture
    7. Digital Forensic Information Provenance and Context Capture and Management
    8. Digital Forensic Tool Interoperability, Integration and Verification
    9. Forensic analysis and interpretation
    10. Digital Forensics Correlation and Differential Analysis
    11. Human Behavior Characterization via Digital Traces
    12. Digital Forensic Information Exchange
    13. Digital Forensics Archival 1. Malware Analysis and Characterization 1. Attack Pattern Extraction 1. Cyber Incident Reporting
    14. Cyber Incident Breach Reporting 1. Incident Management
    15. Incident Response Timeline Management
    16. Incident Response Contributor Tracking
  22. Prioritizing Cyber Threats 1. Prioritizing Cyber Threats based on Motivation 1. Prioritizing Cyber Threats based on Intended Effect 1. Prioritizing Cyber Threats based on Victim Targeting 1. Prioritizing Cyber Threats based on Technical Capability for Detection 1. Prioritizing Cyber Threats based on Tempo of Activity
  23. Managing Situational Awareness
  24. CTI SA Visualization
  25. Mapping CTI to Asset Posture and General SA Information
  26. Management of Content Over Time
  27. Create new content 1. Assert confidence in content based on context
  28. Update content 1. Refine/enhance content
    1. Refine/enhance content with additional content
    2. Refine/enhance content with additional context
    3. Modify confidence in content based on context
  29. Share Cyber Threat Information
  30. Negotiation/Agreement on Technical Factors for Cyber Threat Information Exchange 1. Negotiation/Agreement on Information Semantics and Structure 1. Negotiation/Agreement on Information Serialization Format 1. Negotiation/Agreement on Protocols for Exchange 1. Negotiation/Agreement on Commitments regarding Managing Content Control
  31. Management of Content Sharing Over Time 1. Publish content
    1. Publish new content
    2. Publish updated content (from originator)
    3. Publish refined/enhanced content (from originator) 1. Publish refined/enhanced content with additional content (from originator) 1. Publish refined/enhanced content with additional context (from originator)
    4. Publish corrected content (from originator)
    5. Publish updated content (from non-originator)
    6. Assert Low Confidence in Content (from non-originator)
    7. Revoke previously published content 1. Receive content
    8. Receive new content (from originator)
    9. Receive new content (from non-originator)
    10. Receive updated content (from originator)
    11. Receive updated content (from non-originator) 1. Content Comparative Analysis
    12. Content Duplication Identification
    13. Content Deduplication 1. Reshare content
  32. Cyber Threat Indicator Sharing
  33. Indicator Sighting Reporting 1. Simple Indicator Sighting Reporting (+1) 1. Anonymized Indicator Sighting Reporting 1. Indicator Sighting Reporting with Count 1. Indicator Sighting Reporting with Specific Observation
  34. Malware Analysis Sharing
  35. Holistic Threat Intelligence Report Sharing
  36. Shared Content Source Assessment 1. Assessing/Managing Trust for CTI Sources 1. Assessing/Asserting Confidence in Shared Content
  37. Managing Content Control 1. Asserting Data Markings on Content
    1. Asserting Handling Guidance on Content 1. Interpreting Data Markings on Content 1. Managing/Maintaining Data Markings on Content

To propose a new use case please:

  1. create a new wiki page
  2. title the page "Use Case:" followed by your use case title
  3. copy and paste the following outline into the new page
  4. fill in the appropriate content
  5. edit this page and add your new use case to the list as a link to your new use case page

Use case title (replace with your title)

Pre-1.2.1 Use Case (True/False): False (replace with your value)

Relevant to which SCs (STIX/TAXII/CybOX): STIX (replace with your values)

Abstraction Level (High, Medium or Low): High (replace with your value)

Related Use Cases: Related use case (replace with your content)

Description: Use case objective and flow description (replace with your content)

Stakeholders/Goals:

  • Stakeholder: Stakeholder description (replace with your content)
  • Goal: Goal description (replace with your content)

Preconditions:

  1. Precondition description (replace with your content)

Dependencies:

  1. Dependency description (replace with your content)

Main Success Scenario:

  1. Scenario description (replace with your content)