Skip to content

Commit 16d5bd9

Browse files
rpiazzarpiazza
committed
Merge branch 'fix-incident-schema'
2 parents 2d9e0b3 + 483a460 commit 16d5bd9

File tree

5 files changed

+42
-272
lines changed

5 files changed

+42
-272
lines changed

‎extension-definition-specifications/incident-ef7/event/extension-definition--4ca6de00-5b0d-45ef-a1dc-ea7279ea910e.json‎

Lines changed: 13 additions & 76 deletions
Original file line numberDiff line numberDiff line change
@@ -4,11 +4,10 @@
44
"title": "Event",
55
"description": "An extension for recording events in STIX.",
66
"type": "object",
7-
"unevaluatedProperties": false,
87
"required": [
9-
"extensions"
10-
, "status"
11-
, "type"
8+
"extensions",
9+
"status",
10+
"type"
1211
],
1312
"allOf": [
1413
{
@@ -33,17 +32,12 @@
3332
}
3433
}
3534
},
36-
"created": {},
37-
"modified": {},
38-
"spec_version": {},
39-
"labels": {},
40-
"external_references": {},
4135
"type": {
4236
"type": "string",
4337
"const": "event"
4438
},
4539
"id": {
46-
"type": "string",
40+
"$ref": "https://raw.githubusercontent.com/oasis-open/cti-stix2-json-schemas/stix2.1/schemas/common/identifier.json",
4741
"pattern": "^event--"
4842
},
4943
"event_types": {
@@ -131,72 +125,15 @@
131125
"pattern": "^sighting--"
132126
}
133127
},
134-
"subevents": {
135-
"type": "array",
136-
"minItems": 1,
137-
"items": {
138-
"$ref": "#/definitions/Event_Sequence"
139-
}
140-
}
141-
}
142-
}
143-
],
144-
"definitions": {
145-
"Event_Sequence": {
146-
"type": "object",
147-
"additionalProperties": false,
148-
"required": ["event_ref"],
149-
"properties": {
150-
"event_ref": {
151-
"type": "string",
152-
"$ref": "https://raw.githubusercontent.com/oasis-open/cti-stix2-json-schemas/stix2.1/schemas/common/identifier.json",
153-
"pattern": "^event--",
154-
"description": "The event"
155-
},
156-
"sequence_start": {
157-
"type": "boolean",
158-
"description": "If this event is the start of a sequence.",
159-
"default": true
160-
},
161-
"next_steps": {
162-
"type": "array",
163-
"minItems": 1,
164-
"items": {
165-
"type": "object",
166-
"additionalProperties": false,
167-
"required": [
168-
"condition_type",
169-
"event_ref",
170-
"transition_type"
171-
],
172-
"properties": {
173-
"condition_type": {
174-
"type": "string",
175-
"enum": [
176-
"optional",
177-
"required",
178-
"unknown"
179-
]
180-
},
181-
"event_ref": {
182-
"type": "string",
183-
"$ref": "https://raw.githubusercontent.com/oasis-open/cti-stix2-json-schemas/stix2.1/schemas/common/identifier.json",
184-
"pattern": "^event--"
185-
},
186-
"transition_type": {
187-
"type": "string",
188-
"description": "What end-state causes the target to begin",
189-
"enum": [
190-
"completion",
191-
"failure",
192-
"success",
193-
"unknown"
194-
]
195-
}
196-
}
128+
"next_event_refs": {
129+
"type": "array",
130+
"items": {
131+
"$ref": "https://raw.githubusercontent.com/oasis-open/cti-stix2-json-schemas/stix2.1/schemas/common/identifier.json",
132+
"pattern": "^event--"
197133
}
198-
}
134+
},
135+
"unevaluatedProperties": false
199136
}
200137
}
201-
}
202-
}
138+
]
139+
}

‎extension-definition-specifications/incident-ef7/examples/example_2.1.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,7 @@
1212
"investigation_status": "open",
1313
"criticality": 70,
1414
"detection_methods": [
15-
"automated-tool",
15+
"automated-tools",
1616
"human-review"
1717
],
1818
"event_refs": [

‎extension-definition-specifications/incident-ef7/extension-definition--ef765651-680c-498d-9894-99799f2fa126.json‎

Lines changed: 10 additions & 118 deletions
Original file line numberDiff line numberDiff line change
@@ -51,18 +51,22 @@
5151
}
5252
}
5353
},
54-
"events": {
54+
"event_refs": {
5555
"type": "array",
5656
"minItems": 1,
5757
"items": {
58-
"$ref": "#/definitions/Event_Sequence"
58+
"type": "string",
59+
"$ref": "https://raw.githubusercontent.com/oasis-open/cti-stix2-json-schemas/stix2.1/schemas/common/identifier.json",
60+
"pattern": "^event--"
5961
}
6062
},
61-
"tasks": {
63+
"task_refs": {
6264
"type": "array",
6365
"minItems": 1,
6466
"items": {
65-
"$ref": "#/definitions/Task_Sequence"
67+
"type": "string",
68+
"$ref": "https://raw.githubusercontent.com/oasis-open/cti-stix2-json-schemas/stix2.1/schemas/common/identifier.json",
69+
"pattern": "^task--"
6670
}
6771
},
6872
"determination": {
@@ -134,118 +138,6 @@
134138
}
135139
],
136140
"definitions": {
137-
"Event_Sequence": {
138-
"type": "object",
139-
"additionalProperties": false,
140-
"required": ["event_ref"],
141-
"properties": {
142-
"event_ref": {
143-
"type": "string",
144-
"$ref": "https://raw.githubusercontent.com/oasis-open/cti-stix2-json-schemas/stix2.1/schemas/common/identifier.json",
145-
"pattern": "^event--",
146-
"description": "The event"
147-
},
148-
"sequence_start": {
149-
"type": "boolean",
150-
"description": "If this event is the start of a sequence.",
151-
"default": true
152-
},
153-
"next_steps": {
154-
"type": "array",
155-
"minItems": 1,
156-
"items": {
157-
"type": "object",
158-
"additionalProperties": false,
159-
"required": [
160-
"condition_type",
161-
"event_ref",
162-
"transition_type"
163-
],
164-
"properties": {
165-
"condition_type": {
166-
"type": "string",
167-
"enum": [
168-
"optional",
169-
"required",
170-
"unknown"
171-
]
172-
},
173-
"event_ref": {
174-
"type": "string",
175-
"$ref": "https://raw.githubusercontent.com/oasis-open/cti-stix2-json-schemas/stix2.1/schemas/common/identifier.json",
176-
"pattern": "^event--"
177-
},
178-
"transition_type": {
179-
"type": "string",
180-
"description": "What end-state causes the target to begin",
181-
"enum": [
182-
"completion",
183-
"failure",
184-
"success",
185-
"unknown"
186-
]
187-
}
188-
}
189-
}
190-
}
191-
}
192-
},
193-
"Task_Sequence": {
194-
"type": "object",
195-
"additionalProperties": false,
196-
"required": ["task_ref"],
197-
"properties": {
198-
"task_ref": {
199-
"type": "string",
200-
"$ref": "https://raw.githubusercontent.com/oasis-open/cti-stix2-json-schemas/stix2.1/schemas/common/identifier.json",
201-
"pattern": "^task--",
202-
"description": "The event or task"
203-
},
204-
"sequence_start": {
205-
"type": "boolean",
206-
"description": "If this task is the start of a sequence.",
207-
"default": true
208-
},
209-
"next_steps": {
210-
"type": "array",
211-
"minItems": 1,
212-
"items": {
213-
"type": "object",
214-
"additionalProperties": false,
215-
"required": [
216-
"condition_type",
217-
"task_ref",
218-
"transition_type"
219-
],
220-
"properties": {
221-
"condition_type": {
222-
"type": "string",
223-
"enum": [
224-
"optional",
225-
"required",
226-
"unknown"
227-
]
228-
},
229-
"task_ref": {
230-
"type": "string",
231-
"$ref": "https://raw.githubusercontent.com/oasis-open/cti-stix2-json-schemas/stix2.1/schemas/common/identifier.json",
232-
"pattern": "^task--"
233-
},
234-
"transition_type": {
235-
"type": "string",
236-
"description": "What end-state causes the target to begin",
237-
"enum": [
238-
"completion",
239-
"failure",
240-
"success",
241-
"unknown"
242-
]
243-
}
244-
}
245-
}
246-
}
247-
}
248-
},
249141
"Recoverability": {
250142
"type": "string",
251143
"description": "The scope of impact required to recover from an incident",
@@ -256,7 +148,7 @@
256148
"extended",
257149
"not-recoverable"
258150
],
259-
"$comment": "This is a closed vocabulary: non-applicable is an addition to what is found on https://us-cert.cisa.gov/incident-notification-guidelines for Incident reports that do not have associated recover costs. For example a phishing email that was detected successfully."
151+
"$comment": "This is a closed vocabulary (enumeration): non-applicable is an addition to what is found on https://us-cert.cisa.gov/incident-notification-guidelines for Incident reports that do not have associated recover costs. For example a phishing email that was detected successfully."
260152
}
261153
}
262-
}
154+
}

‎extension-definition-specifications/incident-ef7/tables/incident_relationship_summary.adoc‎

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -4,13 +4,17 @@
44
^|*Type*
55
^|*Target*
66

7+
|[stixtype]#<<event,event>>#
8+
|[stixrelationship]#causes#
9+
|[stixtype]#<<impact,impact>>#
10+
711
|[stixtype]#<<event,event>>#
812
|[stixrelationship]#impacts#
913
|[stixtype]#{infrastructure_url}[infrastructure]#
1014

1115
|[stixtype]#<<event,event>>#
1216
|[stixrelationship]#led-to#
13-
|[stixtype]#<<event,event>>#
17+
|[stixtype]#<<task,task>>#
1418

1519
|[stixtype]#<<event,event>>#
1620
|[stixrelationship]#located-at#
@@ -62,7 +66,7 @@
6266

6367
|[stixtype]#{identity_url}[identity]#
6468
|[stixrelationship]#performed#
65-
|[stixtype]#<<task,task>>#
69+
|[stixtype]#<<task,task>>#, #<<event,event>>#,
6670

6771
|[stixtype]#{incident_url}[incident]#
6872
|[stixrelationship]#attributed-to#

0 commit comments

Comments
 (0)