@ -8,5 +8,8 @@ One of the possible methodologies is to use tags to mark the information and con
For instance the MISP Workflow <<Taxonomy>> allows the user to describe the state of an analysis, as `complete` or `incomplete`. Moreover, it can be used to clearly specify what still needs to be done using the `todo` tags. The workflow taxonomy is separated into two parts. One part is related to the actions to be done (`todo`) and the other part is about the current state of the analysis(`state`) such as `incomplete`, `draft` or `complete`.
The MISP Workflow <<Taxonomy>> can be expanded with local or global values. There are many existing todo such as `workflow:todo="check-passive-dns-for-shared-hosting"` or action related to the analysis `workflow:todo="preserve-evidence"`.
TIP: For more information on the MISP Workflow Taxonomy, feel free to read the https://www.misp-project.org/taxonomies.html#_workflow[Workflow taxonomy cheat sheet].
TIP: To not confuse, MISP also includes a https://www.misp-project.org/2022/08/08/MISP.2.4.160.released.html/[workflow feature] which allows MISP users to create workflow based on MISP triggers.
NOTE: Expressing the confidence or the lack of it in an analysis is a critical step to help a partner or a third-party to check your hypotheses and conclusions.
Analysis or reports are often shared together with technical details, but often lack the associated overall confidence level.
To ascertain this confidence level you can use for example the MISP <<MISPTaxonomies>> called https://www.misp-project.org/taxonomies.html#_admiralty_scale[admiralty-scale] and/or https://www.misp-project.org/taxonomies.html#_estimative_language[estimative-language].
This is a very human way to describe either globally an event or individual indicators of an event, with a set of easy to read human tags. (e.g: admiralty-scale:source-reliability="a/b/c...", estimative-language:likelihood-probability="almost-no-chance", estimative-language:confidence-in-analytic-judgment="moderate")
Generally it is good practice to do this globally for the event as this will enrich the trust/value if set.
Using this in an automated way is also possible but without human intervention, or AI that actually works, not recommended.
Also, on events with hundreds of attributes this is cumbersome and perhaps unfeasible and will just frustrate operators.
The obvious side-effect of this approach is that automation will be the overall benefactor too upping the trust on that level too.
// [TODO: revise description of estimative probability]
This is a very human way to describe either globally an event or individual indicators of an event, with a set of easy to read human tags. (e.g: `admiralty-scale:source-reliability="a/b/c..."`, `estimative-language:likelihood-probability="almost-no-chance"`, `estimative-language:confidence-in-analytic-judgment="moderate"`).
Generally it is good practice to do this globally for the event as this will enrich the trust/value if set. If it's a specific attribute, then the confidence can be described at more granular levels.
Thus, adding confidence or estimative probability has multiple advantages such as:
- Allow receiving organisations to filter, classify and score the information in an automated way based on related tags
- Information with low-confidence can still be shared and reach communities or organisations interested in such information without impacting organisations filtering out by increased confidence level
- Support counter analyses and competitive analyses to validate hypotheses expressed in original reporting
- Depending on source organisation, have an affirmative that some HumInt has one into the sharing process
// [TODO: define counter and competitive analyses]
- Expressing confidence allows the use of in the https://www.misp-project.org/2019/09/12/Decaying-Of-Indicators.html/[decaying indicators feature] in MISP to lower or increase the lifetime of an information
Complement analysis with contrary evidences is also very welcome to ensure the original analysis and the hypotheses are properly evaluated.
NOTE: Classifying information is something that has proven being very useful in lots of domains, including Threat Intelligence, as it helps assessing the main information very quickly. Moreover, it can help to build correlations between events or reports, allowing analysts to better understand threat actors.
NOTE: Classifying (labelling) information is something that has proven being very useful in lots of domains, including Threat Intelligence, as it helps assessing the main information very quickly. Moreover, it can help to build correlations between events or reports, allowing analysts to better understand threat actors.
The first tool we can use to classify information are tags and taxonomies
. Tags can be used to describe how the information can be shared, using the tlp (Traffic Light Protocol) taxonomy, in order to prevent information leaks.
- Tags can be used to describe how the information can be shared, using the TLP (Traffic Light Protocol) https://www.misp-project.org/taxonomies.html#_tlp_2[taxonomy], in order to prevent information leaks.
- Specific taxonomy such as https://www.misp-project.org/taxonomies.html#_pap[PAP] is designed to how information can be used and how far.
- They can also be used to describe the source where information came from.
- Many taxonomies allow the user to further explain the kind of threat.
. They can also be used to describe the source where information came from.
Using tags allow users to proper filter information from an automation perspective. If the https://www.misp-project.org/openapi/[API] is used, the tags can be used to filter in or out the information expected.
. Many taxonomies allow the user to further explain the kind of threat.
When more complete information is required to label a specific event or attribute in MISP, https://www.misp-project.org/galaxy.html[MISP galaxy] comes to the rescue. MISP galaxy can express complex knowledge base of information. MITRE ATT&CK is described using a MISP galaxy. By default, MISP comes with multiple knowledge bases including Threat Actor databases, ransomware groups and many others.
// [TODO: was that the meaning?]
//--mapping--
TIP: Review existing MISP galaxy by browsing all of those on your MISP instances. Many include relationships (e.g. MISP Threat Actor database with MITRE ATT&CK groups).
@ -44,4 +44,4 @@ sharing platform. The list below is in order of importance.
. *https://github.com/MISP/misp-taxonomies/blob/master/cssa/machinetag.json[Origin-Tags]*: Describes where the information came from, whether it was in an automated fashion or in a manual investigation. This should give an impression how value this intelligence is, as manual investigation should supersede any automatic generation of data.
. *https://github.com/MISP/misp-taxonomies/blob/master/PAP/machinetag.json[PAP-Tags]*: An even more advanced approach of data classification is using the Permissible Actions Protocol. It indicates how the received data can be used to search for compromises within the individual company or constituency.
TIP: The full list of available taxonomies can be found *https://github.com/MISP/misp-taxonomies[here]*.
TIP: The full list of available taxonomies can be found *https://github.com/MISP/misp-taxonomies[misp-taxonomies]*.
@ -11,8 +11,10 @@ Information which is often distributed within sharing communities are the follow
- A post-mortem analysis of an incident
- Additional information about existing or known threats (such as adversary techniques, new malware samples or complementary discoveries)
- False-positive or false-negative reporting
- Asking for contribution or support from the community (such as "have you seen this threat?" or "do you have more samples?")
- Asking for contribution or support from the community (such as "have you seen this threat?" or "do you have more samples?" as described in https://www.misp-project.org/taxonomies.html#_collaborative_intelligence[collaborative intelligence] taxonomy)
TIP: By having a look at https://www.misp-project.org/objects.html[the object templates] or the https://www.misp-project.org/datamodels/#misp-core-format[MISP attribute types], this can help you discover what is actively shared within other communities. If a type or an object template is not matching your data model, you can easily create new ones.
TIP: When asking for the support of the community, using a specific taxonomy such as https://www.misp-project.org/taxonomies.html#_collaborative_intelligence[collaborative intelligence] to express your needs, will make your request more concise improving your feedback potential and improve automation.
TIP: MISP allows to extend an existing event without touching the original event. This feature can be used to enhance analysis without affecting the original ones and creating new distribution levels.
pre,pre>code{line-height:1.45;color:rgba(0,0,0,.9);font-family:"Droid Sans Mono","DejaVu Sans Mono",monospace;font-weight:400;text-rendering:optimizeSpeed}
<li><ahref="#_expressing_confidenceestimative_probability_in_an_analysis">Expressing confidence/estimative probability in an analysis</a></li>
<li><ahref="#_how_to_track_and_keep_the_state_of_an_analysis">How to track and keep the state of an analysis</a></li>
<li><ahref="#_how_to_classify_information">How to classify information</a></li>
<li><ahref="#_how_to_classify_label_information">How to classify (label) information</a></li>
</ul>
</li>
<li><ahref="#_authors_and_contributors">Authors and Contributors</a></li>
@ -581,7 +587,7 @@ Valuable information is a moving concept and depends highly on the goal of the u
<p>False-positive or false-negative reporting</p>
</li>
<li>
<p>Asking for contribution or support from the community (such as "have you seen this threat?" or "do you have more samples?")</p>
<p>Asking for contribution or support from the community (such as "have you seen this threat?" or "do you have more samples?" as described in <ahref="https://www.misp-project.org/taxonomies.html#_collaborative_intelligence">collaborative intelligence</a> taxonomy)</p>
</li>
</ul>
</div>
@ -609,6 +615,18 @@ When asking for the support of the community, using a specific taxonomy such as
</tr>
</table>
</div>
<divclass="admonitionblock tip">
<table>
<tr>
<tdclass="icon">
<iclass="fa icon-tip"title="Tip"></i>
</td>
<tdclass="content">
MISP allows to extend an existing event without touching the original event. This feature can be used to enhance analysis without affecting the original ones and creating new distribution levels.
</td>
</tr>
</table>
</div>
<divstyle="page-break-after: always;"></div>
</div>
<divclass="sect2">
@ -739,7 +757,7 @@ sharing platform. The list below is in order of importance.</p>
<iclass="fa icon-tip"title="Tip"></i>
</td>
<tdclass="content">
The full list of available taxonomies can be found <strong><ahref="https://github.com/MISP/misp-taxonomies">here</a></strong>.
The full list of available taxonomies can be found <strong><ahref="https://github.com/MISP/misp-taxonomies">misp-taxonomies</a></strong>.
</td>
</tr>
</table>
@ -761,13 +779,16 @@ Expressing the confidence or the lack of it in an analysis is a critical step to
</table>
</div>
<divclass="paragraph">
<p>Analysis or reports are often shared together with technical details, but often lack the associated overall confidence level.
To ascertain this confidence level you can use for example the MISP <ahref="#MISPTaxonomies">MISP Taxonomies</a> called <ahref="https://www.misp-project.org/taxonomies.html#_admiralty_scale">admiralty-scale</a> and/or <ahref="https://www.misp-project.org/taxonomies.html#_estimative_language">estimative-language</a>.
This is a very human way to describe either globally an event or individual indicators of an event, with a set of easy to read human tags. (e.g: admiralty-scale:source-reliability="a/b/c…​", estimative-language:likelihood-probability="almost-no-chance", estimative-language:confidence-in-analytic-judgment="moderate")
Generally it is good practice to do this globally for the event as this will enrich the trust/value if set.
Using this in an automated way is also possible but without human intervention, or AI that actually works, not recommended.
Also, on events with hundreds of attributes this is cumbersome and perhaps unfeasible and will just frustrate operators.
The obvious side-effect of this approach is that automation will be the overall benefactor too upping the trust on that level too.</p>
<p>Analysis or reports are often shared together with technical details, but often lack the associated overall confidence level.</p>
</div>
<divclass="paragraph">
<p>To ascertain this confidence level you can use for example the MISP <ahref="#MISPTaxonomies">MISP Taxonomies</a> called <ahref="https://www.misp-project.org/taxonomies.html#_admiralty_scale">admiralty-scale</a> and/or <ahref="https://www.misp-project.org/taxonomies.html#_estimative_language">estimative-language</a>.</p>
</div>
<divclass="paragraph">
<p>This is a very human way to describe either globally an event or individual indicators of an event, with a set of easy to read human tags. (e.g: <code>admiralty-scale:source-reliability="a/b/c…​"</code>, <code>estimative-language:likelihood-probability="almost-no-chance"</code>, <code>estimative-language:confidence-in-analytic-judgment="moderate"</code>).</p>
</div>
<divclass="paragraph">
<p>Generally it is good practice to do this globally for the event as this will enrich the trust/value if set. If it’s a specific attribute, then the confidence can be described at more granular levels.</p>
</div>
<divclass="paragraph">
<p>Thus, adding confidence or estimative probability has multiple advantages such as:</p>
@ -784,7 +805,7 @@ The obvious side-effect of this approach is that automation will be the overall
<p>Support counter analyses and competitive analyses to validate hypotheses expressed in original reporting</p>
</li>
<li>
<p>Depending on source organisation, have an affirmative that some HumInt has one into the sharing process</p>
<p>Expressing confidence allows the use of in the <ahref="https://www.misp-project.org/2019/09/12/Decaying-Of-Indicators.html/">decaying indicators feature</a> in MISP to lower or increase the lifetime of an information</p>
</li>
</ul>
</div>
@ -840,6 +861,9 @@ Having a workflow to follow, and be able to refer to, is something useful for th
<divclass="paragraph">
<p>For instance the MISP Workflow <ahref="#Taxonomy">[Taxonomy]</a> allows the user to describe the state of an analysis, as <code>complete</code> or <code>incomplete</code>. Moreover, it can be used to clearly specify what still needs to be done using the <code>todo</code> tags. The workflow taxonomy is separated into two parts. One part is related to the actions to be done (<code>todo</code>) and the other part is about the current state of the analysis(<code>state</code>) such as <code>incomplete</code>, <code>draft</code> or <code>complete</code>.</p>
</div>
<divclass="paragraph">
<p>The MISP Workflow <ahref="#Taxonomy">[Taxonomy]</a> can be expanded with local or global values. There are many existing todo such as <code>workflow:todo="check-passive-dns-for-shared-hosting"</code> or action related to the analysis <code>workflow:todo="preserve-evidence"</code>.</p>
</div>
<divclass="admonitionblock tip">
<table>
<tr>
@ -852,10 +876,22 @@ For more information on the MISP Workflow Taxonomy, feel free to read the <a hre
</tr>
</table>
</div>
<divclass="admonitionblock tip">
<table>
<tr>
<tdclass="icon">
<iclass="fa icon-tip"title="Tip"></i>
</td>
<tdclass="content">
To not confuse, MISP also includes a <ahref="https://www.misp-project.org/2022/08/08/MISP.2.4.160.released.html/">workflow feature</a> which allows MISP users to create workflow based on MISP triggers.
</td>
</tr>
</table>
</div>
<divstyle="page-break-after: always;"></div>
</div>
<divclass="sect2">
<h3id="_how_to_classify_information">How to classify information</h3>
<h3id="_how_to_classify_label_information">How to classify (label) information</h3>
<divclass="admonitionblock note">
<table>
<tr>
@ -863,7 +899,7 @@ For more information on the MISP Workflow Taxonomy, feel free to read the <a hre
<iclass="fa icon-note"title="Note"></i>
</td>
<tdclass="content">
Classifying information is something that has proven being very useful in lots of domains, including Threat Intelligence, as it helps assessing the main information very quickly. Moreover, it can help to build correlations between events or reports, allowing analysts to better understand threat actors.
Classifying (labelling) information is something that has proven being very useful in lots of domains, including Threat Intelligence, as it helps assessing the main information very quickly. Moreover, it can help to build correlations between events or reports, allowing analysts to better understand threat actors.
</td>
</tr>
</table>
@ -871,29 +907,40 @@ Classifying information is something that has proven being very useful in lots o
<divclass="paragraph">
<p>The first tool we can use to classify information are tags and taxonomies</p>
</div>
<divclass="olist arabic">
<olclass="arabic">
<li>
<p>Tags can be used to describe how the information can be shared, using the tlp (Traffic Light Protocol) taxonomy, in order to prevent information leaks.</p>
</li>
<divclass="ulist">
<ul>
<li>
<p>They can also be used to describe the source where information came from.</p>
<p>Tags can be used to describe how the information can be shared, using the TLP (Traffic Light Protocol) <ahref="https://www.misp-project.org/taxonomies.html#_tlp_2">taxonomy</a>, in order to prevent information leaks.</p>
</li>
<li>
<p>Many taxonomies allow the user to further explain the kind of threat.</p>
<p>Specific taxonomy such as <ahref="https://www.misp-project.org/taxonomies.html#_pap">PAP</a> is designed to how information can be used and how far.</p>
<p>They can also be used to describe the source where information came from.</p>
</li>
<li>
<p>Comments</p>
<p>Many taxonomies allow the user to further explain the kind of threat.</p>
</li>
</ul>
</div>
<divclass="paragraph">
<p>Using tags allow users to proper filter information from an automation perspective. If the <ahref="https://www.misp-project.org/openapi/">API</a> is used, the tags can be used to filter in or out the information expected.</p>
</div>
<divclass="paragraph">
<p>When more complete information is required to label a specific event or attribute in MISP, <ahref="https://www.misp-project.org/galaxy.html">MISP galaxy</a> comes to the rescue. MISP galaxy can express complex knowledge base of information. MITRE ATT&CK is described using a MISP galaxy. By default, MISP comes with multiple knowledge bases including Threat Actor databases, ransomware groups and many others.</p>
</div>
<divclass="admonitionblock tip">
<table>
<tr>
<tdclass="icon">
<iclass="fa icon-tip"title="Tip"></i>
</td>
<tdclass="content">
Review existing MISP galaxy by browsing all of those on your MISP instances. Many include relationships (e.g. MISP Threat Actor database with MITRE ATT&CK groups).
</td>
</tr>
</table>
</div>
<divstyle="page-break-after: always;"></div>
</div>
</div>
@ -912,6 +959,9 @@ Classifying information is something that has proven being very useful in lots o
