From dbc27c3b5faeae50ecec94798255242c3c8aefcb Mon Sep 17 00:00:00 2001 From: Alexandre Dulaunoy Date: Sun, 6 Nov 2022 17:20:32 +0100 Subject: [PATCH] chg: [clean-up] various updates and some refs to new features --- best-practices/building-workflow.adoc | 3 + best-practices/expressing-confidence.adoc | 16 +- .../how-to-classify-information.adoc | 18 +- best-practices/intelligence-tagging.adoc | 2 +- best-practices/what-to-share.adoc | 4 +- book.html | 336 +- book.pdf | 6358 +++++++++++------ build.sh | 4 +- 8 files changed, 4345 insertions(+), 2396 deletions(-) diff --git a/best-practices/building-workflow.adoc b/best-practices/building-workflow.adoc index 8da2adf..194e70f 100644 --- a/best-practices/building-workflow.adoc +++ b/best-practices/building-workflow.adoc @@ -8,5 +8,8 @@ One of the possible methodologies is to use tags to mark the information and con For instance the MISP Workflow <> allows the user to describe the state of an analysis, as `complete` or `incomplete`. Moreover, it can be used to clearly specify what still needs to be done using the `todo` tags. The workflow taxonomy is separated into two parts. One part is related to the actions to be done (`todo`) and the other part is about the current state of the analysis(`state`) such as `incomplete`, `draft` or `complete`. +The MISP Workflow <> can be expanded with local or global values. There are many existing todo such as `workflow:todo="check-passive-dns-for-shared-hosting"` or action related to the analysis `workflow:todo="preserve-evidence"`. TIP: For more information on the MISP Workflow Taxonomy, feel free to read the https://www.misp-project.org/taxonomies.html#_workflow[Workflow taxonomy cheat sheet]. + +TIP: To not confuse, MISP also includes a https://www.misp-project.org/2022/08/08/MISP.2.4.160.released.html/[workflow feature] which allows MISP users to create workflow based on MISP triggers. diff --git a/best-practices/expressing-confidence.adoc b/best-practices/expressing-confidence.adoc index b4bceed..3c34296 100644 --- a/best-practices/expressing-confidence.adoc +++ b/best-practices/expressing-confidence.adoc @@ -3,23 +3,19 @@ NOTE: Expressing the confidence or the lack of it in an analysis is a critical step to help a partner or a third-party to check your hypotheses and conclusions. Analysis or reports are often shared together with technical details, but often lack the associated overall confidence level. -To ascertain this confidence level you can use for example the MISP <> called https://www.misp-project.org/taxonomies.html#_admiralty_scale[admiralty-scale] and/or https://www.misp-project.org/taxonomies.html#_estimative_language[estimative-language]. -This is a very human way to describe either globally an event or individual indicators of an event, with a set of easy to read human tags. (e.g: admiralty-scale:source-reliability="a/b/c...", estimative-language:likelihood-probability="almost-no-chance", estimative-language:confidence-in-analytic-judgment="moderate") -Generally it is good practice to do this globally for the event as this will enrich the trust/value if set. -Using this in an automated way is also possible but without human intervention, or AI that actually works, not recommended. -Also, on events with hundreds of attributes this is cumbersome and perhaps unfeasible and will just frustrate operators. -The obvious side-effect of this approach is that automation will be the overall benefactor too upping the trust on that level too. -// [TODO: revise description of estimative probability] +To ascertain this confidence level you can use for example the MISP <> called https://www.misp-project.org/taxonomies.html#_admiralty_scale[admiralty-scale] and/or https://www.misp-project.org/taxonomies.html#_estimative_language[estimative-language]. + +This is a very human way to describe either globally an event or individual indicators of an event, with a set of easy to read human tags. (e.g: `admiralty-scale:source-reliability="a/b/c..."`, `estimative-language:likelihood-probability="almost-no-chance"`, `estimative-language:confidence-in-analytic-judgment="moderate"`). + +Generally it is good practice to do this globally for the event as this will enrich the trust/value if set. If it's a specific attribute, then the confidence can be described at more granular levels. Thus, adding confidence or estimative probability has multiple advantages such as: - Allow receiving organisations to filter, classify and score the information in an automated way based on related tags - Information with low-confidence can still be shared and reach communities or organisations interested in such information without impacting organisations filtering out by increased confidence level - Support counter analyses and competitive analyses to validate hypotheses expressed in original reporting -- Depending on source organisation, have an affirmative that some HumInt has one into the sharing process - -// [TODO: define counter and competitive analyses] +- Expressing confidence allows the use of in the https://www.misp-project.org/2019/09/12/Decaying-Of-Indicators.html/[decaying indicators feature] in MISP to lower or increase the lifetime of an information Complement analysis with contrary evidences is also very welcome to ensure the original analysis and the hypotheses are properly evaluated. diff --git a/best-practices/how-to-classify-information.adoc b/best-practices/how-to-classify-information.adoc index f64a7e9..2714cec 100644 --- a/best-practices/how-to-classify-information.adoc +++ b/best-practices/how-to-classify-information.adoc @@ -1,17 +1,17 @@ -=== How to classify information +=== How to classify (label) information -NOTE: Classifying information is something that has proven being very useful in lots of domains, including Threat Intelligence, as it helps assessing the main information very quickly. Moreover, it can help to build correlations between events or reports, allowing analysts to better understand threat actors. +NOTE: Classifying (labelling) information is something that has proven being very useful in lots of domains, including Threat Intelligence, as it helps assessing the main information very quickly. Moreover, it can help to build correlations between events or reports, allowing analysts to better understand threat actors. The first tool we can use to classify information are tags and taxonomies -. Tags can be used to describe how the information can be shared, using the tlp (Traffic Light Protocol) taxonomy, in order to prevent information leaks. +- Tags can be used to describe how the information can be shared, using the TLP (Traffic Light Protocol) https://www.misp-project.org/taxonomies.html#_tlp_2[taxonomy], in order to prevent information leaks. +- Specific taxonomy such as https://www.misp-project.org/taxonomies.html#_pap[PAP] is designed to how information can be used and how far. +- They can also be used to describe the source where information came from. +- Many taxonomies allow the user to further explain the kind of threat. -. They can also be used to describe the source where information came from. +Using tags allow users to proper filter information from an automation perspective. If the https://www.misp-project.org/openapi/[API] is used, the tags can be used to filter in or out the information expected. -. Many taxonomies allow the user to further explain the kind of threat. +When more complete information is required to label a specific event or attribute in MISP, https://www.misp-project.org/galaxy.html[MISP galaxy] comes to the rescue. MISP galaxy can express complex knowledge base of information. MITRE ATT&CK is described using a MISP galaxy. By default, MISP comes with multiple knowledge bases including Threat Actor databases, ransomware groups and many others. -// [TODO: was that the meaning?] -//--mapping-- +TIP: Review existing MISP galaxy by browsing all of those on your MISP instances. Many include relationships (e.g. MISP Threat Actor database with MITRE ATT&CK groups). -- <> (ATT&CK matrix) -- Comments diff --git a/best-practices/intelligence-tagging.adoc b/best-practices/intelligence-tagging.adoc index 85c6c81..4a16273 100644 --- a/best-practices/intelligence-tagging.adoc +++ b/best-practices/intelligence-tagging.adoc @@ -44,4 +44,4 @@ sharing platform. The list below is in order of importance. . *https://github.com/MISP/misp-taxonomies/blob/master/cssa/machinetag.json[Origin-Tags]*: Describes where the information came from, whether it was in an automated fashion or in a manual investigation. This should give an impression how value this intelligence is, as manual investigation should supersede any automatic generation of data. . *https://github.com/MISP/misp-taxonomies/blob/master/PAP/machinetag.json[PAP-Tags]*: An even more advanced approach of data classification is using the Permissible Actions Protocol. It indicates how the received data can be used to search for compromises within the individual company or constituency. -TIP: The full list of available taxonomies can be found *https://github.com/MISP/misp-taxonomies[here]*. +TIP: The full list of available taxonomies can be found *https://github.com/MISP/misp-taxonomies[misp-taxonomies]*. diff --git a/best-practices/what-to-share.adoc b/best-practices/what-to-share.adoc index 484d561..3ed8458 100644 --- a/best-practices/what-to-share.adoc +++ b/best-practices/what-to-share.adoc @@ -11,8 +11,10 @@ Information which is often distributed within sharing communities are the follow - A post-mortem analysis of an incident - Additional information about existing or known threats (such as adversary techniques, new malware samples or complementary discoveries) - False-positive or false-negative reporting -- Asking for contribution or support from the community (such as "have you seen this threat?" or "do you have more samples?") +- Asking for contribution or support from the community (such as "have you seen this threat?" or "do you have more samples?" as described in https://www.misp-project.org/taxonomies.html#_collaborative_intelligence[collaborative intelligence] taxonomy) TIP: By having a look at https://www.misp-project.org/objects.html[the object templates] or the https://www.misp-project.org/datamodels/#misp-core-format[MISP attribute types], this can help you discover what is actively shared within other communities. If a type or an object template is not matching your data model, you can easily create new ones. TIP: When asking for the support of the community, using a specific taxonomy such as https://www.misp-project.org/taxonomies.html#_collaborative_intelligence[collaborative intelligence] to express your needs, will make your request more concise improving your feedback potential and improve automation. + +TIP: MISP allows to extend an existing event without touching the original event. This feature can be used to enhance analysis without affecting the original ones and creating new distribution levels. diff --git a/book.html b/book.html index 073c3ed..329bef4 100644 --- a/book.html +++ b/book.html @@ -2,29 +2,26 @@ - + - + Best Practices in Threat Intelligence