From ba46bb6a0bffb515c9d76f7f95650c5ab6f3d8f4 Mon Sep 17 00:00:00 2001 From: Alexandre Dulaunoy Date: Tue, 7 Jul 2020 09:13:21 +0200 Subject: [PATCH] chg: [threat-actor] fix #561 by using new meta to classify as a campaign only. Based on https://github.com/MISP/misp-galaxy/issues/469 There is an old and persistence issue in attribution world and basically no-one really agrees on this. So we decided to start a specific metadata `threat-actor-classification` on the threat-actor to define the various types per cluster entry: - _operation_: - _A military operation is the coordinated military actions of a state, or a non-state actor, in response to a developing situation. These actions are designed as a military plan to resolve the situation in the state or actor's favor. Operations may be of a combat or non-combat nature and may be referred to by a code name for the purpose of national security. Military operations are often known for their more generally accepted common usage names than their actual operational objectives._ from Wikipedia - **In the context of MISP threat-actor name, it's a single specific operation.** - _campaign_: - _The term military campaign applies to large scale, long duration, significant military strategy plans incorporating a series of inter-related military operations or battles forming a distinct part of a larger conflict often called a war. The term derives from the plain of Campania, a place of annual wartime operations by the armies of the Roman Republic._ from Wikipedia - **In the context of MISP threat-actor-name, it's long-term activity which might be composed of one or more operations.** - threat-actor - **In the context of MISP threat-actor-name, it's an agreed name by a set of organisations.** - activity group - **In the context of MISP threat-actor-name, it's a group defined by its set of common techniques or activities.** - unknown - **In the context of MISP threat-actor-name, it's still not clear if it's an operation, campaign, threat-actor or activity group** The meta field is an array to allow specific cluster of threat-actor to show the current disagreement between different organisations about the type (threat actor, activity group, campaign and operation). --- clusters/threat-actor.json | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/clusters/threat-actor.json b/clusters/threat-actor.json index 6b5c86bd..df7cb528 100644 --- a/clusters/threat-actor.json +++ b/clusters/threat-actor.json @@ -6810,6 +6810,9 @@ ], "synonyms": [ "Roaming Mantis Group" + ], + "threat-actor-classification": [ + "campaign" ] }, "uuid": "b27beb94-ce25-11e8-8e11-2f1a59bd0e91", @@ -8356,5 +8359,5 @@ "value": "GALLIUM" } ], - "version": 167 + "version": 168 }