Map Indicator SDO sub-types to EclecticIQ entity tags

STIX 2.1 Indicator SDO sub-types are listed in their .indicator_types[] field.

When that SDO is ingested, these .indicator_types[] are set as tags (.entities[].meta.tags[]) on the resulting EclecticIQ Indicator entity, and look like this:

Indicator Type - <§10.10 Indicator Type Vocabulary>

# For example:

Indicator Type - anomalous-activity

Map patterns to EclecticIQ Indicator entity sub-type

EclecticIQ Indicator entity have two “type” fields:

• .entities[].data.type is always set to “Indicator”

• .entities[].data.types[] is a list of sub-types

When a STIX 2.1 Indicator SDO is ingested, the resulting EclecticIQ Indicator entity derives its sub-types (.entities[].data.types[]) from the STIX Patterns contained in the ingested Indicator SDO.

The Intelligence Center looks at the .patterns field of the ingested SDO, and adds one sub-type to the resulting Indicator entity for each SCO type listed in the following table:

Map STIX Pattern to test mechanism

An ingested STIX Pattern produces a test mechanism. Test mechanisms are embedded in EclecticIQ Indicator entities and can be in the Characteristics section when editing the indicator in the entity builder, or in the JSON tab when viewing the indicator on the platform.

Test mechanisms (.entities[].data.test_mechanisms[]) in EclecticIQ JSON look like this:

The .pattern field from an ingested Indicator SDO produces a test mechanism in the resulting entity that contains:

• The full STIX Pattern from the Indicator SDO .pattern field

• The producer identity from the Indicator SDO .created_by_ref field

• A test mechanism type and description derived from the Indicator SDO .pattern_type field

  See Map STIX pattern_type to test mechanism.

The resulting test mechanism looks like this:

Map STIX Pattern to observables

When an Indicator SDO is ingested, its .patterns field is processed to produce EclecticIQ observables.

The platform converts each “Comparison Expression” (§9.1) to observables. The type of the observables resulting from this are derived from the “Object Path” within the comparison expression.

For example, the comparison expression user-account:display_name = 'Peter' is ingested to produce a name observable, with value Peter.

For a full list of supported types, see STIX 2.1 Cyber-observable Objects.

When an EclecticIQ Indicator entity is exported as a STIX 2.1 object, the resulting .patterns[] field is constructed from the observables related to that Indicator entity.

Map general kill chain phases

By default, kill chain phases in Indicator SDOs are mapped to the .entities[].meta.tags[] field in resulting EclecticIQ entities on ingestion.

This produces tags named as follows:

<.kill_chain_phases.kill_chain_name> - <.kill_chain_phases.phase_name>

E.g.

extended-cyber-kill-chain - internal-exploitation

When an indicator entity is exported as a STIX 2.1 bundle, the Intelligence Center checks its .entities[].meta.tags[] field and exports all members that match the format <key> - <value> as STIX 2.1 kill chain phases, like this:

Map Lockheed Martin Kill Chain phases

§2.11 defines a special kill_chain_name for Lockheed Martin Cyber Kill Chain phases: lockheed-martin-cyber-kill-chain.

So, when the Intelligence Center encounters a SDO kill chain phase (kill_chain_phasess) with the attribute "kill_chain_name": "lockheed-martin-cyber-kill-chain", it ingests that kill chain phase as a taxonomy node in the resulting EclecticIQ entity’s taxonomy_paths field instead.

The following table maps Lockheed Martin Kill Chain the phase_name in STIX 2.1 SDOs to EclecticIQ taxonomy_paths:

When an Indicator entity with a Lockheed Martin Kill Chain phase is exported to STIX 2.1, this mapping is reversed.