TTP (deprecated)#
Tip
This entity is analogous to the STIX 1.2 TTPType
Not compatible with STIX 2.1.
The TTP entity is deprecated. Use these STIX 2.1-compatible entities instead:
You can also convert TTPs to STIX 2.1-compatible entities using entity rules.
A TTP — Tactics, Techniques, and Procedures — describes a cyber adversary’s behavior.
TTPs borrow their name and definition from military jargon:
Tactics: “the employment and ordered arrangement of forces in relation to each other.”
Techniques: “non-prescriptive ways or methods used to perform missions, functions, or tasks.”
Procedures: “standard, detailed steps that prescribe how to perform specific tasks.”
(Definitions from: “Joint Publication 1-02, Department of Defense Dictionary of Military and Associated Terms, 8 November 2010 (as amended through 15 February 2016)”)
TTPs include details such as:
The steps the adversary performs to achieve their goal.
The equipment, gear, or tools they use.
For example, software, hardware, USB sticks, forged ID badges, and so on.
Information on any parties they associate with, or the victims they target, as well as on any exploit targets they may leverage achieve their goals.
How they act on, or react to the victim’s behavior to avoid detection or defeat.
The intended goals the adversary wants to achieve.
Create a TTP by selecting:
In the side navigation bar + Create > TTP.
Note
TTPs now cannot be created using EclecticIQ Labs: Intelligence creation on the graph.
Then, Configure this entity.
Configure#
The following sections the fields and options available.
Note
Required fields are marked with an asterisk (*).
General#
Field |
EIQ JSON field |
Description |
---|---|---|
Title* |
|
Descriptive title for this entity. See Titles and aliases. |
Analysis |
|
Long description of TTP. |
Intended effects |
|
See Intended effects. |
Characteristics#
Characteristics are properties on an entity that provide context for the intelligence indicated by this object.
The following are characteristics available for TTPs:
Characteristics: Exploit#
Exploit identified in the context of this TTP. ExploitType.
Tip
Adding this characteristic to a TTP embeds this information in the entity. You may want to create a separate Exploit target entity and create a relationship to that instead.
Field |
EIQ JSON field |
Description |
---|---|---|
Title* |
|
Descriptive title. |
Description |
|
Free text description. |
Characteristics: Malware#
Malware identified in the context of this TTP. Analogous to MalwareType.
Field |
EIQ JSON field |
Description |
---|---|---|
Names |
|
Enter one or more names to identify this malware by. |
Types |
|
See Malware types. |
On publishing this entity, also creates a new
malware
observable for each
malware name added here.
Characteristics: Attack pattern#
Attack pattern identified in the context of this TTP. Analogous to AttackPatternType
Field |
EIQ JSON field |
Description |
---|---|---|
CAPEC |
|
Enter a CAPEC ID. |
Title* |
|
Title of attack pattern. |
Description |
|
Free text description. |
Characteristics: Infrastructure#
Describes infrastructure in the context of this TTP. Analogous to InfrastructureType.
Field |
EIQ JSON field |
Description |
---|---|---|
Title |
|
Title of infrastructure. |
Description |
|
Free text description. |
Types |
|
Characteristics: Persona#
Personas identified in the context of this TTP. Analogous to PersonasType.
Field |
EIQ JSON field |
Description |
---|---|---|
Name* |
|
Name of persona. |
On publishing this entity, also creates a new
name
observable with values specified here
and links it to this entity.
Characteristics: Tools#
Attacker tools identified in the context of this TTP. Analogous to ToolsType.
Field |
EIQ JSON field |
Description |
---|---|---|
Name* |
|
Name of tool. |
Types |
|
Type of attacker tool. Analogous to AttackerToolTypeVocab-1.0. Available options:
|
Description |
|
Description of tool. |
Hashes |
|
Add one or more hashes to this TTP. Analogous to HashType. For each hash added, configure these two fields:
Each hash added here also creates a corresponding
|
Characteristics: Targeted victim#
Set one targeted victim for this TTP. Analogous to VictimTargetingType.
Field |
EIQ JSON field |
Description |
---|---|---|
Name |
|
Name of targeted victim. |
Specification |
|
Add details to describe the targeted victim. See Targeted victim: Specification |
Targeted systems |
|
Select one or more targeted systems. Analogous to SystemTypeVocab-1.0. |
Targeted information |
|
Select one or more items. Analogous to InformationTypeVocab-1.0. |
Targeted victim: Specification#
Add one or more items to Specification
to flesh out the identity being described.
Content here is used to construct the XML
content in the specification_xml
field in EIQ JSON.
Analogous to
STIXCIQIdentity3.0Type
as used in
IdentityType/
CIQIdentity3.0InstanceType/
CIQ 3.0 Specifications.
Field |
Description |
---|---|
Account |
Describes a bank account or similar. Available fields:
|
Person |
Add one or more properties describing a person.
|
Organization |
Add one or more properties describing an organization.
|
Electronic address |
Add one or more electronic addresses for this targeted victim.
|
Each item added to the Specification section creates an observable with the corresponding type:
Specification field |
Resulting observable type(s) |
---|---|
Account |
|
Person |
|
Organization |
|
Electronic address |
|
Observables#
You can create one or more new observables and link it to the currently open entity by selecting + Observable under the Observables section.
Note
If an observable you create here matches an observable rule with an ignore action, it does not appear when the you publish the entity.
In the Add observable view that appears, fill out these fields:
Field |
EIQ JSON field |
Description |
---|---|---|
Type* |
|
See Observable types |
Link name* |
||
Values(s)* |
|
Enter one or more values. One observable is created per value. Values must be comma-separated, or newline-separated, but not both. |
Maliciousness* |
Relationships#
Add relationships to this entity by selecting + Add relationship.
See Relationships.
Meta#
The Meta section contains configuration options that allow you to attach descriptive data to the entity.
Field |
EIQ JSON field |
Description |
---|---|---|
Estimated threat start time |
|
Estimated start of threat. See Time values. |
Estimated threat end time |
|
Estimated end of threat. See Time values. |
Estimated observed time |
|
Estimated time threat was observed. See Time values. |
Half-life |
|
See Half-life. Select one of these options:
|
Tags |
|
See tags and taxonomies. |
Source* |
|
Select one source. |
Source reliability |
|
See source reliability. Options:
|
Information source#
Field |
EIQ JSON field |
Description |
---|---|---|
Description |
|
Description of information source. |
Identity |
|
Name of this information source |
Roles |
|
One or more information source roles. Possible values:
|
References |
|
One or more URLs. |
Data marking#
Descriptive metadata for entity.
Field |
EIQ JSON field |
Description |
---|---|---|
TLP |
|
Set a TLP color for this entity. |
Terms of use |
|
Free text field allowing you to attach terms of use to an entity. Analogous to TermsOfUseMarkingStructureType. |
Simple |
|
Free text field for attaching any text to an entity. Analogous to SimpleMarkingStructureType. |
Workflow#
Use options here to apply workflow options to this entity.
Field |
Description |
---|---|
Add to dataset |
Select this option to add this entity to one or more datasets on Publish. |
Manually enrich |
Run one or more enrichers on this entity on Publish. |
Save and publish#
Tip
For more information, see Draft and published entities.
Select Publish to create this entity, and make it available under + Create > Production > Published.
For more publishing options, select More and then one of these options:
Publish and new: Publish this entity, and start creating a new entity.
Publish and duplicate: Publish this entity, and start creating a new entity using all the values set for this entity.
Select Save draft to save this entity as a draft, and make it available under + Create > Production > Drafts. You must publish an entity to use it elsewhere on EclecticIQ Intelligence Center.
For more options while saving as a draft, select More and then one of these options:
Publish and new: Save this entity as a draft, and start creating a new entity.
Publish and duplicate: Save this entity as a draft, and start creating a new entity using all the values set for this draft entity.