STIX 2.1 Common Properties#
This page provides details on how certain STIX 2.1 common properties are handled by EclecticIQ Intelligence Center.
If the STIX 2.1 common property you are looking for is not here, it may be covered in the documentation for how a specific STIX 2.1 object is handled by EclecticIQ Intelligence Center.
Confidence Scales#
New in version 2.9.0.
Ingested STIX 2.1 confidence values#
If a STIX 2.1 object containing a confidence property is ingested by EclecticIQ Intelligence Center, that value is translated to one of values listed in the table below for the resulting EclecticIQ entity:
STIX 2.1 |
EclecticIQ entity |
---|---|
Not specified |
Unknown |
0 |
None |
1 – 29 |
Low |
30 – 69 |
Medium |
70 – 100 |
High |
The original STIX 2.1 object’s confidence value
is retained only in the .entities[].data.original_stix21_objects
field of the resulting EclecticIQ entity,
and is not used by EclecticIQ Intelligence Center.
Exported STIX 2.1 confidence values#
EclecticIQ Intelligence Center only packs or exports the EclecticIQ entity’s
confidence value. The resulting STIX 2.1 object
will not contain its original .confidence
value.
Exporting EclecticIQ entities to STIX 2.1 will convert EclecticIQ entity confidence values as follows:
EclecticIQ entity |
STIX 2.1 |
---|---|
Not specified |
N/A |
None |
0 |
Low |
15 |
Medium |
50 |
High |
85 |
This complies with the conversion tables in Appendix A of the STIX 2.1 specification.