diff --git a/.gitignore b/.gitignore index 64af247..45c1505 100644 --- a/.gitignore +++ b/.gitignore @@ -1,3 +1,3 @@ _site .sass-cache -.jekyll-metadata \ No newline at end of file +.jekyll-metadata diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml new file mode 100644 index 0000000..7017426 --- /dev/null +++ b/.pre-commit-config.yaml @@ -0,0 +1,13 @@ +exclude: > + (?x)^( + .*\.svg$| + js/bootstrap.min.js + )$ +repos: +- repo: https://github.com/pre-commit/pre-commit-hooks + rev: v1.2.1-1 + hooks: + - id: trailing-whitespace + - id: end-of-file-fixer + - id: check-yaml + - id: check-added-large-files diff --git a/.travis.yml b/.travis.yml index 52b88ec..0b9176a 100644 --- a/.travis.yml +++ b/.travis.yml @@ -4,4 +4,4 @@ install: - pip install stix2-validator script: - - ./validate-examples.sh \ No newline at end of file + - ./validate-examples.sh diff --git a/_includes/header.html b/_includes/header.html index 7e70b50..8364f8f 100644 --- a/_includes/header.html +++ b/_includes/header.html @@ -27,7 +27,7 @@
  • Introductory Walkthrough
  • Examples
  • STIX 1.X and STIX 2 Comparison
    • -
  • Latest STIX Specifications
    • +
  • Latest STIX Specifications
  • diff --git a/_sass/_base.scss b/_sass/_base.scss index b8b30de..96ad5ba 100644 --- a/_sass/_base.scss +++ b/_sass/_base.scss @@ -457,14 +457,14 @@ pre { /* * Tables */ -.table-anchor tbody tr td:nth-of-type(1), +.table-anchor tbody tr td:nth-of-type(1), .table-col1-width tbody tr td:nth-of-type(1), .table-col2-width tbody tr td:nth-of-type(2) { - width: 25%; + width: 25%; } .table-anchor tbody tr td:nth-of-type(2) { - width: 15%; + width: 15%; } .table-anchor tbody tr td a{ @@ -481,4 +481,3 @@ pre { .relationshipIcon { cursor: pointer; } - diff --git a/contribute.md b/contribute.md index 5fcd942..4d262f9 100644 --- a/contribute.md +++ b/contribute.md @@ -14,7 +14,7 @@ Contribute and Join The Global Community

    Let us know how to improve

    - + Submit Feedback
    @@ -23,7 +23,7 @@ Contribute and Join The Global Community

    Want to stay up-to-date on the latest STIX discussions?

    - + Mailing List Subscription
    @@ -39,7 +39,7 @@ Bug reports, suggestions and help requests about spcific OASIS github projects s

    Contributor License Agreement

    - + License Agreement
    @@ -48,11 +48,11 @@ Bug reports, suggestions and help requests about spcific OASIS github projects s

    Resources

    @@ -63,13 +63,13 @@ Bug reports, suggestions and help requests about spcific OASIS github projects s To be directly involved in the development of the STIX specification one must join OASIS and the Technical Committee(TC). This should only be considered by those willing to have a dedicated commitment to STIX and/or CTI. -
    +

    Join the Technical Committee

    - + Join Technical Committee
    -
    \ No newline at end of file +
    diff --git a/examples/malware-indicator-for-file-hash.md b/examples/malware-indicator-for-file-hash.md index c1933ee..075d1a1 100644 --- a/examples/malware-indicator-for-file-hash.md +++ b/examples/malware-indicator-for-file-hash.md @@ -22,7 +22,7 @@ Next, the details of the Poison Ivy malware are captured using a STIX [Malware]( These SDO’s are then coupled together via a [Relationship](https://docs.google.com/document/d/1IvkLxg_tCnICsatu2lyxKmWmh1gY2h8HUNssKIE-UIA/pub#h.e2e1szrqfoan) STIX Relationship Object (SRO). This Relationship connects the **source\_ref**, Indicator, with the **target\_ref**, Malware, via an indicates **relationship\_type**. -A diagram of this relationship below shows the Indicator and Malware SDO’s and the Relationship SRO between them +A diagram of this relationship below shows the Indicator and Malware SDO’s and the Relationship SRO between them [(An interactive version can be found here)](https://oasis-open.github.io/cti-stix-visualization/?url=https://raw.githubusercontent.com/oasis-open/cti-documentation/master/examples/example_json/malware-indicator-for-file-hash.json){: target="_blank"}: ![Malware indicator for file hash]({{ site.baseurl }}/img/Malware-Indicator-for-File-Hash.PNG) diff --git a/faq.md b/faq.md index 6bf1fa8..3034f26 100644 --- a/faq.md +++ b/faq.md @@ -21,4 +21,3 @@ Frequently Asked Questions
    - diff --git a/index.md b/index.md index 2038abc..8600222 100644 --- a/index.md +++ b/index.md @@ -14,7 +14,7 @@ layout: default
    [![STIX Logo]({{ site.baseurl }}/img/LOGO_STIX.svg){: .panel-logo}]({{site.baseurl}}/stix/intro)
    A structured language for cyber threat intelligence
    -
    +

    Structured Threat Information Expression (STIX™) is a language and serialization format used to exchange cyber threat intelligence (CTI). @@ -30,7 +30,7 @@ layout: default **STIX Relationship Example**

    - + Learn More
    @@ -60,8 +60,8 @@ layout: default ![TAXII Collections]({{ site.baseurl }}/img/taxii_diagram.png){: .figure-img .img-fluid} **TAXII Collections**
    -
    - +
    + Learn More
    diff --git a/js/example_filter.js b/js/example_filter.js index dc04232..f4ac49a 100644 --- a/js/example_filter.js +++ b/js/example_filter.js @@ -9,7 +9,7 @@ function filter_idiom_table(by_tag) { function toggle_color(clicked_tag) { var tags = $("a[class=\"tag-filter\""); - for (var i = 0; i < tags.length; i++) { + for (var i = 0; i < tags.length; i++) { tags[i].style.backgroundColor = "transparent"; } @@ -22,13 +22,13 @@ $(document).ready(function() { toggle_color(this); filter_idiom_table(label); }) - + var idiom_table = $("#examples-table"); var rows = $(idiom_table).find('tbody > tr').get(); $.each(rows, function(index, row) { $(idiom_table).children('tbody').append(row); }); - + if (window.location.hash) { filter_idiom_table(window.location.hash.substring(1)); } diff --git a/stix/compare.md b/stix/compare.md index 2c04f42..cea1df4 100644 --- a/stix/compare.md +++ b/stix/compare.md @@ -29,7 +29,7 @@ The generic TTP (tactics, techniques, procedures) and Exploit Target types from ```xml - Initial Compromise @@ -43,13 +43,13 @@ The generic TTP (tactics, techniques, procedures) and Exploit Target types from - - -``` +```
    @@ -129,22 +129,22 @@ Indicator patterns in STIX 1.x were expressed using XML syntax. This made all bu ### STIX 1 Indicator Example ```xml - HTRAN Hop Point Accessor - - - 10.1.0.0/15 @@ -164,13 +164,13 @@ Indicator patterns in STIX 1.x were expressed using XML syntax. This made all bu "created": "2017-02-09T12:11:11.415000Z", "modified": "2017-02-09T12:11:11.415000Z", "name": "HTRAN Hop Point Accessor", - "pattern": "[ipv4-addr:value = + "pattern": "[ipv4-addr:value = '10.1.0.0/15']", "labels": [ "malicious-activity" ], "valid_from": "2015-05-15T09:00:00.000000Z", "kill_chain_phases": [ { - "kill_chain_name": + "kill_chain_name": "mandiant-attack-lifecycle-model", "phase_name": "establish-foothold" } diff --git a/stix/examples.md b/stix/examples.md index b8ce694..cd92346 100644 --- a/stix/examples.md +++ b/stix/examples.md @@ -48,7 +48,7 @@ Done with examples? [Check out the spec!]({{ site.baseurl }}/resources#stix-20-s | [Sighting of Observed-data](/cti-documentation/examples/sighting-of-observed-data) | ![Identity Icon]({{ site.baseurl }}/img/icons/identity.png){: data-tag="Identity" title="Identity"} ![Observed-data Icon]({{ site.baseurl }}/img/icons/observed_data.png){: data-tag="Observed Data" title="Observed Data"} ![Sighting Icon]({{ site.baseurl }}/img/icons/sighting.png){: data-tag="Sighting" title="Sighting"} ![Malware Icon]({{ site.baseurl }}/img/icons/malware.png){: data-tag="Malware" title="Malware"} | Observed data represent machine-generated raw information and are different from Indicators which dictate more of an intelligence assertion. These Observed-data SDO's can still be shared and referenced within a Sighting SRO. This example demonstrates the usage of Observed-data and their relation to other STIX objects. | [Threat Actor Leveraging Attack Patterns and Malware](/cti-documentation/examples/threat-actor-leveraging-attack-patterns-and-malware) | ![Attack Pattern Icon]({{ site.baseurl }}/img/icons/attack_pattern.png){: data-tag="Attack Pattern" title="Attack Pattern"} ![Identity Icon]({{ site.baseurl }}/img/icons/identity.png){: data-tag="Identity" title="Identity"} ![Malware Icon]({{ site.baseurl }}/img/icons/malware.png){: data-tag="Malware" title="Malware"} ![Threat Actor Icon]({{ site.baseurl }}/img/icons/threat_actor.png){: data-tag="Threat Actor" title="Threat Actor"} | Threat actors can often be characterized by the attack patterns they leverage and the malware varieties they use. This example describes how to represent a threat actor who uses a phishing attack pattern to deliver a form of malware. | | [Using Marking Definitions](/cti-documentation/examples/using-marking-definitions) | ![Identity Icon]({{ site.baseurl }}/img/icons/identity.png){: data-tag="Identity" title="Identity"} ![Indicator Icon]({{ site.baseurl }}/img/icons/indicator.png){: data-tag="Indicator" title="Indicator"} ![Amber Marking Icon]({{ site.baseurl }}/img/icons/tlp_amber.png){: title="Marking Definition"} ![Statement Marking Icon]({{ site.baseurl }}/img/icons/restricted_marking.png){: title="Marking Definition"} | Sometimes when creating STIX objects it may be useful to provide guidance or permissions on how those objects may be used. In this example, Marking Definition objects are created and applied to an Indicator object to specify restrictions and copyright information. | -| [Using Granular Markings](/cti-documentation/examples/using-granular-markings) | ![Identity Icon]({{ site.baseurl }}/img/icons/identity.png){: data-tag="Identity" title="Identity"} ![Indicator Icon]({{ site.baseurl }}/img/icons/indicator.png){: data-tag="Indicator" title="Indicator"} ![Green Marking Icon]({{ site.baseurl }}/img/icons/tlp_green.png){: title="Marking Definition"} ![Amber Marking Icon]({{ site.baseurl }}/img/icons/tlp_amber.png){: title="Marking Definition"} ![Red Marking Icon]({{ site.baseurl }}/img/icons/tlp_red.png){: title="Marking Definition"} | Whereas object markings in STIX can limit or restrict how entire objects are used, granular markings delve deeper into the objects and focus on restricting specific individual properties. This example demonstrates how to enforce different TLP markings on multiple properties of an Indicator SDO. +| [Using Granular Markings](/cti-documentation/examples/using-granular-markings) | ![Identity Icon]({{ site.baseurl }}/img/icons/identity.png){: data-tag="Identity" title="Identity"} ![Indicator Icon]({{ site.baseurl }}/img/icons/indicator.png){: data-tag="Indicator" title="Indicator"} ![Green Marking Icon]({{ site.baseurl }}/img/icons/tlp_green.png){: title="Marking Definition"} ![Amber Marking Icon]({{ site.baseurl }}/img/icons/tlp_amber.png){: title="Marking Definition"} ![Red Marking Icon]({{ site.baseurl }}/img/icons/tlp_red.png){: title="Marking Definition"} | Whereas object markings in STIX can limit or restrict how entire objects are used, granular markings delve deeper into the objects and focus on restricting specific individual properties. This example demonstrates how to enforce different TLP markings on multiple properties of an Indicator SDO. | [Visualized SDO Relationships](/cti-documentation/examples/visualized-sdo-relationships) | ![Relationship Icon]({{ site.baseurl }}/img/icons/relationship.png){: data-tag="Relationship" title="Relationship"} | This example iterates over all SDOs and visually represents possible relationships of each SDO to another. Visual representations can simplify understanding and are often easier to interpret then text alone. | STIX 2.0 Threat Reports @@ -60,6 +60,6 @@ The following threat reports have been converted into STIX 2.0. | Threat Report | JSON Representation | Description | | --------------------------------------- | ------------------------------------------------- | ------------------------------------------- | -| [Mandiant's APT1 Report](https://www.fireeye.com/content/dam/fireeye-www/services/pdfs/mandiant-apt1-report.pdf){:target="_blank"} | [APT1 JSON](https://oasis-open.github.io/cti-documentation/examples/example_json/apt1.json) | This in-depth threat report by Mandiant focuses on a sophisticated advanced persistent threat simply called "APT1". Mandiant concluded that this extensive APT conducted cyber espionage campaigns potentially with sponsorship by the Chinese government. Within the STIX 2 JSON for this report, there are several Campaign, Threat Actor, Indicator, Attack Pattern and Malware objects, as well as an Intrusion Set SDO used to model APT1. Along with these SDOs, there are multiple relationships linking these objects together. Feel free to download this converted report to see all of the SDOs and SROs used. | +| [Mandiant's APT1 Report](https://www.fireeye.com/content/dam/fireeye-www/services/pdfs/mandiant-apt1-report.pdf){:target="_blank"} | [APT1 JSON](https://oasis-open.github.io/cti-documentation/examples/example_json/apt1.json) | This in-depth threat report by Mandiant focuses on a sophisticated advanced persistent threat simply called "APT1". Mandiant concluded that this extensive APT conducted cyber espionage campaigns potentially with sponsorship by the Chinese government. Within the STIX 2 JSON for this report, there are several Campaign, Threat Actor, Indicator, Attack Pattern and Malware objects, as well as an Intrusion Set SDO used to model APT1. Along with these SDOs, there are multiple relationships linking these objects together. Feel free to download this converted report to see all of the SDOs and SROs used. | | [Fireeye's Poison Ivy Report](https://www.fireeye.com/content/dam/fireeye-www/global/en/current-threats/pdfs/rpt-poison-ivy.pdf){:target="_blank"} | [Poison Ivy JSON](https://oasis-open.github.io/cti-documentation/examples/example_json/poisonivy.json) | Fireeye's threat report on Poison Ivy covers how this remote access tool (RAT) was used by different campaigns and threat actors. In this converted report, there are several variants of PIVY malware represented by the Malware SDO, as well as Campaign, Threat Actor, Attack Pattern, and Vulnerability objects. Relationship SROs help link the malware variants to the campaigns and threat actors and demonstrate the vulnerabilities PIVY exploits. The JSON representation is available for download. | | [IMDDOS Botnet Report](https://www.coresecurity.com/publication/imddos-botnet-discovery-and-analysis){:target="_blank"} | [IMDDOS Threat Modeling Exercise](https://gist.github.com/rjsmitre/79775df68b0d1c7c0985b4fe7f115586) --- [Visualized](https://oasis-open.github.io/cti-stix-visualization/?url=https://gist.githubusercontent.com/rjsmitre/79775df68b0d1c7c0985b4fe7f115586/raw/d5d2a3e7b4ae52ff7153a8b7b5b57dd066611803/imddos.json){: target="_blank"} | This report by Damballa discusses the Chinese IMDDOS botnet. For this report, several OASIS CTI-TC team members came up with solutions. This conversion to STIX 2.0 models Indicator, Malware, and Threat Actor SDOs, along with the corresponding Relationship objects linking them together. diff --git a/validate-examples.sh b/validate-examples.sh index 3cc1446..fc8081d 100755 --- a/validate-examples.sh +++ b/validate-examples.sh @@ -1,3 +1,3 @@ #!/bin/bash -find . -iname "*.json" -print0 | xargs -0 stix2_validator --strict --ignore 302 \ No newline at end of file +find . -iname "*.json" -print0 | xargs -0 stix2_validator --strict --ignore 302