Observables : expiration date

[Fred-certeu]

Problem to Solve

We use it for selecting observable at SOC level: filter out observables which are too old.

Current Workaround

N/A

Proposed Solution

Calculate an expiration date based on:

• the last observed date
• the type of observable (e.g. IP, domain, URL, etc)
• the TLP

CERT-EU can propose a logic

Additional Information

N/A

[HarishHary]

Can you explain more about the logic used for this here ? How do you plan to compute an expiration date ?

[Fred-certeu]

We have a logic in our current platform, but we need to revise it based on a few years of experience.
This logic works if the observable source doesn't provide any expiration date.

For each observable, the expiration date is equal to : last observed + TTL (time to live)

The TTL is calculated based on:

• observable type
• kill chain
• TLP

Here is how it works now:

IP addresses
TLP = RED -->TTL = 120 days
TLP = AMBER and killchain = delivery --> TTL = 15 days
TLP = AMBER and killchain TTL != delivery --> TTL = 60 days
TLP = GREEN or WHITE and killchain = delivery --> TTL = 7 days
TLP = GREEN or WHITE and killchain TTL != delivery --> TTL = 30 days

URLs
TLP = RED -->TTL = 180 days
TLP = AMBER and killchain = delivery --> TTL = 30 days
TLP = AMBER and killchain TTL != delivery --> TTL = 180 days
TLP = GREEN or WHITE and killchain = delivery --> TTL = 15 days
TLP = GREEN or WHITE and killchain TTL != delivery --> TTL = 60 days

etc

We have not yet decided for new values.
We will come back with proposals unless someone wants to propose something

[HarishHary]

@Fred-certeu Can you elaborate more on killchain = delivery and killchain TTL != delivery ? Can you provide more information on the other type of IoCs ?

[SamuelHassine]

@Fred-certeu, @HarishHary: in the next version, the expiration date will be computed here: https://github.com/OpenCTI-Platform/opencti/blob/master/opencti-platform/opencti-graphql/src/domain/indicator.js [Line 23].

[SamuelHassine]

Please feel free to open other tickets to add new logic based on other types.

[SamuelHassine]

@HarishHary: For killchainPhase == delivery I implemented the following: isKillChainPhaseDelivery = includes('initial-access', killChainPhasesNames) || includes('execution', killChainPhasesNames) ? 'yes' : 'no';