casebook.json

{
  "observables" : [ {
    "value" : "string",
    "type" : "string"
  } ],
  "tlp" : "string",
  "id" : "string",
  "timestamp" : "2016-01-01T01:01:01.000Z",
  "revision" : 10,
  "texts" : [ {
    "type" : "string",
    "text" : "string"
  } ],
  "short_description" : "string",
  "bundle" : {
    "campaign_refs" : [ "string" ],
    "tlp" : "string",
    "incidents" : [ {
      "confidence" : "string",
      "tlp" : "string",
      "id" : "string",
      "timestamp" : "2016-01-01T01:01:01.000Z",
      "revision" : 10,
      "categories" : [ "string" ],
      "incident_time" : {
        "opened" : "2016-01-01T01:01:01.000Z",
        "discovered" : "2016-01-01T01:01:01.000Z",
        "reported" : "2016-01-01T01:01:01.000Z",
        "remediated" : "2016-01-01T01:01:01.000Z",
        "closed" : "2016-01-01T01:01:01.000Z",
        "rejected" : "2016-01-01T01:01:01.000Z"
      },
      "discovery_method" : "string",
      "status" : "string",
      "short_description" : "string",
      "schema_version" : "string",
      "title" : "string",
      "source" : "string",
      "type" : "string",
      "intended_effect" : "string",
      "source_uri" : "string",
      "language" : "string",
      "external_references" : [ {
        "source_name" : "string",
        "description" : "string",
        "url" : "string",
        "hashes" : [ "string" ],
        "external_id" : "string"
      } ],
      "description" : "string",
      "external_ids" : [ "string" ]
    } ],
    "tools" : [ {
      "tlp" : "string",
      "kill_chain_phases" : [ {
        "kill_chain_name" : "string",
        "phase_name" : "string"
      } ],
      "x_mitre_aliases" : [ "string" ],
      "id" : "string",
      "timestamp" : "2016-01-01T01:01:01.000Z",
      "revision" : 10,
      "name" : "string",
      "labels" : [ "string" ],
      "schema_version" : "string",
      "source" : "string",
      "type" : "string",
      "tool_version" : "string",
      "source_uri" : "string",
      "language" : "string",
      "external_references" : [ {
        "source_name" : "string",
        "description" : "string",
        "url" : "string",
        "hashes" : [ "string" ],
        "external_id" : "string"
      } ],
      "description" : "string",
      "external_ids" : [ "string" ]
    } ],
    "indicators" : [ {
      "test_mechanisms" : [ "string" ],
      "indicator_type" : [ "string" ],
      "confidence" : "string",
      "composite_indicator_expression" : {
        "operator" : "string",
        "indicator_ids" : [ "string" ]
      },
      "tlp" : "string",
      "negate" : true,
      "kill_chain_phases" : [ {
        "kill_chain_name" : "string",
        "phase_name" : "string"
      } ],
      "tags" : [ "string" ],
      "id" : "string",
      "timestamp" : "2016-01-01T01:01:01.000Z",
      "valid_time" : {
        "start_time" : "2016-01-01T01:01:01.000Z",
        "end_time" : "2016-01-01T01:01:01.000Z"
      },
      "revision" : 10,
      "short_description" : "string",
      "producer" : "string",
      "likely_impact" : "string",
      "schema_version" : "string",
      "title" : "string",
      "source" : "string",
      "type" : "string",
      "source_uri" : "string",
      "language" : "string",
      "external_references" : [ {
        "source_name" : "string",
        "description" : "string",
        "url" : "string",
        "hashes" : [ "string" ],
        "external_id" : "string"
      } ],
      "severity" : "string",
      "description" : "string",
      "external_ids" : [ "string" ],
      "specification" : {
        "type" : "string",
        "judgements" : [ "string" ],
        "required_judgements" : [ {
          "confidence" : "string",
          "source" : "string",
          "relationship" : "string",
          "judgement_id" : "string"
        } ]
      }
    } ],
    "relationship_refs" : [ "string" ],
    "sighting_refs" : [ "string" ],
    "coa_refs" : [ "string" ],
    "campaigns" : [ {
      "confidence" : "string",
      "tlp" : "string",
      "campaign_type" : "string",
      "activity" : [ {
        "date_time" : "2016-01-01T01:01:01.000Z",
        "description" : "string"
      } ],
      "id" : "string",
      "timestamp" : "2016-01-01T01:01:01.000Z",
      "valid_time" : {
        "start_time" : "2016-01-01T01:01:01.000Z",
        "end_time" : "2016-01-01T01:01:01.000Z"
      },
      "revision" : 10,
      "status" : "string",
      "short_description" : "string",
      "names" : [ "string" ],
      "schema_version" : "string",
      "title" : "string",
      "source" : "string",
      "type" : "string",
      "intended_effect" : [ "string" ],
      "source_uri" : "string",
      "language" : "string",
      "external_references" : [ {
        "source_name" : "string",
        "description" : "string",
        "url" : "string",
        "hashes" : [ "string" ],
        "external_id" : "string"
      } ],
      "description" : "string",
      "external_ids" : [ "string" ]
    } ],
    "attack_pattern_refs" : [ "string" ],
    "judgement_refs" : [ "string" ],
    "feedbacks" : [ {
      "tlp" : "string",
      "entity_id" : "string",
      "id" : "string",
      "timestamp" : "2016-01-01T01:01:01.000Z",
      "revision" : 10,
      "feedback" : 10,
      "schema_version" : "string",
      "source" : "string",
      "type" : "string",
      "reason" : "string",
      "source_uri" : "string",
      "language" : "string",
      "external_references" : [ {
        "source_name" : "string",
        "description" : "string",
        "url" : "string",
        "hashes" : [ "string" ],
        "external_id" : "string"
      } ],
      "external_ids" : [ "string" ]
    } ],
    "coas" : [ {
      "related_COAs" : [ {
        "confidence" : "string",
        "source" : "string",
        "relationship" : "string",
        "COA_id" : "string"
      } ],
      "tlp" : "string",
      "efficacy" : "string",
      "structured_coa_type" : "string",
      "id" : "string",
      "timestamp" : "2016-01-01T01:01:01.000Z",
      "valid_time" : {
        "start_time" : "2016-01-01T01:01:01.000Z",
        "end_time" : "2016-01-01T01:01:01.000Z"
      },
      "revision" : 10,
      "open_c2_coa" : {
        "type" : "string",
        "id" : "string",
        "action" : {
          "type" : "string"
        },
        "target" : {
          "type" : "string",
          "specifiers" : "string"
        },
        "actuator" : {
          "type" : "string",
          "specifiers" : [ "string" ]
        },
        "modifiers" : {
          "destination" : "string",
          "method" : [ "string" ],
          "option" : "string",
          "id" : "string",
          "location" : "string",
          "time" : {
            "start_time" : "2016-01-01T01:01:01.000Z",
            "end_time" : "2016-01-01T01:01:01.000Z"
          },
          "duration" : "2016-01-01T01:01:01.000Z",
          "delay" : "2016-01-01T01:01:01.000Z",
          "source" : "string",
          "response" : "string",
          "additional_properties" : {
            "context" : "string"
          },
          "search" : "string",
          "frequency" : "string"
        }
      },
      "cost" : "string",
      "short_description" : "string",
      "impact" : "string",
      "objective" : [ "string" ],
      "schema_version" : "string",
      "title" : "string",
      "source" : "string",
      "type" : "string",
      "source_uri" : "string",
      "language" : "string",
      "external_references" : [ {
        "source_name" : "string",
        "description" : "string",
        "url" : "string",
        "hashes" : [ "string" ],
        "external_id" : "string"
      } ],
      "coa_type" : "string",
      "description" : "string",
      "external_ids" : [ "string" ],
      "stage" : "string"
    } ],
    "id" : "string",
    "timestamp" : "2016-01-01T01:01:01.000Z",
    "valid_time" : {
      "start_time" : "2016-01-01T01:01:01.000Z",
      "end_time" : "2016-01-01T01:01:01.000Z"
    },
    "revision" : 10,
    "weakness_refs" : [ "string" ],
    "malware_refs" : [ "string" ],
    "data_table_refs" : [ "string" ],
    "verdict_refs" : [ "string" ],
    "short_description" : "string",
    "tool_refs" : [ "string" ],
    "feedback_refs" : [ "string" ],
    "sightings" : [ {
      "observables" : [ {
        "value" : "string",
        "type" : "string"
      } ],
      "confidence" : "string",
      "relations" : [ {
        "origin" : "string",
        "origin_uri" : "string",
        "relation" : "string",
        "relation_info" : {
          "keyword" : {
            "anything" : "anything"
          }
        },
        "source" : {
          "value" : "string",
          "type" : "string"
        },
        "related" : {
          "value" : "string",
          "type" : "string"
        }
      } ],
      "tlp" : "string",
      "internal" : true,
      "id" : "string",
      "timestamp" : "2016-01-01T01:01:01.000Z",
      "revision" : 10,
      "sensor" : "string",
      "count" : 10,
      "short_description" : "string",
      "targets" : [ {
        "type" : "string",
        "observables" : [ {
          "value" : "string",
          "type" : "string"
        } ],
        "observed_time" : {
          "start_time" : "2016-01-01T01:01:01.000Z",
          "end_time" : "2016-01-01T01:01:01.000Z"
        },
        "os" : "string",
        "properties_data_tables" : "string"
      } ],
      "schema_version" : "string",
      "title" : "string",
      "source" : "string",
      "type" : "string",
      "source_uri" : "string",
      "language" : "string",
      "external_references" : [ {
        "source_name" : "string",
        "description" : "string",
        "url" : "string",
        "hashes" : [ "string" ],
        "external_id" : "string"
      } ],
      "severity" : "string",
      "observed_time" : {
        "start_time" : "2016-01-01T01:01:01.000Z",
        "end_time" : "2016-01-01T01:01:01.000Z"
      },
      "description" : "string",
      "external_ids" : [ "string" ],
      "resolution" : "string"
    } ],
    "actor_refs" : [ "string" ],
    "actors" : [ {
      "confidence" : "string",
      "tlp" : "string",
      "id" : "string",
      "timestamp" : "2016-01-01T01:01:01.000Z",
      "valid_time" : {
        "start_time" : "2016-01-01T01:01:01.000Z",
        "end_time" : "2016-01-01T01:01:01.000Z"
      },
      "revision" : 10,
      "identity" : {
        "description" : "string",
        "related_identities" : [ {
          "identity" : "string",
          "confidence" : "string",
          "information_source" : "string",
          "relationship" : "string"
        } ]
      },
      "short_description" : "string",
      "sophistication" : "string",
      "planning_and_operational_support" : "string",
      "schema_version" : "string",
      "title" : "string",
      "source" : "string",
      "type" : "string",
      "intended_effect" : "string",
      "source_uri" : "string",
      "language" : "string",
      "external_references" : [ {
        "source_name" : "string",
        "description" : "string",
        "url" : "string",
        "hashes" : [ "string" ],
        "external_id" : "string"
      } ],
      "motivation" : "string",
      "actor_type" : "string",
      "description" : "string",
      "external_ids" : [ "string" ]
    } ],
    "indicator_refs" : [ "string" ],
    "schema_version" : "string",
    "title" : "string",
    "source" : "string",
    "judgements" : [ {
      "confidence" : "string",
      "tlp" : "string",
      "priority" : 10,
      "id" : "string",
      "timestamp" : "2016-01-01T01:01:01.000Z",
      "valid_time" : {
        "start_time" : "2016-01-01T01:01:01.000Z",
        "end_time" : "2016-01-01T01:01:01.000Z"
      },
      "revision" : 10,
      "disposition" : 10,
      "observable" : {
        "value" : "string",
        "type" : "string"
      },
      "disposition_name" : "string",
      "schema_version" : "string",
      "source" : "string",
      "type" : "string",
      "reason" : "string",
      "source_uri" : "string",
      "language" : "string",
      "external_references" : [ {
        "source_name" : "string",
        "description" : "string",
        "url" : "string",
        "hashes" : [ "string" ],
        "external_id" : "string"
      } ],
      "severity" : "string",
      "reason_uri" : "string",
      "external_ids" : [ "string" ]
    } ],
    "type" : "string",
    "relationships" : [ {
      "tlp" : "string",
      "target_ref" : "string",
      "relationship_type" : "string",
      "id" : "string",
      "timestamp" : "2016-01-01T01:01:01.000Z",
      "revision" : 10,
      "source_ref" : "string",
      "short_description" : "string",
      "schema_version" : "string",
      "title" : "string",
      "source" : "string",
      "type" : "string",
      "source_uri" : "string",
      "language" : "string",
      "external_references" : [ {
        "source_name" : "string",
        "description" : "string",
        "url" : "string",
        "hashes" : [ "string" ],
        "external_id" : "string"
      } ],
      "description" : "string",
      "external_ids" : [ "string" ]
    } ],
    "weaknesses" : [ {
      "detection_methods" : [ {
        "method" : "string",
        "description" : "string",
        "effectiveness" : "string",
        "effectiveness_notes" : "string"
      } ],
      "background_details" : "string",
      "tlp" : "string",
      "architectures" : [ {
        "prevalence" : "string",
        "name" : "string",
        "class" : "string"
      } ],
      "affected_resources" : [ "string" ],
      "structure" : "string",
      "id" : "string",
      "timestamp" : "2016-01-01T01:01:01.000Z",
      "revision" : 10,
      "abstraction_level" : "string",
      "alternate_terms" : [ {
        "term" : "string",
        "description" : "string"
      } ],
      "short_description" : "string",
      "languages" : [ {
        "prevalence" : "string",
        "name" : "string",
        "class" : "string"
      } ],
      "paradigms" : [ {
        "prevalence" : "string",
        "name" : "string"
      } ],
      "potential_mitigations" : [ {
        "description" : "string",
        "phases" : [ "string" ],
        "strategy" : "string",
        "effectiveness" : "string",
        "effectiveness_notes" : "string"
      } ],
      "functional_areas" : [ "string" ],
      "schema_version" : "string",
      "title" : "string",
      "source" : "string",
      "type" : "string",
      "common_consequences" : [ {
        "scopes" : [ "string" ],
        "impacts" : [ "string" ],
        "likelihood" : "string",
        "note" : "string"
      } ],
      "operating_systems" : [ {
        "prevalence" : "string",
        "name" : "string",
        "version" : "string",
        "cpe_id" : "string",
        "class" : "string"
      } ],
      "likelihood" : "string",
      "source_uri" : "string",
      "notes" : [ {
        "type" : "string",
        "note" : "string"
      } ],
      "technologies" : [ {
        "prevalence" : "string",
        "name" : "string"
      } ],
      "language" : "string",
      "external_references" : [ {
        "source_name" : "string",
        "description" : "string",
        "url" : "string",
        "hashes" : [ "string" ],
        "external_id" : "string"
      } ],
      "modes_of_introduction" : [ {
        "phase" : "string",
        "note" : "string"
      } ],
      "description" : "string",
      "external_ids" : [ "string" ]
    } ],
    "verdicts" : [ {
      "type" : "string",
      "disposition" : 10,
      "observable" : {
        "value" : "string",
        "type" : "string"
      },
      "judgement_id" : "string",
      "disposition_name" : "string",
      "valid_time" : {
        "start_time" : "2016-01-01T01:01:01.000Z",
        "end_time" : "2016-01-01T01:01:01.000Z"
      }
    } ],
    "source_uri" : "string",
    "incident_refs" : [ "string" ],
    "attack_patterns" : [ {
      "tlp" : "string",
      "x_mitre_platforms" : [ "string" ],
      "x_mitre_data_sources" : [ "string" ],
      "kill_chain_phases" : [ {
        "kill_chain_name" : "string",
        "phase_name" : "string"
      } ],
      "id" : "string",
      "timestamp" : "2016-01-01T01:01:01.000Z",
      "revision" : 10,
      "x_mitre_contributors" : [ "string" ],
      "abstraction_level" : "string",
      "name" : "string",
      "schema_version" : "string",
      "source" : "string",
      "type" : "string",
      "source_uri" : "string",
      "language" : "string",
      "external_references" : [ {
        "source_name" : "string",
        "description" : "string",
        "url" : "string",
        "hashes" : [ "string" ],
        "external_id" : "string"
      } ],
      "description" : "string",
      "external_ids" : [ "string" ]
    } ],
    "data_tables" : [ {
      "tlp" : "string",
      "row_count" : 10,
      "columns" : [ {
        "name" : "string",
        "type" : "string",
        "description" : "string",
        "required" : true,
        "short_description" : "string"
      } ],
      "id" : "string",
      "timestamp" : "2016-01-01T01:01:01.000Z",
      "valid_time" : {
        "start_time" : "2016-01-01T01:01:01.000Z",
        "end_time" : "2016-01-01T01:01:01.000Z"
      },
      "revision" : 10,
      "short_description" : "string",
      "schema_version" : "string",
      "title" : "string",
      "source" : "string",
      "type" : "string",
      "source_uri" : "string",
      "rows" : [ [ {
        "anything" : "anything"
      } ] ],
      "language" : "string",
      "external_references" : [ {
        "source_name" : "string",
        "description" : "string",
        "url" : "string",
        "hashes" : [ "string" ],
        "external_id" : "string"
      } ],
      "description" : "string",
      "external_ids" : [ "string" ]
    } ],
    "language" : "string",
    "external_references" : [ {
      "source_name" : "string",
      "description" : "string",
      "url" : "string",
      "hashes" : [ "string" ],
      "external_id" : "string"
    } ],
    "malwares" : [ {
      "tlp" : "string",
      "kill_chain_phases" : [ {
        "kill_chain_name" : "string",
        "phase_name" : "string"
      } ],
      "x_mitre_aliases" : [ "string" ],
      "id" : "string",
      "timestamp" : "2016-01-01T01:01:01.000Z",
      "revision" : 10,
      "abstraction_level" : "string",
      "name" : "string",
      "labels" : [ "string" ],
      "schema_version" : "string",
      "source" : "string",
      "type" : "string",
      "source_uri" : "string",
      "language" : "string",
      "external_references" : [ {
        "source_name" : "string",
        "description" : "string",
        "url" : "string",
        "hashes" : [ "string" ],
        "external_id" : "string"
      } ],
      "description" : "string",
      "external_ids" : [ "string" ]
    } ],
    "description" : "string",
    "external_ids" : [ "string" ]
  },
  "schema_version" : "string",
  "title" : "string",
  "source" : "string",
  "type" : "string",
  "source_uri" : "string",
  "language" : "string",
  "external_references" : [ {
    "source_name" : "string",
    "description" : "string",
    "url" : "string",
    "hashes" : [ "string" ],
    "external_id" : "string"
  } ],
  "description" : "string",
  "external_ids" : [ "string" ]
}