Confidence

[johnwunder]

The development of capabilities in STIX to capture a producer's confidence in the data that they create.

Work area:
N/A

Slack: #confidence

Scope

Whatever is necessary to capture producer's confidence in the data that they create. It does not include expressing confidence in another producer's data or confidence in producers.

It's also scoped to only confidence at the STIX Object level - not on individual fields.

Examples

• A threat intelligence creator publishes a campaign and says they have medium confidence in the accuracy of the information.
• A threat intelligence creator publishes a relationship between a malware and a campaign, saying they have high confidence that the campaign uses that malware.

Open Questions

• How to represent the confidence value (consensus: 0-100 scale w/ normative mappings)
• Which objects have a confidence value (consensus: all of them)

[johnwunder]

Moved to drafts.