Skip to content
Permalink
master
Switch branches/tags

Name already in use

A tag already exists with the provided branch name. Many Git commands accept both tag and branch names, so creating this branch may cause unexpected behavior. Are you sure you want to create this branch?
Go to file
 
 
Cannot retrieve contributors at this time

Verdict Object

Verdict A Verdict is chosen from all of the Judgements on that Observable which have not yet expired. The highest priority Judgement becomes the active verdict. If there is more than one Judgement with that priority, then Clean disposition has priority over all others, then Malicious disposition, and so on down to Unknown.

The ID of a verdict is a a str of the form "observable.type:observable.value" for example, "ip:1.1.1.1"

Property Type Description Required?
disposition DispositionNumberInteger
observable Observable Object
type VerdictTypeIdentifierString
valid_time ValidTime Object
disposition_name DispositionNameString The disposition_name field is optional, but is intended to be shown to a user. Applications must therefore remember the mapping of numbers to human words, as in: {1 "Clean", 2 "Malicious", 3 "Suspicious", 4 "Common", 5 "Unknown"}
judgement_id String

Property disposition ∷ DispositionNumberInteger

  • This entry is required

    • DispositionNumber Numeric verdict identifiers
    • Allowed Values:
      • 1
      • 2
      • 3
      • 4
      • 5

Property disposition_name ∷ DispositionNameString

The disposition_name field is optional, but is intended to be shown to a user. Applications must therefore remember the mapping of numbers to human words, as in: {1 "Clean", 2 "Malicious", 3 "Suspicious", 4 "Common", 5 "Unknown"}

  • This entry is optional

    • DispositionName String verdict identifiers
    • Allowed Values:
      • Clean
      • Common
      • Malicious
      • Suspicious
      • Unknown

Property judgement_id ∷ String

  • This entry is optional

    • A URI leading to a judgement

Property observable ∷ Observable Object

  • This entry is required

Property type ∷ VerdictTypeIdentifierString

  • This entry is required

    • Must equal: "verdict"

Property valid_time ∷ ValidTime Object

  • This entry is required

Observable Object

Observable A simple, atomic value which has a consistent identity, and is stable enough to be attributed an intent or nature. This is the classic 'indicator' which might appear in a data feed of bad IPs, or bad Domains. These do not exist as objects within the CTIA storage model, so you never create an observable.

Property Type Description Required?
type ObservableTypeIdentifierString
value String

Property type ∷ ObservableTypeIdentifierString

  • This entry is required

    • ObservableTypeIdentifier Observable type names
    • Allowed Values:
      • amp_computer_guid
      • certificate_common_name
      • certificate_issuer
      • certificate_serial
      • cisco_mid
      • cisco_uc_id
      • device
      • domain
      • email
      • email_messageid
      • email_subject
      • file_name
      • file_path
      • hostname
      • imei
      • imsi
      • ip
      • ipv6
      • mac_address
      • md5
      • ms_machine_id
      • mutex
      • ngfw_id
      • ngfw_name
      • odns_identity
      • odns_identity_label
      • orbital_node_id
      • pki_serial
      • process_name
      • registry_key
      • registry_name
      • registry_path
      • s1_agent_id
      • serial_number
      • sha1
      • sha256
      • swc_device_id
      • trend_micro_id
      • url
      • user
      • user_agent

Property value ∷ String

  • This entry is required

ValidTime Object

ValidTime Period of time when a cyber observation is valid.

Property Type Description Required?
end_time Inst (Date) If end_time is not present, then the valid time position of the object does not have an upper bound.
start_time Inst (Date) If not present, the valid time position of the indicator does not have an upper bound

Property end_time ∷ Inst (Date)

If end_time is not present, then the valid time position of the object does not have an upper bound.

  • This entry is optional

    • ISO8601 Timestamp Schema definition for all date or timestamp values. Serialized as a string, the field should follow the rules of the ISO8601 standard.

Property start_time ∷ Inst (Date)

If not present, the valid time position of the indicator does not have an upper bound

  • This entry is optional

    • ISO8601 Timestamp Schema definition for all date or timestamp values. Serialized as a string, the field should follow the rules of the ISO8601 standard.