What are two functions of Taxii in threat intelligence sharing choose two?
|
As mentioned in a previous article, efficient automation of cyber security requires a standard to describe and a mean to exchange information. The Cyber Threat Intelligence Technical Committee (CTI TC) of the Organization for the Advancement of Structured Information Standards (OASIS) proposes the STIX and TAXII standards to meet both needs. Before joining OASIS in 2015, these two standards (as well as CybOX) were developed at MITRE under the supervision, once again, of the US Department of Homeland Security (DHS), specifically the Office of Cybersecurity and Communications, the National Cybersecurity and Communications Integration Center, and the US-CERT. Show STIX is the acronym for Structured Threat Information eXpression. The name is explicit: it is a standard for expressing information about computer threats in a structured and unambiguous way. Based on JSON, it has the potential to allow automatic information exchange between the many tools used to ensure the security of an organization. , standardized in July 2017, defines two categories of STIX objects: STIX Domain Objects (SDO) and STIX Relationship Objects (SRO). For simplicity, SDOs can be seen as the nodes of a graph interconnected by SROs. For example, the following collection, taken from the standard, represents an [0.[Or as a graph generated by OASIS’ STIX Visualizer: The STIX 2.0 standard defines twelve :
Some SDO properties take the form of unstructured textual data. Others can take their value in one of the defined by the standard to facilitate interoperability and automated use of intelligence. For example, the skill level of a [7 can take these values: curl -H "Accept: application/vnd.oasis.taxii+json" https://cti-taxii.mitre.org/taxii/{9, curl -H "Accept: application/vnd.oasis.taxii+json" https://cti-taxii.mitre.org/stix/collections/{0, curl -H "Accept: application/vnd.oasis.taxii+json" https://cti-taxii.mitre.org/stix/collections/{1, curl -H "Accept: application/vnd.oasis.taxii+json" https://cti-taxii.mitre.org/stix/collections/{2, curl -H "Accept: application/vnd.oasis.taxii+json" https://cti-taxii.mitre.org/stix/collections/{3, curl -H "Accept: application/vnd.oasis.taxii+json" https://cti-taxii.mitre.org/stix/collections/{4, or curl -H "Accept: application/vnd.oasis.taxii+json" https://cti-taxii.mitre.org/stix/collections/{5. The meaning of these values is defined in the . Another example: a curl -H "Accept: application/vnd.oasis.taxii+json" https://cti-taxii.mitre.org/stix/collections/{7 by taking at least one of: curl -H "Accept: application/vnd.oasis.taxii+json" https://cti-taxii.mitre.org/stix/collections/{8, curl -H "Accept: application/vnd.oasis.taxii+json" https://cti-taxii.mitre.org/stix/collections/{9, curl -H "Accept: application/vnd.oasis.stix+json; version=2.0" -H "Range: items=0-0" https://cti-taxii.mitre.org/stix/collections/95ecc380-afe9-11e4-9b6c-751b66dd541e/objects/?match[type]=malware{0, curl -H "Accept: application/vnd.oasis.stix+json; version=2.0" -H "Range: items=0-0" https://cti-taxii.mitre.org/stix/collections/95ecc380-afe9-11e4-9b6c-751b66dd541e/objects/?match[type]=malware{1, curl -H "Accept: application/vnd.oasis.stix+json; version=2.0" -H "Range: items=0-0" https://cti-taxii.mitre.org/stix/collections/95ecc380-afe9-11e4-9b6c-751b66dd541e/objects/?match[type]=malware{2, curl -H "Accept: application/vnd.oasis.stix+json; version=2.0" -H "Range: items=0-0" https://cti-taxii.mitre.org/stix/collections/95ecc380-afe9-11e4-9b6c-751b66dd541e/objects/?match[type]=malware{3, curl -H "Accept: application/vnd.oasis.stix+json; version=2.0" -H "Range: items=0-0" https://cti-taxii.mitre.org/stix/collections/95ecc380-afe9-11e4-9b6c-751b66dd541e/objects/?match[type]=malware{4, curl -H "Accept: application/vnd.oasis.stix+json; version=2.0" -H "Range: items=0-0" https://cti-taxii.mitre.org/stix/collections/95ecc380-afe9-11e4-9b6c-751b66dd541e/objects/?match[type]=malware{5, curl -H "Accept: application/vnd.oasis.stix+json; version=2.0" -H "Range: items=0-0" https://cti-taxii.mitre.org/stix/collections/95ecc380-afe9-11e4-9b6c-751b66dd541e/objects/?match[type]=malware{6, curl -H "Accept: application/vnd.oasis.stix+json; version=2.0" -H "Range: items=0-0" https://cti-taxii.mitre.org/stix/collections/95ecc380-afe9-11e4-9b6c-751b66dd541e/objects/?match[type]=malware{7, curl -H "Accept: application/vnd.oasis.stix+json; version=2.0" -H "Range: items=0-0" https://cti-taxii.mitre.org/stix/collections/95ecc380-afe9-11e4-9b6c-751b66dd541e/objects/?match[type]=malware{8, curl -H "Accept: application/vnd.oasis.stix+json; version=2.0" -H "Range: items=0-0" https://cti-taxii.mitre.org/stix/collections/95ecc380-afe9-11e4-9b6c-751b66dd541e/objects/?match[type]=malware{9, indicator0, indicator1, indicator2, indicator3, indicator4. Of course, one can choose another value but there are no guarantees that it is going to be understood by third party tools.SROs: STIX Relationship ObjectsThe standard also defines two : [0 and curl -H "Accept: application/vnd.oasis.taxii+json" https://cti-taxii.mitre.org/taxii/{0 types for example. Let us pause for a second and note that STIX defines a STIX Relationship Objects (SRO) class that contains object named relationship having one property named relationship_type.The other SRO, <stix:Indicators>0) as well as the victims ([4) having seen the SDO. In the form of a graph, this SRO is generally represented by a node like an SDO for instance. However the value of a indicator6 does not rest in the indicator6 itself but in the relationship between the sighted SDO, the observed data and the victims. Its classification as an SRO is therefore well justified.The following collection, also from the standard, completes the previous example with indicator6 and <stix:Indicators>0.[Consider the equivalent of our first example in the STIX 1.2 documentation: <stix:Indicators>The first obvious difference is the use of XML in this version while version 2 uses JSON. We note then that the relationship between the hash and the malware is not an object in itself in version 1, but included in the indicator. This indicator is also not a top-level object since it is encapsulated in a All this contributes to the OASIS CTI TC simplification and rationalization effort, sometimes to the detriment of the accuracy and expressiveness of the language. However this expressiveness was not really exploited and only a subset of STIX 1.x was actually used with a common understanding. In addition to the lack of SRO equivalents in STIX 1, there are similarities in STIX 2.0 SDOs and STIX 1 components. Report, campaign, course of action, indicator, and threat actor are present in both standards. Exploit target in STIX 1.x is close to curl -H "Accept: application/vnd.oasis.taxii+json" https://cti-taxii.mitre.org/taxii/{7 in STIX 2.0, and TTP (Tactics, Techniques, and Procedures) includes, among others, [1 and malware. STIX 2.0 also defines [4, <stix:Indicators>0, and curl -H "Accept: application/vnd.oasis.taxii+json" https://cti-taxii.mitre.org/taxii/{6 that have equivalents in STIX 1.x but not as first-level components, as well as [6 that has no direct equivalent. On the other hand, the incident component in STIX 1.x has no real equivalent in STIX 2.0.Both standards remain sufficiently similar and it is usually possible to convert documents from one to the other:
However the CTI TC warns that the conversion is not perfect and that difficulties may arise, especially for the conversion 1.x to 2.0. TAXIITAXII, or Trusted Automated Exchange of Intelligence Information, is an intelligence exchange protocol over HTTPS. The standard defines a set of requirements for clients/servers and a REST API to interact with two types of services:
In reality, the channel service is not yet standardized and the term is only reserved for the moment. The search for information on a TAXII server can proceed as follows:
It is possible to restrict this last request to objects published after a certain date and filter them by identifier, type, or version. Indeed, STIX has a rudimentary version management system via the As an example, let us interact with one of : curl -H "Accept: application/vnd.oasis.taxii+json" https://cti-taxii.mitre.org/taxii/{ In this case, there is only one api root, we can retrieve the collections it serves: curl -H "Accept: application/vnd.oasis.taxii+json" https://cti-taxii.mitre.org/stix/collections/{ We can now request objects from any of those collections. As an example, the following command retrieves one curl -H "Accept: application/vnd.oasis.stix+json; version=2.0" -H "Range: items=0-0" https://cti-taxii.mitre.org/stix/collections/95ecc380-afe9-11e4-9b6c-751b66dd541e/objects/?match[type]=malware{ Note that if STIX and TAXII are the result of a common effort, and although a TAXII server must be able to handle STIX, these two standards remain independent. It is possible to exchange STIX information without TAXII, and a TAXII server can also handle other intelligence formats. ConclusionTo be more effective, information sharing on cyber threats must be done within a large community according to a clear standard to facilitate automation. STIX/TAXII focus on the essentials and build on existing technologies to accelerate their adoption. Aware of the limitations of its standards, OASIS CTI TC is already working on version 2.1 which introduces three new SDOs: [00. Meanwhile, it remains possible to introduce custom objects and properties.
Which two capabilities does taxii support choose two?TAXII exists to provide specific capabilities for sharing structured cyber threat information. TAXII Capabilities are the highest level at which TAXII actions can be described. There are three Capabilities that the current version of TAXII supports: push messaging, pull messaging, and discovery.
What is Taxii used for?What is Trusted Automated eXchange of Indicator (TAXII)? Trusted Automated eXchange of Indicator is a protocol used to exchange cyber threat intelligence (CTI) over HTTPS. TAXII enables organizations to share CTI by defining an API that aligns with common sharing models.
What is a taxii server?A TAXII server is a client that exchanges standardized and anonymized cyber threat intelligence among users.
How widely Stix and Taxii are used?STIX and TAXII are widely used to prevent and defend against cyberattacks by enabling threat intelligence to be analyzed and shared among trusted partners and communities.
|
