TISC to STIX Mapping for Export and Sharing - Support and Troubleshooting

TISC to STIX Mapping for Export and Sharing .ns-kb-css-body-editor-container { p { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } span { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } h2 { font-size: 24pt; font-family: Lato; color: var(--now-color--text-primary, black); } h3 { font-size: 18pt; font-family: Lato; color: var(--now-color--text-primary, black); } h4 { font-size: 14pt; font-family: Lato; color: var(--now-color--text-primary, black); } a { font-size: 12pt; font-family: Lato; color: var(--now-color--link-primary, #00718F); } a:hover { font-size: 12pt; color: var(--now-color--link-primary, #024F69); } a:target { font-size: 12pt; color: var(--now-color--link-primary, #032D42); } a:visited { font-size: 12pt; color: var(--now-color--link-primary, #00718f); } ul { font-size: 12pt; font-family: Lato; } li { font-size: 12pt; font-family: Lato; } img { display: ; max-width: ; width: ; height: ; } } .ns-kb-css-body-editor-container { max-width: 1080px; margin: 0 auto; padding: 4px 6px 48px; line-height: 1.6; } .ns-kb-css-body-editor-container p { margin: 0 0 12px; } .ns-kb-css-body-editor-container ul { margin: 4px 0 14px; } .ns-kb-css-body-editor-container li { margin-bottom: 4px; } .sec-head { margin-top: 44px; margin-bottom: 14px; padding-bottom: 8px; border-bottom: 2px solid rgba(0, 113, 143, 0.25); scroll-margin-top: 16px; } .toc { background-color: #f7fafb; border: 1px solid #dde8ea; border-radius: 8px; padding: 16px 22px; margin: 22px 0 34px; } .toc .toc-title { margin-bottom: 8px; } .toc ul { margin: 0; padding-left: 20px; } .toc li { margin-bottom: 5px; font-size: 12pt; } .toc a { color: #00718F; text-decoration: none; } .toc a:hover { text-decoration: underline; color: #024F69; } .ns-kb-css-body-editor-container table { margin: 10px 0 20px; box-shadow: 0 1px 4px rgba(0, 0, 0, 0.08); border-radius: 6px; overflow: hidden; } .ns-kb-css-body-editor-container table thead tr:first-child { background-color: #eaf4f6; } .ns-kb-css-body-editor-container table tbody tr:not(:first-child):nth-child(even) { background-color: #fafcfd; } .ns-kb-css-body-editor-container table tbody tr:hover { background-color: #f0f8fa; } .ns-kb-css-body-editor-container table td, .ns-kb-css-body-editor-container table th { border-color: #d6e4e7 !important; } .ext-key-cell { font-family: 'Courier New', Courier, monospace; font-size: 10pt; color: #00718F; } .ns-kb-css-body-editor-container pre { border-radius: 6px; box-shadow: 0 1px 4px rgba(0, 0, 0, 0.08); } Table of Contents:

Purpose Overview TISC Observables (STIX Cyber Observable Objects) TISC Indicators TISC Objects (STIX Domain Objects) TISC Relationships (STIX Relationship Objects) TLP / Marking Definitions Extension Objects (Custom / Unmapped Fields) MITRE ATT&CK Enrichment Purpose:

This document helps customers consume STIX 2.1 content that has been externally shared or exported from TISC intelligence records, and can be referenced when parsing the TISC-specific STIX payload, including TISC-specific extension fields.

Overview:

This article provides a detailed overview of how TISC Library Records are converted into STIX 2.1 objects. This mapping is used by two distinct capabilities:

External Sharing:

When threat intelligence records are shared externally in STIX format through Outbound Intelligence / TAXII server, the STIX payload is generated as below: A STIX Bundle containing the shared records is generated. TISC Observables are converted to STIX Cyber Observable Objects (e.g. file , domain-name , ipv4-addr ). TISC Indicators are converted to the STIX indicator object. TISC Objects (Attack Pattern, Campaign, Malware, Threat Actor, etc.) are converted to the corresponding STIX Domain Object. Optionally, Users can include related records to entities which would get translated to STIX Relationship objects. When a record has a TLP value set, the corresponding STIX marking definition is included and associated with that record. Export:

Exporting intelligence records in STIX format from threat intel library is only supported for Observables and Indicators When intelligence records are exported , STIX file is generated in the same format as mentioned as part of external sharing section When a user exports an Observable or Indicator record in STIX format, only the selected records are included; related records are not included. Fields noted as available only through External Sharing are not available through Export. TISC Observables (STIX Cyber Observable Objects):

TISC observables are converted to STIX Cyber Observable Objects (SCOs) based on their specific observable type. Below is the mapping of TISC observable type to STIX Cyber Observable objects. TISC Observable Type STIX Object Type Extension Definition ID (for extended/TISC specific attributes) Notes Artifact artifact extension-definition--075ba226-ff95-4210-8238-ffffffffff1f The extension is used to add TISC-specific properties to the standard STIX SCO. Autonomous System Number autonomous-system extension-definition--075ba226-ff95-4210-8238-ffffffffff20 The extension is used to add TISC-specific properties to the standard STIX SCO. Directory directory extension-definition--c75ba226-ff95-4210-8238-ffffffffff1f The extension is used to add TISC-specific properties to the standard STIX SCO. Domain Name domain-name extension-definition--435ba226-ff95-4210-8238-ffffffffff20 The extension is used to add TISC-specific properties to the standard STIX SCO. Email Address email-addr extension-definition--cf5ba226-ff95-4210-8238-ffffffffff1f The extension is used to add TISC-specific properties to the standard STIX SCO. Email Message email-message extension-definition--c35ba226-ff95-4210-8238-ffffffffff20 The extension is used to add TISC-specific properties to the standard STIX SCO. Email Subject email-message extension-definition--875ba226-ff95-4210-8238-ffffffffff20 The extension is used to add TISC-specific properties to the standard STIX SCO. File file extension-definition--4f5ba226-ff95-4210-8238-ffffffffff1e The extension is used to add TISC-specific properties to the standard STIX SCO. IP Address (V4) ipv4-addr extension-definition--0b5ba226-ff95-4210-8238-ffffffffff1f The extension is used to add TISC-specific properties to the standard STIX SCO. IP Address (V6) ipv6-addr extension-definition--4b5ba226-ff95-4210-8238-ffffffffff1f The extension is used to add TISC-specific properties to the standard STIX SCO. IPv4 CIDR ipv4-addr extension-definition--035ba226-ff95-4210-8238-ffffffffff20 The extension is used to add TISC-specific properties to the standard STIX SCO. IPv6 CIDR ipv6-addr extension-definition--0f5ba226-ff95-4210-8238-ffffffffff1f The extension is used to add TISC-specific properties to the standard STIX SCO. MAC Address mac-addr extension-definition--035ba226-ff95-4210-8238-ffffffffff1f The extension is used to add TISC-specific properties to the standard STIX SCO. MD5 Hash x-tisc-md5-hash (custom SCO) extension-definition--cf5ba226-ff95-4210-8238-ffffffffff1e The extension is used as a completely new STIX SCO. Mutex Name mutex extension-definition--c35ba226-ff95-4210-8238-ffffffffff1f The extension is used to add TISC-specific properties to the standard STIX SCO. Network network-traffic extension-definition--875ba226-ff95-4210-8238-ffffffffff1f The extension is used to add TISC-specific properties to the standard STIX SCO. other x-tisc-other-observable (custom SCO) extension-definition--475ba226-ff95-4210-8238-ffffffffff20 The extension is used as a completely new STIX SCO. Process process extension-definition--8f5ba226-ff95-4210-8238-ffffffffff1f The extension is used to add TISC-specific properties to the standard STIX SCO. SHA1 Hash x-tisc-sha1-hash (custom SCO) extension-definition--835ba226-ff95-4210-8238-ffffffffff20 The extension is used as a completely new STIX SCO. SHA256 Hash x-tisc-sha256-hash (custom SCO) extension-definition--835ba226-ff95-4210-8238-ffffffffff1f The extension is used as a completely new STIX SCO. SHA512 Hash x-tisc-sha512-hash (custom SCO) extension-definition--4f5ba226-ff95-4210-8238-ffffffffff1f The extension is used as a completely new STIX SCO. Software software extension-definition--475ba226-ff95-4210-8238-ffffffffff1f The extension is used to add TISC-specific properties to the standard STIX SCO. URL url extension-definition--8f5ba226-ff95-4210-8238-ffffffffff1e The extension is used to add TISC-specific properties to the standard STIX SCO. User Account user-account extension-definition--435ba226-ff95-4210-8238-ffffffffff1f The extension is used to add TISC-specific properties to the standard STIX SCO. Windows Registry Key windows-registry-key extension-definition--8b5ba226-ff95-4210-8238-ffffffffff1f The extension is used to add TISC-specific properties to the standard STIX SCO. X.509 Certificate x509-certificate extension-definition--cb5ba226-ff95-4210-8238-ffffffffff1f The extension is used to add TISC-specific properties to the standard STIX SCO. These extension-definition IDs are fixed per observable type and identical across every TISC instance. They are not generated per record, so the same ID will always be used for a given observable type. Below are the common fields set on every STIX Cyber Observable Object, regardless of type. STIX SCO Field TISC Observable Field / Rule id Derived from the observable's unique TISC ID type Fixed per observable table (see type table above) spec_version "2.1" defanged Is Defanged object_marking_refs TLP (resolved to the matching marking-definition id) labels MITRE ATT&CK techniques/tactics associated with the record (e.g. "TA0001:T1566,T1195") TISC Specific Extension fields for STIX Cyber Observable Objects: Below are the common extension fields set on every STIX Cyber Observable Object, regardless of type STIX Extension Field TISC Observable Field extensions.x_additional_context Additional Context extensions.x_author Author extensions.x_description Description extensions.x_notes Notes extensions.x_value Value (used when the observable type has no other field to hold its value, e.g. Artifact, Network, Process, File, User Account, Email Message, X.509 Certificate) extensions.x_first_seen First Seen extensions.x_last_seen Last Seen extensions.x_first_observed First Observed extensions.x_last_observed Last Observed extensions.x_usage_categories Usage Categories extensions.x_attack_phases Attack Phases extensions.x_is_false_positive Is False Positive extensions.x_source_reported_score Source Reported Score extensions.x_threat_score Threat Score extensions.x_threat_level Threat Level extensions.x_threat_severity Threat Severity extensions.x_reputation Reputation extensions.x_taxonomies Taxonomies extensions.x_tags TISC Tags extensions.x_expiration_time Expiration Time extensions.x_confidence Confidence Artifact: TISC observables of type "Artifact" are converted as artifact SCO. If URL is blank, Value is base64-encoded into payload_bin . Custom fields TISC adds for an Artifact are grouped under extension-definition--075ba226-ff95-4210-8238-ffffffffff1f . STIX artifact Object Field TISC Artifact Observable Field url URL payload_bin Value (base64 encoded, when URL is blank) mime_type MIME Type decryption_key Decryption Key encryption_algorithm Encryption Algorithm hashes.MD5 MD5 Hash hashes.SHA-1 SHA1 Hash hashes.SHA-256 SHA256 Hash hashes.SHA-512 SHA512 Hash Autonomous System Number: TISC observables of type "Autonomous System Number" are converted as autonomous-system SCO. Custom fields TISC adds for an Autonomous System Number are grouped under extension-definition--075ba226-ff95-4210-8238-ffffffffff20 . STIX autonomous-system Object Field TISC AS Number Observable Field number Value name Name rir RIR Directory: TISC observables of type "Directory" are converted as directory SCO. Custom fields TISC adds for a Directory are grouped under extension-definition--c75ba226-ff95-4210-8238-ffffffffff1f . STIX directory Object Field TISC Directory Observable Field path Value path_enc Encoded Path ctime Directory Creation Time mtime Directory Last Modified Time atime Directory Last Accessed Time Domain Name: TISC observables of type "Directory" are converted as domain-name SCO. Custom fields TISC adds for a Domain Name are grouped under extension-definition--435ba226-ff95-4210-8238-ffffffffff20 . STIX domain-name Object Field TISC Domain Name Observable Field value Value extensions.x_is_fqdn Is FQDN When using external sharing, Domain Name observables additionally resolve resolves_to_refs from related relationship rows (relationship type "resolves-to") in case related records are included as part of that external sharing. Email Address: TISC observables of type "Email Address" are converted as email-addr SCO. Custom fields TISC adds for an Email Address are grouped under extension-definition--cf5ba226-ff95-4210-8238-ffffffffff1f . STIX email-addr Object Field TISC Email Address Observable Field value Value When using external sharing, Email Address observables additionally resolve belongs_to_ref from related relationship rows (relationship type "belongs-to"). Email Message / Email Subject: TISC observables of type "Email Message" / "Email Subject" are converted as email-message SCO. Custom fields TISC adds are grouped by type: Email Message under extension-definition--c35ba226-ff95-4210-8238-ffffffffff20 ; Email Subject under extension-definition--875ba226-ff95-4210-8238-ffffffffff20 . STIX email-message Object Field TISC Email Message Observable Field message_id Value (unless an auto-generated "Eml-Msg-*" placeholder) is_multipart Fixed to false date Sent Date subject Email Subject body Email Body to_refs Email Recipients To (resolved from related email-addr SCOs, only if related records are included when using external sharing) cc_refs Email Recipients Cc (resolved from related email-addr SCOs, only if related records are included when using external sharing) bcc_refs Email Recipients Bcc (resolved from related email-addr SCOs, only if related records are included when using external sharing) sender_ref Email Sender (resolved from related email-addr SCO, only if related records are included when using external sharing) File: TISC observables of type "File" are converted as file SCO. Custom fields TISC adds for a File are grouped under extension-definition--4f5ba226-ff95-4210-8238-ffffffffff1e . STIX file Object Field TISC File Observable Field name File Name name_enc Encoded File Name ctime File Created Time mtime File Last Modified Time atime File Last Accessed Time magic_number_hex Magic Number mime_type MIME Type hashes.MD5 MD5 Hash hashes.SHA-1 SHA1 Hash hashes.SHA-256 SHA256 Hash hashes.SHA-512 SHA512 Hash extensions.x_additional_information Additional Information IP Address (V4): TISC observables of type "IP Address (V4)" are converted as ipv4-addr SCO. Custom fields TISC adds for an IP Address (V4) are grouped under extension-definition--0b5ba226-ff95-4210-8238-ffffffffff1f . STIX ipv4-addr Object Field TISC IP Address (V4) Observable Field value Value When using external sharing, IP Address (V4) observables additionally resolve resolves_to_refs and belongs_to_refs from related relationship rows (relationship types "resolves-to", "belongs-to"). IP Address (V6): TISC observables of type "IP Address (V6)" are converted as ipv6-addr SCO. Custom fields TISC adds for an IP Address (V6) are grouped under extension-definition--4b5ba226-ff95-4210-8238-ffffffffff1f . STIX ipv6-addr Object Field TISC IP Address (V6) Observable Field value Value When using external sharing, IP Address (V6) observables additionally resolve resolves_to_refs and belongs_to_refs from related relationship rows (relationship types "resolves-to", "belongs-to"). IPv4 CIDR: TISC observables of type "IPv4 CIDR" are converted as ipv4-addr SCO. Custom fields TISC adds for an IPv4 CIDR are grouped under extension-definition--035ba226-ff95-4210-8238-ffffffffff20 . STIX ipv4-addr Object Field TISC IPv4 CIDR Observable Field value Value When using external sharing, IPv4 CIDR observables additionally resolve resolves_to_refs and belongs_to_refs from related relationship rows (relationship types "resolves-to", "belongs-to"). IPv6 CIDR: TISC observables of type "IPv6 CIDR" are converted as ipv6-addr SCO. Custom fields TISC adds for an IPv6 CIDR are grouped under extension-definition--0f5ba226-ff95-4210-8238-ffffffffff1f . STIX ipv6-addr Object Field TISC IPv6 CIDR Observable Field value Value When using external sharing, IPv6 CIDR observables additionally resolve resolves_to_refs and belongs_to_refs from related relationship rows (relationship types "resolves-to", "belongs-to"). MAC Address: TISC observables of type "MAC Address" are converted as mac-addr SCO. Custom fields TISC adds for a MAC Address are grouped under extension-definition--035ba226-ff95-4210-8238-ffffffffff1f . STIX mac-addr Object Field TISC MAC Address Observable Field value Value MD5 / SHA1 / SHA256 / SHA512 Hash and Other Observable: TISC hash observables and "Other" observable table are converted as custom STIX object types ( x-tisc-md5-hash , x-tisc-sha1-hash , x-tisc-sha256-hash , x-tisc-sha512-hash , x-tisc-other-observable ), since STIX does not define native object types for these value types. STIX Custom SCO Field TISC Observable Field value Value x_ All remaining columns (Additional Context, Tags, Taxonomies, etc.) x_type_from_source Type from Source ("Other" observable only) Mutex Name: TISC observables of type "Mutex Name" are converted as mutex SCO. Custom fields TISC adds for a Mutex Name are grouped under extension-definition--c35ba226-ff95-4210-8238-ffffffffff1f . STIX mutex Object Field TISC Mutex Name Observable Field name Value Network: TISC observables of type "Network" are converted as network-traffic SCO, with http-request-ext , icmp-ext , socket-ext , and tcp-ext cyber-observable extensions populated as applicable. Custom fields TISC adds for a Network are grouped under extension-definition--875ba226-ff95-4210-8238-ffffffffff1f . STIX network-traffic Object Field TISC Network Observable Field start Start Time end End Time is_active Is Network Active src_port Source Port dst_port Destination Port protocols Network Protocols (CSV, defaults to ["NA"] if blank) src_byte_count Source Bytes Count dst_byte_count Destination Bytes Count src_packets Source Packets Count dst_packets Destination Packets Count extensions.http-request-ext.request_method HTTP Request Method extensions.http-request-ext.request_value HTTP Request Value extensions.http-request-ext.request_version HTTP Request Version extensions.http-request-ext.request_header HTTP Request Header (JSON) extensions.http-request-ext.message_body_length HTTP Message Body Length extensions.icmp-ext.icmp_type_hex ICMP Type Byte extensions.icmp-ext.icmp_code_hex ICMP Code Byte extensions.socket-ext.is_blocking Is Socket Blocking extensions.socket-ext.is_listening Is Socket Listening extensions.socket-ext.socket_descriptor Socket Descriptor extensions.socket-ext.socket_handle Socket Handle extensions.socket-ext.options Socket Options (JSON) extensions.socket-ext.address_family Socket Address Family extensions.socket-ext.socket_type Socket Type extensions.tcp-ext.src_flags_hex TCP Source Flags extensions.tcp-ext.dst_flags_hex TCP Destination Flags src_ref Resolved from related m2m observable rows (only if related records are included when using external sharing) dst_ref Resolved from related m2m observable rows (only if related records are included when using external sharing) src_payload_ref Resolved from related m2m observable rows (only if related records are included when using external sharing) dst_payload_ref Resolved from related m2m observable rows (only if related records are included when using external sharing) encapsulates_refs Resolved from related m2m observable rows (only if related records are included when using external sharing) Process: TISC observables of type "Process" are converted as process SCO, with windows-process-ext and windows-service-ext extensions populated as applicable. Custom fields TISC adds for a Process are grouped under extension-definition--8f5ba226-ff95-4210-8238-ffffffffff1f . STIX process Object Field TISC Process Observable Field pid Process ID created_time Process Created Time cwd Current Working Directory command_line Command Line is_hidden Is Hidden environment_variables Environment Variables extensions.windows-process-ext.integrity_level Windows Integrity Level extensions.windows-service-ext.service_name Service Name extensions.windows-service-ext.display_name Service Display Name extensions.windows-service-ext.group_name Service Group Name extensions.windows-service-ext.descriptions Service Descriptions Software: TISC observables of type "Software" are converted as software SCO. Custom fields TISC adds for a Software are grouped under extension-definition--475ba226-ff95-4210-8238-ffffffffff1f . STIX software Object Field TISC Software Observable Field name Value cpe CPE swid SWID vendor Vendor version Version languages Supported Languages URL: TISC observables of type "URL" are converted as url SCO. Custom fields TISC adds for a URL are grouped under extension-definition--8f5ba226-ff95-4210-8238-ffffffffff1e . STIX url Object Field TISC URL Observable Field value Value User Account: TISC observables of type "User Account" are converted as user-account SCO. Custom fields TISC adds for a User Account are grouped under extension-definition--435ba226-ff95-4210-8238-ffffffffff1f . STIX user-account Object Field TISC User Account Observable Field user_id User Id account_login Account Login account_type Account Type display_name Display Name is_service_account Is Service Account can_escalate_privs Can Escalate Privileges is_disabled Is Account Disabled is_privileged Is Privileged account_created Account Created Time account_expires Account Expiry Time credential_last_changed Credentials Last Changed Time account_first_login First Login Time account_last_login Last Login Time extensions.x_additional_information Additional Information Windows Registry Key: TISC observables of type "Windows Registry Key" are converted as windows-registry-key SCO. Custom fields TISC adds for a Windows Registry Key are grouped under extension-definition--8b5ba226-ff95-4210-8238-ffffffffff1f . STIX windows-registry-key Object Field TISC Windows Registry Key Observable Field key Value values Registry Value (parsed JSON) modified_time Key Modified Time number_of_subkeys Subkeys Count X.509 Certificate: TISC observables of type "X.509 Certificate" are converted as x509-certificate SCO. Custom fields TISC adds for an X.509 Certificate are grouped under extension-definition--cb5ba226-ff95-4210-8238-ffffffffff1f . STIX x509-certificate Object Field TISC X.509 Certificate Observable Field serial_number Value (unless an auto-generated placeholder) is_self_signed Is Self Signed issuer Issuer subject Subject version Version signature_algorithm Signature Algorithm validity_not_before Valid From validity_not_after Valid Until subject_public_key_algorithm Subject Public Key Algorithm subject_public_key_exponent Subject Public Key Exponent subject_public_key_modulus Subject Public Key Modulus extensions.x509_v3_extensions.authority_key_identifier Authority Key Identifier extensions.x509_v3_extensions.basic_constraints Basic Constraints extensions.x509_v3_extensions.certificate_policies Certificate Policies extensions.x509_v3_extensions.crl_distribution_points CRL Distribution Points extensions.x509_v3_extensions.extended_key_usage Extended Key Usage extensions.x509_v3_extensions.inhibit_any_policy Inhibit Any Policy extensions.x509_v3_extensions.issuer_alternative_name Issuer Alternative Name extensions.x509_v3_extensions.key_usage Key Usage extensions.x509_v3_extensions.name_constraints Name Constraints extensions.x509_v3_extensions.policy_constraints Policy Constraints extensions.x509_v3_extensions.policy_mappings Policy Mappings extensions.x509_v3_extensions.subject_alternative_name Subject Alternative Name extensions.x509_v3_extensions.subject_directory_attributes Subject Directory Attributes extensions.x509_v3_extensions.subject_key_identifier Subject Key Identifier extensions.x509_v3_extensions.private_key_usage_period_not_before Private Key Usage Valid From extensions.x509_v3_extensions.private_key_usage_period_not_after Private Key Usage Valid Until extensions.x_additional_information Additional Information TISC Indicators:

TISC Indicator records are converted as the STIX indicator Domain Object. Custom fields TISC adds for an Indicator are grouped under extension-definition--4f5ba226-ff95-4210-8238-ffffffffff1d . Below is the mapping of TISC indicator fields to STIX indicator object fields. STIX indicator Object Field TISC Indicator Field name Name description Description pattern Pattern pattern_type Pattern Type pattern_version Pattern Version valid_from Valid From valid_until Valid Until indicator_types Indicator Types kill_chain_phases Attack Phases external_references External References (from related Indicator Reference records: source_name, url, description) labels MITRE ATT&CK techniques/tactics associated with the indicator object_marking_refs TLP extensions.x_additional_context Additional Context extensions.x_description Description extensions.x_notes Notes extensions.x_threat_level Threat Level extensions.x_threat_severity Threat Severity extensions.x_taxonomies Taxonomies extensions.x_tags TISC Tags extensions.x_expiration_time Expiration Time extensions.x_author Author extensions.x_first_seen First Seen extensions.x_last_seen Last Seen extensions.x_first_observed First Observed extensions.x_last_observed Last Observed extensions.x_first_detected First Detected extensions.x_usage_categories Usage Categories extensions.x_platforms Platforms extensions.x_ioc_classification IOC Classification TISC Objects (STIX Domain Objects):

TISC "Object" records (Attack Pattern, Campaign, Malware, Threat Actor, etc.) are converted to the corresponding STIX Domain Object (SDO) based on their specific object type. Below is the mapping of TISC object type to STIX object type. TISC Object Type STIX Object Type Extension Definition ID (for extended/TISC specific attributes) Notes Attack Pattern attack-pattern extension-definition--4b5ba226-ff95-4210-8238-ffffffffff1d The extension is used to add TISC-specific properties to the standard STIX SDO. Campaign campaign extension-definition--8b5ba226-ff95-4210-8238-ffffffffff1d The extension is used to add TISC-specific properties to the standard STIX SDO. Course of Action course-of-action extension-definition--cb5ba226-ff95-4210-8238-ffffffffff1d The extension is used to add TISC-specific properties to the standard STIX SDO. Identity identity extension-definition--0f5ba226-ff95-4210-8238-ffffffffff1d The extension is used to add TISC-specific properties to the standard STIX SDO. Infrastructure infrastructure extension-definition--8f5ba226-ff95-4210-8238-ffffffffff1d The extension is used to add TISC-specific properties to the standard STIX SDO. Intrusion Set intrusion-set extension-definition--cf5ba226-ff95-4210-8238-ffffffffff1d The extension is used to add TISC-specific properties to the standard STIX SDO. Location location extension-definition--035ba226-ff95-4210-8238-ffffffffff1e The extension is used to add TISC-specific properties to the standard STIX SDO. Malware malware extension-definition--835ba226-ff95-4210-8238-ffffffffff1e The extension is used to add TISC-specific properties to the standard STIX SDO. Malware Analysis malware-analysis extension-definition--c35ba226-ff95-4210-8238-ffffffffff1e The extension is used to add TISC-specific properties to the standard STIX SDO. Marking Definition marking-definition extension-definition--cb5ba226-ff95-4210-8238-ffffffffff1e The extension is used to add TISC-specific properties to the standard STIX SDO. Object Sighting sighting extension-definition--cf5ba226-ff95-4210-8238-ffffffffff20 The extension is used to add TISC-specific properties to the standard STIX SDO. Observed Data observed-data extension-definition--435ba226-ff95-4210-8238-ffffffffff1e The extension is used to add TISC-specific properties to the standard STIX SDO. Threat Actor threat-actor extension-definition--075ba226-ff95-4210-8238-ffffffffff1e The extension is used to add TISC-specific properties to the standard STIX SDO. Threat Event incident extension-definition--0f5ba226-ff95-4210-8238-ffffffffff1e The extension is used to add TISC-specific properties to the standard STIX SDO. Threat Grouping grouping extension-definition--475ba226-ff95-4210-8238-ffffffffff1e The extension is used to add TISC-specific properties to the standard STIX SDO. Threat Note note extension-definition--4b5ba226-ff95-4210-8238-ffffffffff1e The extension is used to add TISC-specific properties to the standard STIX SDO. Threat Opinion opinion extension-definition--8b5ba226-ff95-4210-8238-ffffffffff1e The extension is used to add TISC-specific properties to the standard STIX SDO. Threat Report report extension-definition--0b5ba226-ff95-4210-8238-ffffffffff1e The extension is used to add TISC-specific properties to the standard STIX SDO. Tool tool extension-definition--875ba226-ff95-4210-8238-ffffffffff1e The extension is used to add TISC-specific properties to the standard STIX SDO. Vulnerability vulnerability extension-definition--c75ba226-ff95-4210-8238-ffffffffff1e The extension is used to add TISC-specific properties to the standard STIX SDO. These extension-definition IDs are fixed per object type and identical across every TISC instance, the same way as the Observable IDs above. Below are the common fields set on every STIX Domain Object, regardless of type. STIX SDO Field TISC Object Field / Rule id Derived from the record's unique TISC ID type Fixed per object table (see type table above) spec_version "2.1" created Created modified Updated revoked Revoked lang Lang confidence Confidence object_marking_refs TLP (resolved to the matching marking-definition id) external_references Related Object Reference records (source_name, description, hashes, url, external_id) extensions / x_ All remaining columns not otherwise mapped labels MITRE ATT&CK techniques/tactics associated with the record TISC Specific Extension fields for STIX Domain Objects Below are the common extension fields set on every STIX Domain Object, regardless of type. Type-specific extension fields, where they exist, are listed inside that type's own table below (Attack Pattern, Course of Action, Vulnerability). STIX Extension Field TISC Object Field extensions.x_additional_context Additional Context extensions.x_description Description extensions.x_notes Notes extensions.x_threat_level Threat Level extensions.x_threat_severity Threat Severity extensions.x_taxonomies Taxonomies extensions.x_tags TISC Tags extensions.x_expiration_time Expiration Time Attack Pattern: TISC "Attack Pattern" records are converted as attack-pattern object. Custom fields TISC adds for an Attack Pattern are grouped under extension-definition--4b5ba226-ff95-4210-8238-ffffffffff1d . STIX attack-pattern Object Field TISC Attack Pattern Field name Name description Description aliases Aliases kill_chain_phases Attack Phases extensions.x_permissions_required Permissions Required Campaign: TISC "Campaign" records are converted as campaign object. Custom fields TISC adds for a Campaign are grouped under extension-definition--8b5ba226-ff95-4210-8238-ffffffffff1d . STIX campaign Object Field TISC Campaign Field name Name description Description aliases Aliases first_seen First Seen last_seen Last Seen objective Objective Course of Action: TISC "Course of Action" records are converted as course-of-action object. (The STIX action property is reserved for future use by the STIX specification and is not populated.) Custom fields TISC adds for a Course of Action are grouped under extension-definition--cb5ba226-ff95-4210-8238-ffffffffff1d . STIX course-of-action Object Field TISC Course of Action Field name Name description Description extensions.x_action Action extensions.x_external_id External ID Identity: TISC "Identity" records are converted as identity object. Custom fields TISC adds for an Identity are grouped under extension-definition--0f5ba226-ff95-4210-8238-ffffffffff1d . STIX identity Object Field TISC Identity Field name Name description Description contact_information Contact Information identity_class Identity Class roles Roles sectors Sectors Infrastructure: TISC "Infrastructure" records are converted as infrastructure object. Custom fields TISC adds for an Infrastructure are grouped under extension-definition--8f5ba226-ff95-4210-8238-ffffffffff1d . STIX infrastructure Object Field TISC Infrastructure Field name Name description Description aliases Aliases infrastructure_types Infrastructure Types kill_chain_phases Attack Phases first_seen First Seen last_seen Last Seen Intrusion Set: TISC "Intrusion Set" records are converted as intrusion-set object. Custom fields TISC adds for an Intrusion Set are grouped under extension-definition--cf5ba226-ff95-4210-8238-ffffffffff1d . STIX intrusion-set Object Field TISC Intrusion Set Field name Name description Description first_seen First Seen last_seen Last Seen resource_level Resource Level primary_motivation Primary Motivation secondary_motivations Secondary Motivations goals Goals aliases Aliases Location: TISC "Location" records are converted as location object. Custom fields TISC adds for a Location are grouped under extension-definition--035ba226-ff95-4210-8238-ffffffffff1e . STIX location Object Field TISC Location Field name Name description Description latitude Latitude longitude Longitude precision Precision region Region country Country administrative_area Administrative Area city City street_address Street Address postal_code Zip/Postal Code Malware: TISC "Malware" records are converted as malware object. Custom fields TISC adds for a Malware are grouped under extension-definition--835ba226-ff95-4210-8238-ffffffffff1e . STIX malware Object Field TISC Malware Field name Name description Description is_family Is Family first_seen First Seen last_seen Last Seen aliases Aliases kill_chain_phases Attack Phases malware_types Malware Types architecture_execution_envs Processor Architecture implementation_languages Implementation Languages capabilities Malware Capabilities Malware Analysis: TISC "Malware Analysis" records are converted as malware-analysis object. Custom fields TISC adds for a Malware Analysis are grouped under extension-definition--c35ba226-ff95-4210-8238-ffffffffff1e . STIX malware-analysis Object Field TISC Malware Analysis Field product Product (sanitized to lowercase-hyphen) version Version configuration_version Configuration Version analysis_engine_version Analysis Engine Version analysis_definition_version Analysis Definition Version result_name Result Name result Result modules Modules submitted Submitted analysis_started Analysis Started analysis_ended Analysis Ended host_vm_ref Resolved from related Object/Observable records (only if related records are included when using external sharing) operating_system_ref Resolved from related Object/Observable records (only if related records are included when using external sharing) sample_ref Resolved from related Object/Observable records (only if related records are included when using external sharing) installed_software_refs Resolved from related Object/Observable records (only if related records are included when using external sharing) analysis_sco_refs Resolved from related Object/Observable records (only if related records are included when using external sharing) Marking Definition: TISC "Marking Definition" records are converted as marking-definition object. revoked and confidence are explicitly removed since they do not apply to this SDO type. Custom fields TISC adds for a Marking Definition are grouped under extension-definition--cb5ba226-ff95-4210-8238-ffffffffff1e . STIX marking-definition Object Field TISC Marking Definition Field name Name definition_type Definition Type definition.statement Definition (statement text, when Definition Type is Statement) definition.tlp Definition (TLP value, when Definition Type is TLP) Object Sighting: TISC "Object Sighting" records are converted as the STIX sighting object. Custom fields TISC adds for an Object Sighting are grouped under extension-definition--cf5ba226-ff95-4210-8238-ffffffffff20 . STIX sighting Object Field TISC Object Sighting Field description Description first_seen First Seen last_seen Last Seen count Count summary Is Summary sighting_of_ref Related Object/Indicator where relationship type is "sighting-of" (or direct object-indicator relationship) observed_data_refs Related records that target an Observed Data object where_sighted_refs Related records that target an Identity or Location object Observed Data: TISC "Observed Data" records are converted as observed-data object. Custom fields TISC adds for an Observed Data are grouped under extension-definition--435ba226-ff95-4210-8238-ffffffffff1e . STIX observed-data Object Field TISC Observed Data Field first_observed First Observed last_observed Last Observed number_observed Observed Count object_refs Related Observables where relationship type is "observed" and direction is "direct" (only if related records are included when using external sharing) Threat Actor: TISC "Threat Actor" records are converted as threat-actor object. Custom fields TISC adds for a Threat Actor are grouped under extension-definition--075ba226-ff95-4210-8238-ffffffffff1e . STIX threat-actor Object Field TISC Threat Actor Field name Name description Description first_seen First Seen last_seen Last Seen threat_actor_types Threat Actor Types aliases Aliases roles Threat Actor Roles goals Goals sophistication Sophistication resource_level Resource Level primary_motivation Primary Motivation secondary_motivations Secondary Motivations personal_motivations Personal Motivations Threat Event: TISC "Threat Event" records are converted as incident object. Custom fields TISC adds for an Threat Event are grouped under extension-definition--0f5ba226-ff95-4210-8238-ffffffffff1e . STIX incident Object Field TISC Threat Event Field name Name description Description Threat Grouping: TISC "Threat Grouping" records are converted as grouping object. Custom fields TISC adds for a Threat Grouping are grouped under extension-definition--475ba226-ff95-4210-8238-ffffffffff1e . STIX grouping Object Field TISC Grouping Field name Name description Description context Context object_refs Related Objects/Observables/Indicators (only if related records are included when using external sharing) Threat Note: TISC "Threat Note" records are converted as note object. Custom fields TISC adds for a Threat Note are grouped under extension-definition--4b5ba226-ff95-4210-8238-ffffffffff1e . STIX note Object Field TISC Threat Note Field abstract Abstract content Content authors Authors object_refs Related Objects/Observables/Indicators (only if related records are included when using external sharing) Threat Opinion: TISC "Threat Opinion" records that represent an opinion are converted as opinion object. Custom fields TISC adds for a Threat Opinion are grouped under extension-definition--8b5ba226-ff95-4210-8238-ffffffffff1e . STIX opinion Object Field TISC Threat Note Field opinion Opinion Value (lower-cased) explanation Explanation authors Authors object_refs Related Objects/Observables/Indicators (only if related records are included when using external sharing) Threat Report: TISC "Threat Report" records are converted as report object. Custom fields TISC adds for a Threat Report are grouped under extension-definition--0b5ba226-ff95-4210-8238-ffffffffff1e . STIX report Object Field TISC Threat Report Field name Name description Description published Published report_types Report Types object_refs Related Objects/Observables/Indicators (only if related records are included when using external sharing) Tool: TISC "Tool" records are converted as tool object. Custom fields TISC adds for a Tool are grouped under extension-definition--875ba226-ff95-4210-8238-ffffffffff1e . STIX tool Object Field TISC Tool Field name Name description Description tool_version Tool Version aliases Aliases kill_chain_phases Attack Phases tool_types Tool Types Vulnerability: TISC "Vulnerability" records are converted as vulnerability object. CVE/CVSS and related detail not covered by the core mapping is carried as extension fields (e.g. Affected Software). Custom fields TISC adds for a Vulnerability are grouped under extension-definition--c75ba226-ff95-4210-8238-ffffffffff1e . STIX vulnerability Object Field TISC Vulnerability Field name Name description Description extensions.x_affected_software Affected Software extensions.x_cvss_20 CVSS 2.0 extensions.x_cvss_30 CVSS 3.0 extensions.x_severity Severity extensions.x_exploitation_status Exploitation Status extensions.x_published Published extensions.x_record_last_modified Record Last Modified TISC Relationships (STIX Relationship Objects):

Every TISC relationship ( m2m ) table — between Observables, between Objects, between Indicators, and between Objects/Indicators and Observables — is converted as a STIX relationship object. Below is the mapping of TISC relationship fields to STIX relationship object fields. STIX relationship Object Field TISC Relationship Field id Derived from the record's unique TISC ID type Fixed to "relationship" spec_version "2.1" created sys_created_on (Created) modified sys_updated_on (Updated) revoked Revoked relationship_type Relationship Type (defaults to "relates-to" when blank) source_ref Observable/Indicator/Object that is the source of relationship target_ref Observable/Indicator/Object that is the target of relationship description Description start_time Start Time stop_time Stop Time TLP / Marking Definitions:

When a converted record has a TLP value set, the corresponding STIX 2.1 marking-definition object is added to the bundle and referenced via object_marking_refs . These marking-definition id values are fixed and the same for every TISC customer at a given TLP level — they are not generated from the shared record itself. They come directly from the standard TLP 2.0 marking-definition objects published by OASIS, so any other system that also follows that standard will recognize the same IDs. Reference: STIX 2.1 TLP 2.0 marking-definition specification (OASIS cti-stix-common-objects). TISC TLP Value Extension Property tlp_2_0 STIX marking-definition ID STIX marking-definition name TLP:CLEAR clear marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487 TLP:CLEAR TLP:GREEN green marking-definition---bab4a63c-aed9-4cf5-a766-dfca5abac2bb TLP:GREEN TLP:AMBER amber marking-definition---55d920b0-5e8b-4f79-9ee9-91f868d9b421 TLP:AMBER TLP:AMBER+STRICT amber+stict marking-definition---939a9414-2ddd-4d32-a0cd-375ea402b003 TLP:AMBER+STRICT TLP:RED red marking-definition--e828b379-4e03-4974-9ac4-e53a884c97c1 TLP:RED MITRE ATT&CK Enrichment:

Any MITRE ATT&CK techniques and tactics associated with a TISC Observable, Indicator, or Object are included on the converted STIX object as labels , formatted as " : , " (e.g. "TA0001:T1566,T1195" ).