Anthropic-Cybersecurity-Skills/skills/building-ioc-enrichment-pipeline-with-opencti/references/standards.md

Standards and Frameworks Reference

STIX 2.1 (Native Data Model for OpenCTI)

STIX Domain Objects (SDOs)

• Indicator: Contains detection patterns (STIX patterning, YARA, Sigma)
• Malware: Represents malware families and variants
• Threat Actor: Describes adversary groups and individuals
• Campaign: Groups related intrusion activity
• Attack Pattern: Maps to MITRE ATT&CK techniques
• Infrastructure: Represents adversary-owned systems (C2, exploit kits)
• Tool: Legitimate software used by adversaries

STIX Cyber Observables (SCOs)

• IPv4-Addr / IPv6-Addr: Network addresses
• Domain-Name: DNS domain names
• URL: Full URL indicators
• StixFile: File hashes (MD5, SHA-1, SHA-256)
• Email-Addr: Email addresses
• Artifact: Binary content (malware samples)
• Process: Running process information
• Network-Traffic: Network flow data

STIX Relationship Objects (SROs)

• Relationship: Connects two SDOs (e.g., Threat Actor "uses" Malware)
• Sighting: Records observation of an indicator or malware

OpenCTI Connector Standards

Connector Types

1. EXTERNAL_IMPORT: Ingest data from external sources (MISP, TAXII feeds)
2. INTERNAL_IMPORT_FILE: Parse uploaded files (PDF reports, STIX bundles)
3. INTERNAL_ENRICHMENT: Enrich existing observables with external data
4. INTERNAL_ANALYSIS: Analyze content for indicators
5. STREAM: Real-time export to external systems (SIEM, SOAR)

Connector Communication Protocol

• Connectors communicate via RabbitMQ message queues
• Messages contain STIX 2.1 bundles in JSON format
• Enrichment connectors receive entity_id and return STIX bundles
• Rate limiting and retry logic handled by connector framework

Enrichment Service APIs

VirusTotal v3 API

• Endpoint: https://www.virustotal.com/api/v3/
• Resources: files, urls, domains, ip_addresses
• Rate limits: 4 requests/minute (free), 1000/minute (premium)
• Returns: detection ratios, behavioral analysis, relationships

Shodan API

• Endpoint: https://api.shodan.io/
• Resources: host/{ip}, dns/resolve, search
• Returns: open ports, services, banners, vulnerabilities, ASN info

AbuseIPDB v2 API

• Endpoint: https://api.abuseipdb.com/api/v2/
• Resources: check, reports, blacklist
• Returns: abuse confidence score, total reports, categories, country

GreyNoise v3 API

• Endpoint: https://api.greynoise.io/v3/
• Resources: community/{ip}, noise/context/{ip}
• Returns: classification (benign/malicious/unknown), RIOT status, tags

MITRE ATT&CK Framework

• OpenCTI maps Attack Patterns to ATT&CK techniques
• Supports Enterprise, Mobile, and ICS matrices
• Technique relationships enable campaign-level analysis
• Sub-technique granularity (e.g., T1059.001 - PowerShell)

References

• OpenCTI Documentation
• STIX 2.1 Specification
• OpenCTI GitHub
• OpenCTI Connectors Ecosystem
• VirusTotal API v3