Anthropic-Cybersecurity-Skills/skills/building-threat-intelligence-enrichment-in-splunk/references/standards.md

# Standards - Threat Intelligence Enrichment in Splunk

## Threat Intelligence Standards

### STIX (Structured Threat Information eXpression)
- Version 2.1 is the current standard for representing threat intelligence
- Defines objects: Indicator, Malware, Attack Pattern, Threat Actor, Campaign
- Used as the interchange format between TI platforms and SIEMs

### TAXII (Trusted Automated eXchange of Indicator Information)
- Transport mechanism for STIX data
- TAXII 2.1 provides RESTful API for feed collection
- Supports Collection and Channel sharing models

### OpenIOC
- Mandiant's open framework for sharing IOCs
- XML-based format for indicator definitions

### OCSF (Open Cybersecurity Schema Framework)
- Industry standard for normalizing security event data
- Version 1.0 released at BlackHat 2023

## Splunk CIM Data Models for TI

| Data Model | TI Correlation Fields |
|---|---|
| Network_Traffic | src_ip, dest_ip, dest_port |
| Web | url, http_user_agent, domain |
| Email | src_user, file_hash, url |
| Endpoint | process_hash, file_hash, dest |
| Authentication | src_ip, user, app |
| DNS | query, answer, src_ip |

## IOC Types and Confidence Levels

| IOC Type | Splunk Field | Confidence Threshold |
|---|---|---|
| IP Address | ip_intel | > 70% |
| Domain | domain_intel | > 70% |
| File Hash (SHA256) | file_intel | > 80% |
| URL | url_intel | > 75% |
| Email Address | email_intel | > 80% |