Define Marking Definition
Define marking definitions to handle and share the requirements for the data.
Before you begin
Role required: sn_sec_tisc.analyst
Procedure
Navigate to Workspaces > Threat Intelligence Security Center.
Click on Threat Intel Library icon on the workspace.
Go to Marking Definition object.
Click New.
Note: Whenever you create new object records for observables, indicators, entities or objects a source record is created and a prompt message is displayed that the new object record is created and then the user is redirected to the aggregated record.
On the form, fill in the fields.
| Field | Description |
|---|---|
| ID | Unique ID to identify a Marking Definition. |
| Name | A name used to identify the Marking Definition. |
| Definition Type | The type property identifies the type of object. The definition\_type property identifies the type of Marking Definition. |
| Definition | The definition property contains the marking object itself, for example TLP. |
| TLP | TLP is used to ensure that sensitive information is shared with the appropriate audience. It employs four colors \(White, Green, Amber, and Red\) to indicate different degrees of sensitivity. |
| Confidence | Enter the confidence for this object.The confidence property identifies the confidence that the creator has in the correctness of their data. The confidence value MUST be a number in the range of 0-100. |
|Field|Description|
|-----|-----------|
|Notes|Add any additional notes for this Marking Definition.|
| Field | Description |
|---|---|
| Additional Context | Add any additional context for this Marking Definition. |
| Spec Version | The version of the STIX specification used to represent this object.The value of this property must be 2.1 for STIX Objects defined according to this specification. |
| Lang | This property identifies the language of the text content in this object. |
| Created Time In Source | Specifies the time the object is created in the source. |
| Extensions | Indicates the extensions of attack pattern. |
| Modified Time in Source | Specifies the time the object is modified in the source. |
| Processing Status | Represents the processing status of this object, course of action. |
| Created | Specifies the date and time when the object is created in the source. |
| Updated | Specifies the date and time when the object was updated in the source. |
| Created By Ref | This property specifies that the identity object that describes the entity had created this object. |
Click Save.
After you save, a prompt message is displayed indicating that A new observable record is created. Click Continue to edit the record and create new relationships.
Click Continue.
Important: After you create a new observable record, Prevent System Updates check box is displayed.
Select this check box to prevent any updates from the system after the observable or indicator or STIX objects records are created.
Field Description Tags Select Tags Select the tags that are associated with the vulnerability. Add Tags Add new tags. Taxonomies Select Taxonomy Select a Taxonomy that is associated with this vulnerability. Add Taxonomy Values Add Taxonomy values that are associated with this vulnerability.
What to do next
Click any of the following related lists to view additional information about objects associated with the vulnerability.
| Field | Description |
|---|---|
| External References | Lists the external references which refer to non-STIX information. This property is used to provide one or more external object identifiers. |
| Attack Patterns | Lists the attack patterns associated with this object. |
| Campaigns | Lists the campaigns associated with this object. |
| Detections and Mitigations | Lists the detections and mitigations associated with this object. |
| Identities | Lists the identities associated with this object. |
| Indicators | Lists the related Indicators of Compromise (IoC) that have been identified by the threat source associated with this object. |
| Infrastructure | Lists systems, software services, and any associated physical or virtual resources that are associated with this object. |
| Intrusion Sets | Lists a set of adversarial behaviors and resources with common properties associated with this object. |
| Locations | Lists the locations that provide geographic context to this object. |
| Malware | Lists the malicious code associated with this object. |
| Malware Analysis | Lists the malicious analysis associated with this object. |
| Observables | Lists the observables associated with this object. |
| Observed Data | Lists the observed data associated with this object. |
| Threat Actors | Lists the individuals, groups, or organizations who act with malicious intent associated with this object. |
| Threat Events | Lists the Threat Events associated with this object. |
| Threat Groupings | Lists the Threat Groupings associated with this object. |
| Threat Notes | Lists the Threat Notes associated with this object. |
| Threat Opinions | Lists the Threat Opinions associated with this object. |
| Tools | Lists the Tools associated with this object. |
| Vulnerabilities | Lists the Vulnerabilities associated with this object. |
Note:
- You can link and unlink the related records associated with this object. For more information, see Link Threat Intel Related Records.
- The various SDOs within the TI library also contains the potential relationships. To establish a relationships between any two objects, you use the Potential Relationships link from the Threat Intel Library to confirm the relationships between the objects. For more information, see Confirm object-object potential relationships.
- Also, use the Related Records section from the objects form view to confirm the relationships between two Objects using the Potential Relationships section available on the form view. For more information on see, Confirm Potential Relationships from Related Records.
- You can add objects to cases. For more information, see Add to Case.
Parent Topic:Marking Definition