This part of the project focuses on defining the required data in form of data objects and the relationships among each other needed to facilitate the creation of data analytics and validate the detection of adversary techniques. This is inspired by the awesome work of MITRE with their project CAR Analytics. The information needed for each data object is pulled from the entities defined in the Common Information Model.

Data Model Components

Data Objects
Data Object Relationships
Data Object Relationships Vocabulary

Resources

STIX Cybox ObjectRelationshipVOcab-1.1
Cybox Object
STIX Version 2.0. Part 4: Cyber Observable Object
Finding Cyber Threats with ATTCK Based Analytics
CAR Analytics Data Model
Quantifying your hunt: not your parent's red teaming