Threat opinions

An Opinion is an assessment of the accuracy of the information in a STIX Object produced by a different entity. Threat opinions apply for STIX 2.x.

The opinion property captures the level of agreement or disagreement using a fixed scale. The fixed scale also supports a numeric mapping to enable consistent statistical operations across opinions.

For example, an analyst from a consuming organization might say that they "strongly disagree" with a Campaign object and provide an explanation about why.

Opinions are subjective, and the specification does not address how best to interpret them.

Human analysts create Opinions and are composed of human-oriented text, they contain an extra property to capture the author that created the Opinion.

• Define threat opinions
  Define threat opinions as an assessment of the accuracy of the information in a STIX object.

Parent Topic:IoC Repository

Related topics

Attack modes and methods

Indicators of compromise

Observables

Attack patterns

Campaigns

Course of actions

Identities

Infrastructure

Intrusion set

Locations

Malware

Malware analysis

Observed data

Threat actors

Threat groupings

Marking definitions

Threat notes

Threat reports

Sightings

Tools

Vulnerabilities

Relationships

STIX Visualizer