1309 osint extension

[PavelJurka]

Related Issue:

#1309

Description of changes:

We want to use the OSINT profile for threat intelligence, however there are some fields missing from what we currently have. We should align naming to STIX.

[jonrau-at-queryai]

As per the discussion today, we should push this off until 1.5.0. There is a mixture of STIX and vendor-specific (S1) concepts in here that clash with the more genericized incarnation of OSINT.

I feel the schema does either require a specific campaign object, a STIX Extension, or we create a separate CTI/Threat Intel Profile/Object that is either standalone or extends OSINT.

[PavelJurka]

As per the discussion today, we should push this off until 1.5.0. There is a mixture of STIX and vendor-specific (S1) concepts in here that clash with the more genericized incarnation of OSINT.

I feel the schema does either require a specific campaign object, a STIX Extension, or we create a separate CTI/Threat Intel Profile/Object that is either standalone or extends OSINT.

Hello @jonrau-at-queryai and @mikeradka - Is this PR acceptable or what is the way you would accept? Thank you very much!

[zelienka]

I see two potential issues here:

1. detection_pattern_type_id should STIX patterns; i.e., stix, pcre, sigma, snort, suricata, yara.
2. create a campaign object and use that

I don't see any other vendor specific concepts.

Would these changes help?

[zelienka]

we create a separate CTI/Threat Intel Profile/Object that is either standalone or extends OSINT.

Semantically, what would be the difference between CTI and OSINT?