Object Sighting

Sightings denote that an object was seen. Objects may be a malware, tool, threat actor, and so on.

Sightings track who and what is the target, how attacks are carried out, and to track trends in attack behavior.

The Sighting relationship object contains extra properties not present in the generic relationship objects. These extra properties represent data specific to sighting relationships.

• Define Object Sighting
  Define object sighting that describes that an object (malware, tool, threat actor, and so on) was seen.

Related concepts

• Observables
• Indicators
• Attack Patterns
• Campaign
• Courses of Action
• Identity
• Infrastructure
• Intrusion Set
• Location
• Malware
• Malware Analysis
• Observed Data
• Threat Actor
• Threat Event
• Threat Grouping
• Threat Note
• Threat Opinion
• Threat Report
• Tool
• Vulnerability
• Marking Definition
• Data Component
• Data Sources
• Relationships Objects
• Potential Relationships
• Working with Reports in TISC

Related tasks

• Define RSS Feeds