Threat Opinion

An Opinion is an assessment of the accuracy of the information in a STIX Object produced by a different entity. Threat opinions apply for STIX 2.x.

The opinion property captures the level of agreement or disagreement using a fixed scale. The fixed scale also supports a numeric mapping to enable consistent statistical operations across opinions.

For example, an analyst from a consuming organization might say that they "strongly disagree" with a Campaign object and provide an explanation about why.

Opinions are subjective, and the specification does not address how best to interpret them.

Human analysts create Opinions and are composed of human-oriented text, they contain an extra property to capture the author that created the Opinion.

• Define Threat Opinion
  Define threat opinions as an assessment of the accuracy of the information in a STIX object.

Related concepts

• Observables
• Indicators
• Attack Patterns
• Campaign
• Courses of Action
• Identity
• Infrastructure
• Intrusion Set
• Location
• Malware
• Malware Analysis
• Object Sighting
• Observed Data
• Threat Actor
• Threat Event
• Threat Grouping
• Threat Note
• Threat Report
• Tool
• Vulnerability
• Marking Definition
• Data Component
• Data Sources
• Relationships Objects
• Potential Relationships
• Working with Reports in TISC

Related tasks

• Define RSS Feeds