STIX2.1 Extension Example - custom properties

[Chris Ricard <cricard@fsisac.com>]

Folks,

 

On today’s TC call, Rich asked folks who are using custom STIX extensions to kick the tires on the new extension proposal.

 

We (FS-ISAC) use custom properties on the STIX2.1 Vulnerability SDO, in order to make some custom vulnerability reporting available via a TAXII2.1 feed.

 

The intent is for the content to be STIX/TAXII-compliant (since it’s being published to our TAXII server), yet still easy for non-STIX/TAXII applications (such as a vulnerability management system that has no idea what STIX and TAXII are) to be able to ingest it as a RESTful API.

I’ve attached 4 JSON files:

1. stix21-orig.json:  This is an example of what we are currently publishing.  Note that all of the “x-ctix-*” properties are custom top-level properties.
2. stix21-option1.json:  This is my attempt to convert stix21-orig.json to the “Option 1” proposal (Adding properties to an existing STIX object instance)
3. stix21-option2.json: This is my attempt to convert stix21-orig.json to the “Option 2” proposal for adding custom properties to an existing STIX object (Adding properties at the top-level to an existing STIX object instance).
4. stix21-option3.json:  This was just me taking a stab at what it would look like if there was an option to define the extensions in-line, rather than in a separate object.  Obviously it would create additional, duplicative data, but I thought I would toss it out there for consideration, since it would likely be easier for a STIX client to consume.

 

 

My take-aways:

1. Publishing: It appears that we could publish our current custom vulnerability feed using either Option 1 and Option 2 (or Option 3).
2. Consuming: 
1. For STIX/TAXII consumers, Option 1 and Option 2 seem equivalent to me.  As long as the STIX client properly understands the spec, either should work.  The one advantage I see to option 1 is that it allows you to overload the same custom property name in the same SDO defined in different extensions (example, it seems that I could have an “FS-ISAC” risk property, and an “IT-ISAC” risk property in the same SDO, both named “risk”.  I’m not sure why you would want that, though).
2. For NON-STIX/TAXII consumers (example - REST clients which are STIX unaware), Option 2 seems far superior.  The REST client could treat all top-level properties the same, rather than having to understand that some top-level properties are native STIX properties, while others are custom STIX properties that are embedded under the “extensions” property.

 

Also attached is a chicken-scratch python code (process_vulns-json.txt) to illustrate what I’m talking about.   The original JSON and the Option 2 JSON can be processed without any knowledge of STIX or understanding of STIX extensions. However, Option 1 requires an understanding of STIX extensions, and some hand-waving to unpack the custom properties.

 

Hope this makes sense.  Please let me know if I misunderstood anything.

 

Chris Ricard

Sr. Tech Engineer, FS-ISAC

cricard@fsisac.com

work: +1 571-446-3888

cell: +1 703-673-8621

 

 

Attachment: stix21-option2.json
Description: stix21-option2.json

Attachment: stix21-option3.json
Description: stix21-option3.json

Attachment: stix21-option1.json
Description: stix21-option1.json

Attachment: stix21-orig.json
Description: stix21-orig.json

import sys
import json
from pprint import pprint

#Demonstrate a non-STIX aware client parsing STIX objects with custom properties.
#Prints a native property value ("name"), and a custom property value ("cvss_base_score") for each.

#Example of how we're doing custom properties today
original_json=json.loads('''
[{
    "type": "vulnerability",
    "spec_version": "2.1",
    "id": "vulnerability--55574b84-2f9e-48de-97f7-9b5cc6711f09",
    "created": "2020-10-15T21:40:52.746Z",
    "modified": "2020-10-15T21:40:52.746Z",
    "name": "Juniper SBR Carrier Multiple Vulnerabilities",
    "description": "Multiple vulnerabilities have been reported in Juniper SBR Carrier, which can be exploited by malicious people to disclose sensitive information and cause a DoS (Denial of Service).<br><br>For more information:<br>SA83669 (#1)<br>SA89677 (#1)<br>SA90843 (#1)<br>SA91027 (#1)<br>SA94476 (#1)<br><br>The vulnerabilities are reported in versions prior to 8.5.0-R17 and prior to 8.6.0-R12.<br><br><b>Secunia CVSS Scores: </b>Base: 7.5  Overall: 6.5 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C)<div><br><b>Advisory ID: </b>SA98310</div>",
    "labels": [
        "vulnerability:CVE-2019-1563",
        "vulnerability:CVE-2020-1967",
        "vendor:Juniper Networks",
        "vulnerability:CVE-2018-0732",
        "vulnerability:CVE-2018-20843",
        "vulnerability:CVE-2019-15903"
    ],
    "lang": "en",
    "external_references": [
        {
            "source_name": "sa83669",
            "description": "External Reference objects from Flexera",
            "url": "https://app.flexerasoftware.com/#/vt/advisory-database/advisories/?advisory_id=SA83669";
        },
        {
            "source_name": "sa89677",
            "description": "External Reference objects from Flexera",
            "url": "https://app.flexerasoftware.com/#/vt/advisory-database/advisories/?advisory_id=SA89677";
        },
        {
            "source_name": "sa90843",
            "description": "External Reference objects from Flexera",
            "url": "https://app.flexerasoftware.com/#/vt/advisory-database/advisories/?advisory_id=SA90843";
        },
        {
            "source_name": "sa91027",
            "description": "External Reference objects from Flexera",
            "url": "https://app.flexerasoftware.com/#/vt/advisory-database/advisories/?advisory_id=SA91027";
        },
        {
            "source_name": "sa94476",
            "description": "External Reference objects from Flexera",
            "url": "https://app.flexerasoftware.com/#/vt/advisory-database/advisories/?advisory_id=SA94476";
        },
        {
            "source_name": "juniper (1517427)",
            "description": "External Reference objects from Flexera",
            "url": "https://kb.juniper.net/InfoCenter/JSA11074";
        },
        {
            "source_name": "cve",
            "description": "External Reference objects from Flexera",
            "external_id": "CVE-2019-1563"
        }
    ],
    "object_marking_refs": [
        "marking-definition--34098fce-860f-48ae-8e50-ebd3cc5e41da"
    ],
    "x_ctix_advisory_id": "SA98310",
    "x_ctix_credibility": "5 - Verified",
    "x_ctix_criticality": "3 - Moderately critical",
    "x_ctix_cves": [
        "CVE-2019-1563",
        "CVE-2018-0732",
        "CVE-2018-20843",
        "CVE-2020-1967",
        "CVE-2019-15903"
    ],
    "x_ctix_cvss_info": {
        "cvss_base_score": 7.5,
        "cvss_overall_score": 6.5,
        "cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C"
    },
    "x_ctix_impacts": [
        "DoS",
        "Exposure of sensitive information"
    ],
    "x_ctix_products": [
        "Juniper SBR Carrier"
    ],
    "x_ctix_response_action": "Update to version 8.5.0-R17 or 8.6.0-R12.",
    "x_ctix_revisions": [
        {
            "description": "Initial release",
            "released_date": "2020-10-15T21:10:10Z"
        }
    ],
    "x_ctix_risk": "6",
    "x_ctix_severity": "3 - Moderate Impact",
    "x_ctix_source": "Secunia Research from Flexera",
    "x_ctix_urgency": "3 - Action Highly Recommended"
}]
''')

#Example STIX object with custom properies using Option 1
option1_json=json.loads('''
[{
    "type": "stix-extension",
    "spec_version": "2.1",
    "id": "stix-extension--55574b84-2f9e-48de-97f7-9b5cc6711f08",
    "created": "2020-10-15T21:40:52.746Z",
    "modified": "2020-10-15T21:40:52.746Z",
	"name": "FS-ISAC CTIX Vulnerability Extension",
	"created_by_ref": "identity--eafca5be-e6f2-4ef4-ba3e-7f0eb1b55d28",
	"schema": "https://www.fsisac.com/stixtaxii/schemas/ctix-vuln/v1/";,
	"version": "1.0",
	"extension_types": [ "property-extension" ],
	"extension_properties": ["advisory_id","credibility","criticality","cves","cvss_info","impacts","products","response_action","revisions","risk","severity","source","urgency"]
},
{
    "type": "vulnerability",
    "spec_version": "2.1",
    "id": "vulnerability--55574b84-2f9e-48de-97f7-9b5cc6711f09",
    "created": "2020-10-15T21:40:52.746Z",
    "modified": "2020-10-15T21:40:52.746Z",
    "name": "Juniper SBR Carrier Multiple Vulnerabilities",
    "description": "Multiple vulnerabilities have been reported in Juniper SBR Carrier, which can be exploited by malicious people to disclose sensitive information and cause a DoS (Denial of Service).<br><br>For more information:<br>SA83669 (#1)<br>SA89677 (#1)<br>SA90843 (#1)<br>SA91027 (#1)<br>SA94476 (#1)<br><br>The vulnerabilities are reported in versions prior to 8.5.0-R17 and prior to 8.6.0-R12.<br><br><b>Secunia CVSS Scores: </b>Base: 7.5  Overall: 6.5 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C)<div><br><b>Advisory ID: </b>SA98310</div>",
    "labels": [
        "vulnerability:CVE-2019-1563",
        "vulnerability:CVE-2020-1967",
        "vendor:Juniper Networks",
        "vulnerability:CVE-2018-0732",
        "vulnerability:CVE-2018-20843",
        "vulnerability:CVE-2019-15903"
    ],
    "lang": "en",
    "external_references": [
        {
            "source_name": "sa83669",
            "description": "External Reference objects from Flexera",
            "url": "https://app.flexerasoftware.com/#/vt/advisory-database/advisories/?advisory_id=SA83669";
        },
        {
            "source_name": "sa89677",
            "description": "External Reference objects from Flexera",
            "url": "https://app.flexerasoftware.com/#/vt/advisory-database/advisories/?advisory_id=SA89677";
        },
        {
            "source_name": "sa90843",
            "description": "External Reference objects from Flexera",
            "url": "https://app.flexerasoftware.com/#/vt/advisory-database/advisories/?advisory_id=SA90843";
        },
        {
            "source_name": "sa91027",
            "description": "External Reference objects from Flexera",
            "url": "https://app.flexerasoftware.com/#/vt/advisory-database/advisories/?advisory_id=SA91027";
        },
        {
            "source_name": "sa94476",
            "description": "External Reference objects from Flexera",
            "url": "https://app.flexerasoftware.com/#/vt/advisory-database/advisories/?advisory_id=SA94476";
        },
        {
            "source_name": "juniper (1517427)",
            "description": "External Reference objects from Flexera",
            "url": "https://kb.juniper.net/InfoCenter/JSA11074";
        },
        {
            "source_name": "cve",
            "description": "External Reference objects from Flexera",
            "external_id": "CVE-2019-1563"
        }
    ],
    "object_marking_refs": [
        "marking-definition--34098fce-860f-48ae-8e50-ebd3cc5e41da"
    ],
	"extensions": {
		"stix-extension--55574b84-2f9e-48de-97f7-9b5cc6711f08" : {	
			"advisory_id": "SA98310",
			"credibility": "5 - Verified",
			"criticality": "3 - Moderately critical",
			"cves": [
				"CVE-2019-1563",
				"CVE-2018-0732",
				"CVE-2018-20843",
				"CVE-2020-1967",
				"CVE-2019-15903"
			],
			"cvss_info": {
				"cvss_base_score": 7.5,
				"cvss_overall_score": 6.5,
				"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C"
			},
			"impacts": [
				"DoS",
				"Exposure of sensitive information"
			],
			"products": [
				"Juniper SBR Carrier"
			],
			"response_action": "Update to version 8.5.0-R17 or 8.6.0-R12.",
			"revisions": [
				{
					"description": "Initial release",
					"released_date": "2020-10-15T21:10:10Z"
				}
			],
			"risk": "6",
			"severity": "3 - Moderate Impact",
			"source": "Secunia Research from Flexera",
			"urgency": "3 - Action Highly Recommended"
		}
	}
},
{
	"id":"identity--eafca5be-e6f2-4ef4-ba3e-7f0eb1b55d28",
	"identity_class":"organization",
	"lang":"en",
	"name":"FS-ISAC",
	"type":"identity",
	"spec_version":"2.1",
	"created":"2020-10-15T23:40:56.152Z",
	"modified":"2020-10-15T23:40:56.152Z"
}]
''')

#Example STIX object with custom properies using Option 2
option2_json=json.loads('''
[{
    "type": "stix-extension",
    "spec_version": "2.1",
    "id": "stix-extension--55574b84-2f9e-48de-97f7-9b5cc6711f08",
    "created": "2020-10-15T21:40:52.746Z",
    "modified": "2020-10-15T21:40:52.746Z",
	"name": "FS-ISAC CTIX Vulnerability Extension",
	"created_by_ref": "identity--eafca5be-e6f2-4ef4-ba3e-7f0eb1b55d28",
	"schema": "https://www.fsisac.com/stixtaxii/schemas/ctix-vuln/v1/";,
	"version": "1.0",
	"extension_types": [ "toplevel-property-extension" ],
	"extension_properties": ["advisory_id","credibility","criticality","cves","cvss_info","impacts","products","response_action","revisions","risk","severity","source","urgency"]
},
{
    "type": "vulnerability",
    "spec_version": "2.1",
    "id": "vulnerability--55574b84-2f9e-48de-97f7-9b5cc6711f09",
    "created": "2020-10-15T21:40:52.746Z",
    "modified": "2020-10-15T21:40:52.746Z",
    "name": "Juniper SBR Carrier Multiple Vulnerabilities",
    "description": "Multiple vulnerabilities have been reported in Juniper SBR Carrier, which can be exploited by malicious people to disclose sensitive information and cause a DoS (Denial of Service).<br><br>For more information:<br>SA83669 (#1)<br>SA89677 (#1)<br>SA90843 (#1)<br>SA91027 (#1)<br>SA94476 (#1)<br><br>The vulnerabilities are reported in versions prior to 8.5.0-R17 and prior to 8.6.0-R12.<br><br><b>Secunia CVSS Scores: </b>Base: 7.5  Overall: 6.5 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C)<div><br><b>Advisory ID: </b>SA98310</div>",
    "labels": [
        "vulnerability:CVE-2019-1563",
        "vulnerability:CVE-2020-1967",
        "vendor:Juniper Networks",
        "vulnerability:CVE-2018-0732",
        "vulnerability:CVE-2018-20843",
        "vulnerability:CVE-2019-15903"
    ],
    "lang": "en",
    "external_references": [
        {
            "source_name": "sa83669",
            "description": "External Reference objects from Flexera",
            "url": "https://app.flexerasoftware.com/#/vt/advisory-database/advisories/?advisory_id=SA83669";
        },
        {
            "source_name": "sa89677",
            "description": "External Reference objects from Flexera",
            "url": "https://app.flexerasoftware.com/#/vt/advisory-database/advisories/?advisory_id=SA89677";
        },
        {
            "source_name": "sa90843",
            "description": "External Reference objects from Flexera",
            "url": "https://app.flexerasoftware.com/#/vt/advisory-database/advisories/?advisory_id=SA90843";
        },
        {
            "source_name": "sa91027",
            "description": "External Reference objects from Flexera",
            "url": "https://app.flexerasoftware.com/#/vt/advisory-database/advisories/?advisory_id=SA91027";
        },
        {
            "source_name": "sa94476",
            "description": "External Reference objects from Flexera",
            "url": "https://app.flexerasoftware.com/#/vt/advisory-database/advisories/?advisory_id=SA94476";
        },
        {
            "source_name": "juniper (1517427)",
            "description": "External Reference objects from Flexera",
            "url": "https://kb.juniper.net/InfoCenter/JSA11074";
        },
        {
            "source_name": "cve",
            "description": "External Reference objects from Flexera",
            "external_id": "CVE-2019-1563"
        }
    ],
    "object_marking_refs": [
        "marking-definition--34098fce-860f-48ae-8e50-ebd3cc5e41da"
    ],
    "advisory_id": "SA98310",
    "credibility": "5 - Verified",
    "criticality": "3 - Moderately critical",
    "cves": [
        "CVE-2019-1563",
        "CVE-2018-0732",
        "CVE-2018-20843",
        "CVE-2020-1967",
        "CVE-2019-15903"
    ],
    "cvss_info": {
        "cvss_base_score": 7.5,
        "cvss_overall_score": 6.5,
        "cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C"
    },
    "impacts": [
        "DoS",
        "Exposure of sensitive information"
    ],
    "products": [
        "Juniper SBR Carrier"
    ],
    "response_action": "Update to version 8.5.0-R17 or 8.6.0-R12.",
    "revisions": [
        {
            "description": "Initial release",
            "released_date": "2020-10-15T21:10:10Z"
        }
    ],
    "risk": "6",
    "severity": "3 - Moderate Impact",
    "source": "Secunia Research from Flexera",
    "urgency": "3 - Action Highly Recommended",
	"extensions": {
		"stix-extension--55574b84-2f9e-48de-97f7-9b5cc6711f08" : {
			"extends_stix_object_definition": true 
		}
    }	
},
{
	"id":"identity--eafca5be-e6f2-4ef4-ba3e-7f0eb1b55d28",
	"identity_class":"organization",
	"lang":"en",
	"name":"FS-ISAC",
	"type":"identity",
	"spec_version":"2.1",
	"created":"2020-10-15T23:40:56.152Z",
	"modified":"2020-10-15T23:40:56.152Z"
}]
''')



#Prints the title and CVSS score
def printVulnTitleAndCvssScore(title,score):
    print('%s:%s' % (title,score))
    return True

##################################


# Original - native and custom properties are all top-level, custom properties are namespaced.
for obj in original_json:
    if obj['type']=='vulnerability':
        result=printVulnTitleAndCvssScore(obj['name'],obj['x_ctix_cvss_info']['cvss_base_score'])



# Option 2 - native and custom properties are all top-level
for obj in option2_json:
    if obj['type']=='vulnerability':
        result=printVulnTitleAndCvssScore(obj['name'],obj['cvss_info']['cvss_base_score'])


                          
#Option 1:  native properties are top-level, custom properties are nested under the "extensions" property.  So the custom properties must be wrangled out of the extensions property.

for obj in option1_json:
    if obj['type']=='vulnerability':

        #wrangle the custom properties out of the "extensions" property
        cust_properties={}
        extensions=obj['extensions']
        for custs in obj['extensions'].values():
            for (k,v) in custs.items():
                cust_properties[k]=v
        
        result=printVulnTitleAndCvssScore(obj['name'],cust_properties['cvss_info']['cvss_base_score'])