Bridging Together Independent Islands - STIX Custom Objects and Matching Mechanisms to Correlate...

on YouTube ↗31m

" summary

Demonstrates a working extension to STIX inside the OSS S-TIP platform that models real‑world entities (bank‑account, person) with a STIX Customizer, then correlates them to cyberspace artifacts using two implemented rulesets: fuzzy matching (case, katakana↔hiragana, curated equivalence lists) and explicit matching (property‑to‑property constraints). Shows a law‑enforcement use case mapping Japanese bank‑account katakana names to U.S. ASCII names, a GUI demo creating custom objects and matching rules, and GitHub‑hosted code.

AI-written summary · about

" chapters (6)

1. 0:00Start
2. 14:265. Demo (Create Custom Object and Properties)
3. 16:175. Demo (Define Explicit Correlation)
4. 16:585. Demo (Define Fuzzy Matching)
5. 20:175. Demo (Explain the demo Data)
6. 21:085. Demo (Graph Analytics)

" related talks

• 01h 01mIntroduction To STIX/TAXII 2 StandardsAllan Thomson · nullcon Goa 2019
• 30mHow to Create Effective Structured Intelligence Extensions for TIPsPeter Ferguson · FIRST Cyber Threat Intelligence Symposium 2022
• 22mSolving CTI Sector Incoherence in a Living Growing OpenCTI Repository: Extend STIX 2.1 FTWPhilippe Lin · 2024 FIRST Cyber Threat Intelligence Conference
• 48mThe Big Picture of APT Attacks Targeting Japan — APT Incident STIX DatabaseKubo Keiji, Soeda Yoji · CODE BLUE 2017
• 29mA Collective CTI DoctrineDavid Bizeul, Fabien Gainier · 2023 FIRST Cyber Threat Intelligence Conference
• 27mIndicator Message eXchange (IMX): Enabling Structured Cyber Threat Intelligence SharingBrian DeWyngaert · FIRST Conference 2026 (FIRSTCON26)
• 30mCTI-Transmute: Harmonizing Threat Intelligence in a Multi-Standard EcosystemAlexandre Dulaunoy, Christian Studer · FIRST Cyber Threat Intelligence Conference 2026
• 31mSkynet the CTI Intern: Building Effective Machine Augmented...Scott J Roberts · BSidesSF 2024