​6.8​ Report Label

Vocabulary Name: report-label-ov

The report label vocabulary is currently used in the following SDO(s):

  • Report

Report label is an open vocabulary to describe the primary purpose or subject of a report. For example, a report that contains malware and indicators for that malware should have a report label of malware to capture that the malware is the primary purpose. Report labels are not mutually exclusive: a Report can be both a malware report and a tool report. Just because a report contains objects of a type does not mean that the report should include that label. If the objects are there to simply provide evidence or context for other objects, it is not necessary to include them in the label.

Vocabulary Summary
threat-report, attack-pattern, campaign, identity, indicator, malware, observed-data, threat-actor, tool, vulnerability
Vocabulary Value Description
threat-report Report subject is a broad characterization of a threat across multiple facets.
attack-pattern Report subject is a characterization of one or more attack patterns and related information.
campaign Report subject is a characterization of one or more campaigns and related information.
identity Report subject is a characterization of one or more identities and related information.
indicator Report subject is a characterization of one or more indicators and related information.
intrusion-set Report subject is a characterization of one or more intrusion sets and related information.
malware Report subject is a characterization of one or more malware instances and related information.
observed-data Report subject is a characterization of observed data and related information.
threat-actor Report subject is a characterization of one or more threat actors and related information.
tool Report subject is a characterization of one or more tools and related information.
vulnerability Report subject is a characterization of one or more vulnerabilities and related information.

results matching ""

    No results matching ""