FAQ - OCSF relation to STIX

[jetlime]

FAQ - OCSF relation to STIX

[pagbabian-splunk]

I think the best person to elaborate on this would be @JasonKeirstead . In short, STIX IOCs can be matched against OCSF observables to match possible attack vectors from known threat actors. There is an overlap in concept as STIX also distinguishes observables (from where OCSF borrowed the name), from IOCs, which are those observables and other artifacts that match threat vectors.