Graph structure
A OneFirewall Threat Report object sits at the top as the container. It points to an Indicator — the malicious IP — which “indicates” three Attack Pattern objects: Network Service Discovery, Vulnerability Scanning, and Active Scanning. A Course of Action object, Network Service Scanning Mitigation, connects to one of those patterns through a “mitigates” relationship. Four typed relationships, using standard STIX2 vocabulary: indicates, mitigates.Purpose of the format
STIX2 (Structured Threat Information Expression) is a standard specifically so threat intelligence doesn’t remain a paragraph in a written report. A SOAR platform, TIP, or SIEM correlation engine can ingest this bundle directly, without an analyst transcribing “this IP is doing recon” into a separate schema. The relationship types carry meaning a flat IOC list doesn’t: this indicator specifically indicates reconnaissance-stage activity, and a defined mitigation is already attached to it.Kill-chain stage
Network Service Discovery, Vulnerability Scanning, and Active Scanning are early kill-chain activity — mapping exposed services before deciding how to proceed. Structuring intelligence at this stage means downstream automation can act on the reconnaissance itself, rather than waiting for a later, more damaging stage to trigger a response.Proof of Value engagements generate structured intelligence of this kind from a client’s own indicators. Start a Proof of Value.