nucleation

THEORY-1238: Disinformation incidents carried in STIX 2.1 as the DISINFOX mapping carries them are an interoperable representation that survives exchange between organisations, and sharing them in this form improves analysts' correlation and exposure of incidents and their reuse of labels

1 min read

Properties4
StatusProposed
Tagssociety-and-governance
SourceLIT-083 — Toward interoperable representation and sharing of disinformation incidents in cyber threat intelligence
ExtendsTHEORY-651 — Disinformation incidents labelled with DISARM techniques can be carried in standard STIX 2.1 without extending it, as an intrusion set that uses attack patterns, is attributed to a threat actor and targets locations; the DISINFOX mapping that moved 118 incidents into OpenCTI this way keeps only a name, a free-text description, a first-seen date and labels beside those three relationships, with no object or property for an incident's narratives, channels, evidence or countermeasures or for the confidence of its attribution

Graph View

Source

Sánchez González et al. (2025), LIT-083, read in full in NOTE-028. Better correlation, faster exposure and global collaboration are the paper’s motivation (C5), not its results.

Where the evidence stands

The mapping and the ingestion of 118 incidents are THEORY-651, Active, which this entry extends. No round-trip fidelity check, comparison with DAD-CDM, user study or correlation result is reported. The promote_when above is THEORY-651’s condition before the twenty-fourth status review promoted it, carried here unchanged, because it asks what would make the thesis true and not what the source says.

Backlinks