Table of Contents
What is the schema of OpenIOC?
Why should organizations use OpenIOC?
What are the benefits of OpenIOC?
View More guides on Cyber Threat Intelligence
What is the Open Indicators of Compromise (OpenIOC) Framework?
- Cyber Threat Intelligence
Posted on: June 17, 2019
OpenIOC is an open framework, meant for sharing threat intelligence information in a machine-readable format. It was developed by the American cybersecurity firm MANDIANT in November 2011. It is written in eXtensible Markup Language (XML) and can be easily customized for additional threat information so that incident responders can translate their knowledge into a standard format. An organization can leverage this OpenIOC format to share threat-related latest Indicators of Compromise (IoCs) with other organizations, enabling real-time protection against emerging threats.
What is the schema of OpenIOC?
The base schema of OpenIOC is a simple framework that is written in XML, which can be used to document and classify forensic artifacts of an intrusion occurring across any network or host. The framework comes with a 500 pre-defined base set of indicators, as provided by MANDIANT. These pre-defined sets of environments can be used to track down advanced threats.
The base schema isn’t beholden to one indicator, it can be extended further to include additional indicators from multiple sources. The users of OpenIOC indicators are free to create and add their own sets of indicators and extend them as they see fit.
Why should organizations use OpenIOC?
To keep up with threat actor evolution, conventional methods of detecting security breaches are no longer adequate for an organization. Simple signatures have become very easy for a threat actor to overcome.
Sharing indicator threat information across your own sector, or even different sectors, is a crucial part of your organization's endpoint security. You need to be able to communicate how to spot emerging threats in your hosts and networks using a machine-digestible format that can bypass the human delay from intelligence sharing. OpenIOC format provides a common platform to enable communication on a known threat between security teams across sectors.
What are the benefits of OpenIOC?
By using the OpenIOC framework, the organizations will have access to the latest IOCs shared by other organizations. These IOCs can be readily leveraged by multiple threat detection tools, enabling real-time threat detection capabilities. With this, organizations can benefit from the collaborative effect of shared threat intelligence within their industry, as well as global Fortune 1000 companies. Having features like customization and extensions, the framework also offers MANDIANT’s field-tested Indicators of Compromises (IoCs), as well as the option for creating user’s own custom sets of OpenIOC indicators.
Share Blog Post
Related Guides
Related Guides
The Virtual Cyber Fusion Suite
