Use Case: Support Capture of "Atomic" Cyber Data

Abstraction Level: High

Related Use Cases

Description

"Atomic" cyber data refers to entities that can be used in a standalone capacity, may (but do not have to be) be associated with a system (or systems), and have a basic structure that cannot be broken down further. Examples include IP addresses, domain names, port numbers, and the like. Enabling the structured capture of such basic data permits the capture and exchange of instances of this data, along with the characterization of more complex cyber data which may have atomic components, such as a network interface on a system that has an assigned IP address, for example.

Applicable Domains

• Indicator sharing
• Incident response
• Malware analysis
• Digital forensics