Location Entity

[benmontour]

I wanted to ask if a Location entity had been considered. I'm looking for a place to populate Geo information for things like IPs/ASNs/Companies and the STIX Location Domain Object seems the best fit for that. I'm happy to help create that, just not 100% sure all the places it would need to be defined.

[benmontour]

The other thing I'm considering is just dropping it into the Context field on the IP/ASN or whatever. Might be a better option to prevent tag bloat on entities and having to handle if things change or go stale.

[benmontour]

I'm closing this. I think the better option here is to fill in context on a specific observable. Since observables and entities can't be linked through anything but tags. You'd just end up with hundreds of tags on some location entities like countries. Doesn't make sense.

[udgover]

Since observables and entities can't be linked through anything but tags.

What is your use case? Is it manual creation from UI or a feed / task?

If your use case is feed / task based, you can link observables and entities together by using a direct link:

observable_obj.link_to(entity_obj, "located_at")

However, if your use case is UI based, it's currently not possible to direct link between observable and entities. I've recently discussed about this need with the team.

[benmontour]

Is this done via the /add API endpoint or is it not implemented via the API yet?

[udgover]

You can handle this from the web api directly. The complete workflow is as follow but if you already have observable id and entity id you can directly jump to step 3. Let's also assume there's a location entity.

1. Get observable id: call /api/v2/observables/search with the following payload

{
  "query": {"value": "1.2.3.4"},
  "type": "ipv4",
  "count": 50,
  "page": 0
}

You will get a list containing observables as response. If you provided an exact value, you should have only one item in the list and it will contain the id field. Let's assume it's 123456.

2. Same process to get the entity id by calling /api/v2/entities/search with this payload:

{
  "query": {"name": "org", "country": "France"},
  "type": "location",
  "count": 50,
  "page": 0
}

The response is a list of entities and if it contains an exact match, there will be only one item in the list. Pick the id. Let's assume it's 654321.

3. Link object by using the /api/v2/graph/add endpoint as you mentioned. You will then provide the following payload:

{
  "source": "observable/123456",
  "target": "location/654321",
  "link_type": "located_at",
  "description": "can be empty"
}

[benmontour]

thank you! I'll give that a try.

[tomchop]

I also think that the solution that @benmontour went with (adding location in the context of an observable) is the way to go. But I'm not sure about your use-case - how would the location change depending on which entity you're linking it to?

[benmontour]

In this case the use case was relating to populating Geo-IP data onto an IP address observable. With IPs sometimes changing hands or being relocated to different regions by the owner, I was looking for a way to cleanly keep track of that information and be able to easily see via links what country/city an IP is associated with based on the latest Geo-IP dataset.
I did settle on adding this data to the context block on the IP observable itself. Updating it based on the latest data when available.

Example:

"context": [
  {
    "source": "ExampleBadIPs"
  },
  {
    "enriched": "MaxMindASN"
  },
  {
    "iprange": "123.45.67.89/17",
    "ASN": "12345",
    "ORG": "EXAMPLE-AS"
  },
  {
    "enriched": "MaxMindGEO"
  },
  {
    "iprange": "123.45.67.89/32",
    "lat": "123.4567",
    "lon": "-123.4567",
    "radius": "20",
    "cont": "Example Continent",
    "cc": "EX",
    "nation": "Example Country",
    "sc": "EX",
    "state": "Example State/Region",
    "city": "Example City",
    "mcode": "555",
    "tz": "UTC",
    "eu": "0"
  }
]

[tomchop]

Your approach in encoding this into the Observable context is the right one, IMO. However, I would've expected your context to look like this:

"context": [
  {
    "source": "ExampleBadIPsFeed"
  },
  {
    "source": "MaxMindASN",
    "iprange": "123.45.67.89/17",
    "ASN": "12345",
    "ORG": "EXAMPLE-AS"
  },
  {
    "source": "MaxMindGEO"
    "iprange": "123.45.67.89/32",
    "lat": "123.4567",
    "lon": "-123.4567",
    "radius": "20",
    "cont": "Example Continent",
    "cc": "EX",
    "nation": "Example Country",
    "sc": "EX",
    "state": "Example State/Region",
    "city": "Example City",
    "mcode": "555",
    "tz": "UTC",
    "eu": "0"
  }
]

So essentially three context items, one for the feed that brought the IP in, and two for the analytics that processed the IP. Does that make sense?

[benmontour]

That does make sense. I'll adjust what I'm doing to match that.