campaign

Documentation

Overview

Package campaign implements the STIX 2.1 Campaign object.

The following information comes directly from the STIX 2.1 specification.

A Campaign is a grouping of adversarial behaviors that describes a set of malicious activities or attacks (sometimes called waves) that occur over a period of time against a specific set of targets. Campaigns usually have well defined objectives and may be part of an Intrusion Set.

Campaigns are often attributed to an intrusion set and threat actors. The threat actors may reuse known infrastructure from the intrusion set or may set up new infrastructure specific for conducting that campaign.

Campaigns can be characterized by their objectives and the incidents they cause, people or resources they target, and the resources (infrastructure, intelligence, Malware, Tools, etc.) they use.

For example, a Campaign could be used to describe a crime syndicate's attack using a specific variant of malware and new C2 servers against the executives of ACME Bank during the summer of 2016 in order to gain secret information about an upcoming merger with another bank.

Index

• type Campaign
  • func Decode(data []byte) (*Campaign, error)
  • func New() *Campaign
  • func (o *Campaign) Encode() ([]byte, error)
  • func (o *Campaign) EncodeToString() (string, error)
  • func (o *Campaign) GetPropertyList() []string
  • func (o *Campaign) SetObjective(s string) error
  • func (o *Campaign) UnmarshalJSON(b []byte) error
  • func (o *Campaign) Valid() (bool, int, []string)

Types

type Campaign

type Campaign struct {
	objects.CommonObjectProperties
	properties.NameProperty
	properties.DescriptionProperty
	properties.AliasesProperty
	properties.SeenProperties
	Objective string `json:"objective,omitempty"`
}

Campaign - This type implements the STIX 2 Campaign SDO and defines all of

the properties and methods needed to create and work with this object. All of the methods not defined local to this type are inherited from the individual properties.

func Decode

func Decode(data []byte) (*Campaign, error)

Decode - This function is a simple wrapper for decoding JSON data. It will

decode a slice of bytes into an actual struct and return a pointer to that object along with any errors.

func New

func New() *Campaign

New - This function will create a new STIX Campaign object and return it as a

pointer. It will also initialize the object by setting all of the basic properties.

func (*Campaign) Encode

func (o *Campaign) Encode() ([]byte, error)

Encode - This method is a simple wrapper for encoding an object into JSON

func (*Campaign) EncodeToString

func (o *Campaign) EncodeToString() (string, error)

EncodeToString - This method is a simple wrapper for encoding an object into

JSON

func (*Campaign) GetPropertyList

func (o *Campaign) GetPropertyList() []string

GetProperties - This method will return a list of all of the properties that

are unique to this object. This is used by the custom UnmarshalJSON for this object. It is defined here in this file to make it easy to keep in sync.

func (*Campaign) SetObjective

func (o *Campaign) SetObjective(s string) error

SetObjective - This method will take in a string representing an objective,

goal, desired outcome, or intended effect and update the objective property.

func (*Campaign) UnmarshalJSON

func (o *Campaign) UnmarshalJSON(b []byte) error

UnmarshalJSON - This method will over write the default UnmarshalJSON method

to enable custom properties that this library does not know about. It will store them as map where the value of each key is a byte arrays. This way a tool that does know how to deal with them can then further process them after this is done. This will also allow the storage of the raw JSON data.

func (*Campaign) Valid

func (o *Campaign) Valid() (bool, int, []string)

Valid - This method will verify and test all of the properties on an object

to make sure they are valid per the specification. It will return a boolean, an integer that tracks the number of problems found, and a slice of strings that contain the detailed results, whether good or bad.