Implement Confidence on Indicators

[gtback]

No description provided.

[bauman]

I don’t like the idea of adding subjectivity to indicators in the form of a confidence rating. Instead, is it possible to focus on adding “supporting facts” or “evidence” or more formally including linkages into relevant CybOX objects? Using that method, the “confidence” will become self-evident. Indicators presented with little or no supporting evidence, but with “high” confidence don’t seem to provide more actionability than an indicator with “low” confidence.

[gtback]

@bauman - you should probably raise your concern on the STIXProject/schemas repo. This issue is just related to implementing in the python-stix library what is already part of STIX.

FWIW, I think you have a good point. In some cases, parties communicating information via STIX will have some common understanding of what the confidence levels mean, but nothing beats sharing the actual evidence. There are ways to share the evidence via various relationships to other STIX entities, but there may also be a benefit to embedding it directly within the Indicator.

[bauman]

@gtback Understand, I'll comment it there as well. It was more trying to influence priority of issue #35 which seems more valuable in our case.