In a STIX 2.1 bundle, what does an indicator object claim that an observed-data object does not?

## Three different assertions that look alike STIX 2.1 separates things most tooling smears together, and interviews probe exactly this because getting it backwards is the classic threat-intelligence error. **`indicator` — a claim about the future.** Required content is a `pattern`, a `pattern_type` (usually `stix`, the built-in patterning language) and a `valid_from` timestamp. Optional `indicator_types` says what kind of claim it is (`malicious-activity`, `anomalous-activity`, `benign`), and `valid_until` gives it an expiry. The semantics are: *the author believes that matching this pattern means something*. A producer can publish an indicator having never seen the pattern fire anywhere; it can be derived from a sample, from a report, or from a guess. It carries the producer's confidence, not truth. **`observed-data` — a claim about the past.** It carries `first_observed`, `last_observed`, `number_observed` and, in 2.1, `object_refs` pointing at the STIX Cyber-observable Objects (SCOs) that were seen: a `domain-name`, an `email-addr`, a `file`. The semantics are: *these artefacts existed here in this window, this many times*. It makes no malice claim whatsoever. A `domain-name` observable inside observed-data is not an accusation; it is a note that the name appeared. **`sighting` — a relationship, not an object about a thing.** It is an SRO with `sighting_of_ref` (the indicator or other SDO that was matched), `count`, `first_seen`/`last_seen` and `where_sighted_refs` (an identity, i.e. who saw it). Semantics: *someone's tooling matched this*. A sighting count of forty across nine member organisations raises the community's belief that the indicator is worth acting on. It does not establish that any of the nine was compromised, and it does not establish the pattern is precise; forty matches on a shared marketing domain is forty false positives. ## Why the distinction has consequences An ingest pipeline that flattens all three into "an IOC row" loses the ability to answer the questions that matter: - **Can I block this?** An indicator with a tight pattern and a relationship to a malware family, marked with a confidence, is blockable. A bare observable lifted out of observed-data is not — it may be a legitimate host the intruder abused. - **Should I still be looking for it?** `valid_from` and `valid_until` on the indicator say when the claim was believed to hold. Observed-data timestamps do not carry that meaning, so a pipeline that ages content by observation time expires the wrong things. - **Why is this here?** The reason lives in the edges. An `indicator` with an `indicates` relationship to a `malware` object, which in turn has a `uses` relationship from an `intrusion-set`, is intelligence. The same indicator with no edges is a string. ## How the two platforms model this **MISP** organises around an **event** — a container with a date, a distribution level, tags, and a list of **attributes** (typed value plus category, e.g. `domain|ip-src|md5`). An attribute has an `to_ids` flag that decides whether it is meant to be pushed to detection tooling, which is MISP's version of the indicator-versus-observation distinction. MISP **sightings** are a separate count of who reported seeing the attribute. There is no direct STIX equivalent of the event container itself; exporters typically render it as a `report` or `grouping` object, and some of the event's context becomes free text. **OpenCTI** is STIX-native: what it stores *is* the object graph above, with connectors ingesting MISP, TAXII collections and vendor feeds into it. That makes relationship-heavy work natural and makes round-tripping a MISP event through it slightly lossy in the other direction, because a graph does not want to be re-flattened into a dated container. The practical takeaway for an interview: know that a MISP attribute with `to_ids` set is close in intent to a STIX indicator, that a MISP attribute without it is closer to an observation, and that neither platform's model maps to the other without decisions being made. ## The direction errors to avoid saying out loud - "An indicator means it was observed." No — that is observed-data. - "A sighting means the org was compromised." No — it means a pattern matched. - "An IOC and a TTP are the same thing at different sizes." No — an indicator is an artefact-level pattern, a technique is a behaviour, and only the behaviour survives the adversary changing infrastructure. - "The bundle told us it was malicious." A bundle told you what a producer asserted, under a marking, at a time.