misp-taxonomies
misp-taxonomies copied to clipboard
New taxonomy to describe current state of takedown / cleanup / other actions on indicator
Let whoever is "accused" of having compromised infrastructure to respond / mark data as cleaned up / resolved / being worked on, etc.
Hi, we kind of use:
-contact failed (wrong number, out of office hours, etc.) -no reponse yet (i.e. waiting for a response) -demand acknowledged -action refused -action confirmed
HTH