Lecture 26

Alright, good morning. So, now we are moving on to a new topic regarding threat intelligence, right. So, threat intelligence is very important because an organization needs to know what are the different threats that might affect its network or infrastructure. And in order for it to know what kind of threats are currently active in the environment for a specific sector or specific nations or specific geographical location etcetera, they need to figure out what is going on and what are the indicators for those threats. Because threats usually means that attacks are happening, otherwise how would I know that there are threats. Of course, I can get some threat information from dark web and telegram groups and other places where chats and you know various kinds of exploits might be sold in the forums, in the dark web and so on. And therefore, I might be able to also get some information about various malware that might be going to be used and so on. Or what kind of command and control URLs or command and control IP addresses or what kind of TTPs are going to be used for attacks and so on. So, this kind of information every organization needs to, every organization needs to actually get this kind of information on a regular basis, actually on a daily basis. And there are companies which actually collect such information and they actually then share this kind of information. And when they share this kind of information, they might send, share this in natural language, right. So, if you send it in natural language, what would happen is that the organization when they receive that threat intelligence, they have to convert it into a machine readable form. So, that this threat intelligence can be fed into various tools. For example, if I have to, if I know that there are certain command and control URLs or IP addresses, I have to make sure that my firewall has been fed that information, that firewall can block those IP addresses or URLs and so on. Similarly, if I know that there are certain malware hashes are being seen, then I might want to send that information to all my, all my endpoint detection or of course, the network intrusion detection systems, so that they can look for those hashes. So, making such information machine readable is, you know, quite a bit of work and most organizations may not have the right level of expertise or people to actually convert natural language reports of threats into machine readable form. And that is how the, this language, this formalized language called STICS or Sharing Threat Intelligence for Sharing Threat Intelligence has been developed. And currently, the version that is going on is STICS 2.1 and what we are going to do is to see what is STICS and what is, what does it look like, what kind of data model does it have and how to write threat intelligence information in STICS format. And the interesting thing is that not only they have developed STICS, they also have developed a protocol called TAXI. So, the TAXI servers, so TAXI is kind of like a server where the threat intelligence generators, that is, companies that develop threat intelligence information, they develop it in the STICS format and then they put it into the TAXI servers and its subscribers, so anybody who buys that threat intelligence will automatically communicate with the TAXI servers to actually get the threat intelligence and have the automation to actually have the threat intelligence fed into all its necessary tools like firewalls and intrusion detection system and so on, so that that threat intelligence is then processed and accordingly rules and configurations of those defense protection systems will be updated. So, this is when you go for threat intelligence companies where you buy the threat intelligence. There are also organizations such as CERT, Computer Emergency Response Team or CERT, in India it is CERT-IN. There are also sector specific CERTs, for example, there is CERT-FIN which is for financial industry like banks and so on, there could be CERT-POWER. In fact, there are CERT-HYDROS, CERT-THERMAL and CERT-RENEWABLE, this kind of CERTs are also there. These are sector specific CERTs. Now their job is also to generate threat intelligence based on any kind of research they do, any kind of threat intelligence information they receive from other organizations around the world, their peer organizations. Similarly, NCIIPC, the National Critical Information Infrastructure Protection Center, they also share threat intelligence using STICS format. So, even if you do not subscribe to the threat intelligence from expensive threat intelligence companies like Recorded Future, etc., you can, UNIT-42, etc., but you may still receive threat intelligence for free from CERT-IN and other places. So, this is a very, now very common way in which organizations can receive threat intelligence and just by receiving threat intelligence, you know, is not enough, you have to then act on it. And if you use the STICS format, then most tools nowadays like firewall, if you buy a firewall from another company, etc., they actually speak the language of STICS. Therefore, they will be able to automatically process that information and accordingly change their rules or signatures and configuration, etc., as per requirement. So, that is why STICS is very important. There is a, STICS was, is maintained by a group called WESIS group and they have a website, I will show you where you can find more information for those who are more interested in knowing about how threat intelligence is created and collected. So, the main idea here is that you have to have machine readable threat intelligence, right. So, or what we call MRTI, CTI, Cyber Threat Intelligence, TI, Threat Intelligence, these terms are very commonly used and MRTI means Machine Readable Threat Intelligence. So, the goal of this whole thing is that since data is transferred in lightning speed, threat is also spreading in lightning speed and therefore, I have no time to actually tell you in natural language that this be careful about this particular URL or IP address or this malware hash or this kind of threat actor, this kind of TTPs are happening and then you will actually process that information and then act on it, it is going to be too late. So, therefore, the idea is that if you want to make this threat intelligence effective for helping out a lot of organization, then you have to automate the process of sharing threat intelligence and that is the basic idea behind creating this language. So, MRTI has three components, one is STICS, this is the structured, the STICS stands for Structured Threat Information Expression, TAXI, it is the Trusted Automated Exchange of Indicator Information and CYBOX is the Cyber Observable Expression. This is rather less, this is in the MITRE, you can find it in the MITRE website. So, we will focus on these two, the STICS and the TAXI. So, TAXI is the protocol for sharing threat information securely between a threat intelligence creator and threat intelligence consumer. Now, STICS aims to get a graphical model, right. So, let me first show you what a STICS model looks like, right. So, here is what we call a STICS visualizer, right. So, STICS visualizer, so here you see that I have, let us see, so I have the STICS file that describes a particular threat and here are the legends used in this graph. So, here you see that here I have, this is an indicator and this is an indicator. I will explain what indicators are. This is an indicator, now this legend is for malware, so this is a malware and this legend where you have a person, this is a threat actor, right. And then we have a threat report, so it is a report and it is a marking definition. So, we will come to all this, what these things mean, but you see that here I have a particular threat indicator, a particular type of traffic here. So, I have a particular type of traffic which is an indicator. Here I see C2 traffic, the command and control traffic, probably an URL or something and then here is an infected host, right. So, what is happening here? Here is a malware, right. So, these indicators you see that this C2, this like if you find in your organization traffic going to this command and control server or if you find this infected infection or if you find this particular traffic threshold like this is a DOS threshold traffic, then you know, see all of them are pointing to this malware. So, if you find these indicators, you can kind of assume that this is the malware that is in your organization and then you can also, there is another indicator here which also has to, is indicating this. Now, this information is also saying that this particular threat actor, in this case unnamed is actually uses this malware to do this to and this malware can be indicated by these indicators. So, if you see these indicators, you can kind of hypothesize that your system has been infected by this malware and this malware is associated with this particular threat actor and here is a report. So, the report is a top level object. Basically, what it is saying is that this threat intelligence information is basically reporting. So, it is referring to a particular threat actor, it is referring to a particular malware, it is referring to certain types of indicators. So, this is the overall, this report contains all this information and marking definition is basically, something we will see later that whenever you share threat intelligence, you may mark it by saying that this has, this can be shared widely or this can be shared only within the organization, this can be shared within, only within the sector, this kind of stuff. So, there is a marking associated with this report, which basically says, who it can be shared with. So, what this tool, this is called a STIX viewer, you can use, you can take a STIX file and use this viewer to actually see this graphical representation of this threat information. Now, in some cases, this is a very small report, right, it has one threat actor, four indicators and one malware, right. But in many cases, you will have many other elements to this, it can be part of an attack pattern, it may be part of an intrusion set, it may have a campaign associated with it and so on. So, sometimes this picture will be very, very complex, right. So, this is a simple one. And if you can see that, if I select a particular node, for example, if I select this, it is showing me that the structured information, the structured information has multiple different things, like it has a type, in the type of this object is that it is an indicator, it is, it has an ID, this ID is required to uniquely identify this. Then I have the creation time, I have the creation time, I have the modification time, I have the name, I have some label and then I have some description, this is a textual description, it says when this indicator is valid from and then it says which kill chain phases this is, this particular indicator is visible, right. And then it says a pattern, so this is, since this is an indicator, it has a, this is a basically a URL. So, an URL is an indicator. So, as an URL, this indicator has, I think I am now looking at this one, right. Now, this is a different one, this is a windows registry key, right. So, this registry key will tell you that your host has been infected, right. So, this is a, so this structured description is what you need to, you know, write this indicator in a format that is not only machine readable, but it is also unambiguous, that is the, any other tool that is aware of STIX language will be able to process this information and accordingly do the necessary configuration changes, so that it can detect this indicator and so on. So, that is the, that is the overall look of this, but what I want to do, I want to teach you the language of STIX for three reasons. One is of course that you learn that threat intelligence can be actually made machine readable and unambiguous, so that it can be processed by algorithms to change the posture of firewalls and intrusion detector or endpoint agents and so on, so that they can be better at, they can be more current on the threats that they might be fighting, right. So, otherwise they will be or they have to be, see the other way, other way would be to hard code the indicators in inside your tools, right. So, for example, you can say, okay, I will put all the firewall rules in the beginning and then if I have to change any rule, then I have to bring it down and then restart it, right, put, change the new rules, put the new rules and then restart it, but that is not practical because you cannot take down the protection software and change it and then, so you have to actually dynamically be able to process this kind of information and change the posture of that software or equipment to actually do better at fighting the threats that are new, that are coming as threat intelligence, you know, in real time. So, that is the idea, so that is one reason why STIX is an important concept that everybody needs to know if they are going to be in charge of protecting your infrastructure plus you can get STIX information not only from vendors who are going to charge you money for subscription to their taxi service, but also the, you can subscribe to the taxi servers of CERT and sector specific CERTs and ISACs and various other, you know, voluntary organizations or government regulatory organizations who share threat information. The second thing is that you get to know that this kind of language, this structured language has a very important role in all of software engineering including cyber security tools, right. Because nowadays, you will see that even configuration files are created using structured JSON, you know, using JSON syntax basically, right. So, in this case also, it is a JSON syntax that is being stylized for this specific purpose to create the language for STIX, right, so it is basically a data model. And then the third thing is, third reason is of course that I want to give you a homework in which you have to take a threat report and write the corresponding STIX, right, so that is the third reason why you are doing this, right. So now, here is your different types of objects, right, so we already saw this picture, right, so like we have an indicator which indicates something, this is like it may indicate a presence of a threat actor, it may indicate the presence of a campaign, an attack campaign and this campaign may be attributed to a threat actor like for example, APT28 for example. And then you can also say what vulnerabilities it is targeting, right, so there are various types of objects. For example, here you see you have a indicator object, you have a threat actor object, you have a campaign object, you have a vulnerability object and so on, right, so these are different types of objects and each object can be described in a certain fashion, right, with certain attributes. So, now this components of STIX model, first thing is called STIX domain object, so we see what these domain objects are. For example, campaign is a domain object, indicator is a domain object, threat actor is a domain object, so these are specific type of objects. There is also another object called cyber observables, anything that you can observe like for example, a file or an URL or something or an email message etcetera, these are cyber observables and then you have relationship objects. Relationship objects usually relates the domain objects to the cyber observables or maybe it can also relate to domain objects or to I guess observable objects. There is also a extension definition object, this is for because this is kind of object oriented, so there is a derivation process by which you can extend an object, so that is there. There is also meta object and bundle that is when all the objects for a specific threat intelligence has been created, you put them in a bundle, so there are some meta objects and bundle is the top level object. And then there is a patterning language like if you like regular expression is like a patterning language, so this is a little more than regular expression, so there is a patterning language, so these are 6 components of the STIX 2.1 data model. So what we are going to do now is to actually look at the various domain objects, because they are the most important part of the STIX you know data model and this domain objects I am describing in the order of alphabetical order. So there is not it is not like I am talking about attack pattern object first means that attack pattern object is the most important object nothing like that I am just going through I basically took this from the manual and the manual basically goes through all this object descriptions in a in an alphabetic order, so attack pattern right. So example of an attack pattern is spear phishing right, so spear phishing is an attack pattern or it may be a DDoS may be an attack pattern. So whenever you might describe an attack pattern right, so you can say attack pattern is a type of TTP that describes a way a threat actor attempt to compromise targets. So I want to capture what is it that this particular threat actor does, so I can describe that as an attack pattern object, attack pattern is used to help categorize attacks, generalize specific attacks to patterns that they follow and provide detail information about how attacks are performed. So we will see an example, so spear phishing would be an attack pattern, but you can also have more specific attack patterns. For example, a spear phishing as a practice by a particular threat actor right, for example they use a like a may be a particular threat actor always uses a lottery winning type of phishing message. So that could be as a more specific attack pattern if I want to be more specific. So here is what the attack pattern object requires. So if I want to describe an attack pattern, I can describe the attack pattern with these attributes right. So attributes what is happening, so I have to see I have to tell the values of this attributes right. So those of you who know JSON, in JSON I can basically write this colon the type a string that basically describes this type, spec version you can say for example colon the string that describes the spec version. In this case this is TICS 2.1, the ID of the attack pattern, the ID has to be a unique string identifying this attack pattern object. Why because if I in a relationship object, if I want to describe that this attack pattern is used by so and so threat actor, there is also a threat actor data object. So I have a threat actor data object and I have the attack pattern data object, I have to relate the 2. So I need the this unique ID for this attack pattern to do that relationship. These are information like when was this object created, if it has been modified since those things, R here means that it has it is required. So if I want to create an attack pattern object, I must fill in these attributes and these attribute, it have to give it a name right. Other ones are optional for example, created by revoked, whether it has been revoked, labels, confidence with which this attack pattern is being put out as a threat intelligence information, language associated with this attack pattern, some external references it might give you additional documentation references to by using an URL, object marking references. This is about as I said that you know about marking has many different usage, but in this case it may be about who it can be shared with, how widely it can be shared, there may be more granular marking and there may be an extensions in case there will be a derivation from hierarchical derivation from this object. And then here you can give a description as a string, you can give some aliases for this attack pattern and then you can also describe the kill at least the kill chain phases in which this attack pattern has been is using right. So all this information can be put into a JSON format yes, yeah at least locally unique right, global to you cannot do right, so but locally at least it has to be unique correct in what sense, now so the taxi server is actually have authentication, encryption and all that stuff. Now, integrity of this sticks files from the threat intelligence company is their responsibility, so you cannot guarantee this here, because they might keep a hash of the every file and continuous continue to check and all that stuff, but that is their responsibility for you it is difficult to check, I mean you will not be able to check whether it has been tampered with since its creation, yeah. Now, so two companies might give you the see if they created their own threat, they might also have derived it from the let us say site US site right, in that case they may have same ID and all that stuff, but in case they have actually created on their own it is unlikely that ID's will match right. In fact, if to you let us say say two companies you have subscribe to two companies and they are actually describing the same attack pattern, but you will not know that they are the same attack pattern, you will treat this as two separate threat intelligence. Later on by the by now now this by itself the attack pattern is not very useful right, what will happen is that this attack pattern will be related to some indicator objects, see only way you can you can use the threat intelligence in your system in your organization is through the indicators. See if you see that you know indicators could be a C 2 say CNC URL, it could be a malware, it could be a registry change, it could be a particular type of file or hash value etcetera these are indicators right. So, let us say let us say one company saying that when you see these indicators that is that is associated with this attack pattern and this attack pattern is associated with threat actor let us say APT 28 right. You go to another company let us say Microsoft from which you again got a stick and you saw some indicators and then using that threat intelligence you will see that if you if you see the same indicators you will relate that to a particular attack pattern id which is associated with fancy bear right. Now, fancy bear and APT 28 are the same right is considered to be the same. So, later on that part you have to do manually right, so when you are interpreting when you are catching a particular attack pattern in your system obviously, you are not then are doing automation, you are then in the incidence response phase right. At that point when you see I have threat intelligence that is telling me that I have indicators of fancy bear and I also have indicators of APT 28, then I will see whether they are the same or I am now being attacked by 2 different threat actors. And at that point you will consult you know Google or whatever or companies that will help you out and they will say this is the same, but at the same point in time you may be attacked by 2 different threat actors as well right. So, the idea is that all this threat with all the threat intelligence is doing is increasing your capability to associate indicators to particular threat actor or particular attack pattern. And then rest activity that is incident response activity is separate that this thing does not help, this thing only helps you use the indicators and know what indicators to look for, because indicators continue to evolve right like you know today you have some indicators some C2C same threat actor may actually next week change their C2C IP addresses right which they do. So, unless you are subscribing to a feed like this you will not know that right. So, in that case you will see a traffic to a different IP address and you will say this is not in my threat intelligence. So, I am not going to do anything about it that to avoid that I need to have continuous updation of threat intelligence. So, then the next SDO is campaign SDO. So, campaign SDO is basically is a grouping of adversarial behaviors that describes malicious activities or attacks sometimes called waves that occur over a period against a specific set of target. Now, campaigns usually are part of what is called an intrusion set intrusion set. So, let us say APT 28 right. So, APT 28 did a campaign during the during the COVID time by using a supply chain attack on solar wind right. So, all of us remember solar wind attack. So, that was APT 28, but APT 28 also does many other attacks right. So, it is APT 28 is not just doing that solar wind attack. So, if I want to have threat intelligence about APT 28, I may describe an attack pattern that APT 28 is using for the solar wind attack. In that case it was a supply chain compromise right and they use a specific malware. Tomorrow APT 28 is using a different set of malware and different C 2 infrastructure. So, and different attack pattern they might be doing a spear phishing as well right. So, I have multiple attack patterns associated with APT 28, but also I have different campaigns associated with. So, solar wind campaign is different from another campaign done by APT 28 and there are probably hundreds of campaigns of APT 28 including on the Ukraine during the Ukraine war right. So, I will describe each of these campaigns separately, then all these campaigns may come as part of what we call an intrusion set object. Intrusion set contains multiple different campaigns which is now associated with APT 28. So, APT 28 will now be associated with an intrusion set which contains multiple campaigns and each campaign may contain multiple attack patterns and a multiple attack each attack pattern may contain multiple indicators right. So, this is the how the entire thing is. So, now, you might say that what good is it because all I need is indicators right. Why do I need to know whether this indicators are part of a particular attack pattern or particular campaign or intrusion set? I might as well just get the indicators and I just stop banning those indicators. So, if I see a particular C 2 traffic which I know is an indicator for certain APT I will just ban that traffic and if I see a particular malware I will quarantine that malware, if I see a particular IP address I will you know stop that IP address and so on. The reason is that eventually you need visibility about what is happening in your system right. The say the indicators suppose you only know the indicators right and you are being attacked by some group of thugs in sitting in Noida versus APT 28 right. You want to know that the indicators I am seeing I know it is an attack right I am going to stop those IP addresses and so on, but I also want to know what is the situation with respect to me right I mean am I being targeted by some not so sophisticated thugs sitting in some place Noida or some place or am I being attacked by the most resourceful attacker in the world you know one of the most resourceful attacker in the world APT 28 right. So, I need additional information not because that will help me automate. So, only thing that helps me automate is the indicators mostly right, but this additional information enriches my incident response capabilities and my you know ability to understand respond and recover right and communicate. For example, if I am getting attacked by APT 28 I am I should be very careful because that means, that I am in the for some reason my business is in the target of a nation state attacker right versus if my business is a target of a regular cyber criminal right. So, that is why this enrichment enriched information of threat intelligence will help me to actually know what is going on inside my system and that is why this attack pattern campaign etcetera useful. So, campaigns can be characterized by their objects of objectives and incidents they cause people resources the target etcetera. So, for example, this is 2016 Acme bank. So, a particular crime syndicate used particular C 2 servers and a specific malware to attack Acme bank during 2016 summer and they were and the objective was not to get money or something they were trying to get secret information about an upcoming merger with another bank. So, that they can do insider trading right. So, that was a campaign right that was a specific campaign. So, now, here is what it looks like. So, here is a campaign this is a spec version id you see the id to make the id unique there is a randomized string generation usually if you have a software that helps you software editor for sticks creation that will help you to do this unique ids creation date modification date etcetera name and this particular campaign has been named admin at 3 3 8. So, this is a Chinese threat actor and it is there is a description which is optional where it says what it is first seen is date last seen date is not there objective is not there, but you can put this additional information if you have them right. But these are once you have to provide. So, when this threat intelligence comes. So, campaign by itself will not come to you right. So, campaign will come with corresponding attack pattern corresponding threat actor corresponding indicators all that stuff right. So, this is I am just showing you a fragment of a sticks file. So, nobody is going to send you a campaign SDO as threat intelligence without any indicator or anything right because it is not going to be useful for you if you just get this. So, now, there is another SDO called course of action. The course of action SDO is thought of as a way to provide automation for what to do when an indicator is seen right, but right now in the current version it does not have the capability to provide automation instruction. So, it only provides prose information about what course of action to take when you see a particular campaign or when you see a particular attack pattern or something. So, you can give a textual description of what course of action to take when you see something, but in the future it is supposed to be containing instruction for automatable responses like applying patches reconfiguring firewalls etcetera right. So, right now the firewall company has a responsibility to automate. So, when it gets a sticks file it automates certain things or if it wants to automatically block or something it is the firewall company that will give that as a feature. This is not part of the language the language does not say anything about what the firewall company should do. So, every firewall company will do different things right as response to a finding a particular indicator. So, it is a textual description of action. So, it is a reserved action property also serves as a placeholder for future inclusion of machine automatable courses of action. So, courses of action here is a SDO that has a course of action type id created by creation date modification date name it says analyze with fire eye calamine tool set. See it is not giving you a script to do so, it is just saying so. So, eventually your intrusion detection system might when this course of action will be associated with a particular indicator your intrusion detection system might flash to you that this is what you should do right that depends on the intrusion detection tool vendor. And then it is giving a description that calamine is a set of free tools to help organizations detect and examine poison IV infection in the system. So, this is a particular malware the package includes those components these components PIV call back decoding tool and memory decoding tool etcetera. So, you can and the source name is external reference. So, this is additional information. So, this is in the future probably this particular one will be very useful right now it is just additional information and your tools the intrusion detection tools etcetera might be able to use it in some way to help you as a as a help message or something, but it is not going to automate anything. The grouping SDO grouping SDO is the how you group different objects. So, this is like so, we already saw multiple objects right. So, we saw this object like course of action object we saw an example of a campaign object we saw example of well we have not seen any other, but so, while you are actually creating threat intelligence. So, you I am a threat intelligence company and I am a threat analyst and I am creating this threat intelligence information which I will sell to my subscribers right or I am I am certain in that case I am not selling, but I am going to I have a pressure on me to share threat intelligence as soon as possible with all constituents because they have to be protected against this particular campaign and so on and I got the threat intelligence information. So, I first look at indicator. So, I create some indicator objects right. So, I have I create the JSON structures saying that this is the this is a malware this is a URL this is a this is a registry key change all that stuff. These are the things that are going to be seen as part of this threat intelligence also I suspect that this is this threat actor and also I suspect that this is the this is based on this attack pattern. So, I am writing multiple SDO object right now I want to also I am going to work with another analyst who is also going to help me to add additional because this is time consuming activity to create correct sticks objects right. So, what I do is I create a group. So, I create put it in a grouping object the grouping object basically groups related objects which are related to a particular campaign particular threat actor whatever and this is kind of not useful for doing any protection or anything this is useful while creating the threat intelligence because I basically shared the group with another person. So, he can enrich it by adding additional objects inside right. So, that is what grouping object is. So, grouping is not so, important, but you will see a lot of grouping there. So, grouping has all these things type spec version id created modified and there should be a context. So, there should be a shared context and some object references the objects that are grouped together that their references by their ids should be there. So, this when we actually look at multiple examples of his sticks you will see a lot of grouping right. So, grouping is something that is more for convenience of you know sharing the responsibility of creating a shared sticks file. Identity SDO is you know identity is important for any threat intelligence. For example, I might want to say that these threat intelligence pertains to this particular sector power sector or finance sector or I might want to say that this group like the reliance group has been targeted with this particular organization or educational institutes are being targeted by this particular threat actor. So, I may want to add identity information. So, identifying information contact information and sectors the identity belongs to and they are used among other things as target of attacks information sources object creators threat actor identities and so on. So, here are here is an example FireEye as you know is a threat intelligence company. So, it is an identity it is an organization it sector is technology and this is the information. Now, why I have I created this because later on in my larger sticks file I might say what is the source of this information right. Source of this information may be FireEye. So, at that case I will use this ID to associate the top level object the bundle for example, or the report object to this identity. So, this identity is useful to give that kind of information and again this information is not going to help me protect myself as such because as I again and again said that only thing that protects me is the indicator information right everything else is additional information. However, in my tools let us say I have a SOC and the in the SOC I am showing in that I am I am right now having an incident happening. How do I know an incident happening? Because I am seeing the indicators that that my threat intelligence is telling that if you see this URL traffic and if you see this malware etcetera, then you know that you are being attacked by this kind of a campaign. Now, when I am showing this to SOC to SOC analyst that look there is an incident in progress and because I am seeing this indicators I also may want to tell him that this information comes from FireEye right. So, that you know he knows where this information coming from who is telling that this indicators are indicative of some kind of a problem. So, therefore, this kind of information is additional enrichment of the threat intelligence information. Now, incident object is again a stub it does not have much it is included to support use cases right. So, what constitutes an incident right? So, if you see this indicators can you say that right now I should treat this as an incident. So, that is what this incident SDO says. So, it has all these things it has a name, but it may also have other things like which sector this incident is from contact information and so on right. So, now, this is the most important one this is the indicator SDO, but I am run out of time. So, I am going to stop here, but what I would like to do is to discuss this in an extra class on Monday evening I will email you I would like to see if I can get a room where I we can do this, because this is going to take some time I am like I am on slide sixteen out of one hundred and one slides. So, I have to I have to get some additional classes, but you do not have to memorize everything that we are saying here right you get the basic concepts what is this sticks for what are the different types of sticks objects and what are those objects used for you do not have to know like what are the attributes of each sticks object and so on right. So, that is what is important. So, the you do not get intimidated by the number of slides it is not the concept is pretty simple right all right.