An Opinion is a subjective assessment of the accuracy of the intelligence data. The opinion captures the level of agreement or disagreement using a fixed scale. The fixed scale also supports a numeric mapping to allow for consistent statistical operations across opinions.

For example, an analyst from a consuming organization might say that they "strongly disagree" with a Campaign object and provide an explanation about why. In a more automated workflow, a SOC operator might give an Indicator "one star" in their TIP (expressing "strongly disagree") because it is considered to be a false positive within their environment.

Opinions are subjective, and the specification does not address how best to interpret them. Sharing communities are encouraged to provide clear guidelines to their constituents regarding best practice for the use of Opinion objects within the community.

Because Opinions are typically (though not always) created by human analysts and are comprised of human-oriented text, they contain an additional property to capture the analyst(s) that created the Opinion. (STIX Version 2.1)
​
​Adding Opinions

1. Click on +Add new.

2. Under Opinion click on the arrow, from the drop-down menu select your level of agreement or disagreement with the intelligence item.

3. Finally, you have the option to include an Explanation for why you chose your level of agreement. For example, if an opinion of strongly-disagree is given, the explanation can contain the reason you disagree and what evidence you have for the disagreement.

4. Click Save when you are done, or Cancel. You can add as many Opinions as needed to your object. To make edits to an Opinion click the pencil icon. To delete it, click the trash can icon. Click on the arrow below the opinion's except to expand.

Related Content