the dogesec blog

A proposal for a portable Sigma Investigation Guide format that helps security agents and analysts investigate alerts consistently, auditably, and across platforms.

PAP explains what recipients are allowed to do with intelligence, not just who they can share it with. This post covers why that distinction matters and how OASIS models PAP in STIX 2.1.

Vulmatch models CVEs and CWEs as first-class STIX objects. This post explains why coupling a CVE to a CWE reference is not enough, how cwe2stix defines a Weakness SDO, and what that unlocks in practice.

A practical approach to modelling Admiralty Codes in STIX 2.1 using Marking Definitions and Extension Definitions, with reusable objects you can adopt in your own CTI workflows.

Learn how the Cyber Threat Exchange helps researchers publish structured CTI in STIX 2.1 and lets defenders operationalise specialist intelligence through TAXII, APIs, and existing CTI tooling.

Most ATT&CK programs model tactics and techniques, but not procedures. This post explains why that gap matters, where Attack Flow helps, and how STIX could model the missing layer.

Known ATT&CK techniques are not just for labeling incidents. This post shows how to use them as anchors to infer likely predecessor and successor behavior in a realistic adversary sequence, and how MITRE TIE can support that workflow.

D3FEND becomes far more useful when it is not isolated. This post shows how D3FEND links to ATT&CK and CWE through artefacts, so you can traverse from offensive technique or weakness to concrete defensive mitigations.

Most AI CTI workflows waste tokens rediscovering ATT&CK, CWE, CAPEC, and other CTI knowledgebases from scratch. CTI Butler fixes that by giving agents a structured retrieval layer. In this post I show how to turn it into a Claude Code skill that recommends likely mappings from raw analyst input.

Learn how to avoid ad-hoc custom objects by generating schemas and Extension Definitions automatically with stix2extensions, keeping STIX extensions interoperable by default.