{ "type": "bundle", "id": "bundle--f20e798e-71a5-5531-a067-9e4b3003ef2e", "objects": [ { "type": "marking-definition", "spec_version": "2.1", "id": "marking-definition--34098fce-860f-48ae-8e50-ebd3cc5e41da", "created": "2017-01-20T00:00:00.000Z", "definition_type": "tlp", "name": "TLP:GREEN", "definition": { "tlp": "green" } }, { "type": "identity", "spec_version": "2.1", "id": "identity--6e60c19e-e7a7-5408-8071-86c183c7bcb4", "created": "2026-07-26T00:00:00.000Z", "modified": "2026-07-26T00:00:00.000Z", "name": "METEORSTORM", "identity_class": "organization", "description": "METEORSTORM Analytic Layer (AN) enumerated taxonomic elements, Kestrel Orbital Day-1 CONOPS." }, { "type": "x-meteorstorm-analytic", "spec_version": "2.1", "id": "x-meteorstorm-analytic--c97e1ecf-6be4-5cbb-b136-1ba4d3e786f4", "created": "2026-07-26T00:00:00.000Z", "modified": "2026-07-26T00:00:00.000Z", "created_by_ref": "identity--6e60c19e-e7a7-5408-8071-86c183c7bcb4", "name": "AN:THR:Threat:00", "layer": "AN", "tag": "THR", "label": "Threat", "ordinal": "00", "source": "observable", "target_type": "TOE", "target_ref_eten": "SVC:CP:Control Plane:09", "description": "State-sponsored actor with demonstrated capability to gain persistent access to SATCOM management networks and abuse the provider-to-customer trust relationship to push malicious modem updates (KA-SAT / AcidRain class). Source: composite OSINT threat assessment read against the peer-reviewed research paper.", "eten": "AN:THR:Threat:00:State-sponsored actor targeting the ground ACA management plane to push malicious modem updates.", "object_marking_refs": [ "marking-definition--34098fce-860f-48ae-8e50-ebd3cc5e41da" ] }, { "type": "x-meteorstorm-analytic", "spec_version": "2.1", "id": "x-meteorstorm-analytic--5a56f366-fb47-5f07-8ca9-1fc10fd54854", "created": "2026-07-26T00:00:00.000Z", "modified": "2026-07-26T00:00:00.000Z", "created_by_ref": "identity--6e60c19e-e7a7-5408-8071-86c183c7bcb4", "name": "AN:THR:Threat:01", "layer": "AN", "tag": "THR", "label": "Threat", "ordinal": "01", "source": "observable", "target_type": "TOE", "target_ref_eten": "AST:SW:Software:04", "description": "Cleared operator with command authority misuses the commanding console software to issue unauthorized telecommands to the vehicle. Source: insider-threat reporting, MITRE ATT&CK T1078 Valid Accounts.", "eten": "AN:THR:Threat:01:Cleared operator misusing the console software to issue unauthorized telecommands.", "object_marking_refs": [ "marking-definition--34098fce-860f-48ae-8e50-ebd3cc5e41da" ] }, { "type": "x-meteorstorm-analytic", "spec_version": "2.1", "id": "x-meteorstorm-analytic--27711459-18c0-5fb1-a2b8-4d90c7535d82", "created": "2026-07-26T00:00:00.000Z", "modified": "2026-07-26T00:00:00.000Z", "created_by_ref": "identity--6e60c19e-e7a7-5408-8071-86c183c7bcb4", "name": "AN:THR:Threat:02", "layer": "AN", "tag": "THR", "label": "Threat", "ordinal": "02", "source": "observable", "target_type": "TOE", "target_ref_eten": "AST:SI:Signal:00", "description": "RF actor sustains noise injection across the uplink and downlink bands to deny command and telemetry to the vehicle. Source: ITU interference reporting, documented SATCOM jamming campaigns.", "eten": "AN:THR:Threat:02:RF actor jamming the uplink and downlink waveforms to deny command and telemetry.", "object_marking_refs": [ "marking-definition--34098fce-860f-48ae-8e50-ebd3cc5e41da" ] }, { "type": "x-meteorstorm-analytic", "spec_version": "2.1", "id": "x-meteorstorm-analytic--b65cd220-eb55-5e34-90ea-4750fe71dd41", "created": "2026-07-26T00:00:00.000Z", "modified": "2026-07-26T00:00:00.000Z", "created_by_ref": "identity--6e60c19e-e7a7-5408-8071-86c183c7bcb4", "name": "AN:THR:Threat:03", "layer": "AN", "tag": "THR", "label": "Threat", "ordinal": "03", "source": "observable", "target_type": "TOE", "target_ref_eten": "AST:FW:Firmware:01", "description": "Adversary subverts the flight-software update supply chain and pushes a backdoored firmware image to the on-board computer over the command-and-update path. Source: NIST SP 800-193, SolarWinds supply-chain reporting.", "eten": "AN:THR:Threat:03:Adversary pushing a backdoored firmware image to the on-board computer over the update path.", "object_marking_refs": [ "marking-definition--34098fce-860f-48ae-8e50-ebd3cc5e41da" ] }, { "type": "x-meteorstorm-analytic", "spec_version": "2.1", "id": "x-meteorstorm-analytic--36c2a36e-85b7-5779-8214-f1a674e9060c", "created": "2026-07-26T00:00:00.000Z", "modified": "2026-07-26T00:00:00.000Z", "created_by_ref": "identity--6e60c19e-e7a7-5408-8071-86c183c7bcb4", "name": "AN:ATT:Attack Path:00", "layer": "AN", "tag": "ATT", "label": "Attack Path", "ordinal": "00", "source": "observable", "target_type": "TOE", "target_ref_eten": "SVC:CP:Control Plane:09", "description": "Anchored to the ground ACA management plane, SVC:CP:Control Plane:09. Pivot: entry through the external VPN appliance into the management network, abuse of the ground ACA, through the ACA software (AST:SW:Software:02) and credential store (AST:DA:Data:01) onto the patch path (SVC:CP:Control Plane:12), objective a wiper pushed as a firmware update, modems bricked. Source: Space ISAC advisory, KA-SAT / AcidRain reporting.", "eten": "AN:ATT:Attack Path:00:Management-plane entry pivoting through the ground ACA onto the patch path to push a wiper as a firmware update.", "object_marking_refs": [ "marking-definition--34098fce-860f-48ae-8e50-ebd3cc5e41da" ] }, { "type": "x-meteorstorm-analytic", "spec_version": "2.1", "id": "x-meteorstorm-analytic--b108b7ce-d4e4-5899-bea9-b0d0eb335b8b", "created": "2026-07-26T00:00:00.000Z", "modified": "2026-07-26T00:00:00.000Z", "created_by_ref": "identity--6e60c19e-e7a7-5408-8071-86c183c7bcb4", "name": "AN:ATT:Attack Path:01", "layer": "AN", "tag": "ATT", "label": "Attack Path", "ordinal": "01", "source": "observable", "target_type": "TOE", "target_ref_eten": "AST:SW:Software:04", "description": "Anchored to the console operator software, AST:SW:Software:04. Pivot: authenticated operator on the console software issues unauthorized telecommands through the satellite console service (SVC:CP:Control Plane:13), bypassing single-operator review at the ground ACA (SVC:CP:Control Plane:09), objective an out-of-profile command to the vehicle. Source: insider-threat reporting.", "eten": "AN:ATT:Attack Path:01:Authenticated operator issuing unauthorized telecommands from the console, bypassing single-operator review.", "object_marking_refs": [ "marking-definition--34098fce-860f-48ae-8e50-ebd3cc5e41da" ] }, { "type": "x-meteorstorm-analytic", "spec_version": "2.1", "id": "x-meteorstorm-analytic--b48e1822-d28a-5f53-971e-ea2585d0800d", "created": "2026-07-26T00:00:00.000Z", "modified": "2026-07-26T00:00:00.000Z", "created_by_ref": "identity--6e60c19e-e7a7-5408-8071-86c183c7bcb4", "name": "AN:ATT:Attack Path:02", "layer": "AN", "tag": "ATT", "label": "Attack Path", "ordinal": "02", "source": "observable", "target_type": "TOE", "target_ref_eten": "AST:SI:Signal:00", "description": "Anchored to the uplink and downlink waveforms, AST:SI:Signal:00. Pivot: RF actor injects sustained noise onto the waveforms, overwhelming forward-error correction (SVC:HY:Hybrid:01) and tracking and telemetry (SVC:HY:Hybrid:02), objective denial of command and telemetry. Source: documented jamming campaigns.", "eten": "AN:ATT:Attack Path:02:Sustained RF noise on the waveforms overwhelming FEC and tracking to deny command and telemetry.", "object_marking_refs": [ "marking-definition--34098fce-860f-48ae-8e50-ebd3cc5e41da" ] }, { "type": "x-meteorstorm-analytic", "spec_version": "2.1", "id": "x-meteorstorm-analytic--a38781ba-1124-5ece-af63-5e349a6c80bb", "created": "2026-07-26T00:00:00.000Z", "modified": "2026-07-26T00:00:00.000Z", "created_by_ref": "identity--6e60c19e-e7a7-5408-8071-86c183c7bcb4", "name": "AN:ATT:Attack Path:03", "layer": "AN", "tag": "ATT", "label": "Attack Path", "ordinal": "03", "source": "observable", "target_type": "TOE", "target_ref_eten": "AST:FW:Firmware:01", "description": "Anchored to the on-board computer boot firmware, AST:FW:Firmware:01. Pivot: backdoored image staged in the patch pipeline (AST:SW:Software:03), pushed over the command-and-update path (SVC:CP:Control Plane:12), booted by the on-board computer, objective persistent control of the OBC. Source: NIST SP 800-193.", "eten": "AN:ATT:Attack Path:03:Backdoored image staged in the patch pipeline and booted by the on-board computer for persistent control.", "object_marking_refs": [ "marking-definition--34098fce-860f-48ae-8e50-ebd3cc5e41da" ] }, { "type": "x-meteorstorm-analytic", "spec_version": "2.1", "id": "x-meteorstorm-analytic--8409c81d-7aab-5cc6-bb61-0b5dde507d3e", "created": "2026-07-26T00:00:00.000Z", "modified": "2026-07-26T00:00:00.000Z", "created_by_ref": "identity--6e60c19e-e7a7-5408-8071-86c183c7bcb4", "name": "AN:DET:Detection Signature:00:RootA signature for the chain-00 behavior on SVC:CP:Control Plane", "layer": "AN", "tag": "DET", "label": "Detection Signature", "ordinal": "00", "source": "observable", "target_type": "TDM", "target_ref_eten": "SVC:CP:Control Plane:09", "description": "RootA rule KO-DET-ACA-MGMT-PUSH-000: Firmware push from ground ACA management interface outside maintenance window. Covers AN:ATT:Attack Path:00 and AN:THR:Threat:00.", "eten": "AN:DET:Detection Signature:00:RootA signature for the chain-00 behavior on SVC:CP:Control Plane:09.", "object_marking_refs": [ "marking-definition--34098fce-860f-48ae-8e50-ebd3cc5e41da" ], "roota": "name: KO-DET-ACA-MGMT-PUSH-000\ntitle: Firmware push from ground ACA management interface outside maintenance window\nseverity: high\ntype: query\nclass: behavioral\ndate: 2026-07-26\nmitre-attack:\n - t1195.002\ndetection:\n language: splunk-spl-query\n body: index=ground_aca sourcetype=mgmt action=firmware_push | where in_maintenance_window=false OR vpn_auth_anomaly=true\nlogsource:\n product: ground-aca\n service: management-plane\nreferences:\n - AN:ATT:Attack Path:00\n - AN:THR:Threat:00\ntags: KO-DET-ACA-MGMT-PUSH-000, acidrain, ground-aca\nlicense: DRL 1.1\nversion: 1\nuuid: a1b2c3d4-0000-4a00-8a00-000000000000\nmeteorstorm:\n pce: PCE:TE:Terrestrial:00\n seg: SEG:GR:Ground:00\n svc: SVC:CP:Control Plane:09\n an:\n eten: AN:DET:Detection Signature:00\n tdm: SVC:CP:Control Plane:09" }, { "type": "x-meteorstorm-analytic", "spec_version": "2.1", "id": "x-meteorstorm-analytic--0de53ead-20d8-52ce-b9e6-86b35bbfdabd", "created": "2026-07-26T00:00:00.000Z", "modified": "2026-07-26T00:00:00.000Z", "created_by_ref": "identity--6e60c19e-e7a7-5408-8071-86c183c7bcb4", "name": "AN:DET:Detection Signature:01:RootA signature for the chain-01 behavior on AST:SW:Software", "layer": "AN", "tag": "DET", "label": "Detection Signature", "ordinal": "01", "source": "observable", "target_type": "TDM", "target_ref_eten": "AST:SW:Software:04", "description": "RootA rule KO-DET-CONSOLE-OOP-001: Out-of-pattern commanding from the operator console. Covers AN:ATT:Attack Path:01 and AN:THR:Threat:01.", "eten": "AN:DET:Detection Signature:01:RootA signature for the chain-01 behavior on AST:SW:Software:04.", "object_marking_refs": [ "marking-definition--34098fce-860f-48ae-8e50-ebd3cc5e41da" ], "roota": "name: KO-DET-CONSOLE-OOP-001\ntitle: Out-of-pattern commanding from the operator console\nseverity: high\ntype: query\nclass: behavioral\ndate: 2026-07-26\nmitre-attack:\n - t1078\ndetection:\n language: splunk-spl-query\n body: index=console sourcetype=command | where hour_of_day NOT IN (operator_shift) OR peer_review_tag=null OR off_mission_profile=true\nlogsource:\n product: console-ops\n service: command-audit\nreferences:\n - AN:ATT:Attack Path:01\n - AN:THR:Threat:01\ntags: KO-DET-CONSOLE-OOP-001, insider, console\nlicense: DRL 1.1\nversion: 1\nuuid: a1b2c3d4-0001-4a00-8a00-000000000000\nmeteorstorm:\n pce: PCE:TE:Terrestrial:00\n seg: SEG:GR:Ground:00\n svc: SVC:CP:Control Plane:13\n ast: AST:SW:Software:04\n an:\n eten: AN:DET:Detection Signature:01\n tdm: AST:SW:Software:04" }, { "type": "x-meteorstorm-analytic", "spec_version": "2.1", "id": "x-meteorstorm-analytic--64b4203d-c91e-55fe-9965-8758d664a326", "created": "2026-07-26T00:00:00.000Z", "modified": "2026-07-26T00:00:00.000Z", "created_by_ref": "identity--6e60c19e-e7a7-5408-8071-86c183c7bcb4", "name": "AN:DET:Detection Signature:02:RootA signature for the chain-02 behavior on AST:SI:Signal", "layer": "AN", "tag": "DET", "label": "Detection Signature", "ordinal": "02", "source": "observable", "target_type": "TDM", "target_ref_eten": "AST:SI:Signal:00", "description": "RootA rule KO-DET-RF-NOISE-002: Sustained noise-floor anomaly on the uplink and downlink bands. Covers AN:ATT:Attack Path:02 and AN:THR:Threat:02.", "eten": "AN:DET:Detection Signature:02:RootA signature for the chain-02 behavior on AST:SI:Signal:00.", "object_marking_refs": [ "marking-definition--34098fce-860f-48ae-8e50-ebd3cc5e41da" ], "roota": "name: KO-DET-RF-NOISE-002\ntitle: Sustained noise-floor anomaly on the uplink and downlink bands\nseverity: high\ntype: query\nclass: behavioral\ndate: 2026-07-26\ndetection:\n language: splunk-spl-query\n body: index=rf_metrics | stats avg(noise_floor_db) as nf by band, _time span=5m | where nf > env_threshold_db AND sustained_minutes > 10\nlogsource:\n product: rf-frontend\n service: snr-telemetry\nreferences:\n - AN:ATT:Attack Path:02\n - AN:THR:Threat:02\ntags: KO-DET-RF-NOISE-002, jamming, rf\nlicense: DRL 1.1\nversion: 1\nuuid: a1b2c3d4-0002-4a00-8a00-000000000000\nmeteorstorm:\n pce: PCE:TE:Terrestrial:01\n seg: SEG:LI:Link:00\n svc: SVC:HY:Hybrid:02\n ast: AST:SI:Signal:00\n an:\n eten: AN:DET:Detection Signature:02\n tdm: AST:SI:Signal:00" }, { "type": "x-meteorstorm-analytic", "spec_version": "2.1", "id": "x-meteorstorm-analytic--6456b06f-1680-5af4-8d53-1fa2a965379c", "created": "2026-07-26T00:00:00.000Z", "modified": "2026-07-26T00:00:00.000Z", "created_by_ref": "identity--6e60c19e-e7a7-5408-8071-86c183c7bcb4", "name": "AN:DET:Detection Signature:03:RootA signature for the chain-03 behavior on AST:FW:Firmware", "layer": "AN", "tag": "DET", "label": "Detection Signature", "ordinal": "03", "source": "observable", "target_type": "TDM", "target_ref_eten": "AST:FW:Firmware:01", "description": "RootA rule KO-DET-FW-HASH-003: Firmware hash mismatch at boot on the on-board computer. Covers AN:ATT:Attack Path:03 and AN:THR:Threat:03.", "eten": "AN:DET:Detection Signature:03:RootA signature for the chain-03 behavior on AST:FW:Firmware:01.", "object_marking_refs": [ "marking-definition--34098fce-860f-48ae-8e50-ebd3cc5e41da" ], "roota": "name: KO-DET-FW-HASH-003\ntitle: Firmware hash mismatch at boot on the on-board computer\nseverity: high\ntype: query\nclass: behavioral\ndate: 2026-07-26\nmitre-attack:\n - t1542\ndetection:\n language: splunk-spl-query\n body: index=obc_boot sourcetype=attestation | where measured_hash != signed_expected_hash\nlogsource:\n product: obc\n service: boot-attestation\nreferences:\n - AN:ATT:Attack Path:03\n - AN:THR:Threat:03\ntags: KO-DET-FW-HASH-003, supply-chain, firmware\nlicense: DRL 1.1\nversion: 1\nuuid: a1b2c3d4-0003-4a00-8a00-000000000000\nmeteorstorm:\n pce: PCE:OR:Orbital:00\n seg: SEG:SP:Space:00\n svc: SVC:HY:Hybrid:00\n ast: AST:FW:Firmware:01\n an:\n eten: AN:DET:Detection Signature:03\n tdm: AST:FW:Firmware:01" }, { "type": "x-meteorstorm-analytic", "spec_version": "2.1", "id": "x-meteorstorm-analytic--267b20da-e121-5af4-b634-3fc46cf9ae6e", "created": "2026-07-26T00:00:00.000Z", "modified": "2026-07-26T00:00:00.000Z", "created_by_ref": "identity--6e60c19e-e7a7-5408-8071-86c183c7bcb4", "name": "AN:RES:Resilience Measure:00", "layer": "AN", "tag": "RES", "label": "Resilience Measure", "ordinal": "00", "source": "observable", "target_type": "TRE", "target_ref_eten": "SVC:CP:Control Plane:09", "description": "Zero-trust segmentation of the ground ACA management plane from external networks, with hardware-rooted attestation and dual-approval on every management-plane action. Protects SVC:CP:Control Plane:09. Source: internal engineering, KA-SAT / AcidRain lesson.", "eten": "AN:RES:Resilience Measure:00:Zero-trust segmentation and dual-approval on the ground ACA management plane.", "object_marking_refs": [ "marking-definition--34098fce-860f-48ae-8e50-ebd3cc5e41da" ], "resiliency_goal": "Withstand" }, { "type": "x-meteorstorm-analytic", "spec_version": "2.1", "id": "x-meteorstorm-analytic--80c8798c-59e9-5faa-9f0d-046488b7db19", "created": "2026-07-26T00:00:00.000Z", "modified": "2026-07-26T00:00:00.000Z", "created_by_ref": "identity--6e60c19e-e7a7-5408-8071-86c183c7bcb4", "name": "AN:RES:Resilience Measure:01", "layer": "AN", "tag": "RES", "label": "Resilience Measure", "ordinal": "01", "source": "observable", "target_type": "TRE", "target_ref_eten": "AST:SW:Software:04", "description": "Dual-control commanding for high-impact actions, a second operator approving before transmission, with per-operator behavior baselines and pre-pass briefings enforced in the console software. Protects AST:SW:Software:04. Source: internal engineering.", "eten": "AN:RES:Resilience Measure:01:Dual-control commanding and per-operator baselines in the console software.", "object_marking_refs": [ "marking-definition--34098fce-860f-48ae-8e50-ebd3cc5e41da" ], "resiliency_goal": "Withstand" }, { "type": "x-meteorstorm-analytic", "spec_version": "2.1", "id": "x-meteorstorm-analytic--0aee8a5a-4213-5dba-ae76-f8829836a34b", "created": "2026-07-26T00:00:00.000Z", "modified": "2026-07-26T00:00:00.000Z", "created_by_ref": "identity--6e60c19e-e7a7-5408-8071-86c183c7bcb4", "name": "AN:RES:Resilience Measure:02", "layer": "AN", "tag": "RES", "label": "Resilience Measure", "ordinal": "02", "source": "observable", "target_type": "TRE", "target_ref_eten": "AST:SI:Signal:00", "description": "Frequency-agile, spread-spectrum link operation with a pre-arranged backup band; Satellite Operations switches bands automatically when the noise floor exceeds threshold; Satellite Design and Engineering owns the agility waveform. Protects AST:SI:Signal:00. Source: internal engineering.", "eten": "AN:RES:Resilience Measure:02:Frequency-agile spread-spectrum link with automatic band switch on noise threshold.", "object_marking_refs": [ "marking-definition--34098fce-860f-48ae-8e50-ebd3cc5e41da" ], "resiliency_goal": "Withstand" }, { "type": "x-meteorstorm-analytic", "spec_version": "2.1", "id": "x-meteorstorm-analytic--49556ad1-38eb-51a8-a628-8426cfbae7fb", "created": "2026-07-26T00:00:00.000Z", "modified": "2026-07-26T00:00:00.000Z", "created_by_ref": "identity--6e60c19e-e7a7-5408-8071-86c183c7bcb4", "name": "AN:RES:Resilience Measure:03", "layer": "AN", "tag": "RES", "label": "Resilience Measure", "ordinal": "03", "source": "observable", "target_type": "TRE", "target_ref_eten": "AST:FW:Firmware:01", "description": "Measured-boot firmware attestation with a signed-vendor manifest, supply-chain provenance verification at integration, and quarantine of any image whose hash does not match the signed expected value. Protects AST:FW:Firmware:01. Source: internal engineering, NIST SP 800-193.", "eten": "AN:RES:Resilience Measure:03:Measured-boot attestation with signed-vendor manifest and hash-mismatch quarantine.", "object_marking_refs": [ "marking-definition--34098fce-860f-48ae-8e50-ebd3cc5e41da" ], "resiliency_goal": "Anticipate" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--549e45cf-a000-5fc8-9cf8-6c4e11a2d4db", "created": "2026-07-26T00:00:00.000Z", "modified": "2026-07-26T00:00:00.000Z", "created_by_ref": "identity--6e60c19e-e7a7-5408-8071-86c183c7bcb4", "relationship_type": "realizes", "source_ref": "x-meteorstorm-analytic--36c2a36e-85b7-5779-8214-f1a674e9060c", "target_ref": "x-meteorstorm-analytic--c97e1ecf-6be4-5cbb-b136-1ba4d3e786f4", "object_marking_refs": [ "marking-definition--34098fce-860f-48ae-8e50-ebd3cc5e41da" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--df151773-255e-54e7-b7ea-e02ec9bf7b39", "created": "2026-07-26T00:00:00.000Z", "modified": "2026-07-26T00:00:00.000Z", "created_by_ref": "identity--6e60c19e-e7a7-5408-8071-86c183c7bcb4", "relationship_type": "detects", "source_ref": "x-meteorstorm-analytic--8409c81d-7aab-5cc6-bb61-0b5dde507d3e", "target_ref": "x-meteorstorm-analytic--36c2a36e-85b7-5779-8214-f1a674e9060c", "object_marking_refs": [ "marking-definition--34098fce-860f-48ae-8e50-ebd3cc5e41da" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--a177caa1-cd67-5eaa-aa52-69094f85f4cc", "created": "2026-07-26T00:00:00.000Z", "modified": "2026-07-26T00:00:00.000Z", "created_by_ref": "identity--6e60c19e-e7a7-5408-8071-86c183c7bcb4", "relationship_type": "detects", "source_ref": "x-meteorstorm-analytic--8409c81d-7aab-5cc6-bb61-0b5dde507d3e", "target_ref": "x-meteorstorm-analytic--c97e1ecf-6be4-5cbb-b136-1ba4d3e786f4", "object_marking_refs": [ "marking-definition--34098fce-860f-48ae-8e50-ebd3cc5e41da" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--1e37721f-5c70-5971-abd3-78615ba4eac2", "created": "2026-07-26T00:00:00.000Z", "modified": "2026-07-26T00:00:00.000Z", "created_by_ref": "identity--6e60c19e-e7a7-5408-8071-86c183c7bcb4", "relationship_type": "mitigates", "source_ref": "x-meteorstorm-analytic--267b20da-e121-5af4-b634-3fc46cf9ae6e", "target_ref": "x-meteorstorm-analytic--36c2a36e-85b7-5779-8214-f1a674e9060c", "object_marking_refs": [ "marking-definition--34098fce-860f-48ae-8e50-ebd3cc5e41da" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--c01eb82f-e29b-5256-a101-38de0736c913", "created": "2026-07-26T00:00:00.000Z", "modified": "2026-07-26T00:00:00.000Z", "created_by_ref": "identity--6e60c19e-e7a7-5408-8071-86c183c7bcb4", "relationship_type": "mitigates", "source_ref": "x-meteorstorm-analytic--267b20da-e121-5af4-b634-3fc46cf9ae6e", "target_ref": "x-meteorstorm-analytic--c97e1ecf-6be4-5cbb-b136-1ba4d3e786f4", "object_marking_refs": [ "marking-definition--34098fce-860f-48ae-8e50-ebd3cc5e41da" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--c2111203-34f1-5703-843b-ec6aa7f26b24", "created": "2026-07-26T00:00:00.000Z", "modified": "2026-07-26T00:00:00.000Z", "created_by_ref": "identity--6e60c19e-e7a7-5408-8071-86c183c7bcb4", "relationship_type": "realizes", "source_ref": "x-meteorstorm-analytic--b108b7ce-d4e4-5899-bea9-b0d0eb335b8b", "target_ref": "x-meteorstorm-analytic--5a56f366-fb47-5f07-8ca9-1fc10fd54854", "object_marking_refs": [ "marking-definition--34098fce-860f-48ae-8e50-ebd3cc5e41da" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--f8943531-86bc-57a9-95e8-f9bcb17d2763", "created": "2026-07-26T00:00:00.000Z", "modified": "2026-07-26T00:00:00.000Z", "created_by_ref": "identity--6e60c19e-e7a7-5408-8071-86c183c7bcb4", "relationship_type": "detects", "source_ref": "x-meteorstorm-analytic--0de53ead-20d8-52ce-b9e6-86b35bbfdabd", "target_ref": "x-meteorstorm-analytic--b108b7ce-d4e4-5899-bea9-b0d0eb335b8b", "object_marking_refs": [ "marking-definition--34098fce-860f-48ae-8e50-ebd3cc5e41da" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--cd2f3e4b-c4d1-549d-ab72-5b6dde5df9c7", "created": "2026-07-26T00:00:00.000Z", "modified": "2026-07-26T00:00:00.000Z", "created_by_ref": "identity--6e60c19e-e7a7-5408-8071-86c183c7bcb4", "relationship_type": "detects", "source_ref": "x-meteorstorm-analytic--0de53ead-20d8-52ce-b9e6-86b35bbfdabd", "target_ref": "x-meteorstorm-analytic--5a56f366-fb47-5f07-8ca9-1fc10fd54854", "object_marking_refs": [ "marking-definition--34098fce-860f-48ae-8e50-ebd3cc5e41da" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--6fefe215-774b-5ab7-a307-88df078b07d9", "created": "2026-07-26T00:00:00.000Z", "modified": "2026-07-26T00:00:00.000Z", "created_by_ref": "identity--6e60c19e-e7a7-5408-8071-86c183c7bcb4", "relationship_type": "mitigates", "source_ref": "x-meteorstorm-analytic--80c8798c-59e9-5faa-9f0d-046488b7db19", "target_ref": "x-meteorstorm-analytic--b108b7ce-d4e4-5899-bea9-b0d0eb335b8b", "object_marking_refs": [ "marking-definition--34098fce-860f-48ae-8e50-ebd3cc5e41da" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--096d46c1-e839-5201-8723-4347723000a2", "created": "2026-07-26T00:00:00.000Z", "modified": "2026-07-26T00:00:00.000Z", "created_by_ref": "identity--6e60c19e-e7a7-5408-8071-86c183c7bcb4", "relationship_type": "mitigates", "source_ref": "x-meteorstorm-analytic--80c8798c-59e9-5faa-9f0d-046488b7db19", "target_ref": "x-meteorstorm-analytic--5a56f366-fb47-5f07-8ca9-1fc10fd54854", "object_marking_refs": [ "marking-definition--34098fce-860f-48ae-8e50-ebd3cc5e41da" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--ff784d7c-218f-570b-9a09-c6c29f69050f", "created": "2026-07-26T00:00:00.000Z", "modified": "2026-07-26T00:00:00.000Z", "created_by_ref": "identity--6e60c19e-e7a7-5408-8071-86c183c7bcb4", "relationship_type": "realizes", "source_ref": "x-meteorstorm-analytic--b48e1822-d28a-5f53-971e-ea2585d0800d", "target_ref": "x-meteorstorm-analytic--27711459-18c0-5fb1-a2b8-4d90c7535d82", "object_marking_refs": [ "marking-definition--34098fce-860f-48ae-8e50-ebd3cc5e41da" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--6d91c0ff-3f59-542c-bddd-144fc7b1ae39", "created": "2026-07-26T00:00:00.000Z", "modified": "2026-07-26T00:00:00.000Z", "created_by_ref": "identity--6e60c19e-e7a7-5408-8071-86c183c7bcb4", "relationship_type": "detects", "source_ref": "x-meteorstorm-analytic--64b4203d-c91e-55fe-9965-8758d664a326", "target_ref": "x-meteorstorm-analytic--b48e1822-d28a-5f53-971e-ea2585d0800d", "object_marking_refs": [ "marking-definition--34098fce-860f-48ae-8e50-ebd3cc5e41da" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--6585d776-74e5-50b9-97ae-3444f209bd79", "created": "2026-07-26T00:00:00.000Z", "modified": "2026-07-26T00:00:00.000Z", "created_by_ref": "identity--6e60c19e-e7a7-5408-8071-86c183c7bcb4", "relationship_type": "detects", "source_ref": "x-meteorstorm-analytic--64b4203d-c91e-55fe-9965-8758d664a326", "target_ref": "x-meteorstorm-analytic--27711459-18c0-5fb1-a2b8-4d90c7535d82", "object_marking_refs": [ "marking-definition--34098fce-860f-48ae-8e50-ebd3cc5e41da" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--5f7e843b-0588-554f-847b-a11f693d73dc", "created": "2026-07-26T00:00:00.000Z", "modified": "2026-07-26T00:00:00.000Z", "created_by_ref": "identity--6e60c19e-e7a7-5408-8071-86c183c7bcb4", "relationship_type": "mitigates", "source_ref": "x-meteorstorm-analytic--0aee8a5a-4213-5dba-ae76-f8829836a34b", "target_ref": "x-meteorstorm-analytic--b48e1822-d28a-5f53-971e-ea2585d0800d", "object_marking_refs": [ "marking-definition--34098fce-860f-48ae-8e50-ebd3cc5e41da" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--b3dad020-ae8d-5f4f-8da3-b4a28644ca08", "created": "2026-07-26T00:00:00.000Z", "modified": "2026-07-26T00:00:00.000Z", "created_by_ref": "identity--6e60c19e-e7a7-5408-8071-86c183c7bcb4", "relationship_type": "mitigates", "source_ref": "x-meteorstorm-analytic--0aee8a5a-4213-5dba-ae76-f8829836a34b", "target_ref": "x-meteorstorm-analytic--27711459-18c0-5fb1-a2b8-4d90c7535d82", "object_marking_refs": [ "marking-definition--34098fce-860f-48ae-8e50-ebd3cc5e41da" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--bf4c29d2-8af0-5522-9801-99852334deeb", "created": "2026-07-26T00:00:00.000Z", "modified": "2026-07-26T00:00:00.000Z", "created_by_ref": "identity--6e60c19e-e7a7-5408-8071-86c183c7bcb4", "relationship_type": "realizes", "source_ref": "x-meteorstorm-analytic--a38781ba-1124-5ece-af63-5e349a6c80bb", "target_ref": "x-meteorstorm-analytic--b65cd220-eb55-5e34-90ea-4750fe71dd41", "object_marking_refs": [ "marking-definition--34098fce-860f-48ae-8e50-ebd3cc5e41da" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--d8c2774c-2a85-54b6-be3d-9ab91d6376a6", "created": "2026-07-26T00:00:00.000Z", "modified": "2026-07-26T00:00:00.000Z", "created_by_ref": "identity--6e60c19e-e7a7-5408-8071-86c183c7bcb4", "relationship_type": "detects", "source_ref": "x-meteorstorm-analytic--6456b06f-1680-5af4-8d53-1fa2a965379c", "target_ref": "x-meteorstorm-analytic--a38781ba-1124-5ece-af63-5e349a6c80bb", "object_marking_refs": [ "marking-definition--34098fce-860f-48ae-8e50-ebd3cc5e41da" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--014a08ba-174c-59c3-a6d8-afd8b8c5e838", "created": "2026-07-26T00:00:00.000Z", "modified": "2026-07-26T00:00:00.000Z", "created_by_ref": "identity--6e60c19e-e7a7-5408-8071-86c183c7bcb4", "relationship_type": "detects", "source_ref": "x-meteorstorm-analytic--6456b06f-1680-5af4-8d53-1fa2a965379c", "target_ref": "x-meteorstorm-analytic--b65cd220-eb55-5e34-90ea-4750fe71dd41", "object_marking_refs": [ "marking-definition--34098fce-860f-48ae-8e50-ebd3cc5e41da" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--3ea557c2-8a60-53e9-873e-dc81ac6a34d3", "created": "2026-07-26T00:00:00.000Z", "modified": "2026-07-26T00:00:00.000Z", "created_by_ref": "identity--6e60c19e-e7a7-5408-8071-86c183c7bcb4", "relationship_type": "mitigates", "source_ref": "x-meteorstorm-analytic--49556ad1-38eb-51a8-a628-8426cfbae7fb", "target_ref": "x-meteorstorm-analytic--a38781ba-1124-5ece-af63-5e349a6c80bb", "object_marking_refs": [ "marking-definition--34098fce-860f-48ae-8e50-ebd3cc5e41da" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--1bf630fd-65cf-505a-bf38-eea0620f98b6", "created": "2026-07-26T00:00:00.000Z", "modified": "2026-07-26T00:00:00.000Z", "created_by_ref": "identity--6e60c19e-e7a7-5408-8071-86c183c7bcb4", "relationship_type": "mitigates", "source_ref": "x-meteorstorm-analytic--49556ad1-38eb-51a8-a628-8426cfbae7fb", "target_ref": "x-meteorstorm-analytic--b65cd220-eb55-5e34-90ea-4750fe71dd41", "object_marking_refs": [ "marking-definition--34098fce-860f-48ae-8e50-ebd3cc5e41da" ] } ] }