{
  "data_model": "METEORSTORM Analytic Layer, Taxonomic Element Nomenclature (TEN)",
  "source": "MISP meteorstorm taxonomy, machinetag.json, version 2 (definitions verbatim)",
  "generated": "2026-07-26",
  "layer": {
    "layer": "AN",
    "name": "Analytic Layer",
    "definition": "Analytic constructs for threat, detection, and resilience.",
    "uuid": "5e1f444b-5e83-5232-8a98-45a2fa894af2"
  },
  "source_values": {
    "observable": "Built on a real-world report: a signal or data captured from a system. The standard for Indicator of Compromise, Indicator of Attack, Attack Path, and Threat.",
    "synthetic": "Authored data for system resilience engineering and operational exercises."
  },
  "elements": [
    {
      "layer": "AN",
      "tag": "IOC",
      "ten_value": "AN-IOC",
      "display_name": "Indicator of Compromise (IoC)",
      "label": "Indicator of Compromise",
      "definition": "Confirmed indication that a converged space system has been compromised.",
      "target_field": "TOE",
      "target_field_name": "Target of Exploitation",
      "uuid": "b6a3a0a8-5b6a-5b1a-8f4d-1c8c0a0b7d3f"
    },
    {
      "layer": "AN",
      "tag": "IOA",
      "ten_value": "AN-IOA",
      "display_name": "Indicator of Attack (IoA)",
      "label": "Indicator of Attack",
      "definition": "Confirmed indication that a converged space system has been attacked.",
      "target_field": "TOE",
      "target_field_name": "Target of Exploitation",
      "uuid": "c7b4b1b9-6c7b-5c2b-905e-2d9d1b1c8e40"
    },
    {
      "layer": "AN",
      "tag": "ATT",
      "ten_value": "AN-ATT",
      "display_name": "Attack Path",
      "label": "Attack Path",
      "definition": "Confirmed attack path for a converged space system.",
      "target_field": "TOE",
      "target_field_name": "Target of Exploitation",
      "uuid": "fedcba98-7654-3210-fedc-ba9876543210"
    },
    {
      "layer": "AN",
      "tag": "THR",
      "ten_value": "AN-THR",
      "display_name": "Threat",
      "label": "Threat",
      "definition": "Confirmed and active threat against a converged space system.",
      "target_field": "TOE",
      "target_field_name": "Target of Exploitation",
      "uuid": "d8c5c2ca-7d8c-5d3c-a16f-3eae2c2d9f51"
    },
    {
      "layer": "AN",
      "tag": "DET",
      "ten_value": "AN-DET",
      "display_name": "Detection Signature",
      "label": "Detection Signature",
      "definition": "Validated and operational pattern, signal, or logic that triggers on contextualized threat behavior for a converged space system..",
      "target_field": "TDM",
      "target_field_name": "Target of Detection Method",
      "uuid": "e10b04f1-5e83-5be1-98ea-111a40a4b360"
    },
    {
      "layer": "AN",
      "tag": "RES",
      "ten_value": "AN-RES",
      "display_name": "Resilience Measure",
      "label": "Resilience Measure",
      "definition": "Validated and operational protective capability ensuring converged space system resistance or recovery from confirmed threats.",
      "target_field": "TRE",
      "target_field_name": "Target of Resilience Enhancement",
      "uuid": "df8d24c7-6206-5689-b83e-dd287aa0ef12"
    }
  ]
}