I think the answer is "Type". In a multi-TIP environment, the same indicator could be reported by different vendors, so the "Type" of indicator would be the key to differentiate them.
I'm a bit confused on this one. I know the DBotScore is related to threat indicators, but I'm not sure how the context field would work in a multi-TIP scenario. I'll have to review my notes on that.
Okay, let's see... I'm pretty sure the key that would differentiate between multiple entries is the "Type" of indicator, since a multi-TIP environment could have the same indicator from different sources.
Definitely B) Type. It's the only one that makes sense in the context of a multi-TIP environment. Unless, of course, you're a TIP connoisseur who cares about the 'brand' of your indicators.
Reiko
2 months agoDaniel
2 months agoKerrie
3 months agoSue
3 months agoRikki
3 months agoSvetlana
3 months agoGraciela
4 months agoAnnelle
4 months agoCyril
4 months agoLizbeth
4 months agoCherelle
4 months agoAlaine
5 months agoKanisha
5 months agoAnnelle
10 months agoMozell
10 months agoBambi
9 months agoWinfred
9 months agoLillian
9 months agoFrank
10 months agoKimberlie
8 months agoErinn
9 months agoTresa
9 months agoJolanda
10 months agoSylvia
10 months agoTasia
10 months agoAlex
9 months agoSalena
9 months agoMarlon
10 months agoOlen
10 months agoCherilyn
10 months agoMing
10 months agoDonette
11 months agoBea
9 months agoLarae
9 months agoKeneth
9 months agoLachelle
9 months agoDetra
9 months agoCandra
9 months agoBenedict
10 months agoAlease
10 months ago