I think the answer is "Type". In a multi-TIP environment, the same indicator could be reported by different vendors, so the "Type" of indicator would be the key to differentiate them.
I'm a bit confused on this one. I know the DBotScore is related to threat indicators, but I'm not sure how the context field would work in a multi-TIP scenario. I'll have to review my notes on that.
Okay, let's see... I'm pretty sure the key that would differentiate between multiple entries is the "Type" of indicator, since a multi-TIP environment could have the same indicator from different sources.
Definitely B) Type. It's the only one that makes sense in the context of a multi-TIP environment. Unless, of course, you're a TIP connoisseur who cares about the 'brand' of your indicators.
Reiko
6 months agoDaniel
6 months agoKerrie
7 months agoSue
7 months agoRikki
7 months agoSvetlana
7 months agoGraciela
8 months agoAnnelle
8 months agoCyril
8 months agoLizbeth
8 months agoCherelle
8 months agoAlaine
8 months agoKanisha
9 months agoAnnelle
1 year agoMozell
1 year agoBambi
1 year agoWinfred
1 year agoLillian
1 year agoFrank
1 year agoKimberlie
1 year agoErinn
1 year agoTresa
1 year agoJolanda
1 year agoSylvia
1 year agoTasia
1 year agoAlex
1 year agoSalena
1 year agoMarlon
1 year agoOlen
1 year agoCherilyn
1 year agoMing
1 year agoDonette
1 year agoBea
1 year agoLarae
1 year agoKeneth
1 year agoLachelle
1 year agoDetra
1 year agoCandra
1 year agoBenedict
1 year agoAlease
1 year ago