From 5698ecac1ab25f00b73e161c8d04b22745850cc5 Mon Sep 17 00:00:00 2001
From: Alexandre Dulaunoy <a@foo.be>
Date: Fri, 4 Mar 2016 07:48:44 +0100
Subject: [PATCH] Threat actor type vocabulary added

---
 elements/threat-actor-type-vocabulary.json | 60 ++++++++++++++++++++++
 1 file changed, 60 insertions(+)
 create mode 100644 elements/threat-actor-type-vocabulary.json

diff --git a/elements/threat-actor-type-vocabulary.json b/elements/threat-actor-type-vocabulary.json
new file mode 100644
index 0000000..db87619
--- /dev/null
+++ b/elements/threat-actor-type-vocabulary.json
@@ -0,0 +1,60 @@
+{
+  "values": [
+    {
+      "value": "Cyber Espionage Operations"
+    },
+    {
+      "value": "Hacker"
+    },
+    {
+      "value": "Hacker - White hat"
+    },
+    {
+      "value": "Hacker - Gray hat"
+    },
+    {
+      "value": "Hacker - Black hat"
+    },
+    {
+      "value": "Hacktivist"
+    },
+    {
+      "value": "State Actor / Agency"
+    },
+    {
+      "value": "eCrime Actor - Credential Theft Botnet Operator"
+    },
+    {
+      "value": "eCrime Actor - Credential Theft Botnet Service"
+    },
+    {
+      "value": "eCrime Actor - Malware Developer"
+    },
+    {
+      "value": "eCrime Actor - Money Laundering Network"
+    },
+    {
+      "value": "eCrime Actor - Organized Crime Actor"
+    },
+    {
+      "value": "eCrime Actor - Spam Service"
+    },
+    {
+      "value": "eCrime Actor - Traffic Service"
+    },
+    {
+      "value": "eCrime Actor - Underground Call Service"
+    },
+    {
+      "value": "Insider Threat"
+    },
+    {
+      "value": "Disgruntled Customer / User"
+    }
+  ],
+  "version" : 1,
+  "description": "The ThreatActorTypeVocab enumeration is used to define the default STIX vocabulary for expressing the subjective type of a threat actor.",
+  "author": "STIX",
+  "stix": "1.0",
+  "type": "threat-actor-type-vocabulary"
+}