Description

Malware:

• Some malware is named using the hash of the indicator, which makes differentiation very difficult.
• Some labels on malware refer to MITRE tactics. It would be useful to have this information included in the "Kill chain phases".
• If specific techniques from these tactics are identified, it would also be desirable to link them to the corresponding attack pattern entity.

CVE:

Some CVEs are listed as "Tools" entities in addition to being listed as "Vulnerability" entities.

Indicators:

The indicators do not have any "Indicator types" specified.

Infrastructures:

Infrastructures are ingested in bulk, but they are just IP addresses. These same infrastructures are not linked to corresponding indicators/observables.