Adversary Behavior Dossiers
A planned evidence-compilation system for turning source reports into reviewed, traceable case files about adversary behavior.
Adversary Behavior Dossiers is meant to sit downstream of FT3 and FT3c. FT3 names the behavior. FT3c holds the version-pinned crosswalks. A dossier would record a real-world occurrence: the claims, the evidence locators, the chronology, and the classification assertions, with those layers kept distinct.
The design has two planes. A private compiler would acquire authorized sources, extract located claims, reconcile them into occurrences, and propose creating or updating a dossier. A person would resolve a narrow set of high-risk ambiguities and approve a release. The public plane would carry the case file, readable views, STIX 2.1 and MITRE Attack Flow exports, schemas, and a verifier. The compiler would consume a pinned FT3c release. It would not redefine FT3 or author the crosswalks. A framework edge is not evidence that an activity occurred, and a correction would be a new reviewed revision rather than a silent edit.
That pipeline is specified, not built. The repository is a documentation baseline: product requirements, architecture, an implementation plan, and the release boundary. As of the status note dated 29 August 2026, the compiler, public schemas, verifier, generated views, exports, and example dossiers were not implemented. A decision note on 11 September 2026 added an HTML page as a third planned source connector and settled the stage-0 boundary profiles. The repository still contains those documents and no compiler.