My personal preference would be to work with them to all use the same thing vs. having some form of mapping across them. To me, this means that we would need
to be open to accepting ideas from e.g., ThreatExchange and OpenTPX (Note: I’ve taken a quick look and I think there are good things to learn from both). I’ve said this privately to some already: I think ThreatExchange, OpenTPX, et al should be treated as
allies in solving the problem of information sharing.
Thank you.
-Mark
From:
[mailto:]
On Behalf Of Jason Keirstead
Sent: Monday, October 26, 2015 4:32 PM
To:
Cc: ; ; ; Davidson II, Mark S <>
Subject: Re: RE: [cti-interoperability] possible work item
It might help to get you 50% of the way, but the other 50% is the much longer pole.
-
Jason Keirstead
Product Architect, Security Intelligence, IBM Security Systems
www.ibm.com/security
www.securityintelligence.com
Without data, all you are is just another person with an opinion - Unknown
