I'm going to throw out there that we should make ALL relationships between top-level constructs reference only. That would include Report, but also things like TTPs in Indicators, etc.
From: <
> on behalf of Jason Keirstead
Date: Monday, July 27, 2015 at 11:59 AM
To: Trey Darley
Cc: "Jordan, Bret", " "
Subject: Re: [cti-stix] Re: Proposal - Change Report Object
I also +1 this if we are counting votes.
-
Jason Keirstead
Product Architect, Security Intelligence, IBM Security Systems
www.ibm.com/security
www.securityintelligence.com
Without data, all you are is just another person with an opinion - Unknown
Trey Darley ---2015/07/27 12:13:59 PM---+100, Bret!
Cheers,
From:
Trey Darley <
>
To:
"Jordan, Bret" < >, " " <
>
Date:
2015/07/27 12:13 PM
Subject:
[cti-stix] Re: Proposal - Change Report Object
Sent by:
< >
+100, Bret!
Cheers,
Trey
--
Trey Darley
Senior Security Engineer
Soltra
An FS-ISAC & DTCC Company
www.soltra.com
From:
<
> on behalf of Jordan, Bret <
>
Sent:
Monday, July 27, 2015 16:57
To:
Subject:
[cti-stix] Proposal - Change Report Object
In STIX 2.0 I would like to propose that we change the Report Object to contain just reference to the objects that it is binding. I do not want to see it contain data itself.
[soap box]
We need one way of doing things and the current data-model of STIX, while beautiful, makes writing a decision tree in code for some arbitrary data in a STIX package nearly impossible. .
[/soap box]
Thanks,
Bret
Bret Jordan CISSP
Director of Security Architecture and Standards
Office of the CTO
Blue Coat Systems
PGP Fingerprint: 63B4 FC53 680A 6B7D 1447 F2C0 74F8 ACAE 7415 0050
"Without cryptography vihv vivc ce xhrnrw, however, the only thing that can not be unscrambled is an egg."
