I can go with that...
Thanks,
Bret
Bret Jordan CISSP
Director of Security Architecture and Standards | Office of the CTO
Blue Coat Systems
PGP Fingerprint: 63B4 FC53 680A 6B7D 1447 F2C0 74F8 ACAE 7415 0050
"Without cryptography vihv vivc ce xhrnrw, however, the only thing that can not be unscrambled is an egg."
On Oct 22, 2015, at 09:10, Jerome Athias <> wrote:
So for the reflection on where to put/attached the sighting (one toplevel 'object' or each objects),I think this should be linked to the CybOX discussion regardingObservables instances vs patternsand the clarification of the Observation concept (thanks Cory ;-))would make it easier.To Bret's approach, I would like to add the time*1) What: Reference to what it is we are sighting2) Who: The person / organization that is making the sighting3) A count of the number of times it was seen.4) When*KISS:{"type": "sighting","id": "foo.com:sighting-1234-1234-1234-1234","idref": "abc.com:indicator-4321-4321-4321-4321","count": "1222""producer": "tom and jerry""timeframe": between monday and tuesday}2015-10-22 17:27 GMT+03:00 Bush, Jonathan <>:Agreed on all of this Cory. I especially like your thoughts on “simplemeans something different to everyone”. We need to keep everyone’s basecase in mind… so people need to make sure they are speaking up. What isabsolutely critical, what is everyone’s minimum viable product (MVP) here?Also, on data structure, I think that trying to accommodate things liketimespan could get very complicated very quickly, and it changes the problemdomain significantly.From: Cory Casanave [mailto:]Sent: Thursday, October 22, 2015 10:06 AMTo: Bush, Jonathan; 'Jordan, Bret'Cc: : RE: [cti-stix] Conceptul model for sightingBret & Jonathan,In my experience combining a bottom-up and top-down approach yields the bestresult. Particularly in a system as complex as STIX which must satisfymultiple use cases and implementation style, “simple” is not always the samefrom one stakeholder to the next. What is important from both perspectivesis clarity on meaning and a consistent and logical representation. Having amap of the concepts helps with clarity, consistency and solving multiple usecases. Bottom up analysis makes sure critical needs are met in as simple away as possible. Top-down alone can get overly general where as bottom-upalone can get fragmented and limiting. So both is best. The conceptual modelI showed is not intended as the CTI schema model, but such a map of theconcepts.With respect to “sighting”, I found the 1.x STIX representation confusingand lacking some of the links I would expect. The proposition represented inthe conceptual model is that a sighting is a specific observationcorresponding to an indicator that provides evidence for some situation ofinterest. Such a sighting would take place at a specific time and bereported by identified parties. The expectation is of a single event, if“multiple sightings” are within one sighting report then this changes themeaning as well as the data structure somewhat – for example we would needto allow for a timespan, not just a point in time.-Cory CasanaveFrom: [mailto:]On Behalf Of Bush, JonathanSent: Thursday, October 22, 2015 8:48 AMTo: 'Jordan, Bret'; Cory CasanaveCc: : RE: [cti-stix] Conceptul model for sightingI definitely like the “state the use case first” approach here. We can’timplement a data design until we know what we plan on doing with it.On the simplicity suggestion – YES!! Simple, simple, simple. We can alwaysadd fields later. Let’s just get this implemented, baked into our products,and then we can see what we are missing.On the data structure – Seems to me that the big decision on this is whetheror not we have a sighting object or EACH sighting (meaning, it referencessomething and adds context like who saw it, date, etc…) or have a combinedobject that carries a count. The former will offer more flexibility, butwill mean more object instances. The later is really just a summary of theformer, which will be much smaller from a db size perspective, but we won’tbe able to identify individual characteristics of each sighting instance.Personally, I favor flexibility. We can solve the size issue with technicalimplementation.From: [mailto:]On Behalf Of Jordan, BretSent: Wednesday, October 21, 2015 5:42 PMTo: Cory CasanaveCc: : Re: [cti-stix] Conceptul model for sightingI think a better place to start is how people or devices are going tointeract with an IOC-Indicator.1) Human: I am going to see a list of IOCs in my work bench tool and havethe ability to query that list for certain things as I do stuff. Perhaps asI start documenting an issue I am seeing in my network it could show a listof potential IOCs that match it. I could then: a) click a button that says "share a sighting" or b) the software could be configured to emit a sighting everytime the IOC (think URL, IP address, Hash, filename, etc) is referenced in areport.2) Device: A network device / security tool might be watching the networkand either looking for IOCs based on a feed it gets from somewhere or itmight find bad stuff on its own and generate an IOC then query the repo tosee if the IOC is already known. In either case, the device could emit asighting.While I appreciate the desire to cover every esoteric corner case that mightever come up, I think we should take a minimalistic approach to the firstgeneration of the Sighting object.. It is always easy to add stuff, but itis really hard to take it away.I would argue that the bare minimum we need is:1) Reference to what it is we are sighting2) The person / organization that is making the sighting3) A count of the number of times it was seen.Now yes, there is a LOT more things that COULD be added, and all of themcould be added over time. For example (yes this will rub people the wrongway), data markings. I would personally leave them out for now. I wouldlove if we could get to the point where we had to rev the sightings objectspec to support data markings or something else because we had so manypeople using it and begging for the feature.By taking the minimalistic approach we can more quicker and get people usingit.Think:{ "type": "sighting", "id": "foo.com:sighting-1234-1234-1234-1234", "idref": "abc.com:indicator-4321-4321-4321-4321", "count": "1222" "producer": "tom and jerry"}Thanks,BretBret Jordan CISSPDirector of Security Architecture and Standards | Office of the CTOBlue Coat SystemsPGP Fingerprint: 63B4 FC53 680A 6B7D 1447 F2C0 74F8 ACAE 7415 0050"Without cryptography vihv vivc ce xhrnrw, however, the only thing that cannot be unscrambled is an egg."On Oct 21, 2015, at 15:17, Cory Casanave <> wrote:In the meeting today “sighting” was discussed. Below is the sightingcomponent of a conceptual model we are developing for threats and risks.Note that this is a level more general than STIX (the model is being mappedto STIX), but perhaps we can share some ideas.Regards,Cory Casanave<image003.jpg>DTCC DISCLAIMER: This email and any files transmitted with it areconfidential and intended solely for the use of the individual or entity towhom they are addressed. If you have received this email in error, pleasenotify us immediately and delete the email and any attachments from yoursystem. The recipient should check this email and any attachments for thepresence of viruses. The company accepts no liability for any damage causedby any virus transmitted by this email.DTCC DISCLAIMER: This email and any files transmitted with it areconfidential and intended solely for the use of the individual or entity towhom they are addressed. If you have received this email in error, pleasenotify us immediately and delete the email and any attachments from yoursystem. The recipient should check this email and any attachments for thepresence of viruses. The company accepts no liability for any damage causedby any virus transmitted by this email.
Attachment:
signature.asc
Description: Message signed with OpenPGP using GPGMail
