I think that using these simple idioms would be great for folks to see roughly what the different forms look like but I do not think they would be sufficient for comparing size and complexity as a whole.
These are VERY simple example structures. More complex examples would likely differ from these simple ones in how each representation tackle size and complexity.
sean
From: <> on behalf of Terry MacDonald
Date: Friday, October 2, 2015 at 5:51 PM
To: "Jordan, Bret"
Cc: "", "", John Wunder
Subject: Re: [cti-users] Re: [cti-stix] [cti-users] MTI Binding
+1. Is a nice idea as we can see a size and complexity comparison. Is there any chance each person can document the process that the generation took? I'm thinking it could be useful to see how complicated the toolchain for developing each type
of output is.
Cheers
Terry MacDonald
On 3 Oct 2015 6:33 am, "Jordan, Bret" <> wrote:
I think this is a great idea..
Thanks,
Bret
Bret Jordan CISSP
Director of Security Architecture and Standards | Office of the CTO
Blue Coat Systems
PGP Fingerprint: 63B4 FC53 680A 6B7D 1447 F2C0 74F8 ACAE 7415 0050
"Without cryptography vihv vivc ce xhrnrw, however, the only thing that can not be unscrambled is an egg."
On Oct 2, 2015, at 14:08, Wunder, John A. <> wrote:
How
about we take two of the idioms on the
stixproject.github.io site?
- http://stixproject.github.io/documentation/idioms/c2-indicator/
- http://stixproject.github.io/documentation/idioms/simple-incident/
Thanks for helping out. I think it would be nice to see these as:
- Current STIX XML (Done already)
- Simplified XML (TBD, maybe if the JSON one is quick I’ll do this too)
- JSON/JSON-Schema (Wunder)
- JSON-LD (Casanave)
- Any others people are interest (PMML, Thrift, ProtoBuf, etc)
John
On Oct 2, 2015, at 11:50 AM, Cory Casanave <> wrote:
Re: Examples.
Pick your examples, I can help out. Would prefer to baseline off of the same schema subset & example data, current STIX is fine to define the examples. I suggest at least
one that is very simple “pure hierarchical data” and at least one with some related entities.
-Cory
