Re: [cti-stix] Some thoughts on Sightings and conversations to date (Part #2): the semantics of observation, indicator, incident, sightings, etc

From
Jerome Athias <>
Date
2015-11-12T14:08:54+00:00
ID
CAA=AuEcYhHS1f6=OBu7wTvpdZPLR8aD2yY-K11_zvVx=
Thread
Re: [cti-stix] Some thoughts on Sightings and conversations to date (Part #2): the semantics of observation, indicator, incident, sightings, etc
Could we have short term (mid) + long term agreement?

Like

Short: investigation in the incident status

Long: investigation construct

On Thursday, 12 November 2015, Trey Darley <> wrote:
On 11.11.2015 23:23:40, Jane Ginn -  wrote:

>

> I'm inclined to go with the arguments for adding an Investigation

> construct, for this, and many other reasons.

>

I think the reasoning for an Investigation construct is solid. QED, I

support the notion. +1

--

Cheers,

Trey

--

Trey Darley

Senior Security Engineer

4DAA 0A88 34BC 27C9 FD2B  A97E D3C6 5C74 0FB7 E430

Soltra | An FS-ISAC & DTCC Company

www.soltra.com

--

"It is easier to move a problem around (for example, by moving the

problem to a different part of the overall network architecture) than

it is to solve it." --RFC 1925