Bret,
For the most part I think your proposal below is on the right track. I do however have concerns about “Redefining some semantic meaning to some properties or objects in STIX”. I don’t think this
should be something we should be advertising as an option. The only time I believe we’ve done this in the past is with the labels property, and only then after a very lengthy conversation and consideration of all the angles. I don’t want to create an easy/ready-made
process for people to start suggesting that we redefine the meanings of all of our existing work. Doing that should be hard, and for good reason.
Thanks,
Sarah Kelley
Lead Cybersecurity Engineer, T8B2
Defensive Operations
The MITRE Corporation
703-983-6242
From: <>
On Behalf Of Bret Jordan
Sent: Tuesday, July 24, 2018 10:56 AM
To:
Subject: [cti] Enhancement Process
All,
We have had several discussion about an enhancement process. In an effort to help drive this forward and help us get high-level agreement on what this would mean, here are a few points.
Types of Enhancements
New Objects (STIX Domain Objects, STIX Relationship Objects, Cyber Observable Objects)
Named Groupings of new properties on an existing object
Adding clarity or enhanced meaning to some property (example, explaining double or triple tagging of data in a “tags” property)
Redefining some semantic meaning to some properties or objects in STIX
Adding elements or redefining concepts in Patterning
Requirements
Useable by the TC itself for ideas that are not well understood
Useable by people inside the TC for their ideas
Useable by people outside the TC for their ideas
Ability to submit, if the creators desire, the enhancement to the TC
If TC wants to make changes the creators can withdraw their proposal
Ability to register, if creators desire, the enhancement in a registry run by some yet-to-be-determined group/org/method
Ability to advertise in a STIX object that an enhancement is in use
Ability to advertise in TAXII that an enhancement is in use
Ability to filter in TAXII for enhancements
Please let me know if the list of possible enhancement types is correct and if you have any additional requirements.
Bret
