Re: [cti] Slides for Working Call Tomorrow

I can attest that when this was crafted
(with stateful SIEM-like rules in mind), an "exact match" was
what was envisioned. A follow on match would be a second, discrete result.

If that needs clarifying in the document
we should do that.

-
Jason Keirstead
Lead Architect - IBM Security Connect
www.ibm.com/security

"Things may come to those who wait, but only the things left by those
who hustle." - Unknown 

From:      
 Allan Thomson <>
To:      
 Emily Ratliff <>,
"" <>
Date:      
 04/09/2019 08:38 PM
Subject:    
   Re: [cti] Slides
for Working Call Tomorrow
Sent by:    
   <>

Emily â thanks for the proposals.
 
On item #146. 
 
The example you shared:
[ b ] FOLLOWEDBY [ c ] REPEATS 5 TIMES
 
It seems that this should be equivalent
to EXACTLY 5 times. Not AT LEAST 5 times. If that was the intent then we
really should use a different _expression_.
 
[ b ] FOLLOWEDBY [ c ] REPEATS >= 5
TIMES
 
Would seem to clarify whether it is equals
or greater-than-equals and is unambiguous. 
Allan
 
From: ""
<> on behalf of Emily Ratliff <>
Date: Tuesday, April 9, 2019 at 11:49 AM
To: "" <>
Subject: Re: [cti] Slides for Working Call Tomorrow
 
Slides for the GitHub issues.

Thanks!

Emily

Emily Ratliff
STSM, IBM Security Research Initiative Lead

 

Phone:1-512-286-9947|
Mobile:1-512-653-1052
E-mail:
11501 Burnet Rd
Austin, TX 78758-3400
United States

 

From:        Bret
Jordan <>
To:        ""
<>
Date:        04/08/2019
03:52 PM
Subject:        [cti]
Slides for Working Call Tomorrow
Sent by:        <>

 
All,
Here are the slides for the working call
tomorrow.
Bret
[attachment "2019-04-08 Working Call.pdf"
deleted by Emily Ratliff/US/IBM] 
---------------------------------------------------------------------
To unsubscribe from this mail list, you must leave the OASIS TC that 
generates this mail.  Follow this link to all your TCs in OASIS at:
https://www.oasis-open.org/apps/org/workgroup/portal/my_workgroups.php