Infrastructure mini-group discussions

Hi all,

 

Since we could not briefly update folks on the working call today about the Infrastructure mini-group discussions, here is a quick overview:

 

Many changes were made on Relationships, please take a look. There were a lot of
older relationships that didn't quite match the consistency in which we had used with Malware. Tried to be consistent when possible.

Another major discussion point was around Kill Chain phases. The group resolved the comment in the doc without taking action. Work around this impacts other structure of STIX, so it
 may end up falling outside the remit of this mini-group for now.

 

To DO:

 

Sean Barnum to work out language around name (as required field) description - Thoughts or suggestions welcome. Sean working on this.

There were concerns that 'communicates-with' misses a major relationship, and that it does not hit on the “has” bit.  Ideas to suggest a new row for relationships that contains this
 missing relationship? Emily/Caitlin working on this.

Friday 19th call @ noon EDT to discuss more of this work.

 

 

 

Caitlin Huey

EclecticIQ Fusion Center | Senior Threat Intelligence Analyst

Amsterdam, Netherlands