cti-stix — archive

Proposal - Change Report Object

From: Jason Keirstead <[email protected]>
To: [email protected]
Date: Mon, 27 Jul 2015 16:01:00 -0000

I also +1 this if we are counting votes. - Jason Keirstead Product Architect, Security Intelligence, IBM Security Systems www.ibm.com/security www.securityintelligence.com Without data, all you are is just another person with an opinion - Unknown Trey Darley ---2015/07/27 12:13:59 PM---+100, Bret! Cheers, From: Trey Darley <[email protected]> To: "Jordan, Bret" <[email protected]>, "[email protected]" <[email protected]> Date: 2015/07/27 12:13 PM Subject: [cti-stix] Re: Proposal - Change Report Object Sent by: <[email protected]> +100, Bret! Cheers, Trey -- Trey Darley Senior Security Engineer Soltra An FS-ISAC & DTCC Company www.soltra.com From: [email protected] <[email protected]> on behalf of Jordan, Bret <[email protected]> Sent: Monday, July 27, 2015 16:57 To: [email protected] Subject: [cti-stix] Proposal - Change Report Object In STIX 2.0 I would like to propose that we change the Report Object to contain just reference to the objects that it is binding. I do not want to see it contain data itself. [soap box] We need one way of doing things and the current data-model of STIX, while beautiful, makes writing a decision tree in code for some arbitrary data in a STIX package nearly impossible. . [/soap box] Thanks, Bret Bret Jordan CISSP Director of Security Architecture and Standards Office of the CTO Blue Coat Systems PGP Fingerprint: 63B4 FC53 680A 6B7D 1447 F2C0 74F8 ACAE 7415 0050 "Without cryptography vihv vivc ce xhrnrw, however, the only thing that can not be unscrambled is an egg."