cti-stix — archive

Proposal - Change Report Object

From: Aharon Chernin <[email protected]>
To: [email protected]
Date: Mon, 27 Jul 2015 16:29:00 -0000

In general, I favor referencing over inline. The only thing I haven't put much thought on is how I feel about requiring referencing when doing something like composite indicators. Aharon Chernin CTO SOLTRA An FS-ISAC & DTCC Company 18301 Bermuda green Dr Tampa, fl 33647 813.470.2173 [email protected] www.soltra.com From: [email protected] <[email protected]> on behalf of Jordan, Bret <[email protected]> Sent: Monday, July 27, 2015 12:19 PM To: Wunder, John A. Cc: Jason Keirstead; Trey Darley; [email protected] Subject: Re: [cti-stix] Proposal - Change Report Object I could go with that... Thanks, Bret Bret Jordan CISSP Director of Security Architecture and Standards Office of the CTO Blue Coat Systems PGP Fingerprint: 63B4 FC53 680A 6B7D 1447 F2C0 74F8 ACAE 7415 0050 "Without cryptography vihv vivc ce xhrnrw, however, the only thing that can not be unscrambled is an egg." On Jul 27, 2015, at 10:07, Wunder, John A. < [email protected] > wrote: I'm going to throw out there that we should make ALL relationships between top-level constructs reference only. That would include Report, but also things like TTPs in Indicators, etc. From: < [email protected] > on behalf of Jason Keirstead Date: Monday, July 27, 2015 at 11:59 AM To: Trey Darley Cc: "Jordan, Bret", " [email protected] " Subject: Re: [cti-stix] Re: Proposal - Change Report Object I also +1 this if we are counting votes. - Jason Keirstead Product Architect, Security Intelligence, IBM Security Systems www.ibm.com/security www.securityintelligence.com Without data, all you are is just another person with an opinion - Unknown <graycol.gif> Trey Darley ---2015/07/27 12:13:59 PM---+100, Bret! Cheers, From: Trey Darley < [email protected] > To: "Jordan, Bret" < [email protected] >, " [email protected] " < [email protected] > Date: 2015/07/27 12:13 PM Subject: [cti-stix] Re: Proposal - Change Report Object Sent by: < [email protected] > +100, Bret! Cheers, Trey -- Trey Darley Senior Security Engineer Soltra An FS-ISAC & DTCC Company www.soltra.com From: [email protected] < [email protected] > on behalf of Jordan, Bret < [email protected] > Sent: Monday, July 27, 2015 16:57 To: [email protected] Subject: [cti-stix] Proposal - Change Report Object In STIX 2.0 I would like to propose that we change the Report Object to contain just reference to the objects that it is binding. I do not want to see it contain data itself. [soap box] We need one way of doing things and the current data-model of STIX, while beautiful, makes writing a decision tree in code for some arbitrary data in a STIX package nearly impossible. . [/soap box] Thanks, Bret Bret Jordan CISSP Director of Security Architecture and Standards Office of the CTO Blue Coat Systems PGP Fingerprint: 63B4 FC53 680A 6B7D 1447 F2C0 74F8 ACAE 7415 0050 "Without cryptography vihv vivc ce xhrnrw, however, the only thing that can not be unscrambled is an egg." <graycol.gif>