cti-stix — archive

Fwd: Proposal - Allow a client to request an object based on its ID

From: Trey Darley <[email protected]>
To: [email protected]
Date: Wed, 29 Jul 2015 11:11:00 -0000

Hey, Terry - This is actually #1 in my list of TAXII Query use cases, which are are follows: 1) Give me object <uuid> if you have seen it. 2) Give me all the objects you have which are related to object <uuid>. 3) Give me all the objects you have which are of type <foobar> (Indicator/Observable/COA/etc) With the obvious overlays of TLP, Producer, timestamp ranges, Confidence, etc. Unfortunately, as a side effect of TAXII currently being content-agnostic, this is difficult if not impossible. To be useful for query purposes, TAXII needs to get a whole lot closer to STIX/CybOX. Cheers, Trey -- Trey Darley Senior Security Engineer Soltra An FS-ISAC & DTCC Company www.soltra.com From: [email protected] <[email protected]> on behalf of Terry MacDonald <[email protected]> Sent: Tuesday, July 28, 2015 15:07 To: Ms. Jane Ginn Cc: [email protected]; [email protected] Subject: [cti-stix] Re: [cti-taxii] Fwd: Proposal - Allow a client to request an object based on its ID Hi Jane, There wouldn't be an impact as far as I can see. The idea would work something like this: 1. Consumer receives a STIX data object, say an indicator from org A with ID x 2. Consumer receives a top level relationship from org B saying there is a relationship between ID x and an indicator called ID y. 3. The consumer doesn't have a copy of the STIX data object with ID y (apart from knowing the id), so it contacts the original producer (which it knows from the namespace in the ID) and requests the STIX data object with ID y 4. The original producer of ID y object decides to allow the consumer to access the STIX object ID y, and so sends a copy of the o object to the consumer. As far as the report object being links only, I would think the report object in this case would be the summary and overview information, and that it would user the top level relationship object to link to ask of the STIX data objects that are referenced in the report itself. I mentally see the difference as the report being the APT1 report itself, and the STIX objects and relationship objects being all those appendixes that contained IOCs (although STIX can describe much more than just the IOCs listed in the actual APT1 report. Does that help clarify? Cheers Terry MacDonald On 28 Jul 2015 2:58 pm, "Jane Ginn - [email protected] " < [email protected] > wrote: So Terry: How would this Use Case deal with a 'Confidence' rating... or a 'Sighting' ... and..., as you have probably noted... there is some discussion of having the 'Report' object be devoid of data... What would be the impact there with respect to this 'Relationship' object you are proposing? Jane Ginn, MSIA, MRP Cyber Threat Intelligence Network, Inc. [email protected]