cti-stix — archive

Object ID format

From: John Anderson <[email protected]>
To: [email protected]
Date: Mon, 25 Jan 2016 02:36:00 -0000

Terry, True, content does disappear from the Internet sometimes. Sometimes that's a good thing. Other times, how does the web handle that? I can think of three ways: 1. Responsible redirects. (When the purchasing company cares about the content it's moving.) 2. Google. (When other people who link to the content care about its new location.) 3. Wayback machine. (When...?) I wonder how CTI is different from web documents. I mean: If the content is not worth the effort to maintain, why do I care if I can't find it anymore? (Also, keeping a local snapshot is perfectly valid. People mirror the web all the time.) JSA PS-After reading Mark's response, I'm probably beating a dead horse. But I want us to really think hard about why we can't just use the established web for CTI. ________________________________________ From: [email protected] <[email protected]> on behalf of Terry MacDonald <[email protected]> Sent: Friday, January 22, 2016 4:52 PM To: [email protected] Subject: RE: [cti-stix] Re: Object ID format Hi John, Companies are bought by other companies. Organizations rebrand. Groups replace and redesign networks. All of these real-world things affect where things are located and reachable in the Internet. I would still trust these companies, as what they are doing is normal behaviour - and yet they are still changing their Resources. 'Hard linking' the Object-IDs directly to any destination (i.e. using URLs) is a bad idea, as it means that that Object is tied to the location forever. If a company moves to a new network design and we use hard-linking, then the consumer is no longer able to ask for help, unless there is some kind of translation web proxy created that understands Object IDs. I prefer a 'look it up at the time' mechanism for resolving the actual 'real' location of Object IDs. If an ID is in the format [Object]-[UUID], and it links to an InformationSource Object, and that object has a domain name in it, then I will be able to look up the TAXII Domain Service record, and that can then tell me what the current latest (and valid) location is to get more information. In fact we could even include the TAXII server location in the InformationSource Object itself, and if our domain name changes then we can update the InformationSource Object and republish it out to the community. Cheers Terry MacDonald Senior STIX Subject Matter Expert SOLTRA An FS-ISAC and DTCC Company +61 (407) 203 206 [email protected]