openc2 — archive

[Duncan Sparrell]

I (Duncan speaking as sFractal Consulting, not as a co-chair) perceive one of the root issues underlying alot of these questions is OpenC2 applicability to for use in STIX Course of Action and what is this TC's role, what is CTI TC role, and is there a gap. I'm basing this on the timing of Bret's email wrt my CTI email questioning Bret's assertion on the CTI mailing list that OpenC2 may not be the applicable for C2 in STIX. I agree with him that answering the questions below certain ways could preclude OpenC2 from being used as the STIX C2. Therefore I think the use cases should be included in the discussion since what is applicable in one use case may not be in another and we shouldn't talk past each other. I think the use of OpenC2 for STIX should specifically be part of the discussion so we don't inadvertently preclude OpenC2 from being used and cause an almost identical parallel effort to be set up. I would also propose the wording of 2.1.1 be changed from If everyone can do their own things with transport then no one will be interoperable to something less pejorative like Should OpenC2 be transport agnostic or should we have mandatory (or recommended) transport alternatives; and if so how many and which ones? . Is the proposal to have one ballot (yeah or nay to a to-be-developed set of answers to these questions) or each question as it's own ballot? If it is to be one question, should it instead be 'Should OpenC2 scope include what is necessary for use in STIX COA?' since that appears to be fundamental factor in the disagreements? Duncan Sparrell sFractal Consulting LLC iPhone, iTypo, iApologize