[Date Prev] | [Thread Prev] | [Thread Next] | [Date Next] -- [Date Index] | [Thread Index] | [List Home]
Subject: Re: [cti-comment] To get Information/Suggestion from CTI STIX 2.1 Community
Rohan:
Yes, this is the right list for posting this question.
In my view "host" should be an SCO because it represents an atomic-level cyber observable, just as a Domain Name, or IPv4 Object does. I see that we do not currently have a Host SCO defined in Section 6 of the Spec. Therefore, I suggest you use the guidance given in Section 7.3 on creating a Extension Object. In your case, you'll likely be creating it as an SCO, so be sure to follow the conventions established in Sections 2 & 3.
Jane Ginn
On 5/5/2021 11:38 PM, rohan thakur wrote:
Hi CTI Community,
I have been working with STIX implementation since the last 2 years. I have implemented STIX 2.0 in my previous project. Now I am going to work with STIX 2.1 in my current project. I am doing Entity Mapping with STIX 2.1 Objects.
I want to map "host" (hostname) with some STIX SDO or SCO, I am not getting with which STIX 2.1 Object I can map the "host" Entity for data representation. I thought of using "Infrastructure" SDO to represent "host" but I am not sure whether it is a good choice. Please share your suggestions and recommendations.
Note: I am not sure if this is the right forum/community to post this query, if not then please suggest the correct forum and sorry for the inconvenience caused.
M: +91-9646296621Thanks & Regards,Rohan Thakur
-- ********************************** R. Jane Ginn, MSIA, MRP OASIS, CTI TC Secretary OASIS, TAC TC Secretary jg@ctin.us **********************************
[Date Prev] | [Thread Prev] | [Thread Next] | [Date Next] -- [Date Index] | [Thread Index] | [List Home]