Let's get this thing started!

[Trey Darley <trey@soltra.com>]

All,

Welcome to the OASIS CTI CybOX subcommittee! Thanks for your interest
in helping to extend and streamline CybOX as a standard, we're
thrilled to have you on board!

Our first task, as stated in our OASIS charter, is to convert the
existing CybOX 2.1 specifications over to an OASIS CybOX 2.1.1
standard. Once this copy-paste exercise is complete (and DHS Legal
sign off on the intellectual property transfer to OASIS), Ivan and I
will post the draft for subcommittee review and comment. As we're
running into the summer holiday period and a lot of folks will be out,
we'll target this for end of September to ensure that there's plenty
of opportunity for community feedback. As soon as we've reached
consensus in the CybOX subcommittee on the 2.1.1 draft, we'll reach
out to the broader CTI TC for official ratification.

Meanwhile, while all this copy-pasting is going on behind the scenes,
we'd love to hear your vision for the future of CybOX. As you're
probably already aware, the official OASIS CybOX mailing list is
cti-cybox@lists.oasis-open.org. All mails posted here are archived and
viewable to the entire public, so while we actively encourage debate,
let's keep things courteous and civil. :-)

Sometimes a phone call can accomplish what 1000 emails cannot, so we'd
like to schedule regularly-occurring community calls. As we have
participants scattered across the globe, please fill out this Doodle
to help us identify the best timeslot (ie, that covers the most
people.)

Doodle poll: https://doodle.com/mes6aaseuxxhmvq8

In closing, we'd like to give you a general idea of where our heads
are at. As soon as we get through the paperwork exercise of the OASIS
migration, we'd like to get underway with defining CybOX 3.0.

If you've spent much time delving into the CybOX spec, you've no doubt
observed certain idiosyncracies that are organic accretions of its
evolution. Accordingly, we'd like to rearchitect some things, clean up
redundancies, and (obviously) extend the spec with missing object
types.

We realize that vendors who have already implemented support for CybOX
(or are in process of doing so) may be disheartened to see a major,
non-backwards-compatible release coming but the value proposition is a
CybOX that's easier to compose, more readily parsable (and hence,
interoperable), and stable. Our goal would be a cleaned-up CybOX 3.0
that's stable on the order of several years. To do this right, we'll
be making sure to do this in concert with the various CybOX user
communities, including STIX, MAEC, digital forensics, and others.

Towards that end, we'll need your input and help. (This isn't a
full-time job for either of us!)

But we'll discuss in further detail on the call. Please fill out the
doodle. Once the poll results are in, we'll send out a calendar invite
with detailed agenda.

Oh, yes, one last thing. If you know of folks who are using CybOX but
not already participating in the OASIS TC, please reach out and
invite them to join!

Thanks,
Ivan Kirillov
Trey Darley