[Date Prev] | [Thread Prev] | [Thread Next] | [Date Next] -- [Date Index] | [Thread Index] | [List Home]
Subject: Re: [cti-cybox] CybOX 3.0: File Object Refactoring
Thank you Jerome. The text you pasted caused me to question my interpretation of whether the File Object in OVAL could characterize both Files and Directories. Here is the description of the file_object (emphasis mine) which should clear up any ambiguity:
Thank you.
-Mark
From: <cti-cybox@lists.oasis-open.org> on behalf of Jerome Athias <athiasjerome@gmail.com>
Date: Tuesday, December 15, 2015 at 8:02 AM To: Mark Davidson <mdavidson@soltra.com> Cc: Paul Patrick <ppatrick@isightpartners.com>, "Kirillov, Ivan A." <ikirillov@mitre.org>, Jason Keirstead <Jason.Keirstead@ca.ibm.com>, "Jordan, Bret" <bret.jordan@bluecoat.com>, "cti-cybox@lists.oasis-open.org" <cti-cybox@lists.oasis-open.org>, John Anderson <janderson@soltra.com>, Terry MacDonald <terry@soltra.com> Subject: Re: [cti-cybox] CybOX 3.0: File Object Refactoring For Windows, the OVAL spec (Ref. https://oval.mitre.org/language/version5.11/oval-windows-extension-specification_12-18-2014.pdf )
States, Starting at "2.3 win-def:file_object":
filepath:
The absolute path to a file on the system.
The absolute path SHOULD align with the guidance provided in the MSDN documentation5.
A directory MUST NOT be specified for this property.
The path and filename properties MUST NOT be specified when this property is specified.
path:
The directory component of the absolute path to a directory or file on the system.
The path component SHOULD align with the guidance provided in the MSDN documentation6.
The filepath property MUST NOT be specified when this property is specified.
filename:
The name of a file to evaluate.
A filename MUST NOT contain the characters in the set { /,\, ?, |, >, :, *}.
The filename SHOULD also align with the guidance provided in the MSDN documentation, as there are more conventions when
naming files beyond the characters listed above7.
The filepath property MUST NOT be specified when this property is specified.
2015-12-15 15:31 GMT+03:00 Mark Davidson
<mdavidson@soltra.com>:
|
[Date Prev] | [Thread Prev] | [Thread Next] | [Date Next] -- [Date Index] | [Thread Index] | [List Home]