Patterning Working Group - Call Summary

["Jason Keirstead" <Jason.Keirstead@ca.ibm.com>]

In sprit of openness here are the outcomes of the Cybox Patterning working group call today.

- We have a firm consensus in the working group that cybox 3.0 patterning should be based on a syntactical grammar, and not on a series of nested object constructs

- We have a rough concensus that the grammar should be SQL-92 based in structure. Some other approaches such as lucene grammar and a green-field grammar were discussed, but in the end all on the call settled on SQL as the best mixture of shallow learning curve and extensibility for CTI use cases. If anyone has dissenting opinion on this, please let us know.

- We all agreed on a use-case driven approach to flesh out the proposal.

- We posted a playground document to Google Docs (https://docs.google.com/document/d/1suvd7z7YjNKWOwgko-vJ84jfGuxSYZjOQlw5leCswPY/edit). This document consists of three sections:

- A Use Case section. This will be the primary working area of the document. In this section we will add and expand upon use cases for patterning, and represent them in the proposed syntax. We want to add as many use cases here as possible, so if you have some, please send them along or add them in the comments section. If there are use cases we can not model in the grammar, that is what we want to find.

- A operators section. This will be the description of the grammar

- An ANTLR Grammer section. No one had strong feelings for or against ANTLR format so we will keep running with that. I will be attempting to maintain this grammar as the use cases and operators sections grow so that we always have "working code".

- We agreed that the grammar is the initial work product goal for the working group, and tacking turning the grammar into normative text will be done only once we are sure all the use cases can be handled.

That is about it.

-
Jason Keirstead
STSM, Product Architect, Security Intelligence, IBM Security Systems
www.ibm.com/security | www.securityintelligence.com

Without data, all you are is just another person with an opinion - Unknown