For review: Network Connection Object

["Kirillov, Ivan A." <ikirillov@mitre.org>]

The Network Connection Object is finally ready for review: https://docs.google.com/document/d/1oPAHN6nitdVF60RuDlajq0VuN6S_p_RP3ZE48yOBBfQ/edit#heading=h.rgnc3w40xy

 

There are a number of open questions around this Object, including the following:

 

• Right now all fields are optional - should any be required?
• Should protocols be broken down by OSI layer, as in the current implementation?
  • Things like IP don’t fit cleanly into the OSI model
• Does the initial collection of extensions make sense?
  • Are any missing?
• Should the HTTP extension also characterize responses? At the moment it only characterizes HTTP requests.
• The flow extension currently captures an entire network connection payload - should we consider capturing per-packet payloads as well?

Discussion around this Object will be one of the main topics of tomorrow’s working call.

 

Regards,

Ivan