Re: [cti-cybox] Update on the CybOX 3.0 effort

[Paul Patrick <Paul.Patrick@FireEye.com>]

Trey,

One suggestion that I might make is that we add a section similar to what is in the TAXII spec that describes a basic mapping between the capabilities found in the CybOX 2.1 spec. This would help people use the patterning approach more consistently and provide help to those familiar with STIX 1.2 and CybOX 2.1 in making the transition.


Paul Patrick



On 7/15/16, 3:16 PM, "Trey Darley" <cti-cybox@lists.oasis-open.org on behalf of trey@kingfisherops.com> wrote:

    Greetings -

    It's been a busy week in CybOX land. Since we emailed you yesterday,
    we've had a number of helpful comments on CybOX Core [0] and have been
    working to incorporate your feedback as well as generally putting
    additional polish on that document.

    Our primary focus over the past two days has been on the CybOX
    Patterning spec. (Special thanks to John-Mark Gurney and Jason
    Keirstead for their invaluable contributions!) As most of you are
    probably aware, over in STIX land there's a general consensus to make
    CybOX Patterning MTI for STIX implementations supporting Indicators.
    Consequently, it was fortuitous timing that the CybOX SC focused on
    polishing the CybOX Patterning spec this week.

    The CybOX Patterning spec [1] is not perfect, but is now in good shape
    for review by the TC. We welcome your comments and feedback. (If
    anyone does not have the ability to suggest changes on the Google
    Docs, reach out to Ivan or me privately and we'll get that sorted for
    you.)

    Next week, we will be focusing on finalizing the CybOX object specs
    and the CybOX vocabularies. Ivan and I have carved out 4-5 hours per
    day [2] to work through issues on an open bridge [3] so feel free to
    dive in and help us get this thing done!

    As you're probably aware, the STIX SC plans a document freeze later
    today, at which point they will be emailing PDFs to the TC in order to
    launch an informal two week comment period prior to putting the STIX
    2.0 draft specs up for a TC-wide vote to move them into OASIS
    Committee Draft Spec status.

    The CybOX SC has a significant amount of work remaining to be done
    with somewhat less volunteer participation than the STIX SC.
    Consequently, our goal is to trail the STIX SC with one week's delay,
    that is, we aim to be in a position to freeze the CybOX 3.0 draft
    specs at the end of *next* Friday, send out PDFs to the TC for an
    informal two week comment period, etc.

    We want to ensure that everyone is aware of our intentions and the
    ample opportunity we're providing for all interested parties to weigh
    in with their additions, comments, constructive criticism, etc. But in
    order to achieve the TC's goal of hitting MVP for all three CTI
    standards by 29 July, it is imperative that if you care about what
    CybOX 3.0 looks like, that you speak up now and don't wait until the
    last minute.



    [0]: https://docs.google.com/document/d/1PSGv6Uvo3YyrK354cH0cvdn7gGedbhYJkgNVzwW9E6A/edit
    [1]: https://docs.google.com/document/d/1suvd7z7YjNKWOwgko-vJ84jfGuxSYZjOQlw5leCswPY/edit
    [2]: https://docs.google.com/spreadsheets/d/1Wc-3iLGgtM1vdwfV23ClHe80DflFQ8eX-hO69L1xlvk/edit#gid=0
    [3]: https://www.uberconference.com/kingfisherops, PIN 20357

    --
    Cheers,
    Trey
    ++--------------------------------------------------------------------------++
    Kingfisher Operations, sprl
    gpg fingerprint: 85F3 5F54 4A2A B4CD 33C4  5B9B B30D DD6E 62C8 6C1D
    ++--------------------------------------------------------------------------++
    --
    "There's never enough time. Thank you for yours." --Dan Geer


This email and any attachments thereto may contain private, confidential, and/or privileged material for the sole use of the intended recipient. Any review, copying, or distribution of this email (or any attachments thereto) by others is strictly prohibited. If you are not the intended recipient, please contact the sender immediately and permanently delete the original and any copies of this email and any attachments thereto.