Re: [cti-cybox] Network Connection src and dst refs

["Jason Keirstead" <Jason.Keirstead@ca.ibm.com>]

There are use cases where you only have one side of the equation.

Also, and likely more importantly, there are many uses cases where you will only want to SHARE one side of the equation. Many organizations can not and will not share information about their internal IP space.

-
Jason Keirstead
STSM, Product Architect, Security Intelligence, IBM Security Systems
www.ibm.com/security | www.securityintelligence.com

Without data, all you are is just another person with an opinion - Unknown


"Jordan, Bret" ---09/15/2016 11:30:02 AM---What is the use case for these two fields being optional? When would you NOT have something in them

From: "Jordan, Bret" <bret.jordan@bluecoat.com>
To: "cti-cybox@lists.oasis-open.org" <cti-cybox@lists.oasis-open.org>
Date: 09/15/2016 11:30 AM
Subject: [cti-cybox] Network Connection src and dst refs
Sent by: <cti-cybox@lists.oasis-open.org>

---

What is the use case for these two fields being optional?  When would you NOT have something in them?  Does it make since to send this object without these fields? 


Thanks,

Bret



Bret Jordan CISSP
Director of Security Architecture and Standards | Office of the CTO
Symantec
PGP Fingerprint: 63B4 FC53 680A 6B7D 1447  F2C0 74F8 ACAE 7415 0050
"Without cryptography vihv vivc ce xhrnrw, however, the only thing that can not be unscrambled is an egg." 
[attachment "signature.asc" deleted by Jason Keirstead/CanEast/IBM]