[Date Prev] | [Thread Prev] | [Thread Next] | [Date Next] -- [Date Index] | [Thread Index] | [List Home]
Subject: Re: [cti-stix] Proposal - Top Level Relationship Object
Thanks Bret, good points. Updated and removed the redundancy of both occurrence and optional/required statements.
Also I apparently missed that Description is multiple elements. Is the intent behind that multiple languages? Multiple markings? Multiple paragraphs? If we do that, does that mean description needs to be something other than a plain
array of strings?
Keep in mind that STIX 1.2 is complicated for a reason. If we try to do everything that STIX 1.2 does we will end up with something just as complicated. Sometimes a simple 90% solution is better than a very complicated 99.9% solution.
(If you can't tell, I would prefer to allow a single string description.)
John
From: "Thompson, Dean"
Date: Thursday, July 30, 2015 at 3:33 AM To: "'Jordan, Bret'", "Wunder, John A." Cc: Patrick Maroney, 'Terry MacDonald', 'Jason Keirstead', "'cti-stix@lists.oasis-open.org'", 'Chris O'Brien', 'JG on CTI-TC', Jon Baker, 'Aharon Chernin' Subject: RE: [cti-stix] Proposal - Top Level Relationship Object Hi, Whilst I agree that Start_Time should be made compulsory (although there could be reasons when you don’t know the exact start date), I am not sure
that you can make End_Time [1] rather than [0..1]. There are times when you might not know the End_Time (for example a web site is still redirecting Angler malware), a security event of incident may be on-going. If we force End_Time to be compulsory, then that will either force producers to put in some fairy land End_Date, or for them to stamp the time that
a STIX document was produced as the End_Time of the incident/indicator or relationship. This will cause issues later on or those that implement these repositories of data as well as consumers using the data because they may expire or dis-regard valid data
primarily on the basis of the current time being greater than End_Time. Regards, Dean From:
cti-stix@lists.oasis-open.org [mailto:cti-stix@lists.oasis-open.org]
On Behalf Of Jordan, Bret Timestamp is required so we need to change the value from [0..1] to just [1]. We should probably do the same for Start_Time and End_Time. I would also suggest that we maintain plurality rules so things that can have multiple we should
make them plural. Target_IDs and Descriptions Thanks, Bret Bret Jordan CISSP Director of Security Architecture and Standards | Office of the CTO Blue Coat Systems PGP Fingerprint: 63B4 FC53 680A 6B7D 1447 F2C0 74F8 ACAE 7415 0050 "Without cryptography vihv vivc ce xhrnrw, however, the only thing that can not be unscrambled is an egg."
|
[Date Prev] | [Thread Prev] | [Thread Next] | [Date Next] -- [Date Index] | [Thread Index] | [List Home]