[Date Prev] | [Thread Prev] | [Thread Next] | [Date Next] -- [Date Index] | [Thread Index] | [List Home]
Subject: RE: STIX 2.0 - Sightings object
It *feels* like Sightings is an extension of an Incident, but is that correct? What information does a Sighting need to have that an Incident does not?
What other objects types play a big part in the Sighting? From: cti-stix@lists.oasis-open.org [mailto:cti-stix@lists.oasis-open.org]
On Behalf Of Aharon Chernin This should be "sightings object rethought". While coming up with a proposal, I spotted a different way of thinking about Sightings. In my opinion, the most important thing
is determining which STIX object is being sighted. However, there is some other bits of information that is useful: sightings producer and date/time of sighting. Now take a look at the recent relationship object discussions: Relationship Object Discussion: ID [1]: The ID of the relationship,
a simple random GUID Marking[1]: The ID of the marking object that
you should reference Timestamp [1]: A timestamp in UTC stating
when the relationship object was created. Idea: Could a sighting be a type of Relationship? Relationship Object Discussion: ID [1]: <GUID> Marking[1]: TLP Green Timestamp [1]: <timestamp> Or is there more meta data we need to collect regarding sightings that a sighting deserves it's own object? Aharon Chernin SOLTRA
| An FS-ISAC & DTCC Company 18301 Bermuda green Dr Tampa, fl 33647 813.470.2173 |
achernin@soltra.com DTCC DISCLAIMER: This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error, please notify us immediately and delete the email and any attachments from your system. The recipient should check this email and any attachments for the presence of viruses. The company accepts no liability for any damage caused by any virus transmitted by this email. |
[Date Prev] | [Thread Prev] | [Thread Next] | [Date Next] -- [Date Index] | [Thread Index] | [List Home]