Re: [cti-stix] Applying data markings

["Jordan, Bret" <bret.jordan@bluecoat.com>]

So I really like what you have done for Level 1 markings, and I can get behind that.  A few nits/comments though:

1) you have defined marking_definitions and marking_refs.  I am guessing you are using an abbreviated form of references because of the legacy "idref" field.  I would prefer that we adopt a general style guide for the field names.  

Options to be discussed:

a) use underscores || camel casing

b) all lower case || camel casing

c) spell words out || try to use abbreviated forms when possible

My preferences:

I prefer underscores even though the JSON uses camel casing

I personally prefer all lower case

I would prefer abbreviations when possible.  So marking_defs and marking_refs  (this might be hotly debated by this group)

2) EclecticIQ published a great style guide for JSON STIX when they did theirs.  One thing that I did not like at first, but came to love in code was their use of a "type" field.  For example:

{

  "type": "six_package",

  "indicators": [

    {

      "type": "indicator",

      "id": "indicator-1234"

    }

  ]

}

It might be good to do this in your marking objects as well.  Something like "type": "marking" or something. Please the attached PDF of their email to the STIX list from long ago.  

3) Can you give some examples of a Level 2 marking structure that is valid?  I am still not sold on the Level 2, but am willing to work with you, so you can enlighten me.  

Attachment: Intelworks implementation of STIX in JSON.pdf
Description: Adobe PDF document

Thanks,

Bret

Bret Jordan CISSP

Director of Security Architecture and Standards | Office of the CTO

Blue Coat Systems

PGP Fingerprint: 63B4 FC53 680A 6B7D 1447  F2C0 74F8 ACAE 7415 0050

"Without cryptography vihv vivc ce xhrnrw, however, the only thing that can not be unscrambled is an egg." 

On Dec 3, 2015, at 13:11, Wunder, John A. <jwunder@mitre.org> wrote:

All,

I developed this proposal to handle the application of data markings in STIX 2.0: https://github.com/johnwunder/data-markings. Note: it doesn't address the format of the markings themselves (improvements to TLP, the work in FIRST, etc), just how those markings get applied to content.

I this this meets the need for simplicity for object-level markings as we’ve talked about many times while still allowing for more complicated field-level markings for those that need them. Please review the proposal and let’s talk about feedback. If this looks good to everyone we could use it as the solution for issue #231 (currently #2 on our roadmap).

John

Attachment: signature.asc
Description: Message signed with OpenPGP using GPGMail