Re: [cti] F2F

[Trey Darley <trey@soltra.com>]

On 13.04.2016 02:55:17, Jordan, Bret wrote:
> Updated list:
> 
> Day 1
> 1) Design Principles (30 minutes)
> 2) What is MVP and what is not (1 hour)
> 3) Versioning (1 hour)
> 4) Indicators (1 hour)
> 5) Observations (1 hour)
> 6) Sightings (1 hour)
> 7) Patterning (3 hours)
> 
> Day 2
> 8) Basic CybOX objects, like the top 5-10 most commonly used ones (4 hours)
> 9) TTPs (3 hours)
> 10) Vendor Defined Fields and Objects (1 hour)
> 11) Incidents ???
> 

Bret, that's a great list but it looks more like a week's worth of
work than what we can get through in two days' time. Given your
oft-repeated mantra of "running fewer topics to the ground rather than
touching lightly on many topics", to be realistic we should halve that
list.

I suggest:

Tuesday
=======
* Coffee, getting people settled, hooked up to wifi, etc (0:30)
* Design Principles (0:30)
* MVP definition (2:00)
* Vendor Defined Fields and Objects (1:00)
* Lunch break (1:00)
* Observations (2:00)
* Indicators (2:00)

Wednesday
=========
* Coffee, getting people settled, hooked up to wifi, etc (0:30)
* Recap - close out any remaining open topics from Tuesday (however
  long it takes)

[with whatever time remains...]

* Patterning (4:00)
* Lunch break (1:00)
* Top 10 CybOX objects (4:00)
* Versioning (1:00)


I'll be chuffed if we manage to get through all that. I'd say we could
spend a day working through Sightings and Incidents. Let's punt on
that for next week.

Gary & Co, what are our time constraints with the facility? Could we
theoretically have a 06h start and work on through until midnight or
will we get kicked out of the building at 17h?

-- 
Cheers,
Trey
--
Trey Darley
Senior Security Engineer
4DAA 0A88 34BC 27C9 FD2B  A97E D3C6 5C74 0FB7 E430
Soltra | An FS-ISAC & DTCC Company
www.soltra.com
--
"No matter how hard you push and no matter what the priority, you
can't increase the speed of light." --RFC 1925

Attachment: signature.asc
Description: Digital signature