Fwd: [cti] Motion for Open Repository for the Common STIX objects

["JG @ OASIS" <jg@ctin.us>]

TAC TC:

Rich Piazza of MITRE just sent this email out to the CTI TC asking for input on Common Objects for an OASIS Open Repository.

It occurred to me that we should probably submit the Industry Sector Vocabulary that Vasileios has developed for the Open Vocabulary he is suggesting, below (industry-sector-ov). It builds on the STIX 2.1 OV and extends it to include other key industry sector frameworks.Â

The Open Vocab for the 148,032 Vulnerability Objects will also be helpful to our endeavor within the TAC TC.

Best regards,

Jane Ginn

-------- Forwarded Message --------

Subject:	[cti] Motion for Open Repository for the Common STIX objects
Date:	Tue, 23 Feb 2021 17:08:03 +0000
From:	Rich Piazza <rpiazza@mitre.org>
To:	cti@lists.oasis-open.org <cti@lists.oasis-open.org>

Hi all,

Â

As mentioned previously, MITRE has been asked by DHS/CISA to stand up a common object repository. After much thought, we think that it would be best hosted as anÂOASIS Open Repository.Â

This needs the approval of the TC.

Â

We hope that others find it useful and will contribute to the project.Â

Â

See below for a detailed description of this proposed repository and some policy questions and answers.

Â

Â

I move that the TC approve by unanimous consent requesting OASIS to set up an OASIS Open Repository project named cti-stix-common-objects using the following pieces of information:

Â

Purpose Statement: A repository of commonly used STIX objects that do not need to be created and shared by the CTI community.

Â

Initial Maintainers: Rich Piazza, Chris Lenk

Â

Open Source License: BSD-3-Clause License

Â

GitHub Name: cti-stix-common-objects

Â

Short Description: OASIS Common STIX Object Repository: a repository for commonly used STIX objects in order to avoid needless duplication

Â

Â

If there have been no objections before Monday March 1 at 21:00 UTC (5:00 PM EST), I will submit the form [1] to ask OASIS to create the repository.Â

Â

Thank you,

Rich Piazza

Â

[1]Âhttps://www.oasis-open.org/resources/tc-admin-requests/open-repository-request

Â

Â

Â

Rationale for the Repository

Â

Having such a repository of common CTI objects has always been on the âwish listâ of members of the OASIS CTI-TC.

Many entities in cyber threat intelligence are common and having many duplicate STIX objects to represent the same concept has always been seen as wasteful and problematic.Â

Â

Initial Contents of the Repository

Â

ÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂ The initial content was created via a script:

Â

ÂÂÂÂÂÂÂÂÂ Location objects

oÂÂÂ All countries (compiled from Python pycountry package)

oÂÂÂ All States (constant in script)

oÂÂÂ All Canadian Provinces (constant in script)

oÂÂÂ All regions from specification in region-ov

ÂÂÂÂÂÂÂÂÂ Identity objects

oÂÂÂ One for the object creator (currently OASIS - identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a.json)

oÂÂÂ All sectors from specification in industry-sector-ov

ÂÂÂÂÂÂÂÂÂ Vulnerability objects

oÂÂÂ All 148,032 âpublishedâ CVEsÂ

Â

Other objects considered but rejected:

Â

ÂÂÂÂÂÂÂÂÂ ipv4-addr objects (too many â billions and billions)

ÂÂÂÂÂÂÂÂÂ Data Markings

ÂÂÂÂÂÂÂÂÂ Licenses â the text needs to be specific to the license holder, so no realÂcommonÂobjects

• Software objects based on CPE (over 600,000 entries)
• Perhaps the more common Software can be determined

Â

Policies

Â

• Where would it be hosted?
• GitHub oasis-open web site.
• How is the content stored?ÂÂ
• Same as mitre/cti (see https://github.com/mitre/cti)
• Directories for each object type.
• Each file contains one object within a Bundle
• Is it âfrontedâ by a TAXII server?
• Not at this time
• Who maintains it?ÂÂ
• Initially MITRE will volunteer to be the Maintainers, to be replaced or added to with members from the TC
• Who decides what should be in theÂrepository?Â
• The maintainers, for now. Contributions are welcome â via merge requests
• How to use theÂrepository?
• Download the content and incorporate it using the python-stix2 file system datastore

Â

IP Issues

Â

• All repositories on the GitHub oasis-open web site is MUST have a README file that contains a section on Governance.Â

This is where licensing information is stated. I assume that the default BSD-3-Clause License will be used

• Is there a copyright notice (via a data marking) needed on all objects?Â

Â

Â

Â