Re: [cti-comment] To get Information/Suggestion from CTI STIX 2.1 Community

["JG @ OASIS" <jg@ctin.us>]

Rohan:

Yes, this is the right list for posting this question.

In my view "host" should be an SCO because it represents an atomic-level cyber observable, just as a Domain Name, or IPv4 Object does. I see that we do not currently have a Host SCO defined in Section 6 of the Spec. Therefore, I suggest you use the guidance given in Section 7.3 on creating a Extension Object. In your case, you'll likely be creating it as an SCO, so be sure to follow the conventions established in Sections 2 & 3.

Jane Ginn

On 5/5/2021 11:38 PM, rohan thakur wrote:

Hi CTI Community,

I have been working with STIX implementation since the last 2 years. I have implemented STIX 2.0 in my previous project. Now I am going to work with STIX 2.1 in my current project. I am doing Entity Mapping with STIX 2.1 Objects.

I want to map "host" (hostname) with some STIX SDO or SCO, I am not getting with which STIX 2.1 Object I can map the "host" Entity for data representation. I thought of using "Infrastructure" SDO to represent "host" but I am not sure whether it is a good choice. Please share your suggestions and recommendations.

Note: I am not sure if this is the right forum/community to post this query, if not then please suggest the correct forum and sorry for the inconvenience caused.

Thanks & Regards,

Rohan Thakur

M: +91-9646296621

-- 
**********************************
R. Jane Ginn, MSIA, MRP
OASIS, CTI TC Secretary
OASIS, TAC TC Secretary
jg@ctin.us
**********************************