Re: [cti-comment] To get Information/Suggestion from CTI STIX 2.1 Community

[rohan thakur <thakur577@gmail.com>]

Hi Jane,

Thanks for your valuable suggestions. I was thinking of making it SDO but now I will make it SCO.

I would also request the CTI committee to think of adding "host" to official STIX 2.1 SCO specifications.

Thanks once again.

Regards,

Rohan Thakur

M: 9646296621

On Thu, May 6, 2021 at 8:57 PM JG @ OASIS <jg@ctin.us> wrote:

Rohan:

Yes, this is the right list for posting this question.

In my view "host" should be an SCO because it represents an atomic-level cyber observable, just as a Domain Name, or IPv4 Object does. I see that we do not currently have a Host SCO defined in Section 6 of the Spec. Therefore, I suggest you use the guidance given in Section 7.3 on creating a Extension Object. In your case, you'll likely be creating it as an SCO, so be sure to follow the conventions established in Sections 2 & 3.

Jane Ginn

On 5/5/2021 11:38 PM, rohan thakur wrote:

Hi CTI Community,

I have been working with STIX implementation since the last 2 years. I have implemented STIX 2.0 in my previous project. Now I am going to work with STIX 2.1 in my current project. I am doing Entity Mapping with STIX 2.1 Objects.

I want to map "host" (hostname) with some STIX SDO or SCO, I am not getting with which STIX 2.1 Object I can map the "host" Entity for data representation. I thought of using "Infrastructure" SDO to represent "host" but I am not sure whether it is a good choice. Please share your suggestions and recommendations.

Note: I am not sure if this is the right forum/community to post this query, if not then please suggest the correct forum and sorry for the inconvenience caused.

Thanks & Regards,

Rohan Thakur

M: +91-9646296621

-- 
**********************************
R. Jane Ginn, MSIA, MRP
OASIS, CTI TC Secretary
OASIS, TAC TC Secretary
jg@ctin.us
**********************************