[Date Prev] | [Thread Prev] | [Thread Next] | [Date Next] -- [Date Index] | [Thread Index] | [List Home]
Subject: Re: [cti-cybox] CybOX Object Selection
>If there is not a strong use case for an object *or* there is not a strong champion on the list to advocate for it - then skip it (IE, >an object should need a strong use case *and* a strong champion who actually uses it today in active use). Adding later
is >easier than revising or removing.
I agree – I think in the past we were adding Objects to meet potential
use cases, without great clarity or definition. Going forward, I think we need some concrete evidence as to why something should be included.
>I have another proposal as well. There are a large number of objects in here that are only used by MAEC. I wonder if these >should be grouped into some MAEC extension of Cybox if they have no strong champions outside of the MAEC realm. >Thoughts?
This could be an interesting proposition, but what would an extension really entail? A subset of CybOX that is only necessary to support if you use MAEC, or something more notional? Also, some of the Objects used by MAEC (e.g., DNS Query) could be applicable
to many other domains. Maybe what we really need is a “malware analysis” subset, a “digital forensics” subset, etc.?
Regards,
Ivan
From: Jason Keirstead <Jason.Keirstead@ca.ibm.com>
Date: Tuesday, February 2, 2016 at 10:25 AM To: Ivan Kirillov <ikirillov@mitre.org> Cc: "cti-cybox@lists.oasis-open.org" <cti-cybox@lists.oasis-open.org> Subject: Re: [cti-cybox] CybOX Object Selection I would advocate against the "lets include it because it is easy" approach. As we discussed today, one the things we’d like to do soon is figure out the set of Objects that will make be included in CybOX 3.0: https://github.com/CybOXProject/schemas/wiki/CybOX-3.0:-Object-Selection. This will help us scope the release and allow us to prioritize efforts on some of the critical refactoring that needs to be done (e.g., around Network Connection). Overall, there appeared to be consensus on NOT including any new Objects in CybOX 3.0 and focusing on refactoring the existing set from v2.1. While there wasn’t clear consensus on the green-field approach, it appeared that many thought it would serve as a suitable starting point for determining this set, with the following considerations:
Ivan |
[Date Prev] | [Thread Prev] | [Thread Next] | [Date Next] -- [Date Index] | [Thread Index] | [List Home]