Re: [cti-cybox] CybOX Objects/Relationships

["Kirillov, Ivan A." <ikirillov@mitre.org>]

That matches my current thinking as well. It will be interesting to see what everyone else thinks :)

BTW feel free to comment on the GitHub Gist JSON Examples [1] directly. I can then roll the comments back into the main document or just create a new document around examples (most likely).

[1] https://gist.github.com/ikiril01

Regards,

Ivan

From: Bret Jordan <bret.jordan@bluecoat.com>
Date: Thursday, April 7, 2016 at 10:16 AM
To: Ivan Kirillov <ikirillov@mitre.org>
Cc: "cti-cybox@lists.oasis-open.org" <cti-cybox@lists.oasis-open.org>
Subject: Re: [cti-cybox] CybOX Objects/Relationships

My vote....

Q1) Should CybOX define a set of top-level objects (TLOs) and be capable of being used in a standalone capacity? Or should it just define a set of types that are used in languages that incorporate CybOX?

No, CybOX should not be a standalone thing.  It should be used by higher level languages.  

Q2) Should CybOX Objects be defined using a relationship-driven approach, or one based on embedded Objects?

This needs to be done on a case by case basis.  There might be some cases where it makes sense, but in turn there will be some where it will not make sense at all.   There needs to be a good middle ground.  

Thanks,

Bret

Bret Jordan CISSP

Director of Security Architecture and Standards | Office of the CTO

Blue Coat Systems

PGP Fingerprint: 63B4 FC53 680A 6B7D 1447  F2C0 74F8 ACAE 7415 0050

"Without cryptography vihv vivc ce xhrnrw, however, the only thing that can not be unscrambled is an egg." 

On Apr 7, 2016, at 09:44, Kirillov, Ivan A. <ikirillov@mitre.org> wrote:

We’ve put together a writeup on the questions surrounding CybOX Object and Relationships that stemmed from the CTI Common discussion (I’ve also attached a PDF copy for those who can’t access Google docs):

https://docs.google.com/document/d/1AQoxQ0YasnJ875EgDDyjDXX7cAQS10-b0WJRciOjACA/edit?usp=sharing

Fundamentally, the questions that this is trying to address are:

• Should CybOX define a set of top-level objects (TLOs) and be capable of being used in a standalone capacity? Or should it just define a set of types that are used in languages that incorporate CybOX?
• Should CybOX Objects be defined using a relationship-driven approach, or one based on embedded Objects?

Feel free to add any comments directly to the Google doc, or to this email thread. This is likely to be one of the main topics of discussion for next Thursday’s CybOX working session call.

Regards,

Ivan

<CybOXObjectsRelationships.pdf>
---------------------------------------------------------------------
To unsubscribe from this mail list, you must leave the OASIS TC that
generates this mail.  Follow this link to all your TCs in OASIS at:
https://www.oasis-open.org/apps/org/workgroup/portal/my_workgroups.php