Re: [cti-cybox] CybOX Objects/Relationships

["Jason Keirstead" <Jason.Keirstead@ca.ibm.com>]

I have been thinking about this a lot and have come to the conclusion that we should just table this until after MVP.

- It is easier to add the concept of relations than take them away

- It is yet to be seen if this would ever actually be used by analysts. If people need it, they will come asking for it... until people ask for it we shouldn't be cooking up potential scenarios IMO.

Sent from IBM Verse

Terry MacDonald --- Re: [cti-cybox] CybOX Objects/Relationships ---

From:	"Terry MacDonald" <terry.macdonald@cosive.com>
To:	"John-Mark Gurney" <jmg@newcontext.com>
Cc:	"Jordan, Bret" <bret.jordan@bluecoat.com>, "Ivan A. Kirillov" <ikirillov@mitre.org>, cti-cybox@lists.oasis-open.org
Date:	Fri, Apr 8, 2016 9:06 PM
Subject:	Re: [cti-cybox] CybOX Objects/Relationships

---

+1. I'm still wondering if we need CybOX only relationships (not STIX relationships!) to show when the thing we are attempting to describe and document are contained within other, or sent together with each other. I'm thinking email with PDF doc that contains an embedded executable. Or a compressed zip that has two malicious dropper files in it. Both of these things would result in one STIX observable. But are made up of multiple related things sent at that one time...

Cheers
Terry MacDonald

On 9/04/2016 09:48, "John-Mark Gurney" <jmg@newcontext.com> wrote:

Jordan, Bret wrote this message on Fri, Apr 08, 2016 at 19:41 +0000:
> Great write up Ivan..  Based on this information and the previous discussions around this topic.  My vote would be for:
>
> "CybOX is just a common set of data models that are used by higher level languages.."

+1

--
John-Mark

---------------------------------------------------------------------
To unsubscribe from this mail list, you must leave the OASIS TC that
generates this mail.  Follow this link to all your TCs in OASIS at:
https://www.oasis-open.org/apps/org/workgroup/portal/my_workgroups.php