Re: [cti-stix] Proposal - Top Level Relationship Object

["Jordan, Bret" <bret.jordan@bluecoat.com>]

The screen shot is from a UML model, with some extra data for context.  Further we are having substantive discourse about this topic, if there are things that are missing in the diagram, then please bring them up and fill in the gaps. I for one would love your feedback about how to make it better.

I think it is also important to note how this process should probably work, given the problems we have had in the past.

1) We should discuss things on the list and bounce ideas back and forth until we come to some sort of stead state.

2) At that point I can see the current ideas being captured and archived on the wiki as a proposal to be included in the next major release

3) Until such a time that the next release is done, people can continue adding to or making suggestions about a said proposal on the wiki.   But at least we will have captured it.  

In the past we would discuss things over and over and they would never get captured, and then they would get blackholed to die. What I am trying to do here, is get us to a point where it can resemble a proposal that can make it to the wiki.  From there we can continue discussing as people come up with ideas and requests, but at least we will have something down on paper.

Thanks,

Bret

Bret Jordan CISSP

Director of Security Architecture and Standards | Office of the CTO

Blue Coat Systems

PGP Fingerprint: 63B4 FC53 680A 6B7D 1447  F2C0 74F8 ACAE 7415 0050

"Without cryptography vihv vivc ce xhrnrw, however, the only thing that can not be unscrambled is an egg." 

On Jul 30, 2015, at 17:21, Patrick Maroney <Pmaroney@Specere.org> wrote:

 Bret,

I appreciate and support the desire to move forward, however I need to push back on this.  The Relationships Model is a critical gap that requires, in my view, substantive discourse and conceptual modeling. 

I suggest to the CTI TC that:

(1) We should be driving towards completion of the Conceptual Models expressed in:

  (1.1) UML

  (1.2) Some form of diagrammatic representation (form TBD).

  (1.3) Narrative Specifications in OASIS Standards document format.

(2) Progress forward should modify and enhance these Conceptual Models and supportive documents.

Patrick Maroney
President
Integrated Networking Technologies, Inc.
Desk: (856)983-0001
Cell: (609)841-5104
Email: pmaroney@specere.org

_____________________________
From: Jordan, Bret <bret.jordan@bluecoat.com>
Sent: Thursday, July 30, 2015 6:17 PM
Subject: Re: [cti-stix] Proposal - Top Level Relationship Object
To: <cti-stix@lists.oasis-open.org>


Lets try and finish this up tomorrow, Friday.  I would like to see us start work on the Sighting Object the week after BH/DC.  

Outstanding Items:

1) How do we handle an unknown start / end time?  Do we just leave it blank or do we actually put in "unknown" or a zeroed out date/time?

2) Are these values good for the Confidence Vocab?

3) What should the Type Vocab be, is this really needed?

4) How do we handle a more elaborate object marking?  Do we add a Marking_Detail as an object like I said earlier? 

5) Do we really need multiple targets?  Just trying to make sure John's question gets enough focus.

<Screen Shot 2015-07-30 at 16.15.55.png>

Thanks,

Bret

Bret Jordan CISSP

Director of Security Architecture and Standards | Office of the CTO

Blue Coat Systems

PGP Fingerprint: 63B4 FC53 680A 6B7D 1447  F2C0 74F8 ACAE 7415 0050

"Without cryptography vihv vivc ce xhrnrw, however, the only thing that can not be unscrambled is an egg." 

Attachment: signature.asc
Description: Message signed with OpenPGP using GPGMail