[Date Prev] | [Thread Prev] | [Thread Next] | [Date Next] -- [Date Index] | [Thread Index] | [List Home]
Subject: RE: [cti-stix] Top-level Sighting Object from last meeting
My thought would be that the Sighting
structure permit a reference to any other top level object, but for 2.0 we limit (in the spec) Sighting to only the use case(s) we know enough to solve (e.g., sightings of detected information). As a means of enforcing this rule, the spec could have text along the lines of “The reference field MUST reference an (e.g.,) Indicator. Note that this rule may
be expanded in future revisions of STIX”. This rule would give software an easy way to toss out non-conforming sightings. There’s probably also a variant of this use case where the sighting references something not in STIX (e.g., a signature that was not previously sent via STIX).
If we require that the Sighting reference a STIX object, then we are also requiring that the e.g., Indicator be previously sent via STIX. I think that having everything done via STIX is the ideal case, and the one we should optimize for. But we should consider
the uneven progress that will be made toward STIX adoption. Say, for instance, somebody wants to add STIX code to an IDS. It would be great (IMO) if they could have the sensor output STIX sightings for signatures that were not sent via STIX (perhaps they are
sent by the IDS’ management console), then once a STIX source is hooked up to the sensor (maybe the management console gets upgraded later), just start populating the sightings more completely. The question for me is how to make the sighting object useful
without necessarily having a dereferencable STIX ID (maybe this is an argument for Alternative ID? And we say that people MAY use Alternative ID in lieu of a STIX object ID? If we did that, IMO the rules regarding the usage of Alternative ID would have to
be pretty strict). Anyway, this paragraph is turning into a ramble so I’ll end it. A couple other shorter thoughts: ·
IMO source should be a required field, even if there is an explicit option for not disclosing the actual source (e.g., Unknown, Anonymous). I roughed
out a quick prototype the other day, and sighting info without a source just felt incomplete. ·
Alternative_ID makes sense for indicator, but IMO not as much for a sighting (minus the previous caveat). In theory, the processing software could dereference
the referenced ID then use any fields from that dereferenced object (like Alternative ID in the case of indicators). Or else we could have a “reference type” field.
o
Note: This dereferencing capability probably relies on the query discussion happening in the TAXII SC. A “get by ID” use case has been raised a few
times. ·
I agree that for Sightings, the “inside the org” use case overlaps significantly with the “org to org” use case. I suspect this is the case with many
other use cases also. Thank you. -Mark From: cti-stix@lists.oasis-open.org [mailto:cti-stix@lists.oasis-open.org]
On Behalf Of Bush, Jonathan I would tend to agree Terry (just feels cleaner and more focused), although I’m curious about your thoughts are on how we restrict that.
If the reference is just an ID, couldn’t anything be put in that field regardless of what we say the ‘rules’ are? From:
cti-stix@lists.oasis-open.org [mailto:cti-stix@lists.oasis-open.org]
On Behalf Of Terry MacDonald Hi All, One other thing I wanted to highlight was a point raised by Aharon late last week in the STIX meeting. We need to discuss
what exactly we want the Sighting Object to be able to reference. As I understand it the available options are: ·
Should a Sighting Object only reference ‘detected’ information (e.g. Observable Instances
only – most similar to an Indicator) OR ·
Should a Sighting Object reference
any other top-level Object (e.g. Threat Actor’s, TTPs, etc). This will be the most flexible and least restrictive for the future. OR ·
Should a Sighting Object reference
some top-level Objects based on STIX model (e.g. Threat Actor’s, TTPs, Indicators, Incident, Report) My
personal preference is for the first option – but I am very interested in what others think. I think we need to scope the Sighting object and discuss its purpose fairly early on to work out exactly where it will fit in the model. Cheers Terry MacDonald Senior STIX Subject Matter Expert SOLTRA | An FS-ISAC
and DTCC Company +61 (407) 203 206 |
terry@soltra.com From:
cti-stix@lists.oasis-open.org [mailto:cti-stix@lists.oasis-open.org]
On Behalf Of Terry MacDonald Hi Jason - What is "Alternative_ID" ? The Alternative_ID was taken from the IndicatorType object. From that object’s description it ‘Specifies an alternative
identifier (or alias) for the cyber threat Indicator.’. The idea was to allow the Sighting to have a reference of some kind, referring back to the ID that the tool that identified it had given it. It may not be useful in the Sighting context but I wanted to
include it just in case. TBH we may want to think more about how we handle ‘aliases’ in general across the whole STIX model… - Can you add to the proposal, which fields would be mandatory, and which optional? It's unclear to me. I presume a subset is mandatory,
but not all. Yes, my thinking was that a subset of the Sighting fields would be mandatory. I’ve suggested some below but would really
like to see what everyone else thinks. Suggested Mandatory Fields ·
Version ·
Title
·
Timestamp / Time Period ·
One or more referenced objects (i.e. idref) – (This would be done via Top-level relationship object) Suggested Optional Fields ·
Sighting Count ·
Timestamp / Time Period ·
Victim Organization information ·
Producer Organization information ·
Sighting Confidence ·
TLP / Data Markings ·
Alternative Sighting ID ·
Sighting Type ·
Description ·
Short Description Mark’s other post earlier today reminded me that I had earlier requested a Sighting object last year (https://github.com/STIXProject/schemas/issues/306).
In there I even drew a nice updated STIX model diagram to include where I personally saw the Sighting object located (thanks to Bret for the visio). But this may help provide more context?
Please note this reflects my own personal viewpoint. Cheers Terry MacDonald Senior STIX Subject Matter Expert SOLTRA | An FS-ISAC
and DTCC Company +61 (407) 203 206 |
terry@soltra.com
From:
cti-stix@lists.oasis-open.org [mailto:cti-stix@lists.oasis-open.org]
On Behalf Of Jason Keirstead Questions - What is "Alternative_ID" ? - Can you add to the proposal, which fields would be mandatory, and which optional? It's unclear to me. I presume a subset is mandatory,
but not all. -
|
[Date Prev] | [Thread Prev] | [Thread Next] | [Date Next] -- [Date Index] | [Thread Index] | [List Home]