Deconstruction of Cybox observables from STIX reports

cti-stix message

Subject: Deconstruction of Cybox observables from STIX reports

From: "Jyoti Verma (jyoverma)" <jyoverma@cisco.com>

To: "Barnum, Sean D." <sbarnum@mitre.org>, "joep@eclecticiq.com" <joep@eclecticiq.com>, "terry@soltra.com" <terry@soltra.com>

Date: Thu, 29 Oct 2015 19:52:56 +0000

Hi,

I brought this up during the Cybox call today and taking it offline for further discussion. To recap, we are looking into deconstructing Cybox observables from STIX IOCs for distribution to disparate systems that can deal with them and then at a later point in time, re-construct them back thereby enriching the original IOC. Instead of re-inventing the wheel on this, I was wondering if there is a tool out there that can handle comprehensive use cases. Would love to hear the approach and challenges faced in this process by folks who do this currently.

Thanks,

Jyoti