RE: Deconstruction of Cybox observables from STIX reports

[Terry MacDonald <terry@soltra.com>]

Hi Jyoti,

 

If I am reading you correctly you are wanting to take a STIX feed and pull out the CybOX objects, then send those to the security tools you have in order to monitor for those Observables? And then when you get a Sighting, send the updated information back into STIX?

 

Is that right?

 

Are you feeding this into a ‘STIX database’ at any stage for long term storage?

 

Cheers

 

Terry MacDonald

Senior STIX Subject Matter Expert

SOLTRA | An FS-ISAC and DTCC Company

+61 (407) 203 206 | terry@soltra.com

 

 

From: Jyoti Verma (jyoverma) [mailto:jyoverma@cisco.com]
Sent: Friday, 30 October 2015 6:53 AM
To: Barnum, Sean D. <sbarnum@mitre.org>; joep@eclecticiq.com; Terry MacDonald <terry@soltra.com>
Cc: cti-stix@lists.oasis-open.org
Subject: Deconstruction of Cybox observables from STIX reports

 

Hi,

 

I brought this up during the Cybox call today and taking it offline for further discussion. To recap, we are looking into deconstructing Cybox observables from STIX IOCs for distribution to disparate systems that can deal with them and then at a later point in time, re-construct them back thereby enriching the original IOC. Instead of re-inventing the wheel on this, I was wondering if there is a tool out there that can handle comprehensive use cases. Would love to hear the approach and challenges faced in this process by folks who do this currently. 

 

Thanks,

Jyoti