[Date Prev] | [Thread Prev] | [Thread Next] | [Date Next] -- [Date Index] | [Thread Index] | [List Home]
Subject: Re: [cti-stix] [+1]'s
New
Under Investigation
Confirmed
Closed - False Positive
Closed - Resolved
-
Jason Keirstead
Product Architect, Security Intelligence, IBM Security Systems
www.ibm.com/security | www.securityintelligence.com
Without data, all you are is just another person with an opinion - Unknown
Jerome Athias ---11/10/2015 02:07:14 PM---That's a potential approach for Incident. Otherwise, what about "Under investigation" (for Opened) a
From: Jerome Athias <athiasjerome@gmail.com>
To: "Wunder, John A." <jwunder@mitre.org>
Cc: Jason Keirstead/CanEast/IBM@IBMCA, Trey Darley <trey@soltra.com>, Terry MacDonald <terry@soltra.com>, "Barnum, Sean D." <sbarnum@mitre.org>, "cti-stix@lists.oasis-open.org" <cti-stix@lists.oasis-open.org>
Date: 11/10/2015 02:07 PM
Subject: Re: [cti-stix] [+1]'s
If we do create two constructs, I would humbly suggest that we try to come up with a more distinct term for this, otherwise discussing "sighting" and "citation" in conversation will result in endless confusion.
Its already had enough for me to communicate the difference between an indicator and an observable to people :)
-
Jason Keirstead
Product Architect, Security Intelligence, IBM Security Systems
www.ibm.com/security | www.securityintelligence.com
Without data, all you are is just another person with an opinion - Unknown
<graycol.gif>Trey Darley ---11/10/2015 10:18:30 AM---On 06.11.2015 22:58:44, Terry MacDonald wrote: >
From: Trey Darley <trey@soltra.com>
To: Terry MacDonald <terry@soltra.com>
Cc: Jason Keirstead/CanEast/IBM@IBMCA, "Barnum, Sean D." <sbarnum@mitre.org>, "cti-stix@lists.oasis-open.org" <cti-stix@lists.oasis-open.org>
Date: 11/10/2015 10:18 AM
Subject: Re: [cti-stix] [+1]'s
Sent by: <cti-stix@lists.oasis-open.org>
[Date Prev] | [Thread Prev] | [Thread Next] | [Date Next] -- [Date Index] | [Thread Index] | [List Home]