Re: [cti-stix] Object ID format

["Wunder, John A." <jwunder@mitre.org>]

Right, we just need to explicitly mandate a UUID as the ID portion. Neither STIX 1.2 nor the TWIGS proposals actually did this…they just said that it was some ID that the producer guarantees is unique in their namespace, which is not sufficient.

I definitely think this is the way to go.

From: <cti-stix@lists.oasis-open.org> on behalf of Sean Barnum <sbarnum@mitre.org>
Date: Thursday, January 21, 2016 at 10:34 AM
To: Jason Keirstead <Jason.Keirstead@ca.ibm.com>
Cc: "cti-stix@lists.oasis-open.org" <cti-stix@lists.oasis-open.org>
Subject: Re: [cti-stix] Object ID format

I had the same initial reaction but if you look at the second half of his email you will see he realizes this and clarifies things.

sean

From: "cti-stix@lists.oasis-open.org" <cti-stix@lists.oasis-open.org> on behalf of Jason Keirstead <Jason.Keirstead@ca.ibm.com>
Date: Thursday, January 21, 2016 at 10:24 AM
Cc: "cti-stix@lists.oasis-open.org" <cti-stix@lists.oasis-open.org>
Subject: Re: [cti-stix] Object ID format

"They can’t just re-use the 123 from my ID because they can’t guarantee that it’s unique. So they have to regenerate it."

I don't get this part. If the spec mandates RFC UUID and we also include the object type for even more entropy - it is essentially a guarantee it is unique.

-
Jason Keirstead
Product Architect, Security Intelligence, IBM Security Systems
www.ibm.com/security | www.securityintelligence.com

Without data, all you are is just another person with an opinion - Unknown