Re: [cti-cybox] CybOX Versions in STIX?

[Mark Davidson <mdavidson@soltra.com>]

I have been thinking that a specific version of STIX would always use a specific version of CybOX, just like your list has.

Thank you.

-Mark

From: <cti-cybox@lists.oasis-open.org> on behalf of "Kirillov, Ivan A." <ikirillov@mitre.org>
Date: Tuesday, May 10, 2016 at 3:06 PM
To: "cti-stix@lists.oasis-open.org" <cti-stix@lists.oasis-open.org>
Cc: "cti-cybox@lists.oasis-open.org" <cti-cybox@lists.oasis-open.org>
Subject: [cti-cybox] CybOX Versions in STIX?

At this point I think the assumption has been that a particular version of STIX would support a particular version of CybOX, and only this version.

E.g.,

• STIX 2.0 would support CybOX 3.0
• STIX 2.1 would support CybOX 3.1
• Etc.

Does this align with the existing community perceptions? Are there any particular needs or cases where STIX would want to support multiple versions of CybOX at one time? The only hypothetical example I can come up with is if STIX incorporates data from another source, such as MAEC, that uses a different version of CybOX. However, I would imagine that, for compatibility reasons, STIX would only want to incorporate data sources that use the same version of CybOX that it uses.

This came about from some recent discussions in CybOX about the spec_version field and whether we need to incorporate it in the CybOX Container/ArgleBargle. If the assumption is that STIX, MAEC, and other CybOX users will only support a particular version of CybOX for any one release, then perhaps this field isn’t needed.

Regards,

Ivan