Re: [cti-stix] external-references keywords

[Allan Thomson <athomson@lookingglasscyber.com>]

Rich – I think external_id and url can be combined into a single attribute “ref” or similar.

 

Source could be an ov.

 

allan

 

From: "cti-stix@lists.oasis-open.org" <cti-stix@lists.oasis-open.org> on behalf of "Piazza, Rich" <rpiazza@mitre.org>
Date: Tuesday, May 31, 2016 at 10:43 AM
To: "cti-stix@lists.oasis-open.org" <cti-stix@lists.oasis-open.org>
Subject: [cti-stix] external-references keywords

 

Hi everyone,

 

I think these four keywords would cover all of the external reference details.  I’ve including some examples below.  Can anyone think of some external reference that couldn’t be specified using these keywords?

 

                Rich

 

 

 

external_references: array of {

                description : string

                external_id: string

                source: ov?

                url: url

}

 

Any combination is legal

 

Examples:

 

CAPEC:

 

[ { “source”: “capec”, “external_id”: “capec-550” } ]

 

CAPEC with URL

 

[ { “source”: “capec”, “external_id”: “capec-550”, “url”:  “http://capec.mitre.org/data/definitions/550.html”} ]

 

APT1:

 

[{ “description”: “APT1 report”, “url”: “http://intelreport.mandiant.com/Mandiant_APT1_Report.pdf”}]

 

VERIS:

 

[{“source”: “veris”, “external_id”: “00C84D6A-CDB8-4A5B-A1A6-0D75A65274D7”}]

 

Jira:

 

[{“source”: “jira”, “external_id”: “TAB-1370”, “url”: “https://issues.oasis-open.org/browse/TAB-1370”}]