Re: [cti-stix] external-references keywords

["Jason Keirstead" <Jason.Keirstead@ca.ibm.com>]

FWIW, external_reference seems to have a lot of overlap with the Cybox Artifact object ( see

https://docs.google.com/document/d/1DdS-NrVTjGJ3wvCJ7dbSlhYeiaWS6G6dOXu2F3POpUs/edit#heading=h.3py86bmi9w34 )

Could there be some unification here?

-
Jason Keirstead
STSM, Product Architect, Security Intelligence, IBM Security Systems
www.ibm.com/security | www.securityintelligence.com

Without data, all you are is just another person with an opinion - Unknown


"Piazza, Rich" ---05/31/2016 02:44:29 PM---Hi everyone, I think these four keywords would cover all of the external reference details. I've in

From: "Piazza, Rich" <rpiazza@mitre.org>
To: "cti-stix@lists.oasis-open.org" <cti-stix@lists.oasis-open.org>
Date: 05/31/2016 02:44 PM
Subject: [cti-stix] external-references keywords
Sent by: <cti-stix@lists.oasis-open.org>

---

Hi everyone,
 
I think these four keywords would cover all of the external reference details.  I’ve including some examples below.  Can anyone think of some external reference that couldn’t be specified using these keywords?
 
                Rich
 
 
 
external_references: array of {
                description : string
                external_id: string
                source: ov?
                url: url
}
 
Any combination is legal
 
Examples:
 
CAPEC:
 
[ { “source”: “capec”, “external_id”: “capec-550” } ]
 
CAPEC with URL
 
[ { “source”: “capec”, “external_id”: “capec-550”, “url”:  “http://capec.mitre.org/data/definitions/550.html”} ]
 
APT1:
 
[{ “description”: “APT1 report”, “url”: “http://intelreport.mandiant.com/Mandiant_APT1_Report.pdf”}]
 
VERIS:
 
[{“source”: “veris”, “external_id”: “00C84D6A-CDB8-4A5B-A1A6-0D75A65274D7”}]
 
Jira:
 
[{“source”: “jira”, “external_id”: “TAB-1370”, “url”: “https://issues.oasis-open.org/browse/TAB-1370”}]