Re: [cti-stix] external-references keywords

["Jordan, Bret" <bret.jordan@bluecoat.com>]

These are two different concepts in two different domains that look and feel a like, but are not a like.  If we need the same functionality, then we should replicate that functionality in STIX.  

Thanks,

Bret

Bret Jordan CISSP

Director of Security Architecture and Standards | Office of the CTO

Blue Coat Systems

PGP Fingerprint: 63B4 FC53 680A 6B7D 1447  F2C0 74F8 ACAE 7415 0050

"Without cryptography vihv vivc ce xhrnrw, however, the only thing that can not be unscrambled is an egg." 

On Jun 2, 2016, at 15:35, John-Mark Gurney <jmg@newcontext.com> wrote:

Jason Keirstead wrote this message on Wed, Jun 01, 2016 at 09:28 -0300:

The reason I brought it up is if we could combine the semantics, it would
allow people to optionally EMBED the external resource into the STIX
document.

This may be desired in some situations
- where these external resources are subject to change and you want to
ensure your document contains the current state at the time the document
was created, in addition to the external URI.
- where the external resource is proprietary / internal and thus can't be
accessed by others, but you are OK sharing the content.

JIRA is a good example of this.. what if I add an external reference to a
JIRA or Bugzilla entry living at https://10.0.0.1/? and share that... that
external reference is useless to everyone. But maybe I want to also EMBED
the content in my document, to make it not useless. The "Artifact" cybox
object has this capability.

Yes, it does, but how are you wanting to share this information?  Are
you simply making it an Observation that you publish w/o further
information, or what?  Are you wanting to share the web page? or?

Also, the Artifact object wouldn't help you in this case, as it
explicitly states that if you provide a URL, that you cannot provide
a payload, and vice versa.  So you couldn't say here is a page what
was located here.  Anyways, an HTTP Request object would be better
when sharing this information...

--
John-Mark

Attachment: signature.asc
Description: Message signed with OpenPGP using GPGMail