STIX MVP Priorities

["Wunder, John A." <jwunder@mitre.org>]

Hey all,

 

We’re getting down to the wire now so I also wanted to take this chance to outline our major topic areas and make sure we’re working towards a solid MVP release. At a high level, I believe this covers the major topics we need to finish up. I’ve ordered these in my priority order.

 

1.       Sighting, Observation, Indicator

2.       Malware and Tool

3.       Identity

4.       Internationalization

5.       Threat Actor

6.       Malicious Infrastructure

7.       Incident

8.       Asset

9.       Target

10.   Intrusion Set

11.   Opinion

12.   Granular Markings

 

IMO we should delay MVP if we don’t finish 1-5. My personal goal is to be able to finish 1-8.

 

We really need to prioritize these topics and make decisions so we can be sure to have something complete by MVP. I’m a little bit worried we’ll spend too much time deciding on asset vs. infrastructure and won’t have time to get identity or target right, for example. So I would ask everyone to think about your priorities and let us know what to focus on. Can you rank the above items in your order of priority, and then help us focus on the top priority items? Is there anything we could postpone until after MVP, or at least hold off on discussing further until we’ve finished the other items?

 

This isn’t to say that those of you focusing on intrusion set, opinion, incident, asset, or infrastructure should stop work. Just keep in mind that we really need to get identity right because we use it all over or we’re going to be in trouble. I do think we’re close on asset vs. infrastructure and so will still send out some mail on that topic to see if we can’t get the definitions at least on the same page.

 

John