OASIS Mailing List ArchivesView the OASIS mailing list archive below
or browse/search using MarkMail.

 


Help: OASIS Mailing Lists Help | MarkMail Help

cti-stix message

[Date Prev] | [Thread Prev] | [Thread Next] | [Date Next] -- [Date Index] | [Thread Index] | [List Home]


Subject: Re: STIX 2.0-CORE Draft 1 8.4.​ Versioning Question


I’d be interested in exploring a solution whereby we don’t break the conceptual understanding that In STIX, you convey your insights (analysis, reporting, artifacts) - making only you or people on your behalf responsible for updates. Here too, we must solve the gateway A->gateway B,C (who both reversion in your namespace)->gateway D who received two different new versions. Merging?

However, perhaps we could allow for something that says that when you reversion an entity from namespace X you can not reversion from namespace Y, but you could make some sort of similar reference “is associated with”, “is our understanding of”, “….”. Or perhaps literally reversion but simply within your namespace – so that one can see this was “overwritten” by a new org/namespace.

J-

From: Jerome Athias <athiasjerome@gmail.com>
Date: Sunday, July 24, 2016 at 8:59 AM
To: Joep Gommers <joep@eclecticiq.com>
Cc: "cti-stix@lists.oasis-open.org" <cti-stix@lists.oasis-open.org>
Subject: Re: STIX 2.0-CORE Draft 1 8.4.​ Versioning Question

I do understand that and agree for the majority of cases.
To give a -special case- often coming as a concern/question about CTI:
What would happen if an adversary introduces fake/disinformation/counter-CTI?
Yes, one could use Confidence/Opinion/Judgment
But I'm looking for an answer to this, imho, valid concern.

Thanks
Best regards 

On Sunday, 24 July 2016, Joep Gommers <joep@eclecticiq.com> wrote:
For what its worth I’d be interested in this discussion because;
- it makes completely sense that only you can reversion  your own intelligence, or people from your namespace, considering your conveying your analysis and insights - not to mention conflicts of merging etc
- its among the most requested features from our customer/prospect base who view it more as a knowledge base then a collection of our people’s analysis fused with their own (namespace)




On 7/23/16, 6:12 AM, "cti-stix@lists.oasis-open.org on behalf of Jerome Athias" <cti-stix@lists.oasis-open.org on behalf of athiasjerome@gmail.com> wrote:

>Hi,
>
>Reviewing the current draft, I would have this question regarding Versioning:
>(The Only Stupid Question is the One You Don't Ask)
>
>"Only the object creator is permitted to create new versions of a STIX
>Object. Producers other than the object creator MUST NOT create new
>versions of that object."
>vs "Derived Object"
>
>Question: If I want to derive (duplicate/enhance - create a "new
>version" of) one STIX Object (object creator=Org A), as-is, is there a
>mechanism for me (Org B) to reference the ID of the initial Object?
>
>
>
>PS:
>"As with issuing a new version, only the object creator is permitted
>to revoke a STIX object."
>Note: this could have to be reevaluated, investigated further in the future.
>
>---------------------------------------------------------------------
>To unsubscribe from this mail list, you must leave the OASIS TC that
>generates this mail.  Follow this link to all your TCs in OASIS at:
>https://www.oasis-open.org/apps/org/workgroup/portal/my_workgroups.php
>


[Date Prev] | [Thread Prev] | [Thread Next] | [Date Next] -- [Date Index] | [Thread Index] | [List Home]