Re: [cti-stix] Re: [cti] [cti-stix] MISP Taxonomies [Was: CTI Brussels F2F Meeting...RSVP deadline 5 September]

["Wunder, John A." <jwunder@mitre.org>]

The wider scale certainly seems like the path of least resistance. Tools get to do what they want and for the most part things should just work. A couple worries (perhaps edge cases?) I would have:

1. The admiralty scale has specific semantics for each level that tools not using it would of course not honor. So someone who set a confidence of “high” in ToolA, which maps to 100 (let’s say), would get translated to a 1 in the admiralty scale when displayed by ToolB. But was it actually confirmed by other sources?
2. There would potentially be issues where people map scales over differently. I.e. (None, Low, Medium, High) would have a different range than (Low, Medium, High) and so a score of “Low” in ToolC might translate to “None” in ToolD and confuse people. Then you have to explain to the user that “well, in reality it’s a 1-100 scale underneath and the products use different scales and……”

I’m not totally opposed btw, just wanted to point out some of these issues.

John

On 9/13/16, 7:42 AM, "cti-stix@lists.oasis-open.org on behalf of Alexandre Dulaunoy" <cti-stix@lists.oasis-open.org on behalf of Alexandre.Dulaunoy@circl.lu> wrote:

    On 13/09/16 12:31, Jason Keirstead wrote:
    > Yes, exactly.
    > 
    > The purpose of the larger range is simply to accommodate more possible scales than a single 1-5 scale. Nothing more or less.
    
    Indeed. The proposal came from some real cases we had like reorganizing the confidence level of various sources. The 1-5 scale is clearly
    for human analysts where the whole range is mainly for machine-to-machine. With the current proposal[2], you can have both.
    
    Compared to the existing confidence level in STIX described with the HighMediumLowVocab-1.0[1], we added a scale
    and a clear description for analysts.
    
    [1] http://stixproject.github.io/data-model/1.2/stixVocabs/HighMediumLowVocab-1.0/
    [2] https://github.com/MISP/misp-taxonomies/blob/master/misp/machinetag.json#L31
    
    -- 
    Alexandre Dulaunoy
    CIRCL - Computer Incident Response Center Luxembourg
    41, avenue de la gare L-1611 Luxembourg
    info@circl.lu - www.circl.lu
    
    ---------------------------------------------------------------------
    To unsubscribe from this mail list, you must leave the OASIS TC that 
    generates this mail.  Follow this link to all your TCs in OASIS at:
    https://www.oasis-open.org/apps/org/workgroup/portal/my_workgroups.php