Re: [cti-stix] Patterning for Course of Actions

[Trey Darley <trey@kingfisherops.com>]

On 14.10.2016 18:48:06, Jyoti Verma (jyoverma) wrote:
> I went through the latest Cybox patterning documentation and really
> like how its come together. The concept of patterning can apply to
> other objects as well and I'd like to bring up this topic for
> discussion here.
> 

Hey, Jyoti -

Observable Patterning is pretty key to tying everything together in
STIX 2.0. A _ton_ of work has gone into that document but so far it
seems like most of the TC has yet to review it. Knowing that you've
had eyes on it is motivating as we stretch towards the finish line.
Thanks for the positive feedback, Jyoti!

> 
> I see a specific need for this in the case of Courses of actions
> where you might want to apply certain conditional logic on the
> execution of actions. This is best illustrated with the following
> examples:
> 
>   1.  Action B should be executed after action A completes successfully
>   2.  Action A should be executed in parallel with action B
>   3.  Action C should be executed after a certain duration of A and B completing
> 

Makes sense to me.

> 
> Is the patterning model extensible to realize these conditions?
> 

Actions (similar to the use cases as you enumerated above) were a
major component of CybOX 2.1. As a SC we deliberately scoped that out
for CybOX 3.0^W^WObservable Patterning but it's at the top of our
hitlist for the next release. As we iterate on COAs in STIX 2.x it's
only logical that we align the Observable Patterning language to
support that. Thanks for highlighting this need!

-- 
Cheers,
Trey
++--------------------------------------------------------------------------++
Kingfisher Operations, sprl
gpg fingerprint: 85F3 5F54 4A2A B4CD 33C4  5B9B B30D DD6E 62C8 6C1D
++--------------------------------------------------------------------------++
--
"For all resources, whatever it is, you need more." --RFC 1925

Attachment: signature.asc
Description: Digital signature