RE: [cti-stix] Possible items for STIX 2.1 - +1 to openc2 coa

[<duncan@sfractal.com>]

I'm opening a tangent thread off the original email on what should be in stix 2.1.

Ie a different topic than incident/events.

I'm giving a +1 to including openc2 coa in stix 2.1. I've been away from stix for awhile so I'm still getting up to speed on the process. Let me know if there is anything I can to do help wrt openc2 coa in stix 2.1.

Duncan Sparrell

s-Fractal Consulting LLC

iPhone, iTypo, iApologize

-------- Original Message --------
Subject: [cti-stix] Possible items for STIX 2.1
From: "Bret Jordan (CS)" <Bret_Jordan@symantec.com>
Date: Tue, November 08, 2016 11:35 am
To: "cti-stix@lists.oasis-open.org" <cti-stix@lists.oasis-open.org>

Infrastructure

Malware

Incident

Course of Action - OpenC2

Internationalization

Confidence (source confidence)

Comments

Location

     When the location information was looked up / assigned.

     Service used to look up the location

     Accuracy of the service or methodology

     Self Reported

Add organizational relationships

     Employees

Threat Actor -> Threat Actor relationship

Intel Notes 

Bret