Hi All,
I've attached the latest IEP v2 documents with updates based on the feedback we've received so far.
The STIX 2.1 Proposal has been majorly modified to use two different Data Marking objects, in the interest of making the number of bytes smaller on the wire and simplifying their use. It now separates the IEP Policy and the IEP Policy Reference parts into two different Data Marking objects.
The Framework document was updated with the latest TLP definitions after it was pointed out we'd missed including the latest changes (thanks Thomas!)
The JSON specification was modified to align closer to STIX to simplify parsing based on feedback from Bret and Allan, and we also changed the examples so that the TLP-SIG JSON examples use https://www.first.org/tlp as their external reference (makes much more sense).
IEP will be discussed at the upcoming CTI Face-2-face meeting in Maryland on Thursday May 25, and I'm really hoping we'll get it into STIX 2.1.
We REALLY need a way of marking the restrictions on Threat Intel in a more descriptive way - and I firmly believe Threat Intel sharing will be much better off if we include IEP v2 in STIX 2.1.
Cheers
Terry MacDonald | Chief Product Officer
