[Date Prev] | [Thread Prev] | [Thread Next] | [Date Next] -- [Date Index] | [Thread Index] | [List Home]
Subject: Re: [cti-stix] FW: [cti] Location - precision, altitude, and administrative area
And where there is also a demonstrated need for that data to be encoded in its own property in support of clear semantics and/or to enable automation.
From: <cti-stix@lists.oasis-open.org> on behalf of "Wunder, John A." <jwunder@mitre.org> So putting floor in the street_address field should be supported now, just like any other part of the street address. We should probably clarify this in examples. As an example, MITRE’s located on floors 5-6 in our national business part site, by saying suite 500 and 600. Given our current location approach that would be: { “country”: “us”, “administrative_area”: “Maryland”, “city”: “Annapolis Junction”, “street_address”: “300 Sentinel Drive Suites 500 & 600” } Obviously the newline would be encoded. If you had a location where they just wanted to say floor you could do that too, like “Floor 16”. The reason I don’t think we should add AGL/MSL altitude is the usual one…IMO we should only add fields when there’s a use case for them that’s in common use across many organizations/tools. John From: <cti-stix@lists.oasis-open.org> on behalf of Allan Thomson <athomson@lookingglasscyber.com> Hi Sarah – As shared in response to John’s email I would be fine if we support floor at a minimum. But there location systems that handle altitude also.
Is there a reason I’m missing why we don’t allow both as options?
From: Sarah Kelley <Sarah.Kelley@cisecurity.org> So, my question to you Allan would be this. If the primary purpose of adding the altitude field would be so that you could represent a specific floor of a building, then:
I’m not saying that if people need this field we shouldn’t do it. My biggest problem with altitude is that the only use case I’ve heard is building floor, which is like more accurately represented by just saying “123 Main Street, Fifth
Floor, Rm #12” than it is by saying “Altitude = 60 ft”. Is there a use case I’m missing here? I’d willing to expand my knowledge. Thanks, Sarah Kelley Senior Cyber Threat Analyst Multi-State Information Sharing and Analysis Center (MS-ISAC) 31 Tech Valley Drive East Greenbush, NY 12061 518-266-3493 24x7 Security Operations Center SOC@cisecurity.org - 1-866-787-4722 From: Allan Thomson <athomson@lookingglasscyber.com>
All – Whether you agree or disagree with the number of organizations interested in altitude representation in location there are use cases that it helps solve. As stated previously, any large city with skyscrapers (NY, London, Signapore….etc) or enterprise (Fortune 500) that have many different floors and typically multi-tenant environments, then being able to determine location of related intelligence
associated with a particular floor is a valid use case. I don’t think organizations that don’t care about this use case should necessarily make decisions to exclude the ability for the standard to support altitude. Is there really a big impact to the velocity of STIX2.1 location efforts by not having altitude as an option? I suggest there’s minimal impact to *allowing* altitude as an option in the location object if a provider wants to include it as an option property. From: "cti-stix@lists.oasis-open.org" <cti-stix@lists.oasis-open.org> on behalf of Terry MacDonald <terry.macdonald@cosive.com> I agree with Sarah. I believe that altitude is only useful to a very small group, and the 80/20 rule will apply in this case. Cheers Terry MacDonald Cosive On 25/07/2017 7:44 AM, "Sarah Kelley" <Sarah.Kelley@cisecurity.org> wrote:
This message and attachments may contain confidential information. If it appears that this message was sent to you by mistake, any retention, dissemination, distribution or copying of this message and attachments is strictly prohibited.
Please notify the sender immediately and permanently delete the message and any attachments.
|
[Date Prev] | [Thread Prev] | [Thread Next] | [Date Next] -- [Date Index] | [Thread Index] | [List Home]