I disagree that it needs to be deprecated.
You could easily just add an enum that says the string contains multiple in future for combinational language strings and define rules on how you qualify the content as have been suggested to do that.
I just donât think we should be doing that as step1 which is what you are suggesting.
Allan
From: Jason Keirstead <Jason.Keirstead@ca.ibm.com>
Date: Wednesday, June 12, 2019 at 7:12 AM
To: Allan Thomson <athomson@lookingglasscyber.com>
Cc: "cti-stix@lists.oasis-open.org" <cti-stix@lists.oasis-open.org>
Subject: Re: Re: [cti-stix] RE https://github.com/oasis-tcs/cti-stix2/issues/28
"So if someone wants to add an IP address to a signature in Snort then they would just do that. They wouldnât update the Snort signature to combine with STIX2."
It's not about that. It is about using Snort for the network traffic part and YARA for the file part and being able to combine them both in an indicator in STIX. Something neither language can do today. There are toolchains that support both Snort and YARA.
I did create the seperate Github item for tracking.
https://github.com/oasis-tcs/cti-stix2/issues/162
However it should be noted that that is basically going to deprecate this property once implemented. So we are going forward with something we already know will be deprecated.
-
Jason Keirstead
Lead Architect - IBM Security Connect
www.ibm.com/security
"Would you like me to give you a formula for success? It's quite simple, really. Double your rate of failure."
- Thomas J. Watson
From: Allan Thomson <athomson@lookingglasscyber.com>
To: Jason Keirstead <Jason.Keirstead@ca.ibm.com>, "cti-stix@lists.oasis-open.org" <cti-stix@lists.oasis-open.org>
Date: 06/12/2019 10:57 AM
Subject: [EXTERNAL] Re: [cti-stix] RE
https://github.com/oasis-tcs/cti-stix2/issues/28
Sent by: <cti-stix@lists.oasis-open.org>
Jason â I think we understood that you were suggesting combination capability to combine both Snort + STIX2 or Yara + STIX2â.etc.
My point was that if a product already supports Snort or Yara then its likely much (but not all) of the capabilities would be defined in the single language itself and not a combination of languages.
So if someone wants to add an IP address to a signature in Snort then they would just do that. They wouldnât update the Snort signature to combine with STIX2.
Now I can see future cases where something is not possible to define holly in Snort2 or YARA and therefore you need additional capabilities. But that seems like a running step when weâre barely crawling with pattern
grammar use.
If you want to combine languages then I suggest we target that capability beyond 2.1.
Allan
From:
"cti-stix@lists.oasis-open.org" <cti-stix@lists.oasis-open.org> on behalf of Jason Keirstead <Jason.Keirstead@ca.ibm.com>
Date: Wednesday, June 12, 2019 at 4:48 AM
To: "cti-stix@lists.oasis-open.org" <cti-stix@lists.oasis-open.org>
Subject: [cti-stix] RE https://github.com/oasis-tcs/cti-stix2/issues/28
I want to reply to Allans comment in the working call meeting notes as I was not present:
Alan: Is the proposal is to add it to the pattern or add it as a separate thing in addition to STIX patterning? Jason may be suggesting adding sort or Yara to the same pattern property and just clarify which it is
Bret: Jason wants to put it in the STIX pattern
Alan: makes no sense to combine them into one. Why not have an enum with strings of STIX pattern, snort, Yara, and then you put the pattern in there.
The reason I want to have this inside the SCO pattern is simple. YARA is just another way to find files (no different than a matching properties on an SCO file object). Snort is just another way to find network traffic (no different than matching a propertieson
an SCO network-traffic object).
The same is true for all of these "rudimentary patterms" people want to use. They are just different syntaxes to write an Observation _expression_.
I would like to be able to say [ SNORT:'alert tcp any any -> any any (content:"ABC"; content:"DEF"; distance:1;) ]AND
[ip-address:value = '1.2.3.4' ]
or
[ YARA: < YARA HERE > ] FOLLOWED BY [ network-traffic:<foobar> ] WITHIN 5 MINUTES
This is very simple, and how I actually want to make use of these things.
I opened https://github.com/oasis-tcs/cti-stix2/issues/162to track this.
-
Jason Keirstead
Lead Architect - IBM Security Connect
www.ibm.com/security
"Would you like me to give you a formula for success? It's quite simple, really. Double your rate of failure."
- Thomas J. Watson