Re: [cti-stix] [cti-users] MTI Binding

["Jordan, Bret" <bret.jordan@bluecoat.com>]

Help me understand how some of these other lesser known bindings are going to make things easier and faster for the average million+ open source, web application, and APP developers?  Further are these lesser known bindings in the development stacks of the majority of networking and security product vendors?  If not, then that is a show stopper.  We need to make things easier, not more complex.  If JSON-LD or some other binding is going to make things easier, please give real examples so we can all better understand why.

Keep in mind that we are trying to get away from an overly complex and difficult to implement XML model, that few understand, so we can increase adoption.  I do not want to propose that we adopt yet another difficult to understand and non-widely accepted binding.  

When I look at the traction that Facebook's ThreatExchange with its simple JSON structure is getting, we need to realize that there might be something to that. Developers love JSON, for what ever reason, but they do.  Further I do not see how native JSON can not do everything we need.  Intelworks is using it and it seem to be working quite well for their CTI solution and Soltra is using it on the backend of their product for all of their needs and other companies that I talk to are immediately translating the XML on the wire to JSON so they can "do something with it". 

I would love to see some examples of a real indicator with a TTP in JSON-LD so we can better understand what that would mean and look like.  I am okay with getting on board with JSON-LD, I just want to make sure it does not hinder broad scale adoption.

Thanks,

Bret

Bret Jordan CISSP

Director of Security Architecture and Standards | Office of the CTO

Blue Coat Systems

PGP Fingerprint: 63B4 FC53 680A 6B7D 1447  F2C0 74F8 ACAE 7415 0050

"Without cryptography vihv vivc ce xhrnrw, however, the only thing that can not be unscrambled is an egg." 

Attachment: signature.asc
Description: Message signed with OpenPGP using GPGMail