[Date Prev] | [Thread Prev] | [Thread Next] | [Date Next] -- [Date Index] | [Thread Index] | [List Home]
Subject: Re: [cti-users] "Data Marking" syntaxes
So something along the lines of the following? We can obviously rename "extra" to be something better suited for this use case, I just used that instead of TLP=BLACK. This is meant to get us talking and working to consensus on something that will make things better. { "type": "indicator", "marking": { "tlp": "white || green || amber || red", "extra": "true || false", "share": "public || limited || no", "jurisdiction": [ "EU", "Safe Harbour" ], "anonymize": "true || false", "details": "some really long detailed text with extra context", "handling": { "encrypt-at-rest": "true || false", "encrypt-in-transit": "true || false" } } } Thanks, Bret Bret Jordan CISSP Director of Security Architecture and Standards | Office of the CTO Blue Coat Systems PGP Fingerprint: 63B4 FC53 680A 6B7D 1447 F2C0 74F8 ACAE 7415 0050 "Without cryptography vihv vivc ce xhrnrw, however, the only thing that can not be unscrambled is an egg."
|
Attachment:
signature.asc
Description: Message signed with OpenPGP using GPGMail
[Date Prev] | [Thread Prev] | [Thread Next] | [Date Next] -- [Date Index] | [Thread Index] | [List Home]