Re: [cti-users] "Data Marking" syntaxes

["Jordan, Bret" <bret.jordan@bluecoat.com>]

THANKS for sharing.  That looks neat.  

Thanks,

Bret

Bret Jordan CISSP

Director of Security Architecture and Standards | Office of the CTO

Blue Coat Systems

PGP Fingerprint: 63B4 FC53 680A 6B7D 1447  F2C0 74F8 ACAE 7415 0050

"Without cryptography vihv vivc ce xhrnrw, however, the only thing that can not be unscrambled is an egg." 

On Nov 25, 2015, at 00:39, Alexandre Dulaunoy <Alexandre.Dulaunoy@circl.lu> wrote:

Signed PGP part

On 09/11/15 17:03, Jordan, Bret wrote:
> So something along the lines of the following?  We can obviously rename "extra" to be something better suited for this use case, I just used that instead of TLP=BLACK.  This is meant to get us
> talking and working to consensus on something that will make things better.
>
>
> { "type": "indicator", "marking": { "tlp": "white || green || amber || red", "extra": "true || false", "share": "public || limited || no", "jurisdiction": [ "EU", "Safe Harbour" ], "anonymize":
> "true || false", "details": "some really long detailed text with extra context", "handling": { "encrypt-at-rest": "true || false", "encrypt-in-transit": "true || false" } } }

Just for your information, we maintain a machine-readable taxonomy (triple-tags) for the Traffic Light Protocol:

https://github.com/MISP/misp-taxonomies/blob/master/tlp/machinetag.json

It's currently used in MISP 2.4 for the taxonomy tagging but can be used by any other information sharing tool.

https://github.com/MISP/misp-taxonomies/

If you see any other potential extension to the TLP taxonomy or other. Feel free to open an issue or/and a pull request.

Cheers.

--
Alexandre Dulaunoy
CIRCL - Computer Incident Response Center Luxembourg
41, avenue de la gare L-1611 Luxembourg
info@circl.lu - www.circl.lu

This publicly archived list provides a forum for asking questions,
offering answers, and discussing topics of interest on STIX,
TAXII, and CybOX.  Users and developers of solutions that leverage
STIX, TAXII and CybOX are invited to participate.

In order to verify user consent to OASIS mailing list guidelines
and to minimize spam in the list archive, subscription is required
before posting.

Subscribe: cti-users-subscribe@lists.oasis-open.org
Unsubscribe: cti-users-unsubscribe@lists.oasis-open.org
Post: cti-users@lists.oasis-open.org
List help: cti-users-help@lists.oasis-open.org
List archive: http://lists.oasis-open.org/archives/cti-users/
List Guidelines: http://www.oasis-open.org/maillists/guidelines.php
CTI Technical Committee: https://www.oasis-open.org/committees/cti/
Join OASIS: http://www.oasis-open.org/join/

Attachment: signature.asc
Description: Message signed with OpenPGP using GPGMail