Re: [cti-users] Cybox modelling for Company/ Organisation details

[Trey Darley <trey@kingfisherops.com>]

On 20.07.2016 11:00:56, Conrad Crampton wrote:
>
> I’m very new to Cybox and attempting to model data received via log
> files for web proxies, firewalls etc, and so far managing to plough
> through this. However, I would like to model the company for which
> the request relates i.e. the HTTP_Session object initated by a
> User_Account who is employed by a Company. It is this latter entity
> I can’t seem to find an appropriate object for in Cybox. Can anyone
> suggest how to accomplish this? I have thought about using
> Exploit_Target (from Stix) but at the time of the observation they
> aren’t necessarily an Exploit_Target – unless we take the broader
> meaning of a target being anyone is a potential target.
> 

Hi, Conrad -

It would appear that you're basing your work on CybOX 2.1. If you can
afford to hold off a bit, we're getting close to having the OASIS
Committee Draft Specification for CybOX 3.0 published. (Incidentally,
I am one of the CybOX SC co-chairs.)

CybOX 3.0 should be dramatically simpler to implement than 2.1. There
are still some pieces in motion in the object specifications but we're
getting close to done (for some value of "done", given that it's a
committee effort.) Have a look [0] and let us know what you think.

[0]: https://docs.google.com/document/d/1eIl5iBR7vQd_8kgxFWt3bCaxG8WjtqutdjuW9n1iXaI/edit

-- 
Cheers,
Trey
++--------------------------------------------------------------------------++
Kingfisher Operations, sprl
gpg fingerprint: 85F3 5F54 4A2A B4CD 33C4  5B9B B30D DD6E 62C8 6C1D
++--------------------------------------------------------------------------++
--
"Good, Fast, Cheap: Pick any two (you can't have all three)." --RFC 1925

Attachment: signature.asc
Description: Digital signature