Bret,
I appreciate and support the desire to move forward, however I need to push back on this. The Relationships Model is a critical gap that requires, in my view, substantive discourse and conceptual modeling.
I suggest to the CTI TC that:
(1) We should be driving towards completion of the Conceptual Models expressed in:
(1.1) UML
(1.2) Some form of diagrammatic representation (form TBD).
(1.3) Narrative Specifications in OASIS Standards document format.
(2) Progress forward should modify and enhance these Conceptual Models and supportive documents.
_____________________________
From: Jordan, Bret <
bret.jordan@bluecoat.com>
Sent: Thursday, July 30, 2015 6:17 PM
Subject: Re: [cti-stix] Proposal - Top Level Relationship Object
To: <
cti-stix@lists.oasis-open.org>
Lets try and finish this up tomorrow, Friday. I would like to see us start work on the Sighting Object the week after BH/DC.
Outstanding Items:
1) How do we handle an unknown start / end time? Do we just leave it blank or do we actually put in "unknown" or a zeroed out date/time?
2) Are these values good for the Confidence Vocab?
3) What should the Type Vocab be, is this really needed?
4) How do we handle a more elaborate object marking? Do we add a Marking_Detail as an object like I said earlier?
5) Do we really need multiple targets? Just trying to make sure John's question gets enough focus.
Thanks,
Bret
Bret Jordan CISSP
Director of Security Architecture and Standards | Office of the CTO
Blue Coat Systems
PGP Fingerprint: 63B4 FC53 680A 6B7D 1447 F2C0 74F8 ACAE
7415 0050
"Without cryptography vihv vivc ce xhrnrw, however, the only thing that can not be unscrambled is an egg."