RE: [cti] The Adaptive Object-Model Architectural Style

[Cory Casanave <cory-c@modeldriven.com>]

+2 for connecting the dots!

 

From: Paul Patrick [mailto:ppatrick@isightpartners.com]
Sent: Friday, November 13, 2015 3:43 PM
To: Terry MacDonald; Cory Casanave; Jordan, Bret; Wunder, John A.
Cc: cti@lists.oasis-open.org
Subject: Re: [cti] The Adaptive Object-Model Architectural Style

 

+1000 on Terry’s statement about both together.  The real value is in both together which is a message that comes directly from customers and partners that I work with that not only want but need this type of intelligence.

 

 

Paul Patrick

iSight Partners

 

 

 

From: <cti@lists.oasis-open.org> on behalf of Terry MacDonald <terry@soltra.com>
Date: Friday, November 13, 2015 at 2:58 PM
To: Cory Casanave <cory-c@modeldriven.com>, "Jordan, Bret" <bret.jordan@bluecoat.com>, "Wunder, John A." <jwunder@mitre.org>
Cc: "cti@lists.oasis-open.org" <cti@lists.oasis-open.org>
Subject: RE: [cti] The Adaptive Object-Model Architectural Style

 

It’s a symbiotic relationship.

 

I am hugely worried that a STIX-Lite would only focus on Indicators and Sightings, ignoring the massive benefits that keeping that symbiotic relationship has. If I’m honest, the main reason I have invested so much time of my last 3 years into this is the fact that STIX bridges the gap between the Threat Analysts and Incident Response personnel. Nothing else did that at the time.

 

I would hate for us to lose sight of the value we have in keeping both together in a single model. In my mind that is the value of STIX.