[Date Prev] | [Thread Prev] | [Thread Next] | [Date Next] -- [Date Index] | [Thread Index] | [List Home]
Subject: Re: [cti] CybOX Object Extensions
That’s a great question Eldan; I don’t think we’ll ever be completely aware of all future extensions, and therefore we should make our design flexible so that the “base” Object does not have to be updated to take into account new extensions, and also so
that custom extensions can be specified.
In the Volume example referenced below, we hard-coded the set of available extensions for the sake of JSON schema validation; however, to support the above goals we’ll likely just need to make the “extended_properties” field an abstract dictionary, with
a set of “default” extensions that are available and documented via the specification, but not enforced in the JSON schema:
"extended-properties": {"type": "object"} Regards,
Ivan
From: <cti@lists.oasis-open.org> on behalf of Eldan Ben-Haim <ELDAN@il.ibm.com>
Date: Sunday, February 14, 2016 at 6:01 AM To: Ivan Kirillov <ikirillov@mitre.org> Cc: "cti@lists.oasis-open.org" <cti@lists.oasis-open.org> Subject: Re: [cti] CybOX Object Extensions Reference [1] below suggests that the specification of a "base" object (e.g Volume) is aware of all future extensions; for example the "Volume" definition's "extended-properties" type lists all possible extensions.
If I read this right, this means that there's no way to represent an extension other than what the specification initially proposed (what's more, this means that even as the specification evolves we'll need to formally change existing base objects as we add extensions). Is this correct?
From: "Kirillov, Ivan A." <ikirillov@mitre.org> To: "cti@lists.oasis-open.org" <cti@lists.oasis-open.org> Date: 02/10/2016 08:01 PM Subject: [cti] CybOX Object Extensions Sent by: <cti@lists.oasis-open.org> Sending this to the broader CTI list since it’s part of the STIX/CybOX Indicator tranche. I don’t believe we have consensus yet on the concept of CybOX extensions, so here’s our current thinking to help summarize where we stand:
{ "hashes": [{ "type": "md5", "hash-value": "3773a88f65a5e780c8dff9cdc3a056f3" }], "size": 25537, "extended-properties": { "FileMetadataExtension": {"mime-type": "vnd.microsoft.portable-executable"}, "EXT3FileExtension": {"inode": "34483923"}, "PEBinaryFileExtension": {"exports": [{"name": "foo_app"}]} } }
|
[Date Prev] | [Thread Prev] | [Thread Next] | [Date Next] -- [Date Index] | [Thread Index] | [List Home]