[Date Prev] | [Thread Prev] | [Thread Next] | [Date Next] -- [Date Index] | [Thread Index] | [List Home]
Subject: Re: [cti] Proposed normative text available for Report object refactoring - (Goal: Reach official consensus by Monday)
On 16.02.2016 06:42:23, Allan Thomson wrote: > I would say that it would be a useful extension of STIX to be able > to handle passing blobs (regardless of what the blob contains). > Ivan and I *just* had a long conversation about this in the context of CybOX. The existing Artifact object in CybOX 2.1 allows this in a CybOX context (although as far as I can tell, no-one is actually using it so far.) Time permitting, I'll take a stab this week at defining a "Blob" object in the CTI Commons spec (with corresponding relationship types), based roughly on the existing CybOX 2.1 Artifact object. This would support passing blobs of arbitrary stuff at both the STIX and CybOX levels. Cool? -- Cheers, Trey -- Trey Darley Senior Security Engineer 4DAA 0A88 34BC 27C9 FD2B A97E D3C6 5C74 0FB7 E430 Soltra | An FS-ISAC & DTCC Company www.soltra.com -- "It is always possible to aglutenate multiple separate problems into a single complex interdependent solution. In most cases this is a bad idea." --RFC 1925
Attachment:
signature.asc
Description: PGP signature
[Date Prev] | [Thread Prev] | [Thread Next] | [Date Next] -- [Date Index] | [Thread Index] | [List Home]