OASIS Mailing List ArchivesView the OASIS mailing list archive below
or browse/search using MarkMail.


Help: OASIS Mailing Lists Help | MarkMail Help

cti message

[Date Prev] | [Thread Prev] | [Thread Next] | [Date Next] -- [Date Index] | [Thread Index] | [List Home]

Subject: Re: [cti] Proposed normative text available for Report object refactoring - (Goal: Reach official consensus by Monday)

On 16.02.2016 06:42:23, Allan Thomson wrote:
> I would say that it would be a useful extension of STIX to be able
> to handle passing blobs (regardless of what the blob contains).

Ivan and I *just* had a long conversation about this in the context of
CybOX. The existing Artifact object in CybOX 2.1 allows this in a
CybOX context (although as far as I can tell, no-one is actually using
it so far.)

Time permitting, I'll take a stab this week at defining a "Blob"
object in the CTI Commons spec (with corresponding relationship
types), based roughly on the existing CybOX 2.1 Artifact object.

This would support passing blobs of arbitrary stuff at both the STIX
and CybOX levels. Cool?

Trey Darley
Senior Security Engineer
4DAA 0A88 34BC 27C9 FD2B  A97E D3C6 5C74 0FB7 E430
Soltra | An FS-ISAC & DTCC Company
"It is always possible to aglutenate multiple separate problems into a
single complex interdependent solution. In most cases this is a bad
idea." --RFC 1925

Attachment: signature.asc
Description: PGP signature

[Date Prev] | [Thread Prev] | [Thread Next] | [Date Next] -- [Date Index] | [Thread Index] | [List Home]