OASIS Mailing List ArchivesView the OASIS mailing list archive below
or browse/search using MarkMail.

 


Help: OASIS Mailing Lists Help | MarkMail Help

cti message

[Date Prev] | [Thread Prev] | [Thread Next] | [Date Next] -- [Date Index] | [Thread Index] | [List Home]


Subject: Re: [cti] Spec Version


Agree - FWIW, IIRC last year we all agreed as a TC on the principle that the purpose of STIX is a data interchange format - not a data storage format. Therefore it only makes sense that you would not mix versions in one data interchange. IE When I download an HTML or XML document... it is all one version. I can't stick HTML 3.0 markup inside an HTML 4.0 document.. you can't specify versions on each fragment.. only for the entire document.

-
Jason Keirstead
STSM, Product Architect, Security Intelligence, IBM Security Systems
www.ibm.com/security | www.securityintelligence.com

Without data, all you are is just another person with an opinion - Unknown


Inactive hide details for Mark Davidson ---04/18/2016 08:02:50 AM---IMO you should be able to send everything in a single versiMark Davidson ---04/18/2016 08:02:50 AM---IMO you should be able to send everything in a single version of STIX. The format (STIX 2.0, 2.1, 2.

From: Mark Davidson <mdavidson@soltra.com>
To: "Jordan, Bret" <bret.jordan@bluecoat.com>, Terry MacDonald <terry.macdonald@cosive.com>
Cc: "cti@lists.oasis-open.org" <cti@lists.oasis-open.org>, Patrick Maroney <Pmaroney@specere.org>
Date: 04/18/2016 08:02 AM
Subject: Re: [cti] Spec Version
Sent by: <cti@lists.oasis-open.org>





IMO you should be able to send everything in a single version of STIX. The format (STIX 2.0, 2.1, 2.2 or XML vs JSON vs Stone-Tablets) is just the representation, it’s not the indicator itself.

Is there a reason why sending everything as one version of STIX wouldn’t work? I’d really like to avoid the “mixed content” scenario because it is a very complex operating environment to support.

Thank you
-Mark

From: <cti@lists.oasis-open.org> on behalf of "Jordan, Bret" <bret.jordan@bluecoat.com>
Date:
Sunday, April 17, 2016 at 10:36 PM
To:
Terry MacDonald <terry.macdonald@cosive.com>
Cc:
"cti@lists.oasis-open.org" <cti@lists.oasis-open.org>, Patrick Maroney <Pmaroney@specere.org>
Subject:
Re: [cti] Spec Version

Yeah, I thought about that... But I do not see any tools (long term) working that way... Meaning, I do not see them storing the RAW STIX 2.0 or STIX 2.1 format. I see them pulling the data out and putting in their graph database. So when you request something from them, you would get everything in the same version. Similar to what FB and others do today.

Also, supporting multiple versions of content in the same STIX package seems like a very small corner case. You could easy just send two packages if you really wanted to send mixed content.

Thanks,

Bret



Bret Jordan CISSP
Director of Security Architecture and Standards | Office of the CTO
Blue Coat Systems
PGP Fingerprint: 63B4 FC53 680A 6B7D 1447 F2C0 74F8 ACAE 7415 0050
"Without cryptography vihv vivc ce xhrnrw, however, the only thing that can not be unscrambled is an egg."




[Date Prev] | [Thread Prev] | [Thread Next] | [Date Next] -- [Date Index] | [Thread Index] | [List Home]