STIX 2.0 Draft 3

All,

Thanks everyone for the great comments, feedback, and (especially) suggestions on STIX 2.0 drafts 1 and 2! As Rich Struse mentioned in his e-mail last week, we’ve had a TON of activity and the specification is significantly better as a result.

Now that comments have tapered off, the editors have decided to release STIX 2.0 Draft 3. Given the amount of feedback this will be a decent change from Draft 2:

- Significant refactoring of the introduction

- Update to marking definitions to remove versioning

- Added the FIRST IEP marking definition as an option

- Cleaned up Threat Actor, Intrusion Set, and Campaign

- Cleaned up Sighting and Observed Data

- Added Infrastructure object

- Improved Malware object (some minor work remains)

- Tightened fields/relationships on Incident object to a small stub

- Improved vocabulary descriptions

- Relationships tweaked and cleaned up

- Miscellaneous editorial changes

- Removed version_comment

Given our timeline, Draft 3 will be the final draft of STIX 2.0! To focus on the finish line, here’s a few guidelines for review:

1. At this point we will not be considering any new additions to the specification. There’s just not enough time to discuss anything new.

2. Focus your review on objects, properties, and relationships, rather than the text. We appreciate all of the text suggestions, but at this point we need a final review of the structured format itself to make sure it will work.

3. Finally, please provide suggestions rather than simply comments. If something is broken, don’t just say it’s broken. Tell us how you want to fix it. This will make sure we keep moving forward.

Looking ahead, we hope to have received all comments on draft 3 by Friday, August 12 so that we can issue a release candidate on Monday, August 15. After the release candidate is issued we’ll remove suggestion access to Google Docs and require that all comments be made on the e-mail list. This will ensure that everyone has full awareness of what we’re changing.

Again, thanks everyone for all of your hard work on this. As I read through the specification and imagine using it I’m feeling very, very good about where we ended up. A couple other people I’ve talked to who have been less involved have said the same. We’ve done some great work already, so let’s keep that up next week and make a final push to finish this off.

Thanks,

John

cti message