OASIS Mailing List ArchivesView the OASIS mailing list archive below
or browse/search using MarkMail.


Help: OASIS Mailing Lists Help | MarkMail Help

cti message

[Date Prev] | [Thread Prev] | [Thread Next] | [Date Next] -- [Date Index] | [Thread Index] | [List Home]

Subject: Updated IEP v2 docs based on feedback so far

Hi All, 

I've attached the latest IEP v2 documents with updates based on the feedback we've received so far.

The STIX 2.1 Proposal has been majorly modified to use two different Data Marking objects, in the interest of making the number of bytes smaller on the wire and simplifying their use. It now separates the IEP Policy and the IEP Policy Reference parts into two different Data Marking objects. 

The Framework document was updated with the latest TLP definitions after it was pointed out we'd missed including the latest changes (thanks Thomas!)

The JSON specification was modified to align closer to STIX to simplify parsing based on feedback from Bret and Allan, and we also changed the examples so that the TLP-SIG JSON examples use https://www.first.org/tlp as their external reference (makes much more sense).

IEP will be discussed at the upcoming CTI Face-2-face meeting in Maryland on Thursday May 25, and I'm really hoping we'll get it into STIX 2.1. 

We REALLY need a way of marking the restrictions on Threat Intel in a more descriptive way - and I firmly believe Threat Intel sharing will be much better off if we include IEP v2 in STIX 2.1.


Terry MacDonald | Chief Product Officer

Attachment: STIX2.1Proposal-InformationExchangePolicyMarkingObjectTypeupdated20170517.pdf
Description: Adobe PDF document

Attachment: FIRST_IEP_2_JSON_20170519.docx
Description: application/vnd.openxmlformats-officedocument.wordprocessingml.document

Attachment: FIRST_IEP_Framework_2_20170519.docx
Description: application/vnd.openxmlformats-officedocument.wordprocessingml.document

[Date Prev] | [Thread Prev] | [Thread Next] | [Date Next] -- [Date Index] | [Thread Index] | [List Home]