OASIS Mailing List ArchivesView the OASIS mailing list archive below
or browse/search using MarkMail.

 


Help: OASIS Mailing Lists Help | MarkMail Help

cti message

[Date Prev] | [Thread Prev] | [Thread Next] | [Date Next] -- [Date Index] | [Thread Index] | [List Home]


Subject: Working Call - Meeting Notes - Searchable Version



CTI TC Weekly Working Call - Text-based notes

[Note:Â A separate PDF version with embedded screenshots will be uploaded to Kavi]

Attendees:

Chris Ricard

Trey Darley

Bret Jordan

Sean Barnum

Â

Jeffrey Mates

Gary Katz

Allan Thomson

Nicholas Hayden

John Wunder â Moderator

Jane Ginn - Recorder

John-Mark Gurney

Drew Varner

Agenda:

  • ÂCSD Updates
  • Infrastructure SDO w/ Emphasis on How To Handle Observed_Data
  • Proposed Spec text for Internationalization SDO

Meeting Notes:

ÂÂÂÂÂÂÂÂÂÂÂ John Wunder

ÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂ Update on the working draft â when out

ÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂ *** Switched to discussion on Infrastructure & how Observed Data is handled

ÂÂÂÂÂÂÂÂÂÂÂ Jeffrey Mates

ÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂ [Reviewed the slide deck]

Need to be able to pierce the bubble around Observed Data that we constructed

ÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂ Need one subject OD (Parent_Node) to reference the others (Child_Nodes)

ÂÂÂÂÂÂÂÂÂÂÂ John-Mark Gurney

ÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂ In that example â It makes sense

ÂÂÂÂÂÂÂÂÂÂÂ Allan Thomson

ÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂ Did you consider just making it an optional argument on the Observed Data yourself?

ÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂ [Gave an example of an optional property]

ÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂ Then, you donât have to have the additional property called out â Alternative way

ÂÂÂÂÂÂÂÂÂÂÂ Jeffrey Mates

ÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂ We could make that part of the base observable

ÂÂÂÂÂÂÂÂÂÂÂ Allan Thomson

ÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂ It might make it more elegant

ÂÂÂÂÂÂÂÂÂÂÂ John-MarkÂÂÂÂÂ

ÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂ Iâd like to say that Iâd not like to use the property on the Observable

ÂÂÂÂÂÂÂÂÂÂÂ Sean Barnum

ÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂ Iâd like it on the Observed_Data, rather than on every single Observable

ÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂ Not on every class

ÂÂÂÂÂÂÂÂÂÂÂ Allan Thomson

ÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂ There is a difference between a schema and an instance

ÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂ [Gave an example]

ÂÂÂÂÂÂÂÂÂÂÂ Sean Barnum

ÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂ I understand what you were saying

ÂÂÂÂÂÂÂÂÂÂÂ John Wunder

ÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂ [Explained about the optional property]

ÂÂÂÂÂÂÂÂÂÂÂ John-Mark Gurney

ÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂ We need a better definition of what âparentâ means â a synonym for ârootâ

ÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂ [Gave Apache example]

ÂÂÂÂÂÂÂÂÂÂÂ Trey Darley

ÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂ To John-Markâs point â would that not be the initial entry point into the Observed_Data

ÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂ That is the definition I was suggestion

ÂÂÂÂÂÂÂÂÂÂÂ Bret Jordan

ÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂ I generally like what Gary and Jeffrey have done â it will need a little more work

ÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂ To flush out

ÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂ Iâd like to see where we agree and where we disagree â if just the little things

ÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂ We should call those out â High level of agreement

ÂÂÂÂÂÂÂÂÂÂÂ Trey Darley

ÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂ Iâll be brief and responding to Bret

ÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂ I would suggest that in the Working Document for 2.2

ÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂ That Gary and Jeffrey add what this would look like in the Spec

ÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂ Before we commit

ÂÂÂÂÂÂÂÂÂÂÂ Allan Thomson

ÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂ This example on the screen is one example

ÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂ [Gave a multilayered example]

ÂÂÂÂÂÂÂÂÂÂÂ Jeffrey Mates

ÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂ We assumed a full static analysis â that can include a large graph

ÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂ You can set any number of Parents, but, you specify a key entry point

ÂÂÂÂÂÂÂÂÂÂÂ Allan Thomson

ÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂ Then, you would need different Observed_Data objects

Â

ÂÂÂÂÂÂÂÂÂÂÂ Gary Katz

ÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂ [Explained how the multiple layers of the graph data model would work]

ÂÂÂÂÂÂÂÂÂÂÂ Allan Thomson

ÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂ [Gave example of Web Server, then Web App â As multi-layer]

ÂÂÂÂÂÂÂÂÂÂÂ Gary Katz

ÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂ There are relationships within it.

ÂÂÂÂÂÂÂÂÂÂÂ Trey Darley

ÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂ Gary is correct â Within Observed_Data, there is a Graph

ÂÂÂÂÂÂÂÂÂÂÂ Allan Thomson

ÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂ I was not able to see the Contained_Ref â Now I see it

ÂÂÂÂÂÂÂÂÂÂÂ John-Mark

ÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂ So that last comment points out that Parent Node is on the wrong object

ÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂ Really the Infrastructure object should list what it is referring to

ÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂ [Pointed back to Allanâs example ]â If you have to reference â problematic

ÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂ Would need to create two references back

ÂÂÂÂÂÂÂÂÂÂÂ Bret Jordan

ÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂ Other people need to be add to it -Â for Infrastructure and Malware

ÂÂÂÂÂÂÂÂÂÂÂ John-Mark

ÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂ That does not change it [gave examples of links back to different Observed_Data objects]

ÂÂÂÂÂÂÂÂÂÂÂ Jeffrey Mates

ÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂ [Explained why the proposal has the Parent_Node where it is â The logic used]

ÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂ It also let us have a non-changing state within Observed_Data

ÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂ We were trying to ensure it was a stand-alone object â that wouldnât break in another way

ÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂ I wonder if we should make the Parent Nodes an Array of Arrays

ÂÂÂÂÂÂÂÂÂÂÂ John-Mark

ÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂ That would be a Material Change â I would be concerned about that

ÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂ I do remember us talking about having only 1 Graph

ÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂ But, in my reading, I donât see the reference

ÂÂÂÂÂÂÂÂÂÂÂ Gary Katz

ÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂ It is in there â I cannot remember where

ÂÂÂÂÂÂÂÂÂÂÂ Trey Darley

ÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂ It is there

ÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂ [John switched to the slide that shows the text in the Spec]

ÂÂÂÂÂÂÂÂÂÂÂ John-Mark

ÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂ I donât think we have what a Cyber_Observable relationship is

ÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂ I donât have a huge objection to relaxing that requirement

ÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂ If we relax this and allowed multiple roots

ÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂ Effectively we are in a Tree, not a Graph

ÂÂÂÂÂÂÂÂÂÂÂ Jeffrey Mates

ÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂ We canât guarantee that it is not A-Cyclic â [Gave example of dropping malware]

ÂÂÂÂÂÂÂÂÂÂÂ John-Mark

ÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂ You canât delete yourself and then create yourself

ÂÂÂÂÂÂÂÂÂÂÂ Jeffrey Mates

ÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂ That is where the time factor comes in

ÂÂÂÂÂÂÂÂÂÂÂ Gary Katz

ÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂ It depends on how it is modeled

ÂÂÂÂÂÂÂÂÂÂÂ John-Mark

ÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂ It needs to be understood by machines in real time

ÂÂÂÂÂÂÂÂÂÂÂ Jeffrey Mates

ÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂ [Gave example of the challenges of automating]

ÂÂÂÂÂÂÂÂÂÂÂ John-Mark

ÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂ But within the Graph, there is no Timestamp

ÂÂÂÂÂÂÂÂÂÂÂ Trey Darley

ÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂ [Proposed a solution]

ÂÂÂÂÂÂÂÂÂÂÂ Jeffrey Mates

ÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂ [Gave example of how the Timestamp is working]

ÂÂÂÂÂÂÂÂÂÂÂ John-Mark Gurney

ÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂ We are trying to have this Observed_Data do a lot of thingsâ Does it make sense

ÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂ [Gave several examples]

ÂÂÂÂÂÂÂÂÂÂÂ Allan Thomson

ÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂ The conversation leads me believe that we are not exactly clear about

ÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂ What a machine is going to do

ÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂ We need to be very clear on which Use Cases would work

ÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂ How do we know that we actually got it right?

ÂÂÂÂÂÂÂÂÂÂÂ John Wunder

ÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂ [Gave some examples of different Use Cases]

ÂÂÂÂÂÂÂÂÂÂÂ Allan Thomson

ÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂ [Gave some more examples]

ÂÂÂÂÂÂÂÂÂÂÂ Gary Katz

ÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂ The whole reason for have the Parent_Node defined â That is what this proposal

ÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂ Is getting to.

ÂÂÂÂÂÂÂÂÂÂÂ Allan Thomson

ÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂ To the conversation about Cyclic Graphs â But, the opposite is that if people donât

ÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂ Understand what they are trying to do

ÂÂÂÂÂÂÂÂÂÂÂ Gary Katz

ÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂ If people donât know what to do with the data - They shouldnât be working on it

ÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂ [Gave example of the different personas in the Interop Spec]

ÂÂÂÂÂÂÂÂÂÂÂ Allan Thomson

ÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂ I get that â The more explicit you are, the better it is for an intended use

ÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂ Gave an example of using a specific use case in the Spec

ÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂ What I am saying is that we should add those specific Use Cases to the Spec

ÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂ Unless you are doing this Use Case â Then you can ignore

ÂÂÂÂÂÂÂÂÂÂÂ John-Mark Gurney

ÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂ We should make explicit that the Use Case should not be Cyclic Use Cases

ÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂ These are the roots of all of the trees in this Graph â and they must be listed

ÂÂÂÂÂÂÂÂÂÂÂ Jeffrey Mates

ÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂ The simpler the better [Gave examples â Firewall vs. mutex, or Firewall vs. IP]

ÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂ You could link to a mid-point â which is what is important to me

ÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂ It is a full-blown graph, because we allow extensionsâ

ÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂ It is up to the appliance to parse it

ÂÂÂÂÂÂÂÂÂÂÂ John-Mark Gurney

ÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂ I understand what you mean â Posed a question about how you would know

ÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂ Where you link to a middle point

ÂÂÂÂÂÂÂÂÂÂÂ Jeffrey Mates

ÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂ We have to remember that it is an exchange not a storage function

ÂÂÂÂÂÂÂÂÂÂÂ John-Mark Gurney

ÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂ You are using an existing object for something else it was not designed to do

ÂÂÂÂÂÂÂÂÂÂÂ Jeffrey Mates

ÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂ I think if we use the existing object â then we can use what we have

ÂÂÂÂÂÂÂÂÂÂÂ John Wunder

ÂÂÂÂÂÂÂÂÂÂÂ ÂÂÂÂÂÂÂÂÂÂÂ I think we need to flush out some of these and create some Use Cases

ÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂ We need to list the types of products that we care about

ÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂ Then list they types of data that each would need

ÂÂÂÂÂÂÂÂÂÂÂ Trey Darley

ÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂ It almost suggests that we might want to resurrect the Mini-Group

ÂÂÂÂÂÂÂÂÂÂÂ Gary Katz

ÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂ I can put together some more examples â We are trying to get to STIX 2.1

ÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂ To get to closure

ÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂ Weâve had some side conversations â It is not breaking â It does provide a solution

ÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂ What do we need to resolve â to close on it

ÂÂÂÂÂÂÂÂÂÂÂ John Wunder

ÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂ Discussed the properties that became optional â Implications for Patterning

ÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂ John-Mark & Trey are the best to discuss

ÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂ Second one I heard today â Is the multi-layered nature of the proposal

ÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂ The other question â the Cyclic nature

ÂÂÂÂÂÂÂÂÂÂÂ Trey Darley

 Next steps? Next working group call? Mini-group? Come up with some examples

ÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂ While we want to support Malware and Incident â this was initially created

ÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂ To support Infrastructure

ÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂ We need to try in running code â We want to make sure we donât break Indicators

ÂÂÂÂÂÂÂÂÂÂÂ John Wunder

ÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂ If there are no more comments, weâll go on to another topic

ÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂ With Internationalization â We reference RFCs for language codes

ÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂ Bret suggested to add some âSHOULDâ statements in there to give some people

ÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂ Some guidance on how to implement

ÂÂÂÂÂÂÂÂÂÂÂ ÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂ [Asked for comments]

ÂÂÂÂÂÂÂÂÂÂÂ Trey Darley

ÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂ I believe Bret was going to propose some text

ÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂ The points Bret raised makes sense

ÂÂÂÂÂÂÂÂÂÂÂ John Wunder

ÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂ He has proposed text in the email â I donât know that it needs to be a SHOULD

ÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂ But, Iâm pretty open on this one

ÂÂÂÂÂÂÂÂÂÂÂ John-Mark Gurney

ÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂ From my brief read, it sounds like what you do out of the RFC â

ÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂ Examples would help in that case, too.

ÂÂÂÂÂÂÂÂÂÂÂ Allan Thomson

ÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂ I have a question on the previous topic

ÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂ Does the Spec have an ability to say whether a File was created or deleted?

ÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂ It is not actually thereâ.

ÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂ Cyber_Observables are not actually files â

ÂÂÂÂÂÂÂÂÂÂÂ Trey Darley

ÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂ 2.0 was an MVP â Actions is a reserved term â it is an important capability that

ÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂ We have always intended to address

ÂÂÂÂÂÂÂÂÂÂÂ Sean Barnum

ÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂ I was going to point that out tooâ that is one of the things that we are missing too.

ÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂ We are using relationships â it is less expressive

ÂÂÂÂÂÂÂÂÂÂÂ Allan Thomson

ÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂ What Iâm observing is that we are going from a definition of âStateâ to a definition

ÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂ Of âBehaviorâ

ÂÂÂÂÂÂÂÂÂÂÂ Sean Barnum

ÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂ That is true, when you bring in Actions [Gave example of Cyclic Use Case]

ÂÂÂÂÂÂÂÂÂÂÂ ÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂ It does not invalidate the usefulness for static information

ÂÂÂÂÂÂÂÂÂÂÂ Jeffrey Mates

ÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂ It is not specifically in there â for how you define an action â Include wrap

ÂÂÂÂÂÂÂÂÂÂÂ John-Mark Gurney

ÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂ [Made a final comment on how Actions will work]

Â

Chat Panel Discussions

Â

From jordan to Everyone:Â 12:18 PM

I will be on the phone only for the next 15-20 minutes. But I need to drop off of the web portion.

From Allan Thomson to Everyone:Â 12:22 PM

technically you can figure out parent_nodes automatically. just look for things that are not connected in the local graph (have 0 parents). its just more explicit

From Trey Darley to Everyone:Â 12:25 PM

@Allan: I believe you are correct.

From Trey Darley to Everyone:Â 12:34 PM

@Allan: +1

From jmg to Everyone:Â 12:35 PM

you shouldn't/can't have cycles, even in the created file then file deletes itself.. because the file cannot create itself, something else created it, then the file ran and then the file did the delete...

if it's cyclic, then you've invented a time machine!

From Allan Thomson to Everyone:Â 12:39 PM

+1 to jmg

From sean.barnum to Everyone:Â 12:42 PM

Cyclic relationships are the reality of threat intel. We cannot simply say that you are not allowed to express them because of limitations in the current observed data structure and its timestamps.

if the structure has limitations then lets fix those limitations rather than attempt to rule out real world CTI use cases

From Allan Thomson to Everyone:Â 12:42 PM

we are not describing a state machine including all behaviors. weâre describing artifacts of intel for specific uses.

From Trey Darley to Everyone:Â 12:43 PM

Make Arglebargle Great Again! :-P

From jmg to Everyone:Â 12:47 PM

minigroup +1

sean, I'm not saying ALL of STIX cannot by cyclic, I'm saying that the data that you observe cannot be cyclic.. you can't observe a file create itself, and delete itself.. something else had to create the file.. a file cannot sprint into existance from no where..

From sean.barnum to Everyone:Â 12:48 PM

I donât think anyone was talking about a file creating and deleting itself. The very valid use case Jeff gave was file A dropping file B which deletes file A. These sorts of cycles are absolutely real in the real world

Meeting Terminated

*********************************

-- 
R. Jane Ginn, MSIA, MRP
Secretary, Cyber Threat Intelligence Technical Committee (CTI TC)
OASIS
jg@ctin.us
+1(928)399-0509


[Date Prev] | [Thread Prev] | [Thread Next] | [Date Next] -- [Date Index] | [Thread Index] | [List Home]