OASIS Mailing List ArchivesView the OASIS mailing list archive below
or browse/search using MarkMail.


Help: OASIS Mailing Lists Help | MarkMail Help

cti message

[Date Prev] | [Thread Prev] | [Thread Next] | [Date Next] -- [Date Index] | [Thread Index] | [List Home]

Subject: Re: [EXT] [cti] STIX 2.1 CS01 Corrections

Hi Nick,


Thanks so much for finding all of these typos!  Bret and I (the editors) say âthere is an infinite number of typos left to findâ.




Rich Piazza

Lead Cyber Security Engineer

The MITRE Corporation






From: <cti@lists.oasis-open.org> on behalf of Nick Schwane <nschwane@celerium.com>
Date: Friday, October 16, 2020 at 8:36 AM
To: "cti@lists.oasis-open.org" <cti@lists.oasis-open.org>
Subject: [EXT] [cti] STIX 2.1 CS01 Corrections


Here are some corrections that I have for STIX 2.1 committee spec 01.


4.6 Indicator â The malware object in the example is missing the is_family property.


4.15 Report â Replace âââ in the identity object in the example with modified and created properties to have a complete & valid example. The reportâs published property is an invalid date because it has 3 digits for the day: "2016-01-201T17:00:00Z". The relationshipâs target_ref property should have the id of the campaign in the example: campaign--83422c77-904c-4dc1-aff5-5c38f3a2c55c.


6.12 Network Traffic Object â The network traffic object example under Network Traffic with Netflow Data has an invalid src_ref identifier. It is one digit short and should have a 7 added to the end to point to one of the ipv4-addr objects in the example.


6.13 Process Object â The process object in the Basic Process example has created as a property instead of created_time. Statement Marking Object Type â The statement marking definition example uses the id of TLP:GREEN. This should get a new id since the ids for the TLP marking definitions are reserved.



On a side note, the Poison Ivy JSON example at https://oasis-open.github.io/cti-documentation/stix/examples is missing is_family from all of the malware objects.






Nick Schwane / Software Engineer



Office: 804-744-6235 


Twitter signature_1906159177 Facebook signature_1906159177 LinkedIn signature_1906159177


Disclaimer: This message is intended only for the use of the individual or entity to which it is addressed and may contain information which is privileged, confidential, proprietary, or exempt from disclosure under applicable law. If you are not the intended recipient or the person responsible for delivering the message to the intended recipient, you are strictly prohibited from disclosing, distributing, copying, or in any way using this message. If you have received this communication in error, please notify the sender and destroy and delete any copies you may have received.

[Date Prev] | [Thread Prev] | [Thread Next] | [Date Next] -- [Date Index] | [Thread Index] | [List Home]