Preservation of STIX

["Taylor, Marlon" <Marlon.Taylor@cisa.dhs.gov>]

Hi TC,

 

What is the TC stance on the preservation of STIX content?

 

Through engagements with various members of the STIX community it has become apparent that STIX content is handled differently within the community. The difference in STIX handling (e.g. dropped fields) results in confusion and lack of trust between systems. This concern has echoed throughout the STIX community, the Interop subcommittee, and now the TC for the purpose of resolution! This is great timing as we can address this for all while the specification is in public review prior on the way to becoming an OASIS standard!

 

The table below highlights areas of consideration. The âRow #â column provides an unique identifier of each use case. Iâm we hoping we as a TC can provide a decision on this matter and show alignment via the rows below.

 

Row #	Ingest - Keep Original   No â the original STIX is a not accessible   Yes â the original STIX is accessible	Process  - Translate to internal Data Model   None â no STIX properties are mapped to the data model Some â some STIX properties are mapped to the data model All â every STIX property in mapped to the data model	Export â Original   No â the original STIX is not exportable Yes â the original STIX is exportable	Export â Processed   No â the internal data model is not exportable is STIX Yes â the internal data model is exportable is STIX
1	No	None	No	No
2	No	None	No	Yes
3	No	None	Yes	No
4	No	None	Yes	Yes
5	No	Some	No	No
6	No	Some	No	Yes
7	No	Some	Yes	No
8	No	Some	Yes	Yes
9	No	All	No	No
10	No	All	No	Yes
11	No	All	Yes	No
12	No	All	Yes	Yes
13	Yes	None	No	No
14	Yes	None	No	Yes
15	Yes	None	Yes	No
16	Yes	None	Yes	Yes
17	Yes	Some	No	No
18	Yes	Some	No	Yes
19	Yes	Some	Yes	No
20	Yes	Some	Yes	Yes
21	Yes	All	No	No
22	Yes	All	No	Yes
23	Yes	All	Yes	No
24	Yes	All	Yes	Yes

 

Addressing the preservation of STIX as a TC will drive a better understanding for all and interoperability.

 

 

Marlon Taylor