Comparing OpenC2 language to McAfee OpenDxl-ontology and Symantec ICDx

I think it would be a good exercise to compare our language to both McAfee OpenDxl-ontology and Broadcom ICD. I uploaded some ICD information to OpenC2 file server that can be used for comparison purposes. For OpenDxl-ontology it is available on the web at https://opencybersecurityalliance.github.io/opendxl-ontology/.

I think the exercise should be from both directions. Ie we should look for actions/targets/specifiers/args/etc that are in these documents that we do have AND we should look for where OpenDxl/ICD use different terms than what OpenC2 specified. In the former case (e.g. ICD has a target called âcertificateâ), we should evaluate whether to add to OpenC2 and whether the word chosen is one we could all agree to. In the latter case (eg OpenDxl uses âblacklistâ â we would use âdenyâ) we should request them to change to our word.

Duncan Sparrell

sFractal Consulting LLC

iPhone, iTypo, iApologize

I welcome VSRE emails. Learn more at http://vsre.info/

openc2-lang message