OASIS Mailing List ArchivesView the OASIS mailing list archive below
or browse/search using MarkMail.


Help: OASIS Mailing Lists Help | MarkMail Help

openc2-lang message

[Date Prev] | [Thread Prev] | [Thread Next] | [Date Next] -- [Date Index] | [Thread Index] | [List Home]

Subject: Re: [openc2-lang] SCAP 2.0 Monitoring Overlay Idea

This takes us back to issue 347 in the language spec where we discuss the refinement of temporality.


Im going to include the SCAP use case temporality requirements in issue 347.


On Jun 17, 2020, at 4:27 AM, duncan sfractal.com <duncan@sfractal.com> wrote:

Thank you. I am forwarding this on to the experts to prepare a use case explain how to do it. We look forward to working together.
Duncan Sparrell
sFractal Consulting LLC
iPhone, iTypo, iApologize
I welcome VSRE emails. Learn more at http://vsre.info/
From: Adam Montville <Adam.Montville@cisecurity.org>
Date: Tuesday, June 16, 2020 at 2:58 PM
To: "duncan@sfractal.com" <duncan@sfractal.com>
Subject: SCAP 2.0 Monitoring Overlay Idea
Hi Duncan,
Per your request, Iâve attached a draft-of-a-draft overview of what the SCAP 2.0 group is considering as a requirement. That group would like to be able to schedule state collection and evaluation on various intervals ranging from when a computing resource âwakes upâ or connects (from the perspective of the enterprise), when a target attribute of interest changes (i.e. configuration setting X has changed from enabled to disabled), to a variety of time-based intervals ranging from minutes to months.
Rather than reinvent any wheels, they asked me to see whether OpenC2 might have some _expression_ for this sort of thing.
Thanks in advance for your help.
Kind regards,
This message and attachments may contain confidential information. If it appears that this message was sent to you by mistake, any retention, dissemination, distribution or copying of this message and attachments is strictly prohibited. Please notify the sender immediately and permanently delete the message and any attachments. 

. . . . . 
<Monitoring Overlay Syntax Proposal.docx>
To unsubscribe from this mail list, you must leave the OASIS TC that 
generates this mail.  Follow this link to all your TCs in OASIS at:

[Date Prev] | [Thread Prev] | [Thread Next] | [Date Next] -- [Date Index] | [Thread Index] | [List Home]