Comparing OpenC2 language to McAfee OpenDxl-ontology and Symantec ICDx

I think it would be a good exercise to compare our language to both McAfee OpenDxl-ontology and Broadcom ICD. I uploaded some ICD information to OpenC2 file server that can be used for comparison purposes.
 For OpenDxl-ontology it is available on the web at 
https://opencybersecurityalliance.github.io/opendxl-ontology/.

 

I think the exercise should be from both directions. Ie we should look for actions/targets/specifiers/args/etc that are in these documents that we do have AND we should look for where OpenDxl/ICD use different
 terms than what OpenC2 specified. In the former case (e.g. ICD has a target called âcertificateâ), we should evaluate whether to add to OpenC2 and whether the word chosen is one we could all agree to. In the latter case (eg OpenDxl uses âblacklistâ â we would
 use âdenyâ) we should request them to change to our word.

 

Duncan Sparrell

sFractal Consulting LLC

iPhone, iTypo, iApologize

I welcome VSRE emails. Learn more at http://vsre.info/