cti-taxii — archive

A TAXII v2.0 Proposal with STIX implications

From: Aharon Chernin <[email protected]>
To: [email protected]
Date: Wed, 26 Aug 2015 17:53:00 -0000

> We just need to get the STIX team to realize that their is more to STIX creation than just a data model and OWL level stuff. It's not two people developing STIX, it should be a community. > I think STIX needs to define the STIX server part that you called out. I like Terry's document as well and I agree that STIX should be separated from TAXII . I am still digesting the STIX server part. My initial reaction is that the layer between the TAXII server and the STIX data should not be standardized and should be left as an area where vendors can innovate. I also ask myself, does this reduce STIX complexity? Aharon Chernin CTO SOLTRA An FS-ISAC & DTCC Company 18301 Bermuda green Dr Tampa, fl 33647 813.470.2173 [email protected] www.soltra.com From: [email protected] <[email protected]> on behalf of Jordan, Bret <[email protected]> Sent: Wednesday, August 26, 2015 12:32 PM To: Terry MacDonald Cc: [email protected]; [email protected] Subject: Re: [cti-stix] A TAXII v2.0 Proposal with STIX implications Terry, Great proposal. I am in agreement with all of the top level elements you call out and believe it fits in nicely with the proposals we have already talked about. Meaning, I do not think it is really a different proposal, just a more complete proposal. Further I think this is what Mark and I have been talking about all along, you just did the hard part of writing it all up, and you did an amazing job at that. We just need to get the STIX team to realize that their is more to STIX creation than just a data model and OWL level stuff. I think STIX needs to define the STIX server part that you called out. Thanks, Bret Bret Jordan CISSP Director of Security Architecture and Standards Office of the CTO Blue Coat Systems PGP Fingerprint: 63B4 FC53 680A 6B7D 1447 F2C0 74F8 ACAE 7415 0050 "Without cryptography vihv vivc ce xhrnrw, however, the only thing that can not be unscrambled is an egg." On Aug 25, 2015, at 22:34, Terry MacDonald < [email protected] > wrote: Hi All, Over the past few weeks I've been pondering how we could improve STIX and TAXII as many others have been, and I've come up with a proposal that I'd like to share. I normally would only post this to the cti-taxii list, but as it potentially impacts STIX I think it's worth posting to the sti-stix list as well. Apologies if you get two copies. As it has lots of pretty pictures, rather than send it out in email, I've put it here: http://blog.threatloop.com/post/127598238937/taxii-stix-v20-proposal I'd really appreciate your thoughts. Cheers Terry MacDonald STIX, TAXII, CybOX Consultant M: +61-407-203-026 E: [email protected] W: www.threatloop.com Disclaimer: The opinions expressed within this email do not represent the sentiment of any other party except my own. My views do not necessarily reflect those of my employers.