OASIS Cyber Threat Intelligence (CTI) TC

Pat,


In my opinion, STIX 2 and CybOX 2 are in too much flux to focus on their schema implementations. However, I would always encourage the community to work on schemas implementations early in the process if the would like to donate the man hours to the group.


More points towards our lack of focus on schema representation at this point:
*) We have not reached consensus on the definition of what an “observation” is, and several other frequently used high level objects, in STIX 2. An email went out from John Wunder on Thursday to the STIX TC asking for comments on both the definition of
a few of the STIX high level objects and how they work together in the STIX 2 pre-draft specs. The response to this would be a good gauge to our closeness on consensus. 
*) A word of caution. STIX TC members wishing to invest the hours to build JSON schema implementations at this time risk large changes in the spec until we reach pre-draft consensus.   
*) I think the community is in alignment that a JSON schema should be made based on the agreed STIX 2 specification. I also think it is acceptable to get JSON schema availability timing based on STIX 2 draft specifications when they are available.


Aharon









From: < cti@lists.oasis-open.org > on behalf of Patrick Maroney < Pmaroney@Specere.org >
Date: Saturday, April 9, 2016 at 4:20 PM
To: OASIS CTI TC Discussion List < cti@lists.oasis-open.org >
Subject: [cti] RFI & Motion: JSON MTI & JSON Schemas





Obviously, the STIX and CybOX specifications are still very much under development.  However, I'm unable to locate any notional/draft JSON Schemas for STIX or CybOX on GitHub, OASIS Document libraries, or Slack Channel. The fact that there are only 6 posts
in the 10,000's of Slack Channels/postings that even contain the word "schema" would indicate that there is no current focus on JSON Schemas.


(1) Do these exist anywhere within the known CTI TC document locations? If so, where?
(2) Do these exist anywhere in CTI TC member locations (e.g. GitHub)? If so, where?
(3) If not what is the current road map (with estimated target dates) for their creation as part of the JSON MTI?


Hopefully we have CTI TC consensus that the inclusion of normative JSON Schemas for the OASIS CTI TC Committee Specifications and Standards are critical to our success in many endeavors.  


To quickly and formally establish if this consensus exists, I submit the following motion to the CTI TC:


Motion: "I move that the inclusion of normative JSON Schemas in all OASIS CTI TC Committee Specifications and Standards based on a JSON MTI are critical to our success and are therefore mandatory deliverables".


Of particular immediate concern as one of the CTI TC Interoperability SC cochairs ( and basis for formally raising this topic today ) relates to the substantive technical body of work that is required to develop normative Interoperability and
Conformance Documentation, Use Cases/Scenarios, Test Suites, Test Descriptor, Tools, and CTI Interoperability Testing services.



These CTI Interoperability efforts require a significant amount of planning and coordination.  The road map and target dates for the delivery of the draft JSON Schemas by the STIX and CybOX SCs represent critical dependencies  and potential high risk blocking
milestones.


Note:  I created the "json-mti-schema" Slack Channel for advancing the planning and related discourse on the specific topic of CTI TC JSON schemas (and coordination of delivery of same)

Patrick Maroney
President
Integrated Networking Technologies, Inc.
Desk:
(856)983-0001
Cell:
(609)841-5104
Email:
pmaroney@specere.org

Aharon, Many thanks for responding.  I'm not advocating "Focus" on the actual schema implementations.  Intent and requested outcomes are: (1) Formally establish consensus that JSON Schemas are "Must" deliverables as outlined in the Motion. (I think all we need is for someone to formally second the motion.  Rich can call for objections, and presuming none, we can quickly pass as a resolution. (2) Estimated target dates for delivery of initial draft JSON schemas by each SC. (3) Add these schemas as specific deliverables to the STIX and CybOX Road Maps and update going forward as these plans evolve. Patrick Maroney President Integrated Networking Technologies, Inc. Desk: (856)983-0001 Cell: (609)841-5104 Email: pmaroney@specere.org _____________________________ From: Aharon Chernin < achernin@soltra.com > Sent: Sunday, April 10, 2016 9:35 AM Subject: Re: [cti] RFI & Motion: JSON MTI & JSON Schemas To: Patrick Maroney < pmaroney@specere.org >, OASIS CTI TC Discussion List < cti@lists.oasis-open.org > Pat, In my opinion, STIX 2 and CybOX 2 are in too much flux to focus on their schema implementations. However, I would always encourage the community to work on schemas implementations early in the process if the would like to donate the man hours to the group. More points towards our lack of focus on schema representation at this point: *) We have not reached consensus on the definition of what an “observation” is, and several other frequently used high level objects, in STIX 2. An email went out from John Wunder on Thursday to the STIX TC asking for comments on both the definition of a few of the STIX high level objects and how they work together in the STIX 2 pre-draft specs. The response to this would be a good gauge to our closeness on consensus.  *) A word of caution. STIX TC members wishing to invest the hours to build JSON schema implementations at this time risk large changes in the spec until we reach pre-draft consensus.    *) I think the community is in alignment that a JSON schema should be made based on the agreed STIX 2 specification. I also think it is acceptable to get JSON schema availability timing based on STIX 2 draft specifications when they are available. Aharon From: < cti@lists.oasis-open.org > on behalf of Patrick Maroney < Pmaroney@Specere.org > Date: Saturday, April 9, 2016 at 4:20 PM To: OASIS CTI TC Discussion List < cti@lists.oasis-open.org > Subject: [cti] RFI & Motion: JSON MTI & JSON Schemas Obviously, the STIX and CybOX specifications are still very much under development.  However, I'm unable to locate any notional/draft JSON Schemas for STIX or CybOX on GitHub, OASIS Document libraries, or Slack Channel. The fact that there are only 6 posts in the 10,000's of Slack Channels/postings that even contain the word "schema" would indicate that there is no current focus on JSON Schemas. (1) Do these exist anywhere within the known CTI TC document locations? If so, where? (2) Do these exist anywhere in CTI TC member locations (e.g. GitHub)? If so, where? (3) If not what is the current road map (with estimated target dates) for their creation as part of the JSON MTI? Hopefully we have CTI TC consensus that the inclusion of normative JSON Schemas for the OASIS CTI TC Committee Specifications and Standards are critical to our success in many endeavors.   To quickly and formally establish if this consensus exists, I submit the following motion to the CTI TC: Motion: "I move that the inclusion of normative JSON Schemas in all OASIS CTI TC Committee Specifications and Standards based on a JSON MTI are critical to our success and are therefore mandatory deliverables". Of particular immediate concern as one of the CTI TC Interoperability SC cochairs ( and basis for formally raising this topic today ) relates to the substantive technical body of work that is required to develop normative Interoperability and Conformance Documentation, Use Cases/Scenarios, Test Suites, Test Descriptor, Tools, and CTI Interoperability Testing services. These CTI Interoperability efforts require a significant amount of planning and coordination.  The road map and target dates for the delivery of the draft JSON Schemas by the STIX and CybOX SCs represent critical dependencies  and potential high risk blocking milestones. Note:  I created the "json-mti-schema" Slack Channel for advancing the planning and related discourse on the specific topic of CTI TC JSON schemas (and coordination of delivery of same) Patrick Maroney President Integrated Networking Technologies, Inc. Desk: (856)983-0001 Cell: (609)841-5104 Email: pmaroney@specere.org

Lack of visibility in terms of planning (should it result in best effort) is a real issue. From discussions with major actors, they don't want to invest in xml based dev and can't start with json. So status quo not benefiting the community. Personally I had to cancel a talk where a CTI exchange partnership were supposed to be signed between key players of a big energy sector due to lack of visibility. And I will not engage into new loss of credibility. I hope a new super Mario could help with plumbing On Sunday, 10 April 2016, Patrick Maroney < Pmaroney@specere.org > wrote: Aharon, Many thanks for responding.  I'm not advocating "Focus" on the actual schema implementations.  Intent and requested outcomes are: (1) Formally establish consensus that JSON Schemas are "Must" deliverables as outlined in the Motion. (I think all we need is for someone to formally second the motion.  Rich can call for objections, and presuming none, we can quickly pass as a resolution. (2) Estimated target dates for delivery of initial draft JSON schemas by each SC. (3) Add these schemas as specific deliverables to the STIX and CybOX Road Maps and update going forward as these plans evolve. Patrick Maroney President Integrated Networking Technologies, Inc. Desk: (856)983-0001 Cell: (609)841-5104 Email: pmaroney@specere.org _____________________________ From: Aharon Chernin < achernin@soltra.com > Sent: Sunday, April 10, 2016 9:35 AM Subject: Re: [cti] RFI & Motion: JSON MTI & JSON Schemas To: Patrick Maroney < pmaroney@specere.org >, OASIS CTI TC Discussion List < cti@lists.oasis-open.org > Pat, In my opinion, STIX 2 and CybOX 2 are in too much flux to focus on their schema implementations. However, I would always encourage the community to work on schemas implementations early in the process if the would like to donate the man hours to the group. More points towards our lack of focus on schema representation at this point: *) We have not reached consensus on the definition of what an “observation” is, and several other frequently used high level objects, in STIX 2. An email went out from John Wunder on Thursday to the STIX TC asking for comments on both the definition of a few of the STIX high level objects and how they work together in the STIX 2 pre-draft specs. The response to this would be a good gauge to our closeness on consensus.  *) A word of caution. STIX TC members wishing to invest the hours to build JSON schema implementations at this time risk large changes in the spec until we reach pre-draft consensus.    *) I think the community is in alignment that a JSON schema should be made based on the agreed STIX 2 specification. I also think it is acceptable to get JSON schema availability timing based on STIX 2 draft specifications when they are available. Aharon From: < cti@lists.oasis-open.org > on behalf of Patrick Maroney < Pmaroney@Specere.org > Date: Saturday, April 9, 2016 at 4:20 PM To: OASIS CTI TC Discussion List < cti@lists.oasis-open.org > Subject: [cti] RFI & Motion: JSON MTI & JSON Schemas Obviously, the STIX and CybOX specifications are still very much under development.  However, I'm unable to locate any notional/draft JSON Schemas for STIX or CybOX on GitHub, OASIS Document libraries, or Slack Channel. The fact that there are only 6 posts in the 10,000's of Slack Channels/postings that even contain the word "schema" would indicate that there is no current focus on JSON Schemas. (1) Do these exist anywhere within the known CTI TC document locations? If so, where? (2) Do these exist anywhere in CTI TC member locations (e.g. GitHub)? If so, where? (3) If not what is the current road map (with estimated target dates) for their creation as part of the JSON MTI? Hopefully we have CTI TC consensus that the inclusion of normative JSON Schemas for the OASIS CTI TC Committee Specifications and Standards are critical to our success in many endeavors.   To quickly and formally establish if this consensus exists, I submit the following motion to the CTI TC: Motion: "I move that the inclusion of normative JSON Schemas in all OASIS CTI TC Committee Specifications and Standards based on a JSON MTI are critical to our success and are therefore mandatory deliverables". Of particular immediate concern as one of the CTI TC Interoperability SC cochairs ( and basis for formally raising this topic today ) relates to the substantive technical body of work that is required to develop normative Interoperability and Conformance Documentation, Use Cases/Scenarios, Test Suites, Test Descriptor, Tools, and CTI Interoperability Testing services. These CTI Interoperability efforts require a significant amount of planning and coordination.  The road map and target dates for the delivery of the draft JSON Schemas by the STIX and CybOX SCs represent critical dependencies  and potential high risk blocking milestones. Note:  I created the "json-mti-schema" Slack Channel for advancing the planning and related discourse on the specific topic of CTI TC JSON schemas (and coordination of delivery of same) Patrick Maroney President Integrated Networking Technologies, Inc. Desk: (856)983-0001 Cell: (609)841-5104 Email: pmaroney@specere.org

I second the motion that while JSON was chosen as MTI, the inclusion of normative JSON Schemas in all OASIS CTI TC Committee Specifications and Standards based on a JSON MTI are critical to our success and are therefore mandatory deliverables. I want also to highlight that I would appreciate, if not vision or strategy, use of project management principles for better planning and improvement of deliverables. On Sunday, 10 April 2016, Patrick Maroney < Pmaroney@specere.org > wrote: Aharon, Many thanks for responding.  I'm not advocating "Focus" on the actual schema implementations.  Intent and requested outcomes are: (1) Formally establish consensus that JSON Schemas are "Must" deliverables as outlined in the Motion. (I think all we need is for someone to formally second the motion.  Rich can call for objections, and presuming none, we can quickly pass as a resolution. (2) Estimated target dates for delivery of initial draft JSON schemas by each SC. (3) Add these schemas as specific deliverables to the STIX and CybOX Road Maps and update going forward as these plans evolve. Patrick Maroney President Integrated Networking Technologies, Inc. Desk: (856)983-0001 Cell: (609)841-5104 Email: pmaroney@specere.org _____________________________ From: Aharon Chernin < achernin@soltra.com > Sent: Sunday, April 10, 2016 9:35 AM Subject: Re: [cti] RFI & Motion: JSON MTI & JSON Schemas To: Patrick Maroney < pmaroney@specere.org >, OASIS CTI TC Discussion List < cti@lists.oasis-open.org > Pat, In my opinion, STIX 2 and CybOX 2 are in too much flux to focus on their schema implementations. However, I would always encourage the community to work on schemas implementations early in the process if the would like to donate the man hours to the group. More points towards our lack of focus on schema representation at this point: *) We have not reached consensus on the definition of what an “observation” is, and several other frequently used high level objects, in STIX 2. An email went out from John Wunder on Thursday to the STIX TC asking for comments on both the definition of a few of the STIX high level objects and how they work together in the STIX 2 pre-draft specs. The response to this would be a good gauge to our closeness on consensus.  *) A word of caution. STIX TC members wishing to invest the hours to build JSON schema implementations at this time risk large changes in the spec until we reach pre-draft consensus.    *) I think the community is in alignment that a JSON schema should be made based on the agreed STIX 2 specification. I also think it is acceptable to get JSON schema availability timing based on STIX 2 draft specifications when they are available. Aharon From: < cti@lists.oasis-open.org > on behalf of Patrick Maroney < Pmaroney@Specere.org > Date: Saturday, April 9, 2016 at 4:20 PM To: OASIS CTI TC Discussion List < cti@lists.oasis-open.org > Subject: [cti] RFI & Motion: JSON MTI & JSON Schemas Obviously, the STIX and CybOX specifications are still very much under development.  However, I'm unable to locate any notional/draft JSON Schemas for STIX or CybOX on GitHub, OASIS Document libraries, or Slack Channel. The fact that there are only 6 posts in the 10,000's of Slack Channels/postings that even contain the word "schema" would indicate that there is no current focus on JSON Schemas. (1) Do these exist anywhere within the known CTI TC document locations? If so, where? (2) Do these exist anywhere in CTI TC member locations (e.g. GitHub)? If so, where? (3) If not what is the current road map (with estimated target dates) for their creation as part of the JSON MTI? Hopefully we have CTI TC consensus that the inclusion of normative JSON Schemas for the OASIS CTI TC Committee Specifications and Standards are critical to our success in many endeavors.   To quickly and formally establish if this consensus exists, I submit the following motion to the CTI TC: Motion: "I move that the inclusion of normative JSON Schemas in all OASIS CTI TC Committee Specifications and Standards based on a JSON MTI are critical to our success and are therefore mandatory deliverables". Of particular immediate concern as one of the CTI TC Interoperability SC cochairs ( and basis for formally raising this topic today ) relates to the substantive technical body of work that is required to develop normative Interoperability and Conformance Documentation, Use Cases/Scenarios, Test Suites, Test Descriptor, Tools, and CTI Interoperability Testing services. These CTI Interoperability efforts require a significant amount of planning and coordination.  The road map and target dates for the delivery of the draft JSON Schemas by the STIX and CybOX SCs represent critical dependencies  and potential high risk blocking milestones. Note:  I created the "json-mti-schema" Slack Channel for advancing the planning and related discourse on the specific topic of CTI TC JSON schemas (and coordination of delivery of same) Patrick Maroney President Integrated Networking Technologies, Inc. Desk: (856)983-0001 Cell: (609)841-5104 Email: pmaroney@specere.org

I’ve spent a little bit of time working on these and have a version in my personal repo:  http://github.com/johnwunder/stix2.0 . Rich Piazza also converted over the old idioms from the STIX 1.2 github.io
site.


As Aharon said, though, things are still in so much flux that it doesn’t really make a lot of sense to keep them in sync with the text specs. I would make a change and a day later someone would suggest something different. IMO these are something that
we should start to work on more once we have things very close to finalized.


Another comment is that I’ve seen people using the term “normative” in relation to the schemas. I used to think the schemas would be normative too but was convinced otherwise. Schemas should be informative…that way you can resolve disagreements between
the schemas and the text specifications in favor of the text specifications and ensure consistency across all of the serializations (MTI and otherwise). This is how MITRE has done other specs as well, and is how TAXII 1.1’s XML Binding Specification is written.


John








From: < cti@lists.oasis-open.org > on behalf of Aharon Chernin < achernin@soltra.com >
Date: Sunday, April 10, 2016 at 9:35 AM
To: Patrick Maroney < Pmaroney@Specere.org >, OASIS CTI TC Discussion List < cti@lists.oasis-open.org >
Subject: Re: [cti] RFI & Motion: JSON MTI & JSON Schemas







Pat,


In my opinion, STIX 2 and CybOX 2 are in too much flux to focus on their schema implementations. However, I would always encourage the community to work on schemas implementations early in the process if the would like to donate the man hours to the group.


More points towards our lack of focus on schema representation at this point:
*) We have not reached consensus on the definition of what an “observation” is, and several other frequently used high level objects, in STIX 2. An email went out from John Wunder on Thursday to the STIX TC asking for comments on both the definition of
a few of the STIX high level objects and how they work together in the STIX 2 pre-draft specs. The response to this would be a good gauge to our closeness on consensus. 
*) A word of caution. STIX TC members wishing to invest the hours to build JSON schema implementations at this time risk large changes in the spec until we reach pre-draft consensus.   
*) I think the community is in alignment that a JSON schema should be made based on the agreed STIX 2 specification. I also think it is acceptable to get JSON schema availability timing based on STIX 2 draft specifications when they are available.


Aharon









From: < cti@lists.oasis-open.org > on behalf of Patrick Maroney < Pmaroney@Specere.org >
Date: Saturday, April 9, 2016 at 4:20 PM
To: OASIS CTI TC Discussion List < cti@lists.oasis-open.org >
Subject: [cti] RFI & Motion: JSON MTI & JSON Schemas





Obviously, the STIX and CybOX specifications are still very much under development.  However, I'm unable to locate any notional/draft JSON Schemas for STIX or CybOX on GitHub, OASIS Document libraries, or Slack Channel. The fact that there are only 6 posts
in the 10,000's of Slack Channels/postings that even contain the word "schema" would indicate that there is no current focus on JSON Schemas.


(1) Do these exist anywhere within the known CTI TC document locations? If so, where?
(2) Do these exist anywhere in CTI TC member locations (e.g. GitHub)? If so, where?
(3) If not what is the current road map (with estimated target dates) for their creation as part of the JSON MTI?


Hopefully we have CTI TC consensus that the inclusion of normative JSON Schemas for the OASIS CTI TC Committee Specifications and Standards are critical to our success in many endeavors.  


To quickly and formally establish if this consensus exists, I submit the following motion to the CTI TC:


Motion: "I move that the inclusion of normative JSON Schemas in all OASIS CTI TC Committee Specifications and Standards based on a JSON MTI are critical to our success and are therefore mandatory deliverables".


Of particular immediate concern as one of the CTI TC Interoperability SC cochairs ( and basis for formally raising this topic today ) relates to the substantive technical body of work that is required to develop normative Interoperability and
Conformance Documentation, Use Cases/Scenarios, Test Suites, Test Descriptor, Tools, and CTI Interoperability Testing services.



These CTI Interoperability efforts require a significant amount of planning and coordination.  The road map and target dates for the delivery of the draft JSON Schemas by the STIX and CybOX SCs represent critical dependencies  and potential high risk blocking
milestones.


Note:  I created the "json-mti-schema" Slack Channel for advancing the planning and related discourse on the specific topic of CTI TC JSON schemas (and coordination of delivery of same)

Patrick Maroney
President
Integrated Networking Technologies, Inc.
Desk:
(856)983-0001
Cell:
(609)841-5104
Email:
pmaroney@specere.org

I agree that things are too much in flux to have JSON schemas at the moment – I am confident the CTI TC will cross that bridge soon. Really, once we figure out the normative specification, the JSON schema is a straightforward mapping. When writing TAXII
1.x it was the same – the TAXII Services Spec (where messages, message fields, and their meanings are defined) took up the bulk of the work effort and the XML binding was fairly straightforward. Schemas IMO are an informative piece of technical material that
are supplied along with the normative texts to make them easier to write code against (much like a software library could be supplied).


Thank you.
-Mark








From: < cti@lists.oasis-open.org > on behalf of "Wunder, John A." < jwunder@mitre.org >
Date: Monday, April 11, 2016 at 7:23 AM
To: Aharon Chernin < achernin@soltra.com >, Patrick Maroney < Pmaroney@Specere.org >, OASIS CTI TC Discussion List < cti@lists.oasis-open.org >
Subject: Re: [cti] RFI & Motion: JSON MTI & JSON Schemas






I’ve spent a little bit of time working on these and have a version in my personal repo:  http://github.com/johnwunder/stix2.0 . Rich Piazza also converted over the old idioms from the STIX 1.2 github.io
site.


As Aharon said, though, things are still in so much flux that it doesn’t really make a lot of sense to keep them in sync with the text specs. I would make a change and a day later someone would suggest something different. IMO these are something that
we should start to work on more once we have things very close to finalized.


Another comment is that I’ve seen people using the term “normative” in relation to the schemas. I used to think the schemas would be normative too but was convinced otherwise. Schemas should be informative…that way you can resolve disagreements between
the schemas and the text specifications in favor of the text specifications and ensure consistency across all of the serializations (MTI and otherwise). This is how MITRE has done other specs as well, and is how TAXII 1.1’s XML Binding Specification is written.


John








From: < cti@lists.oasis-open.org > on behalf of Aharon Chernin < achernin@soltra.com >
Date: Sunday, April 10, 2016 at 9:35 AM
To: Patrick Maroney < Pmaroney@Specere.org >, OASIS CTI TC Discussion List < cti@lists.oasis-open.org >
Subject: Re: [cti] RFI & Motion: JSON MTI & JSON Schemas







Pat,


In my opinion, STIX 2 and CybOX 2 are in too much flux to focus on their schema implementations. However, I would always encourage the community to work on schemas implementations early in the process if the would like to donate the man hours to the group.


More points towards our lack of focus on schema representation at this point:
*) We have not reached consensus on the definition of what an “observation” is, and several other frequently used high level objects, in STIX 2. An email went out from John Wunder on Thursday to the STIX TC asking for comments on both the definition of
a few of the STIX high level objects and how they work together in the STIX 2 pre-draft specs. The response to this would be a good gauge to our closeness on consensus. 
*) A word of caution. STIX TC members wishing to invest the hours to build JSON schema implementations at this time risk large changes in the spec until we reach pre-draft consensus.   
*) I think the community is in alignment that a JSON schema should be made based on the agreed STIX 2 specification. I also think it is acceptable to get JSON schema availability timing based on STIX 2 draft specifications when they are available.


Aharon









From: < cti@lists.oasis-open.org > on behalf of Patrick Maroney < Pmaroney@Specere.org >
Date: Saturday, April 9, 2016 at 4:20 PM
To: OASIS CTI TC Discussion List < cti@lists.oasis-open.org >
Subject: [cti] RFI & Motion: JSON MTI & JSON Schemas





Obviously, the STIX and CybOX specifications are still very much under development.  However, I'm unable to locate any notional/draft JSON Schemas for STIX or CybOX on GitHub, OASIS Document libraries, or Slack Channel. The fact that there are only 6 posts
in the 10,000's of Slack Channels/postings that even contain the word "schema" would indicate that there is no current focus on JSON Schemas.


(1) Do these exist anywhere within the known CTI TC document locations? If so, where?
(2) Do these exist anywhere in CTI TC member locations (e.g. GitHub)? If so, where?
(3) If not what is the current road map (with estimated target dates) for their creation as part of the JSON MTI?


Hopefully we have CTI TC consensus that the inclusion of normative JSON Schemas for the OASIS CTI TC Committee Specifications and Standards are critical to our success in many endeavors.  


To quickly and formally establish if this consensus exists, I submit the following motion to the CTI TC:


Motion: "I move that the inclusion of normative JSON Schemas in all OASIS CTI TC Committee Specifications and Standards based on a JSON MTI are critical to our success and are therefore mandatory deliverables".


Of particular immediate concern as one of the CTI TC Interoperability SC cochairs ( and basis for formally raising this topic today ) relates to the substantive technical body of work that is required to develop normative Interoperability and
Conformance Documentation, Use Cases/Scenarios, Test Suites, Test Descriptor, Tools, and CTI Interoperability Testing services.



These CTI Interoperability efforts require a significant amount of planning and coordination.  The road map and target dates for the delivery of the draft JSON Schemas by the STIX and CybOX SCs represent critical dependencies  and potential high risk blocking
milestones.


Note:  I created the "json-mti-schema" Slack Channel for advancing the planning and related discourse on the specific topic of CTI TC JSON schemas (and coordination of delivery of same)

Patrick Maroney
President
Integrated Networking Technologies, Inc.
Desk:
(856)983-0001
Cell:
(609)841-5104
Email:
pmaroney@specere.org

Wunder, John A. wrote this message on Mon, Apr 11, 2016 at 11:23 +0000: > Another comment is that I’ve seen people using the term “normative” in relation to the schemas. I used to think the schemas would be normative too but was convinced otherwise. Schemas should be informative…that way you can resolve disagreements between the schemas and the text specifications in favor of the text specifications and ensure consistency across all of the serializations (MTI and otherwise). This is how MITRE has done other specs as well, and is how TAXII 1.1’s XML Binding Specification is written. I agree, the spec is the only normative definition. The schema helps validate adherence to the spec, but the schema should not be considered normative.. It is possible that the schema cannot be as strict as the specification says, so therefore the specification must be the final arbiter.. -- John-Mark

I agree - but I would also propose that we do not vote on a normative spec, until there is an affiliated schema artifact attached, regardless of if that artifact is classified as informative or not. We need to make sure that the normative text is practical and implementable. Without a spec showing how to implement the text, we have a large possibility of future problems. IE - a JSON Schema should be a pre-requisite of voting on the specification. - Jason Keirstead STSM, Product Architect, Security Intelligence, IBM Security Systems www.ibm.com/security www.securityintelligence.com Without data, all you are is just another person with an opinion - Unknown John-Mark Gurney ---04/12/2016 01:14:38 PM---Wunder, John A. wrote this message on Mon, Apr 11, 2016 at 11:23 +0000: > Another comment is that I’ From: John-Mark Gurney <jmg@newcontext.com> To: "Wunder, John A." <jwunder@mitre.org> Cc: Aharon Chernin <achernin@soltra.com>, Patrick Maroney <Pmaroney@Specere.org>, OASIS CTI TC Discussion List <cti@lists.oasis-open.org> Date: 04/12/2016 01:14 PM Subject: Re: [cti] RFI & Motion: JSON MTI & JSON Schemas Sent by: <cti@lists.oasis-open.org> Wunder, John A. wrote this message on Mon, Apr 11, 2016 at 11:23 +0000: > Another comment is that I’ve seen people using the term “normative” in relation to the schemas. I used to think the schemas would be normative too but was convinced otherwise. Schemas should be informative…that way you can resolve disagreements between the schemas and the text specifications in favor of the text specifications and ensure consistency across all of the serializations (MTI and otherwise). This is how MITRE has done other specs as well, and is how TAXII 1.1’s XML Binding Specification is written. I agree, the spec is the only normative definition.  The schema helps validate adherence to the spec, but the schema should not be considered normative..  It is possible that the schema cannot be as strict as the specification says, so therefore the specification must be the final arbiter.. -- John-Mark --------------------------------------------------------------------- To unsubscribe from this mail list, you must leave the OASIS TC that generates this mail.  Follow this link to all your TCs in OASIS at: https://www.oasis-open.org/apps/org/workgroup/portal/my_workgroups.php