OASIS Cyber Threat Intelligence (CTI) TC

 View Only

STIX Sightings & Semantic Equivalence

  • 1.  STIX Sightings & Semantic Equivalence

    Posted 09-19-2018 13:34




    All,

     

    On behalf of our work for DHS, we ve been working on some studies and white papers on several topics related to the application and use of STIX 2.x data. Accordingly, we d like to share with you today two white papers that have come
    out of this work: one that covers the use (including prescriptive guidance) of sightings in a STIX/TAXII ecosystem [1] and another on calculating semantic equivalence (addressing the question of whether two STIX objects are similar but not identical) between
    STIX SDOs [2] and the use cases that this addresses.

     

    MITRE and our DHS sponsor consider these to be important topics that are relevant to the use of STIX 2.x today and going forward. As such, we d welcome any feedback or input you may have please feel free to add comments directly
    to the Google Docs.

     

    [1]   https://docs.google.com/document/d/1zPqKX9LY8wB9Prj_aua0iD505ti6k7jY5PWLwEd731U/edit?usp=sharing

    [2]   https://docs.google.com/document/d/1QWgCi2HkVXFje5T3p8hxxVij8zb2eKEcciKZmeIQXjg/edit?usp=sharing

     

    Regards,

    Ivan Kirillov
    MITRE