OASIS Cyber Threat Intelligence (CTI) TC

I wanted to share the most recent draft of the Incident property extension that DC3 has put together both as a JSON Schema and the initial draft of the Word version of it. Currently this is primarily the product of DC3 and the USG, but I was hoping that there is enough community interest in the TC to ensure that this isn't just a DC3 core incident extension, but instead a generic one for the entire community. Please let me know if there is any interest in discussing this on a working call. //SIGNED// Jeffrey Mates, Civ DC3/TSD Computer Scientist Technical Solutions Development jeffrey.mates@dc3.mil 410-694-4335 Attachment: Incident Core Extension.docx Description: application/vnd.openxmlformats-officedocument.wordprocessingml.document Attachment: incident_core.json Description: application/json Attachment: smime.p7s Description: S/MIME cryptographic signature

Jeffrey: Great work. Thanks for submitting this. I think a number of folks from the TAC TC would be interested in working on this with you. Interest registered. Jane Ginn On 8/19/2021 9:00 AM, Mates, Jeffrey CIV DC3/TSD wrote: I wanted to share the most recent draft of the Incident property extension that DC3 has put together both as a JSON Schema and the initial draft of the Word version of it. Currently this is primarily the product of DC3 and the USG, but I was hoping that there is enough community interest in the TC to ensure that this isn't just a DC3 core incident extension, but instead a generic one for the entire community. Please let me know if there is any interest in discussing this on a working call. //SIGNED// Jeffrey Mates, Civ DC3/TSD Computer Scientist Technical Solutions Development jeffrey.mates@dc3.mil 410-694-4335 -- ********************************** R. Jane Ginn, MSIA, MRP OASIS, CTI TC Secretary OASIS, TAC TC Secretary jg@ctin.us **********************************

Thanks Jane, I wasn t tracking that TC so I will reach out.   //SIGNED//   Jeffrey Mates, Civ DC3/TSD Computer Scientist Technical Solutions Development jeffrey.mates@dc3.mil 410-694-4335   From: cti@lists.oasis-open.org <cti@lists.oasis-open.org> On Behalf Of JG @ OASIS Sent: Monday, August 23, 2021 7:42 PM To: cti@lists.oasis-open.org Subject: [Non-DoD Source] Re: [cti] STIX Incident Extension - Subgroup or Working Sessions?   All active links contained in this email were disabled. Please verify the identity of the sender, and confirm the authenticity of all links contained within the message prior to copying and pasting the address to a Web browser.   Jeffrey: Great work.  Thanks for submitting this.  I think a number of folks from the TAC TC would be interested in working on this with you. Interest registered.   Jane Ginn     On 8/19/2021 9:00 AM, Mates, Jeffrey CIV DC3/TSD wrote: I wanted to share the most recent draft of the Incident property extension that DC3 has put together both as a JSON Schema and the initial draft of the Word version of it. Currently this is primarily the product of DC3 and the USG, but I was hoping that there is enough community interest in the TC to ensure that this isn't just a DC3 core incident extension, but instead a generic one for the entire community.Please let me know if there is any interest in discussing this on a working call.//SIGNED//Jeffrey Mates, Civ DC3/TSDComputer ScientistTechnical Solutions Developmentjeffrey.mates@dc3.mil < Caution-mailto:jeffrey.mates@dc3.mil > 410-694-4335 -- **********************************R. Jane Ginn, MSIA, MRPOASIS, CTI TC SecretaryOASIS, TAC TC Secretaryjg@ctin.us < Caution-mailto:jg@ctin.us > ********************************** Attachment: smime.p7s Description: S/MIME cryptographic signature

Dear all, we are interested in contributing to this subgroup if you create it.   Kind regards, Alexandre CABROL PERALES Cybersecurity Division – Managed Security Services Agency Director Sopra-Steria - B t. EOLIS 2 - Parc Saint-Exupéry 8 avenue Yves Brunaud BP 90133 31772 Colomiers Cedex – France Phone : +33 (0)5 34 35 00 00 - Mobile: +33 (0)6 77 72 47 75 alexandre.cabrol@soprasteria.com – www.soprasteria.com Phone : +33 (0)5 34 35 00 00 - Mobile: +33 (0)6 77 72 47 75 alexandre.cabrol@soprasteria.com  –  www.soprasteria.com         C2 – Usage restreint From: cti@lists.oasis-open.org <cti@lists.oasis-open.org> On Behalf Of JG @ OASIS Sent: mardi 24 août 2021 01:42 To: cti@lists.oasis-open.org Subject: Re: [cti] STIX Incident Extension - Subgroup or Working Sessions?   Jeffrey: Great work.  Thanks for submitting this.  I think a number of folks from the TAC TC would be interested in working on this with you. Interest registered.   Jane Ginn     On 8/19/2021 9:00 AM, Mates, Jeffrey CIV DC3/TSD wrote: I wanted to share the most recent draft of the Incident property extension that DC3 has put together both as a JSON Schema and the initial draft of the Word version of it.  Currently this is primarily the product of DC3 and the USG, but I was hoping that there is enough community interest in the TC to ensure that this isn't just a DC3 core incident extension, but instead a generic one for the entire community.   Please let me know if there is any interest in discussing this on a working call.   //SIGNED//   Jeffrey Mates, Civ DC3/TSD Computer Scientist Technical Solutions Development jeffrey.mates@dc3.mil 410-694-4335   -- ********************************** R. Jane Ginn, MSIA, MRP OASIS, CTI TC Secretary OASIS, TAC TC Secretary jg@ctin.us **********************************