CTI STIX Subcommittee

Hi All, While reading the STIX 2.0 document, I would like to share with you a current issue we have with large set of STIX objects or packages (v1.1). Large objects are becoming more common in threatintel sharing platforms. We have seen a significant grow in the MISP instances that we know about of indicators or additional information like malware samples. The section 7. mentions the use of bundle which improves the situation while exchanging over non-TAXII interfaces. It's indeed an improvement but we saw many limitations with current JSON parsers which are often non-stream based and load the whole JSON structure in memory. Could we extend the use of bundle to have a simple MANIFEST file approach where the STIX objects are only referenced in the bundle without adding the full object by itself? This would avoid the parsing of the full JSON object and having a simple way to create bundle in packages (like ZIP, tar.gz...) with each STIX objects as file. Thank you very much. Cheers. PS: Also, we would be very interested on hearing about best-practices when it comes to sharing large datasets in STIX 1.1/1.2. -- Alexandre Dulaunoy CIRCL - Computer Incident Response Center Luxembourg 41, avenue de la gare L-1611 Luxembourg info@circl.lu - www.circl.lu

Hi Alexandre – I agree and had advocated for a similar approach as you suggest natively in STIX too. That is, having a manifest concept in STIX files. Regarding best practices. Creating a manifest files and a set of ‘bundled’ files was how we dealt with the large content issue in our products. The content was JSON just not STIX. The response from the community in the past has been that the manifest approach is better served by the transport mechanism such as TAXII. I’m not sure I agree with that answer but have decided that its easier to just create a custom top-level object for the manifest concept and then use that mechanism. Its not ideal as its not a standard approach but it would work for sharing across products that do need to have a similar mechanism. allan On 8/18/16, 11:55 PM, "cti-stix@lists.oasis-open.org on behalf of Alexandre Dulaunoy" <cti-stix@lists.oasis-open.org on behalf of Alexandre.Dulaunoy@circl.lu> wrote: Hi All, While reading the STIX 2.0 document, I would like to share with you a current issue we have with large set of STIX objects or packages (v1.1). Large objects are becoming more common in threatintel sharing platforms. We have seen a significant grow in the MISP instances that we know about of indicators or additional information like malware samples. The section 7. mentions the use of bundle which improves the situation while exchanging over non-TAXII interfaces. It's indeed an improvement but we saw many limitations with current JSON parsers which are often non-stream based and load the whole JSON structure in memory. Could we extend the use of bundle to have a simple MANIFEST file approach where the STIX objects are only referenced in the bundle without adding the full object by itself? This would avoid the parsing of the full JSON object and having a simple way to create bundle in packages (like ZIP, tar.gz...) with each STIX objects as file. Thank you very much. Cheers. PS: Also, we would be very interested on hearing about best-practices when it comes to sharing large datasets in STIX 1.1/1.2. -- Alexandre Dulaunoy CIRCL - Computer Incident Response Center Luxembourg 41, avenue de la gare L-1611 Luxembourg info@circl.lu - www.circl.lu --------------------------------------------------------------------- To unsubscribe from this mail list, you must leave the OASIS TC that generates this mail. Follow this link to all your TCs in OASIS at: https://www.oasis-open.org/apps/org/workgroup/portal/my_workgroups.php

Can you put together a proposal for what this would need to look like / how it should work?  I am sure we can easily do this / add this for 2.1. Thanks, Bret Bret Jordan CISSP Director of Security Architecture and Standards Office of the CTO Blue Coat Systems PGP Fingerprint: 63B4 FC53 680A 6B7D 1447  F2C0 74F8 ACAE 7415 0050 Without cryptography vihv vivc ce xhrnrw, however, the only thing that can not be unscrambled is an egg.   On Aug 19, 2016, at 00:55, Alexandre Dulaunoy < Alexandre.Dulaunoy@circl.lu > wrote: Hi All, While reading the STIX 2.0 document, I would like to share with you a current issue we have with large set of STIX objects or packages (v1.1). Large objects are becoming more common in threatintel sharing platforms. We have seen a significant grow in the MISP instances that we know about of indicators or additional information like malware samples. The section 7. mentions the use of bundle which improves the situation while exchanging over non-TAXII interfaces. It's indeed an improvement but we saw many limitations with current JSON parsers which are often non-stream based and load the whole JSON structure in memory. Could we extend the use of bundle to have a simple MANIFEST file approach where the STIX objects are only referenced in the bundle without adding the full object by itself? This would avoid the parsing of the full JSON object and having a simple way to create bundle in packages (like ZIP, tar.gz...) with each STIX objects as file. Thank you very much. Cheers. PS: Also, we would be very interested on hearing about best-practices when it comes to sharing large datasets in STIX 1.1/1.2. -- Alexandre Dulaunoy CIRCL - Computer Incident Response Center Luxembourg 41, avenue de la gare L-1611 Luxembourg info@circl.lu - www.circl.lu --------------------------------------------------------------------- To unsubscribe from this mail list, you must leave the OASIS TC that generates this mail.  Follow this link to all your TCs in OASIS at: https://www.oasis-open.org/apps/org/workgroup/portal/my_workgroups.php Attachment: signature.asc Description: Message signed with OpenPGP using GPGMail