CTI STIX Subcommittee

I would like to submit the following two minor proposals for 2.1... - The addition of a " software_ref " property to the " Process " cyber observable object. This would allow one to encode what piece of software a given process is for (which you can then tie to CPE and do many things with) - A defined relationship type of " vulnerable_to " to be added from observed_data to vulnerability . This would allow you to say that a given process, system, or software was vulnerable to a certain vulnerability. - Jason Keirstead Lead Architect - IBM.Security www.ibm.com/security "Things may come to those who wait, but only the things left by those who hustle." - Unknown

How would we handle if the field has more than one input? For example the software_ref could be multiple version of windows or multiple favors of Linux. Best Regards, Nicholas Hayden, CISSP, GICSP, Sec+ Senior Director of Threat Intelligence anomali.com 808 Winslow St Redwood City, CA 94063 Phone: (650) 257-0867 Twitter: @anomali On Sep 28, 2018, 7:48 PM -0400, Jason Keirstead <Jason.Keirstead@ca.ibm.com>, wrote: I would like to submit the following two minor proposals for 2.1... - The addition of a software_ref property to the Process cyber observable object. This would allow one to encode what piece of software a given process is for (which you can then tie to CPE and do many things with) - A defined relationship type of vulnerable_to to be added from observed_data to vulnerability . This would allow you to say that a given process, system, or software was vulnerable to a certain vulnerability. - Jason Keirstead Lead Architect - IBM.Security www.ibm.com/security Things may come to those who wait, but only the things left by those who hustle. - Unknown

A given process instance in an observable
can't be running in multiple versions of windows at the same time though... - Jason Keirstead Lead Architect - IBM.Security www.ibm.com/security "Things may come to those who wait, but only the things left by those
who hustle." - Unknown From:      
  Nicholas Hayden <nhayden@anomali.com> To:      
  cti-stix@lists.oasis-open.org,
Jason Keirstead <Jason.Keirstead@ca.ibm.com> Date:      
  10/01/2018 10:10 AM Subject:    
    Re: [cti-stix]
Two Minor 2.1 STIX Proposals Sent by:    
    <cti-stix@lists.oasis-open.org> How would we handle if the field has more than one input?
For example the software_ref could be multiple version of windows or
multiple favors of Linux. Best Regards, Nicholas Hayden, CISSP, GICSP, Sec+ Senior Director of Threat Intelligence anomali.com 808 Winslow St Redwood City, CA 94063 Phone: (650) 257-0867 Twitter: @anomali On Sep 28, 2018, 7:48 PM -0400, Jason Keirstead <Jason.Keirstead@ca.ibm.com>,
wrote: I would like to submit the following
two minor proposals for 2.1... - The addition of a " software_ref " property to the " Process "
cyber observable object. This would allow one to encode what piece of software
a given process is for (which you can then tie to CPE and do many things
with) - A defined relationship type of " vulnerable_to " to be
added from observed_data to vulnerability . This would allow
you to say that a given process, system, or software was vulnerable to
a certain vulnerability. - Jason Keirstead Lead Architect - IBM.Security www.ibm.com/security "Things may come to those who wait, but only the things left by those
who hustle." - Unknown

Hey, Jason - I think your suggestions are entirely sensible. They add semantic value, are trivial to implement, and don't break anything in the specs. Unless someone voices a substantive suggestion, I move that we incorporate your suggestions in the next STIX CSD. Cheers, Trey On 28.09.2018 20:48:34, Jason Keirstead wrote: > I would like to submit the following two minor proposals for 2.1... > > - The addition of a "software_ref" property to the "Process" cyber > observable object. This would allow one to encode what piece of software a > given process is for (which you can then tie to CPE and do many things > with) > > - A defined relationship type of "vulnerable_to" to be added from > observed_data to vulnerability. This would allow you to say that a given > process, system, or software was vulnerable to a certain vulnerability. > > - > Jason Keirstead > Lead Architect - IBM.Security > www.ibm.com/security > > "Things may come to those who wait, but only the things left by those who > hustle." - Unknown > > -- ++--------------------------------------------------------------------------++ Director of Standards Development, New Context gpg fingerprint: 3918 9D7E 50F5 088F 823F 018A 831A 270A 6C4F C338 ++--------------------------------------------------------------------------++ -- "No campaign plan survives first contact with the enemy." --Helmuth Graf von Moltke Attachment: signature.asc Description: PGP signature