Please correct an error in https://stixproject.github.io/about/ , "About STIX"

Dear CTI Comment Authorities,

I would like to point out a somewhat confusing error in one of your documents:

In the document:

"About STIX"
URL: https://stixproject.github.io/about/

The second opening paragraph states:

***********************************************************************************************************************

The STIX whitepaper describes the motivation and architecture behind STIX. At a high level the STIX language consists of 9 key constructs and the relationships between them:                                                                                                                                                                     [I think this should be "8 key constructs"]

************************************************************************************************************************

You list the following 8 constructs, rather than 9, therefore I think the above should say "8 constructs"

*Observables describe what has been or might be seen in cyber
*Indicators describe patterns for what might be seen and what they mean if they are
*Incidents describe instances of specific adversary actions
*Adversary Tactics, Techniques, and Procedures describe attack patterns, malware, exploits, kill chains, tools, infrastructure, victim targeting, and other methods used by the adversary
*Exploit Targets describe vulnerabilities, weaknesses, or configurations that might be exploited
*Courses of Action describe response actions that may be taken in response to an attack or as a preventative measure
*Campaigns describe sets of incidents and/or TTPs with a shared intent
*Threat Actors describe identification and/or characterization of the adversary

However, I only count 8 key constructs rather than 9.


V/R,


Alan Peltzman, CISSP, IT Specialist (INFOSEC)
DISA/RME/RE11
717-267-9953, DSN: 570-9953


Tuesday, 13 June 2017