Re: [cti] Working Call - This week

Marlon,

The attached package is a sighting, including an observation. It’s my best understanding of where we landed after the F2F last week…I called the CybOX container “cybox-container” based on what they called it in CybOX, name is very much up in the air.

John

From: <> on behalf of Marlon Taylor <>

Date: Monday, April 25, 2016 at 8:00 AM

To: "Jordan, Bret" <>, "" <>

Subject: RE: [cti] Working Call - This week

Hi Bret,

Would you attach a snippet of an observation and sighting so others can review before the call?

Thanks,

-Marlon

 

From: 
 on behalf of Jordan, Bret

Sent: Saturday, April 23, 2016 6:53:36 PM

To: 

Subject: [cti] Working Call - This week

Here is the start of an agenda for this weeks working call.  Please send us your suggestions and updates. 

Status Updates - 5 minutes

1) Slack - Archiving the sightings and versioning channels

2) Vendor Defined Objects - Update, call for review

3) Observations (new name??) and Sightings - please review and make sure it will work

Working Session - 45 minutes

4) TTPs as a whole - need mini-group to help finish this

a) What to do with Kill-Chain and Kill-Chain-Phase TLOs

b) Can we merge Malicious Tool and Malware and just have a boolean flag to distinguish them

5) Can we remove the Common Types (Impact and Statement)

6) Rename STIX Package

7) Exploit Targets as a whole

Week Ahead - 5 minutes
8) General call for other new mini-groups?

9) Update on i18n

Thanks,

Bret

Bret Jordan CISSP

Director of Security Architecture and Standards | Office of the CTO

Blue Coat Systems

PGP Fingerprint: 63B4 FC53 680A 6B7D 1447  F2C0 74F8 ACAE 7415 0050

"Without cryptography vihv vivc ce xhrnrw, however, the only thing that can not be unscrambled is an egg." 

Attachment:
sighting.json

Description: sighting.json