Re: STIX Confidence proposal nearing completion

After reviewing this, I think we should actually have a call to go through the mappings.  I do not think they are yet ready for prime time.

Bret

From:  <> on behalf of Sarah Kelley <>

Sent: Monday, February 27, 2017 9:49:17 AM

To: 

Subject: [cti] STIX Confidence proposal nearing completion 

 

All,

 

We feel that we have reached a general consensus on the approach for confidence. In following with the procedure outlined in the CTI meeting last Thursday, we are bringing this topic to the
 list for any other changes and comments. 

 

If you haven’t had a chance to review it yet, the proposal is located here:

https://docs.google.com/document/d/15qD9KBQcVcY4FlG9n_VGhqacaeiLlNcQ7zVEjc8I3b4/edit#heading=h.th8nitr8jb4k

 

 

A summary of the approach:

 

An optional confidence property will be added to each SDO. This confidence value indicates the producer’s confidence in the correctness of their data. Confidence
MUST be an integer value in the range 0-100. An appendix will be provided that contains normative mappings to other scales like low/med/high, 0-10, Words of Estimative Probability (WEP), and Admiralty credibility. These mappings
MUST be used if any scale not 0-100 is used. 

 

If you have not had a chance to review the proposal, please do so before Wednesday March 1st. At that point, we will be moving confidence into the STIX 2.1 spec. While this does
 not mean that additional changes cannot be made, we would prefer to make any major revisions before the proposal goes into the working 2.1 specification.

 

Thanks, 

 

Sarah Kelley

Senior Cyber Threat Analyst

Center for Internet Security (CIS)

Integrated Intelligence Center (IIC)

Multi-State Information Sharing and Analysis Center (MS-ISAC)

1-866-787-4722 (7×24 SOC)

Email: 

www.cisecurity.org

Follow us @CISecurity

 

This message and attachments may contain confidential information. If it appears that this message was sent to you by mistake, any retention, dissemination, distribution or copying of this message and attachments is strictly prohibited. Please notify the sender
 immediately and permanently delete the message and any attachments. 
. . .