← Prev in month
← Prev in thread
Next in thread →
Next in month →
STIX COA mini group call 5/8/2017 - meeting minutes
Hi,
Below are the consolidated notes from the meeting today. Please chime in if I captured something incorrectly. Also, please let me know if I missed your attendance.
Participants
Jyoti Verma, Sam Zargar, Allan Thomson, Ben Sooter, Bret Jordan, Gary, John-Mark, John Wunder, Sourabh Satish, Henry, Jefferey Mates, Duncan Sparrel, Nicolas
Minutes:
We went over the use case that Jeff shared and started building out the COA object using the example
We should also have post conditions (on_success, on_failure) along with preconditions (requires_success, requires_failure) - Allan
The action details could be captured in a property of it own eg. "openc2" and this could be a blob - Bret
No need for a "type" attribute to capture the action type - John–Mark
We could represent the action in cybox observable style - John–Mark
The “start_index” field could capture which action to start with
We went over different options for linking the different actions as called out below
Open Questions and Options to think about (thanks Bret):
Should linkages between atomic COA elements be linked with an 'integer' or should they be linked via a text `string`?
Should the atomic COA elements look like STIX elements or Cyber Observable elements? Namely, should the name/id be inside the object or should it be a map
Option 1: using id to map the linkage - STIX style
{
"type": "course-of-action",
"id": "course-of-action--8e2e2d2b-17d4-4cbf-938f-98ee46b3cd3f",
"created_by_ref": "identity--f431f809-377b-45e0-aa1c-6a4751cae5ff",
"created": "2016-04-06T20:03:48.000Z",
"modified": "2016-04-06T20:03:48.000Z",
"name": "Some top level name for the COA",
"description": "Some top level description for the COA".
"actions": [
{
"action_id": 1,
"name": "name of COA action",
"description": "some description or human course of action",
"on_success": [2],
"on_failure": [3],
"requires_success": [],
"requires_failure": [],
"openc2": "some openc2 command"
},
{
"action_id": 2,
"name": "name of COA action",
"description": "some description or human course of action",
"on_success": [4],
"on_failure": [3],
"requires_success": [1],
"requires_failure": [],
"openc2": "some openc2 command"
}
]
}
Option 2 : using names to map the linkage – STIX style
{
"type": "course-of-action",
"id": "course-of-action--8e2e2d2b-17d4-4cbf-938f-98ee46b3cd3f",
"created_by_ref": "identity--f431f809-377b-45e0-aa1c-6a4751cae5ff",
"created": "2016-04-06T20:03:48.000Z",
"modified": "2016-04-06T20:03:48.000Z",
"name": "Some top level name for the COA",
"description": "Some top level description for the COA".
"actions": [
{
"name": "some name 1",
"description": "some description or human course of action",
"on_success": ["some name 2"],
"on_failure": ["some name 3"],
"requires_success": [],
"requires_failure": [],
"openc2": "some openc2 command"
},
{
"name": "some name 2",
"description": "some description or human course of action",
"on_success": ["some name 4"],
"on_failure": ["some name 3"],
"requires_success": ["some name 1"],
"requires_failure": [],
"openc2": "some openc2 command"
}
]
}
Another thing we talked about was how to have the keys be determined. The two examples above are in STIX like style. The next two are Cyber Observable style
Option 3: using id to map the linkage - Cyber Observable style
{
"type": "course-of-action",
"id": "course-of-action--8e2e2d2b-17d4-4cbf-938f-98ee46b3cd3f",
"created_by_ref": "identity--f431f809-377b-45e0-aa1c-6a4751cae5ff",
"created": "2016-04-06T20:03:48.000Z",
"modified": "2016-04-06T20:03:48.000Z",
"name": "Some top level name for the COA",
"description": "Some top level description for the COA".
"actions": {
"1": {
"name": "name of COA action",
"description": "some description or human course of action",
"on_success": [2],
"on_failure": [3],
"requires_success": [],
"requires_failure": [],
"openc2": "some openc2 command"
},
"2": {
"name": "name of COA action",
"description": "some description or human course of action",
"on_success": [4],
"on_failure": [3],
"requires_success": [1],
"requires_failure": [],
"openc2": "some openc2 command"
}
}
}
Option 4: using names to map the linkage - Cyber observable style
{
"type": "course-of-action",
"id": "course-of-action--8e2e2d2b-17d4-4cbf-938f-98ee46b3cd3f",
"created_by_ref": "identity--f431f809-377b-45e0-aa1c-6a4751cae5ff",
"created": "2016-04-06T20:03:48.000Z",
"modified": "2016-04-06T20:03:48.000Z",
"name": "Some top level name for the COA",
"description": "Some top level description for the COA".
"actions": {
"some name 1": {
"description": "some description or human course of action",
"on_success": ["some name 2"],
"on_failure": ["some name 3"],
"requires_success": [],
"requires_failure": [],
"openc2": "some openc2 command"
},
"some name 2": {
"description": "some description or human course of action",
"on_success": ["some name 4"],
"on_failure": ["some name 3"],
"requires_success": ["some name 1"],
"requires_failure": [],
"openc2": "some openc2 command"
}
}
}
Agenda for next meeting:
Identify the option that will work for most use cases
Go over Sarah’s use cases
Discuss topics that didn’t get covered this time around
Define relationship types for COAs
Should the STIX COA support time based sequencing?
Topics for F2F
Thanks,
Jyoti
Technical Leader
Office of the CTO, Security Business Group, Cisco Systems
From: <> on behalf of OASIS Open <>
Date: Friday, May 5, 2017 at 10:43 AM
To: <>
Subject: [cti] STIX COA mini group call
Submitter's message
Follow on call for STIX COA
-- Ms. Jyoti Verma
Event Title:
STIX COA mini group call
Date: Monday, 08 May 2017, 12:00pm to 01:00pm PDT
Location: Webex
Description
STIX COA working group follow on call
Join WebEx meeting
Meeting number: 208 034 411
Meeting password: tecePfxH (83237394 from phones)
Join from a video conferencing system or application
Dial
From the Cisco internal network, dial *267* and the 9-digit meeting number. If you are the host, enter your PIN when prompted.
If you are a host,
go here to view host information.
Join by phone
+1-866-432-9903 Call-in toll-free number (US/Canada)
+1-408-525-6800 Call-in toll number (US/Canada)
Access code: 208 034 411
Global call-in numbers | Toll-free
calling restrictions
Can't join the meeting?
Contact support.
IMPORTANT NOTICE: Please note that this WebEx service allows audio and other information sent during the session to be recorded, which may be discoverable in a legal matter. By joining this session,
you automatically consent to such recordings. If you do not consent to being recorded, discuss your concerns with the host or do not join the session..
Agenda
Agenda:
Discuss use cases
Define relationship types for COAs
Should the STIX COA support time based sequencing?
How should STIX COA work with and make use of automated actions like OpenC2?
Topics for F2F
Owner: Ms. Jyoti Verma
Group: OASIS Cyber Threat Intelligence (CTI) TC
Sharing: This event is shared with the OASIS Open (General Membership), and General Public groups.
Public Event Link
Learn more about subscribing
here.
View the OASIS Cyber Threat Intelligence (CTI) TC calendar
here.
You may receive future notifications with updates to this event. Update the event on your calendar by accepting the changes.
STIX COA working group follow on call
https://cisco.webex.com/ciscosales/j.php?MTID=m888a682f4e1cd5852c08b0371b0e9d42 Meeting number: 208 034 411 Meeting password: tecePfxH (83237394 from phones) Join from a video conferencing system or application Dial
From the Cisco internal network, dial *267* and the 9-digit meeting number. If you are the host, enter your PIN when prompted. If you are a host,
https://cisco.webex.com/ciscosales/j.php?MTID=m5e2929ccb74bc31fbc8a35626cb60f47 to view host information. Join by phone +1-866-432-9903 Call-in toll-free number (US/Canada) +1-408-525-6800 Call-in toll number (US/Canada) Access code: 208 034 411
https://cisco.webex.com/ciscosales/globalcallin.php?serviceType=MC&ED=385072362&tollFree=1 |
https://www.webex.com/pdf/tollfree_restrictions.pdf Can't join the meeting?
https://cisco.webex.com/ciscosales/mc IMPORTANT NOTICE: Please note that this WebEx service allows audio and other information sent during the session to be recorded, which may be discoverable in a legal matter.
By joining this session, you automatically consent to such recordings. If you do not consent to being recorded, discuss your concerns with the host or do not join the session.. Agenda: Agenda: Discuss use cases Define relationship types for COAs Should the
STIX COA support time based sequencing? How should STIX COA work with and make use of automated actions like OpenC2? Topics for F2F Group: OASIS Cyber Threat Intelligence (CTI) TC Creator: Ms. Jyoti Verma ---------------------------------------------------------------------
To unsubscribe from this mail list, you must leave the OASIS TC that generates this mail. Follow this link to all your TCs in OASIS at:
https://www.oasis-open.org/apps/org/workgroup/portal/my_workgroups.php
← Prev in month
← Prev in thread
Next in thread →
Next in month →