Sarah,
While I agree with you, at this stage I am just trying to capture what is possible. Then the TC can decide on which ones to do now, which to do in the future, and which ones we may never do.
But having a complete list helps ensure someone does not come back and say you forgot about X, Y, and Z.
Bret
Sent from my Commodore 64
PGP
Fingerprint: 63B4 FC53 680A 6B7D 1447 F2C0 74F8 ACAE 7415 0050
On Jul 24, 2018, at 11:10 AM, Kelley, Sarah E. <> wrote:
Bret,
For the most part I think your proposal below is on the right track. I do however have concerns about âRedefining some semantic meaning to some properties or objects in STIXâ. I donât think this
should be something we should be advertising as an option. The only time I believe weâve done this in the past is with the labels property, and only then after a very lengthy conversation and consideration of all the angles. I donât want to create an easy/ready-made
process for people to start suggesting that we redefine the meanings of all of our existing work. Doing that should be hard, and for good reason.
Thanks,
Sarah Kelley
Lead Cybersecurity Engineer, T8B2
Defensive Operations
The MITRE Corporation
703-983-6242
<image002.jpg>
From: <>
On Behalf Of Bret Jordan
Sent: Tuesday, July 24, 2018 10:56 AM
To:
Subject: [cti] Enhancement Process
All,
We have had several discussion about an enhancement process. In an effort to help drive this forward and help us get high-level agreement on what this would mean, here are a few points.
Types of Enhancements
New Objects (STIX Domain Objects, STIX Relationship Objects, Cyber Observable Objects)
Named Groupings of new properties on an existing object
Adding clarity or enhanced meaning to some property (example, explaining double or triple tagging of data in a âtagsâ property)
Redefining some semantic meaning to some properties or objects in STIX
Adding elements or redefining concepts in Patterning
Requirements
Useable by the TC itself for ideas that are not well understood
Useable by people inside the TC for their ideas
Useable by people outside the TC for their ideas
Ability to submit, if the creators desire, the enhancement to the TC
If TC wants to make changes the creators can withdraw their proposal
Ability to register, if creators desire, the enhancement in a registry run by some yet-to-be-determined group/org/method
Ability to advertise in a STIX object that an enhancement is in use
Ability to advertise in TAXII that an enhancement is in use
Ability to filter in TAXII for enhancements
Please let me know if the list of possible enhancement types is correct and if you have any additional requirements.
Bret
