www oasisopen org CTI Cyb OX SC Meeting

www. oasis-open. org CTI Cyb. OX SC Meeting November 19, 2015

www. oasis-open. org Agenda Recent discussions recap Maturity spectrum/cti-stats discussion Cyb. OX 3. 0 roadmap update File object refactoring OASIS work product status & discussion

Recent Discussions Address object refactoring Splitting up the existing Address object into more “atomic” entities Hash. Type refactoring Making it easier to capture common (e. g. , MD 5) hash values Observable revocation

Maturity Spectrum http: //cyboxproject. github. io/maturity-spectrum/ Three-tiered model for capturing the relative maturity of Cyb. OX components Semantic consensus Semantic completeness Existing use Informed by cti-stats Used to inform our Cyb. OX 3. 0+ decisions What should we focus on refactoring and improving now? What should we leave for later versions?

cti-stats I http: //cyboxproject. github. io/cti-stats/ Up-to-date statistics around usage of STIX and Cyb. OX components STIX entities Cyb. OX objects STIX Objects Counts Percentages Campaign 101 0. 02% Course of Action 10 0. 00% Exploit Target 18 0. 00% Incident 3 0. 00% Indicator 497944 98. 99% 0 0. 00% TTP 4736 0. 94% Threat Actor 228 0. 05% Report

cti-stats II Cyb. OX Objects Counts Percentages Address 194400 30. 24% Artifact 48 0. 01% Domain. Name 194915 30. 32% Email. Message 1515 0. 24% File 21928 3. 41% Hostname 13 0. 00% HTTPSession 185 0. 03% Link 255 0. 04% Memory 40 0. 01% 1332 0. 21% Network. Connection 30 0. 00% PDFFile 6 0. 00% Port 3696 0. 58% URI 218889 34. 05% Whois 539 0. 08% Win. Executable. File 551 0. 09% Win. Registry. Key 4437 0. 69% Mutex

cti-stats III

Cyb. OX 3. 0 Roadmap Update We’re considering merging Cyb. OX Core and Common, in addition to performing any streamlining around them They serve similar purposes “Common” is only truly common to Cyb. OX We want to avoid basing our refactoring on reductionist reasoning based on just the simple constructs in use today Therefore, in addition to the simpler Object types that we see in use in the wild today, we’ll select 3 -5 additional, more complex Objects for refactoring

File Object Refactoring I https: //github. com/Cyb. OXProject/schemas/wiki/Cyb. OX-3. 0: -File-Object. Refactoring There a number of existing issues with the File object and its subclasses: • Conflation of generic file properties with those related to file systems and disk -level representation • There are certain fields that may be specific to Windows and no other platforms • There currently are LOTS of subclasses of the File object: • File • Archive File • Image File • PDF File • Unix File • Windows Executable File

File Object Refactoring II

File Object Refactoring III { "hashes" : [{"type": "md 5", "hash_value": "3773 a 88 f 65 a 5 e 780 c 8 dff 9 cdc 3 a 056 f 3"}], "size" : 25537, "file_system_properties": {"file_name": {"delimiter": "/", "components": ["usr", "tmp", "foo. exe"]}}, "extensions": [{"type": "EXT 3 File. Extension", "inode": "34483923"}, {"type": "PEBinary. File. Extension", "exports": [{"name": "foo_app"}]}] }

OASIS Work Product Update Cyb. OX 2. 1. 1 40 specifications out of 94 reviewed and edited https: //github. com/Cyb. OXProject/specifications/tree/master/documents ETA: Late November/Early December

Next meeting December 10 th-20 th?