www oasisopen org CTI STIX SC Monthly Meeting

www. oasis-open. org CTI STIX SC Monthly Meeting August 19, 2015

www. oasis-open. org Agenda n Work progress status l n n Update on STIX 1. 2. 1 specs Discuss ideas for HOW we do work The need for use cases

STIX 1. 2. 1 specification status n n Worked with OASIS folks and now have OASIS document templates for all parts of STIX language specs In process of migrating spec content from pre-OASIS form into the templates l l Work being done by MITRE people who edited the original pre-OASIS documents Drafts for Overview and Core documents are mostly done n l Working through editing, formatting, policy details with OASIS Estimate it will only take a few hours per document n Should have all existing documents migrated to OASIS drafts within 1. 5 -2. 5 weeks n n n n STIX Version 1. 2. 1 Part 1: Overview. [URI – added during publication] STIX Version 1. 2. 1 Part 2: Common. [URI] STIX Version 1. 2. 1 Part 3: Core. (this document) STIX Version 1. 2. 1 Part 4: Indicator. [URI] STIX Version 1. 2. 1 Part 5: TTP. [URI] STIX Version 1. 2. 1 Part 6: Incident. [URI] STIX Version 1. 2. 1 Part 7: Threat Actor. [URI] STIX Version 1. 2. 1 Part 8: Campaign. [URI] STIX Version 1. 2. 1 Part 9: Course of Action. [URI] STIX Version 1. 2. 1 Part 10: Exploit Target. [URI] STIX Version 1. 2. 1 Part 11: Report. [URI] STIX Version 1. 2. 1 Part 12: Extensions. [URI] STIX Version 1. 2. 1 Part 13: Data Marking. [URI] STIX Version 1. 2. 1 Part 14: Vocabularies. [URI] STIX Version 1. 2. 1 Part 15: UML Model. [URI] XML schemas: (list file names or directory name) [URI]

STIX Tools Update n n n Open. IOC->STIX tool update was released to support STIX 1. 2 STIX 2 HTML is in process of update for STIX 1. 2 STIXviz is almost ready for its STIX 1. 2 release

Ideas for HOW we do work Leveraging github n n n Issue trackers Wikis Will likely need to being thinking of the “specs” repository as primary area for STIX language l n Should eventually move over appropriate tracker issues from “schemas” repository Ideas for how else we could be leveraging github?

Ideas for HOW we do work Other ideas for technical enablers? n Does anyone have any other ideas for gaps/solutions of technical enablers for our work? l Discuss exploration into collaboration tools n n l SC co-chairs are discussing potential options Interested in input/feedback on requirements and options Options for managing meetings better?

Ideas for HOW we do work Official STIX SC Secretary? n What do people think of the idea of having an official STIX SC Secretary to organize and coordinate SC activities?

Ideas for HOW we do work Discussion of STIX SC work processes n Don’t want to rehash the email from the co-chairs sent on 8/1 l n Encourage ideas and discussion but caution that consensus and decisions will need to follow process. l n Do need to emphasize that under formal governance our work will need to be open, deliberative, ordered and tracked. Please keep talking. : -) Encourage contributions beyond just thoughts l l As work product efforts are stood up, editors will be needed Contributions of use cases, conceptual models, schema structures, normative or informative language suggestions, test data, etc. will be invaluable to collaborative progression n MITRE folks will continue to be involved but we will need a broader base of active contributors going forward

The need for use cases n The need for Use Cases has been repeatedly raised l Use cases have always been driving STIX/TAXII/Cyb. OX but they have not been explicitly codified n l l Under formal governance we need to do this This topic is being discussed across the SCs at the TC level not just for STIX We need to capture comprehensive set of use cases for STIX n n Suggestion: Initial capture and evolution in a github wiki Suggestion: Identifying a volunteer to help coordinate this activity