CTI STIX SC Kickoff Meeting July 16, 2015

Agenda n Approach and policies for the SC n Coordination across TC n Types of work products to be pursued n Developing a roadmap for SC work l Specific work products n Questions to be resolved

Approach and Policies n Coordinated collaboration l Everyone contributes opinions l As much as possible everyone contributes work l Sean and Aharon coordinate the madness n Leverage CTI resources as much as possible l Avoid having EVERYTHING occur on list n Record, persist and publish all plans and decisions n We will work out policies as we go forward

Coordination across TC n Inform, collaborate, monitor n Semantic intersections n Naming conventions n Meeting schedules n Release schedules n Processes (as much as possible)

Types or Work Products n Language specs l Implementation specific binding specs n Best practice and usage documentation n Supporting utilities n Test data n Content catalogs

Roadmap n Will be developing roadmap over next few weeks n Roadmap will likely contain list of work products with details for each l Name of work product l Scope of work product l Type of work product (SC vs TC, standard vs non- standard) l Editors l Intended timing (rough time targets or dependencies) n Initial thoughts l STIX v Tail work products l STIX v2.0 + Tail work products l Catalogs (COAs, TTPs, Profiles)

STIX v1.2.1 Specification n Baseline spec within OASIS n Minimal scope change possible n Multipart standard l Directly map across existing docs to new docs n Input (v1.2) specs should be complete within a couple weeks n Timing depends on DHS IP transfer n We hope to get a significant headstart behind the scenes

STIX v1.2.1 “Tail” n STIX XML binding spec l + XML Schemas n Related automation updates l Python-stix for l java-stix for n STIX XML test data set n other documentation n other utilities

STIX v2.0 Specification n Tackle some of the bigger refactoring issues n Same multipart approach as v1.2.1 expected n Actual spec work will need to wait until v1.2.1 release n We can start discussing issues today l Primarily using github issue trackers n Will likely involve some initial steps in semantic modeling

STIX v2.0 “Tail” n STIX 2.0 XML binding spec l + XML Schemas n STIX JSON binding spec n STIX SQL binding spec ?? n Related automation updates l Python-stix for 2.0 l java-stix for 2.0 n STIX 2.0 XML test data set n other documentation n other utilities

Open Questions n What documentation need to be maintained for each spec version? n What new documentation should be created? n What utilities need to be maintained for each spec version? n What new utilities should be created? n How will we handle editors and process for each work product? n What will be our guidelines for determining what sort of document each work product will be (TC vs SC, standards vs non-standards, etc.)? n What will be our meeting schedule? n How formally will we track meeting participation?