CTI CybOX SC Meeting August 27, 2015

Agenda n CybOX Object Survey Results n OASIS Work Product Status & Discussion n CybOX Use Case Discussion n Recent Discussion Topics

Object Survey Results I ObjectCount% of Total Responses Address Object Domain Name Object Message Object File Object URI Object Hostname Object Port Object Network Connection Object Process Object Win Registry Key Object DNS Record Object HTTP Session Object Win Executable File Object X509 Certificate Object Artifact Object Network Subnet Object Socket Address Object System Object User Account Object Win File Object Top 10

Object Survey Results II ObjectCount% of Total Responses Network Route Entry Object25.13 Pipe Object25.13 Unix Network Route Entry Object25.13 Win Kernel Hook Object25.13 Win Network Route Entry Object25.13 Win Pipe Object25.13 Win Volume Object25.13 Semaphore Object12.56 Unix Pipe Object12.56 Volume Object12.56 Win Critical Section Object12.56 Win Kernel Object12.56 Win Memory Page Region Object12.56 Win Semaphore Object12.56 Win System Restore Object12.56 Disk Partition Object00.00 GUI Dialogbox Object00.00 GUI Object00.00 GUI Window Object00.00 Win Mailslot Object00.00 Win Waitable Timer Object00.00 Bottom 10

OASIS Work Products n CybOX 2.1.1: multi-part specification l Overview l Core l Common l Objects* n XML binding specification l Includes reference implementation n CybOX XSDs l Vocabularies l Extensions l UML Model

CybOX Use Cases I n Core vision l Representation of cyber observables, including both static and dynamic l Specification of patterns on cyber observables l Extensibility to allow for representation of custom/specialized cyber observables

CybOX Use Cases II n Domains l Indicator sharing l Incident response l Malware analysis l Digital forensics l Others n Data sources l Sensors l Systems l Others

Recent Discussion Topics n On GitHub: l Lists in CybOX Object fields l Atomic vs. Abstract CybOX Objects l Duplicate/Overlapping CybOX Objects l Separate Patterns and Instances in CybOX Observables and Objects

Next meeting n Thursday, September 24 4:00pm EDT