CTI STIX SC Monthly Meeting December 23, 2015

Agenda n Keep call short for the Holidays n Introduce the STIX 2.0 Round 1 Strawman proposals l Inform on what they are, where they are, and why they are l Do NOT want to debate the proposals on this call n Open discussion or end early and go see our families

STIX 2.0 Round 1 Strawman Proposals What are they? n Contributions as experts not co-chair n The STIX 2.0 Round 1 Strawman proposals include 18 proposals covering 22 tracker issues including: l 6 Top Ten Roadmap issues (#306, #148, #291, #221, #201, #360) l 16 other issues

Why are they? n Give food for thought over Holidays n Set us up for focus after the Holidays n Identify and close quick consensus issues n Identify good issues for F2F agenda n Provide well thought out fully modeled proposed solutions to issues to focus and frame conversation and move us forward faster

Where are they? n Overview page and proposals are in the STIXProject/specifications wiki Overview page STIXProject/specifications wiki n Full STIX 2.0 Round 1 Strawman draft UML model is available in the stix-2.0-Round-1- Strawman branch of the specifications repository on githubstix-2.0-Round-1- Strawman branch

Proposal format n Issue Summary n Proposed n Proposed Model n Examples l JSON Schema Serialization snippets l JSON Serialization example snippets n Open Questions

Notes and Caveats n All proposed changes exist in an integrated STIX 2.0 Round 1 Strawman model derived from model n Proposals, model fragments and JSON snippets will often include changes from other issues and proposals n JSON snippets are illustrative not normative l Don’t get hung up on style or naming conventions (we can adjust that) l Snippets were kept as simple and focused as possible l There are likely errors here and there n It is our intent to provide JSON Schema snippets but have not yet had time. Assistance would be appreciated. n We’ll tackle these proposals on the list but please feel free to register thoughts and feedback within the relevant issues in the tracker

n STIX 2.0 Proposal1 : Extend core constructs from a single base class (#148) n STIX 2.0 Proposal2 : Make IDs required (#221) n STIX 2.0 Proposal3: Add Alternative_IDs to all top level objects (#358, #187) n STIX 2.0 Proposal4: Remove Short_Description (#194) n STIX 2.0 Proposal5 : Abstract Source to top level construct rather than embedded only within other constructs (#233) n STIX 2.0 Proposal6 : Remove the attribute from some constructs (#336) n STIX 2.0 Proposal7 : Make Observable structure align with other components (#160) n STIX 2.0 Proposal8 : Remove either embedded or referenced relationships (#201) n STIX 2.0 Proposal9 : Abstract relationships as top level constructs rather than embedded within other constructs (#291) n STIX 2.0 Proposal10 : Make field names consistent for usages of Information Source (#263) n STIX 2.0 Proposal11 : Abstract Sightings into an independent construct rather than embedded within Indicator (#306) n STIX 2.0 Proposal12 : Clarify semantics of different types of TTPs as expressed in the TTP construct (#360) n STIX 2.0 Proposal13 : Refactor Kill Chain Types (#117, #191, #241, #190, #47) n STIX 2.0 Proposal14 : Flatten list layers in Package (#382) n STIX 2.0 Proposal15 : Remove abstract base types for "top level" objects (#386) n STIX 2.0 Proposal16 : Refactor Report Object (#385) n STIX 2.0 Proposal17: Clarify semantics of different types of Exploit Targets as expressed in the Exploit Target construct (#387) n STIX 2.0 Proposal18: Abstract Victim to top level construct rather than embedded only within Incident and TTP (#149)

n Comments? n Questions? n Happy Holidays!