1. CTI CybOX SC Meeting www.oasis-open.org August 27, 2015

2. www.oasis-open.org Agenda n CybOX Object Survey Results n OASIS Work Product Status & Discussion n CybOX Use Case Discussion n Recent Discussion Topics

3. Object Survey Results I ObjectCount% of Total Responses Address Object2769.23 Domain Name Object2666.67 Email Message Object2461.54 File Object2461.54 URI Object2256.41 Hostname Object1948.72 Port Object1743.59 Network Connection Object1641.03 Process Object1538.46 Win Registry Key Object1538.46 DNS Record Object1230.77 HTTP Session Object1230.77 Win Executable File Object1128.21 X509 Certificate Object1128.21 Artifact Object1025.64 Network Subnet Object1025.64 Socket Address Object1025.64 System Object1025.64 User Account Object1025.64 Win File Object1025.64 Top 10

4. Object Survey Results II ObjectCount% of Total Responses Network Route Entry Object25.13 Pipe Object25.13 Unix Network Route Entry Object25.13 Win Kernel Hook Object25.13 Win Network Route Entry Object25.13 Win Pipe Object25.13 Win Volume Object25.13 Semaphore Object12.56 Unix Pipe Object12.56 Volume Object12.56 Win Critical Section Object12.56 Win Kernel Object12.56 Win Memory Page Region Object12.56 Win Semaphore Object12.56 Win System Restore Object12.56 Disk Partition Object00.00 GUI Dialogbox Object00.00 GUI Object00.00 GUI Window Object00.00 Win Mailslot Object00.00 Win Waitable Timer Object00.00 Bottom 10

5. OASIS Work Products n CybOX 2.1.1: multi-part specification l Overview l Core l Common l Objects* n XML binding specification l Includes reference implementation n CybOX 2.1.1 XSDs l Vocabularies l Extensions l UML Model

6. CybOX Use Cases I n Core vision l Representation of cyber observables, including both static and dynamic l Specification of patterns on cyber observables l Extensibility to allow for representation of custom/specialized cyber observables

7. CybOX Use Cases II n Domains l Indicator sharing l Incident response l Malware analysis l Digital forensics l Others n Data sources l Sensors l Systems l Others

8. Recent Discussion Topics n On GitHub: https://github.com/CybOXProject/schemas/issues https://github.com/CybOXProject/schemas/issues l Lists in CybOX Object fields l Atomic vs. Abstract CybOX Objects l Duplicate/Overlapping CybOX Objects l Separate Patterns and Instances in CybOX Observables and Objects

9. Next meeting n Thursday, September 24 th @ 4:00pm EDT