##master-page:FrontPage

#format wiki #language en #pragma section-numbers off

******************************************************************************************************************************************************

About the CTI TC

• The STIX and TAXII standards are governed by the OASIS Cyber Threat Intelligence Technical Committee (CTI TC). STIX and TAXII were created in 2012 under the auspices of the US Department of Homeland Security. In June of 2015, DHS licensed all of the intellectual property and trademarks associated with STIX and TAXII to OASIS, a nonprofit consortium that drives the development, convergence and adoption of open standards for the global information society. Since June of 2015, the CTI TC has been working to create the next generation of STIX and TAXII standards.

The current leadership:

• Co-Chair: Richard Struse ( [email protected] ), MITRE Corporation

• Co-Chair: Trey Darley ( [email protected] ), CERT.be

• Co-Secretary: Jane Ginn ( [email protected] ), Cyber Threat Intelligence Network, Inc. (CTIN)

• Co-Secretary: Ed Cabrara ( [email protected] ), Trend Micro

• Subcommittee Co-Chairs:

• STIX

  • Bret Jordan ( [email protected] ), Symantec Corp.

  TAXII

  • Bret Jordan ( [email protected] ), Symantec Corp.

  Interoperability

  • Stephen Russett ( [email protected] ), Cyber Threat Intelligence Network, Inc.

  • Justin Stewart ( [email protected] ), Looking Glass

  Video Overview: Interview of Chairman Richard Struse

About STIX 2.x

• STIX — the Structured Threat Information eXpression — is a language and serialization format used to exchange cyber threat intelligence (CTI). STIX enables organizations to share CTI with one another in a consistent and machine-readable manner, allowing security communities to better understand what computer-based attacks they are likely to see and to better prepare for and/or respond to those attacks faster and more effectively. STIX is designed to improve many different capabilities, such as collaborative threat analysis, automated threat exchange, automated detection and response, and more.

• See the FAQ

• STIX 2.0 Committee Specification (CS) - WD03

  • Part 1: STIX Core Concepts
    

  • Part 2: STIX Objects
    

  • Part 3: Cyber Observables Core Concepts
    

  • Part 4: Cyber Observable Objects
    

  • Part 5: STIX Patterning

About TAXII 2.x

• TAXII — the Trusted Automated Exchange of Intelligence Information — is an application layer protocol for the communication of CTI in a simple and scalable manner over HTTPS. TAXII enables organizations to share CTI by defining a standard API that aligns with common sharing models. TAXII is specifically designed to support the exchange of CTI represented in STIX.

• See the FAQ

  TAXII 2.0 Specification (CS) - WD02

  • TAXII 2.0 Specification

Interoperability

• The Interoperability Subcommittee of the CTI TC has developed a 2-Part Committee Note that establishes a step-by-step guide to a self-certification process. Once a Producer of STIX feeds, a vendor providing a Threat Intelligence Platform (TIP), a vendor providing a Security Incident and Event Management (SIEM) tool, a vendor that provides threat mitigation systems (TMS), or a vendor that provides threat detection systems (TDS) executes the steps outlined, demonstrates successful interoperability, and documents such, that supplier may submit a statement to OASIS testifying to the self-certification. We are using TMS to refer to tools such as firewalls and intrusion prevention systems. We are using TDS to refer to tools such as intrusion detection software and web proxies.

• We are using the following four use cases:

  1. Threat indicator sharing (of IOCs);
  2. Threat detection and sighting sharing (from TMSs to crowdsourcing threat intelligence among members of a trust community);
  3. Threat intelligence version challenges (for updates and revisions to intelligence data sharing); and
  4. Intelligence data markings (determining the sharing opportunities and constraints applied to a trust community).
  The self-certification process is intended to be policed by market forces. If a vendor or supplier self-certifies and is shown to be misrepresenting its products the OASIS Community will remove the vendor from the STIX/TAXII 2 compatible products list after verification of the claim.The vendor or supplier will need to re-test the attested product and submit documentation as per the Committee Note to once again achieve listing on the interoperability list.

• Details on the program can be found at the STIXPreferred Website.

• * STIX 2.0 Interoperability Test Document Part 1

  • STIX 2.0 Interoperability Test Document Part 2

  • STIXPreferred Operating Rules

• Logos noting STIX2 'Preferred' and TAXII2 'Preferred' Status will be made available to vendors that self-certify

Get Involved

• The CTI TC has monthly meetings of the entire membership. They are scheduled for the third Thursday of each month and two sessions are held – one at 11AM US Eastern time and another at 9PM US Eastern time (we hold two meetings in order to make it easier for members in different time zones to participate). Attendance at the monthly meeting (either time) is required to gain/retain voting rights according to OASIS rules. You must attend two consecutive meetings to gain your voting rights and if you miss two consecutive monthly meetings, you lose your voting rights until such time as you have attended two in a row. You’ll need to log into the OASIS Kavi platform during the meeting to record your attendance. We use these records to maintain our voting rights records. In addition to the monthly meetings, the TC has a regular “working call” scheduled at every Tuesday at 3PM Eastern time. This call is used to discuss technical topics. In addition to the monthly meetings, the CTI TC has historically held three face-to-face (F2F) meetings a year to discuss technical topics. These normally last two days and we make every effort to host the meetings in a variety of locations. While we encourage in-person participation, we also provide an audio/video stream to enable remote attendees. As we move into the implementation stage of the STIX 2.x and TAXII 2.x standards we will also be holding Plugfests, Hackathons and other hands-on sessions coupled with these F2F sessions.

Collaboration Mechanisms

• The CTI TC uses a variety of mechanisms to communicate and collaborate, including:
  • Mailing lists: STIX Cyber Observables TAXII Interop
  • Slack: Send an email to any of the co-Chairs to be onboarded onto the CTI TC Slack channel
  • Google Docs: Visit the Table of Contents page for links to the working documents

  • Resources:The CTI TC maintains information resources for both the general public and for TC members.

    • These are located at:

      • Public Information Site: https://www.oasis-open.org/committees/tc_home.php

      • TC Members: Log-in and browse to the CTI TC link on Kavi.

Documentation

• cti-documentation

  • OASIS Open Repository: GitHub Pages site for STIX, CybOX, and TAXII

  cti-stix2-json-schemas

  • OASIS Open Repository: Non-normative schemas and examples for STIX 2

Open-Source APIs and Tools (in order of contribution)

STIX2 data sources

artwork

• Open Source Icons

• https://github.com/freetaxii/stix2-graphics

Subcommittee Wiki Links

• STIX

• TAXII

• Interoperability

Communications Links

• Recurring TC / SC Calls

Other Misc.

• January 2016 F2F Consensus Topics

• Jupyter Notebook Demo

• Jupyter Notebook Libraries

• STIX2 Hackathon

This wiki is powered by MoinMoin.