OASIS Cyber Threat Intelligence (CTI) TC Wiki- Set goal of defining a Minimally-Viable Product (MVP) for STIX, TAXII and CybOX
- Set target date of 7/1/2016 for the draft STIX 2.0, TAXII 2.0 and CybOX 3.0 specifications
- Use TWIGS as the starting point for STIX 2.0 specification development
- CybOX 3.0 should include only those objects that are being used in the wild and that can be refactored if needed
- "Green-field" approach
- Relationships in CybOX Objects should ideally be defined using the top-level Relationship Object
- CybOX File Object likely will not encompass pipes/sockets for 3.0
- Extensions or a similar method will be used for the CybOX Object hierarchy refactoring
- Creation of CTI Common to contain objects shared by STIX and CybOX
- STIX Relationship Object (high-level) approach
- Controlled Vocabulary (high-level) approach
- HTTPS as MTI transport for TAXII
- IDs on all objects
- Remove short descriptions
- Flatten top level objects
- Remove abstract base types
- Refactor TTP into multiple top-level objects
Refactor ExploitTarget into multiple top-level objects
- Two-level Data Markings
- External IDs
- Report object refactoring
- Basics of the syntax for STIX/CybOX IDs