Subject: [sacm] Cross-posting: Request for Public Comments on STIX 2.0

From: "Struse, Richard" <[email-masked]>
Date: Thu, 16 Mar 2017 14:22:45 +0000

Dear Cybersecurity Community Member,

The OASIS Cyber Threat Intelligence Technical Committee (CTI TC
<https://www.oasis-open.org/committees/cti/> ) members have recently
approved STIX 2.0 as a Committee Specification Draft (CSD) and submitted it
for 30-day public review.  The public review started 08 March 2017 at 00:00
UTC and ends 06 April 2017 at 23:59 UTC. 

This is an open invitation to comment. OASIS solicits feedback from
potential users, developers and others, whether OASIS members or not, for
the sake of improving the interoperability and quality of its technical
work.

What is STIX?

Structured Threat Information Expression (STIX) is a language and
serialization format used to exchange cyber threat intelligence (CTI). STIX
enables organizations to share CTI with one another in a consistent and
machine readable manner, allowing security communities to better understand
what computer-based attacks they are most likely to see and to anticipate
and/or respond to those attacks faster and more effectively. STIX is
designed to improve many different capabilities, such as collaborative
threat analysis, automated threat exchange, automated detection and
response, and more.  More information can be found here
<https://oasis-open.github.io/cti-documentation/stix/about> .

What's New in STIX 2.0?

STIX 2.0 represents a significant evolution in the design and implementation
of STIX.  To date, STIX has been very successful in demonstrating that
machine-readable cyber threat intelligence can be widely shared and used
operationally. Both commercial and government threat intelligence feeds
provide it and many threat intelligence tools produce and/or consume it.  As
with anything, however, in developing and implementing STIX 1.x the
community (both vendors and consumers) have found that it also had some
shortcomings. These included excessive complexity and excessive flexibility.
In addition, STIX 1.x used XML, which has fallen out of favor with much of
the developer community.

STIX 2 is a redesign of STIX that has the same goals and builds on the same
foundational concepts but in a way that addresses those shortcomings. It is
not backwards-compatible but is intended to be a replacement for STIX 1.x.
STIX 2.0 is the first release of STIX 2 and is intended to be a framework on
which future capabilities can be built. In fact, while STIX 2.0 is currently
under review, the community is already working on additional capabilities to
add in STIX 2.1. All of the releases in the STIX 2 series will build on each
other such that upgrading from one version to the next should be easy
(unlike the change from STIX 1 to STIX 2).  For more information, consult
the FAQ <https://oasis-open.github.io/cti-documentation/stix/review> .

STIX 2.0 Documents

STIX Version 2.0 is a five-part specification. The prose documents and
related files are available here:

Part #

Title

Links

1

STIX Core Concepts

Editable Authoritative Source (DOCX)
<http://docs.oasis-open.org/cti/stix/v2.0/csprd01/part1-stix-core/stix-v2.0-
csprd01-part1-stix-core.docx> 

HTML
<http://docs.oasis-open.org/cti/stix/v2.0/csprd01/part1-stix-core/stix-v2.0-
csprd01-part1-stix-core.html> 

PDF
<http://docs.oasis-open.org/cti/stix/v2.0/csprd01/part1-stix-core/stix-v2.0-
csprd01-part1-stix-core.pdf> 

2

STIX Objects

Editable Authoritative Source (DOCX)
<http://docs.oasis-open.org/cti/stix/v2.0/csprd01/part2-stix-objects/stix-v2
.0-csprd01-part2-stix-objects.docx> 

HTML
<http://docs.oasis-open.org/cti/stix/v2.0/csprd01/part2-stix-objects/stix-v2
.0-csprd01-part2-stix-objects.html> 

PDF
<http://docs.oasis-open.org/cti/stix/v2.0/csprd01/part2-stix-objects/stix-v2
.0-csprd01-part2-stix-objects.pdf> 

3

Cyber Observable Core Concepts

Editable Authoritative Source (DOCX)
<http://docs.oasis-open.org/cti/stix/v2.0/csprd01/part3-cyber-observable-cor
e/stix-v2.0-csprd01-part3-cyber-observable-core.docx> 

HTML
<http://docs.oasis-open.org/cti/stix/v2.0/csprd01/part3-cyber-observable-cor
e/stix-v2.0-csprd01-part3-cyber-observable-core.html> 

PDF
<http://docs.oasis-open.org/cti/stix/v2.0/csprd01/part3-cyber-observable-cor
e/stix-v2.0-csprd01-part3-cyber-observable-core.pdf> 

4

Cyber Observable Objects

Editable Authoritative Source (DOCX)
<http://docs.oasis-open.org/cti/stix/v2.0/csprd01/part4-cyber-observable-obj
ects/stix-v2.0-csprd01-part4-cyber-observable-objects.docx> 

HTML
<http://docs.oasis-open.org/cti/stix/v2.0/csprd01/part4-cyber-observable-obj
ects/stix-v2.0-csprd01-part4-cyber-observable-objects.html> 

PDF
<http://docs.oasis-open.org/cti/stix/v2.0/csprd01/part4-cyber-observable-obj
ects/stix-v2.0-csprd01-part4-cyber-observable-objects.pdf> 

5

STIX Patterning

Editable Authoritative Source (DOCX)
<http://docs.oasis-open.org/cti/stix/v2.0/csprd01/part5-stix-patterning/stix
-v2.0-csprd01-part5-stix-patterning.docx> 

HTML
<http://docs.oasis-open.org/cti/stix/v2.0/csprd01/part5-stix-patterning/stix
-v2.0-csprd01-part5-stix-patterning.html> 

PDF
<http://docs.oasis-open.org/cti/stix/v2.0/csprd01/part5-stix-patterning/stix
-v2.0-csprd01-part5-stix-patterning.pdf> 

For your convenience, OASIS also provides a complete package of the prose
documents and related files in a ZIP distribution file. You can download the
ZIP file here
<http://docs.oasis-open.org/cti/stix/v2.0/csprd01/stix-v2.0-csprd01.zip> .

How To Comment on STIX 2.0

Comments on STIX 2.0 may be submitted to the TC by any person through the
use of the OASIS TC Comment Facility
<https://www.oasis-open.org/committees/comments/index.php?wg_abbrev=cti> .
Comments submitted by TC non-members for this work and for other work of
this TC are publicly archived and can be viewed here
<https://lists.oasis-open.org/archives/cti-comment/> .  Please submit any
comments before the public comment period ends on April 6, 2017.

By submitting comments you implicitly agree to the terms of the OASIS
Feedback License
<https://www.oasis-open.org/policies-guidelines/ipr#appendixa> , which
ensures that any alterations made to the specifications based upon your
feedback are covered by the same IPR protections under which TC members
operate.  In addition, in connection with this public review of STIX 2.0, we
call your attention to the OASIS IPR Policy
<https://www.oasis-open.org/policies-guidelines/ipr#Non-Assertion-Mode>
applicable to the work of this technical committee. While all members of the
TC should already be familiar with this document (which may create
obligations regarding the disclosure and availability of a member's patent,
copyright, trademark and license rights that read on an approved OASIS
specification), public reviewers who are not TC members are encouraged to
review the OASIS IPR Policy.  OASIS invites any persons who know of any such
claims to disclose these if they may be essential to the implementation of
the above specification, so that notice of them may be posted to the notice
page for this TC's work.

Invitation to Forward This Call for Comments

OASIS and the CTI TC encourage widespread public review of the STIX 2.0
specifications.  Therefore, please feel free to forward this call for
comments onto any and all interested parties.

Thank you.

Regards,

Richard J. Struse 

Chair, OASIS Cyber Threat Intelligence (CTI) Technical Committee

Chief Advanced Technology Officer

National Cybersecurity and Communications Integration Center (NCCIC) 

Cyber Security & Communications

U.S. Department of Homeland Security

e-mail:   <mailto:[email-masked]> [email-masked]
Phone:  202-527-2361