News about STIX, TAXII, CybOX, and MAEC

Structured Threat Information Expression (STIX™) 2.0 and Trusted Automated eXchange of Indicator Information (TAXII™) 2.0 have a new website. The STIX 1.x and TAXII 1.x websites have been archived.

Visit this new website for the most recent information about STIX and TAXII:

Please join us on Wednesday, November 30, 2016 for our next bi-weekly community call about the next version of MAEC Language, Version 5.0.

Each bi-weekly call focuses on one or so aspects of "Malware Attribute Enumeration and Characterization (MAEC™) 5.0, with this week's specific topic(s) noted below on the agenda. But feel free to bring up any other MAEC-related topics at any time.

Date & Time

Wednesday, November 30, 2016 11:00 a.m. – 12:00 p.m. EST

Agenda

Capabilities

Structural Features

Call Details

Phone: +1 (781) 271-2020 / +1 (703) 983-2020 Link: https://meet.mitre.org/ikirillov/7F073TTD Conference ID: 9326128

Help

[email protected]

Useful Links

MAEC Working Call page

MAEC 5.0 Roadmap

MAEC Repositories

Our next 1-hour, bi-weekly Working Session Call for Malware Attribute Enumeration and Characterization (MAEC™) Version 5.0 will be held on November 30, 2016.

Please join us on Wednesday, November 9, 2016 for our next bi-weekly community call about the next version of MAEC Language, Version 5.0.

Each bi-weekly call focuses on one or so aspects of "Malware Attribute Enumeration and Characterization (MAEC™) 5.0, with this week's specific topic(s) noted below on the agenda. But feel free to bring up any other MAEC-related topics at any time.

Date & Time

Wednesday, November 9, 2016 11:00 a.m. – 12:00 p.m. EST

Agenda

Malware Action

Behavior

Call Details

Phone: +1 (781) 271-2020 / +1 (703) 983-2020 Link: https://meet.mitre.org/ikirillov/7F073TTD Conference ID: 9326128

Help

[email protected]

Useful Links

MAEC Working Call page

MAEC 5.0 Roadmap

MAEC Repositories

python-stix Version 1.2.0.2 is now available for download from PyPI, and to view the source code in the STIXProject repository on GitHub.com. Documentation for this release is hosted on ReadTheDocs.org.

Our next 1-hour, bi-weekly Working Session Call for Malware Attribute Enumeration and Characterization (MAEC™) Version 5.0 will be held on November 9, 2016.

Call details will be posted on the MAEC Working Call page on the MAEC website, and announced here and on the MAEC Community Email Discussion List, closer to the meeting date.

Please join us on Wednesday, October 26, 2016 for our next bi-weekly community call about the next version of MAEC Language, Version 5.0.

Each bi-weekly call focuses on one or so aspects of "Malware Attribute Enumeration and Characterization (MAEC™) 5.0, with this week's specific topic(s) noted below on the agenda. But feel free to bring up any other MAEC-related topics at any time.

Date & Time

Wednesday, October 26, 2016 11:00 a.m. – 12:00 p.m. EDT

Agenda

The Malware Instance Object.

Call Details

Phone: +1 (781) 271-2020 / +1 (703) 983-2020 Link: https://meet.mitre.org/ikirillov/7F073TTD Conference ID: 9326128

Help

[email protected]

Useful Links

MAEC Working Call page

MAEC 5.0 Roadmap

MAEC Repositories

Due to scheduling issues the call on October 12 needed to be cancelled. Our next 1-hour, bi-weekly Working Session Call for Malware Attribute Enumeration and Characterization (MAEC™) Version 5.0 will be held on October 26, 2016.

Call details will be posted on the MAEC Working Call page on the MAEC website, and announced here and on the MAEC Community Email Discussion List, closer to the meeting date.

Structured Threat Information Expression (STIX™) is cited in an October 4, 2016 press release entitled “Arbor Networks Spectrum Introduces Virtualized Internal Network Traffic Analysis to Accelerate Advanced Threat Defenses.”

The main topic of the press release is Arbor Networks Inc.’s release of version 2.2 of its Arbor Networks Spectrum product, a “high performance network traffic analysis platform integrating Netflow, packet and threat intelligence data for real-time and retrospective investigation of advanced threats.”

STIX is cited as product feature for importing STIX feeds to apply shared threat intelligence in bullet number three of five, as follows: “Support for third party intelligence use in STIX formats.”

The OASIS Cyber Threat Intelligence (CTI) technical committee (TC) has released the Committee Specification Draft (CSD) of the upcoming version of Cyber Observable eXpression (CybOX™) for public review and comment. The review period ends on October 28, 2016.

“This is an open invitation to comment. OASIS solicits feedback from potential users, developers and others, whether OASIS members or not, for the sake of improving the interoperability and quality of its technical work.”

CybOX Version 2.1.1 Committee Specification Draft 01 / Public Review Draft 01 20 June 2016

“Cyber Observable Expression (CybOX) is a standardized language for encoding and communicating high-fidelity information about cyber observables, whether dynamic events or stateful measures that are observable in the operational cyber domain. By specifying a common structured schematic mechanism for these cyber observables, the intent is to enable the potential for detailed automatable sharing, mapping, detection and analysis heuristics.”

Structured Threat Information Expression (STIX™) and Trusted Automated eXchange of Indicator Information (TAXII™) are cited in a September 28, 2016 press release entitled “HITRUST Advances the State of Cyber Threat Information Sharing for the Nation’s Healthcare Sector.”

The main topic of the press release is Health Information Trust Alliance’s (HITRUST) announcement that it has become “the first healthcare information sharing organization connected and sharing cyber threat indicators with the Department of Homeland Security’s (DHS) Automated Indicator Sharing (AIS) Program.”

STIX and TAXII are mentioned as follows: “HITRUST has already been sharing CTI in near real-time through the [HITRUST Cyber Threat XChange (CTX)] with organizations in the healthcare sector as well as other industries. HITRUST CTX enables seamless and near real-time CTI exchange through its support for STIX, TAXII, SIEM integration and a robust API.”

Please join us on Wednesday, September 28, 2016 for our first bi-weekly community call about the next version of MAEC Language, Version 5.0.

Each bi-weekly call will focus on one aspect of "Malware Attribute Enumeration and Characterization (MAEC™) 5.0, with this week's specific topic noted below on the agenda. But feel free to bring up any other MAEC-related topics at any time.

Date & Time

Wednesday, September 28, 2016 11:00 a.m. – 12:00 p.m. EDT

Agenda

The Malware Family Object.

Call Details

Phone: +1 (781) 271-2020 / +1 (703) 983-2020 Link: https://meet.mitre.org/ikirillov/7F073TTD Conference ID: 9326128

Help

[email protected]

Useful Links

MAEC Working Call page

MAEC 5.0 Roadmap

MAEC Repositories

Structured Threat Information Expression (STIX™) and Trusted Automated eXchange of Indicator Information (TAXII™) are mentioned in an September 22, 2016 article entitled “Even A False Positive Can Be Valuable” on Dark Reading.

The main topic of this article is that “Sharing information about cyberthreats is important for the financial services industry, even when threats turn out to be not-so-threatening.”

STIX and TAXII are mentioned in a section of the article entitled “Standardized Formats,” when the author states: “Improving security through collaboration isn't a new concept, but it has typically been achieved through manual interactions. Today, data sharing is facilitated through the use of standard languages, including Structured Threat Information Expression (STIX), the structure of the message describing the threat, and Trusted Automated Exchange of Indicator Information (TAXII), the transport to send the STIX message. STIX and TAXII allow CTI data to be accessed in a standardized format. These open standards are essential for the interoperability and machine processing that are key to acting on information quickly.”

STIX and TAXII are mentioned a second time in the same section, when the author discusses the value of open standards: “CTI data-sharing systems leverage these open standards and provide information through information-sharing communities to those companies that haven't begun using STIX/TAXII ... Open standards also address the problems companies face when using multiple vendors, where the bundling of CTI data may only work with one vendor's tools. CTI-sharing systems allow for information from multiple sources to be used in multiple tools that detect or defend the network.”

Structured Threat Information Expression (STIX™) and Trusted Automated eXchange of Indicator Information (TAXII™) are cited as product features in a September 14, 2016 press release entitled “EclecticIQ Announces Bi-directional Threat Intelligence Integration with Real-time Feedback Loop for HPE Security ArcSight ESM.”

The main topic of the press release is EclecticIQ’s announcement of the integration between its own “bi-directional security information and event management (SIEM)” with “HPE Security ArcSight Enterprise Security Management (ESM), a SIEM and advanced analytics platform that combined dramatically cuts down the time to detect and respond to threats.”

STIX and TAXII are mentioned as follows: “EclecticIQ Platform empowers analysts through data fusion, workflow support and by streaming threat intelligence into HPE Security ArcSight. In the instance of a match, aggregated notifications are reported back into EclecticIQ Platform. This drives greater efficiency of threat intelligence, future research and implementation of security measures. EclecticIQ Platform supports a large variety of data formats including industry standard STIX and TAXII.”

Structured Threat Information Expression (STIX™) and Trusted Automated eXchange of Indicator Information (TAXII™) are cited as product features in a September 12, 2016 press release entitled “Bandura STIX and TAXII Capabilities Bring Block List Automation to SME and Enterprise.”

STIX and TAXII are mentioned in the first sentence of the press release, as follows: “Bandura, LLC, maker of the PoliWall/ProACT Threat Intelligence Platform, today announces the addition of STIX and TAXII capability to automate the use of industry block lists."

Brian Peterson, Bandura's COO/CFO, then explains why Bandura added STIX and TAXII: “Adding this automation to the already robust PoliWall/ProACT Threat Intelligence Platform, gives the small to mid‐sized enterprise an essential weapon in the ongoing battle against cyber‐attack and data leakage ... With PoliWall, the customer just opens the block list screen and imports the list(s) they want auto‐updated and auto‐blocked—literally set it and forget it!”

The OASIS Cyber Threat Intelligence (CTI) Technical Committee (TC) released Release Candidate 3 of the Structured Threat Information Expression (STIX™) Version 2.0 Specification for the community on September 19, 2016.

STIX Version 2.0, Release Candidate 3

Beginning Wednesday, September 28, 2016, the Malware Attribute Enumeration and Characterization (MAEC™) Team will be hosting the first of a series of 1-Hour, Bi-Weekly, Working Session Calls for MAEC Version 5.0.

Each call will focus on a particular topic. However, we very much welcome suggestions from our community, so please let us know what you’d like to discuss for any meeting. Anything MAEC-related is relevant!

Agenda for September 28th:

The Malware Family Object.

Call details will be posted on the MAEC Working Call page on the MAEC website, and announced here and on the MAEC Community Email Discussion List, closer to the meeting date.