#cybox

The OASIS Cyber Threat Intelligence (CTI) technical committee (TC) has released the Committee Specification Draft (CSD) of the upcoming version of Cyber Observable eXpression (CybOX™) for public review and comment. The review period ends on October 28, 2016.

“This is an open invitation to comment. OASIS solicits feedback from potential users, developers and others, whether OASIS members or not, for the sake of improving the interoperability and quality of its technical work.”

CybOX Version 2.1.1 Committee Specification Draft 01 / Public Review Draft 01 20 June 2016

“Cyber Observable Expression (CybOX) is a standardized language for encoding and communicating high-fidelity information about cyber observables, whether dynamic events or stateful measures that are observable in the operational cyber domain. By specifying a common structured schematic mechanism for these cyber observables, the intent is to enable the potential for detailed automatable sharing, mapping, detection and analysis heuristics.”

The OASIS Cyber Threat Intelligence (CTI) Technical Committee (TC) released Release Candidate 3 of the Structured Threat Information Expression (STIX™) Version 2.0 Specification for the community on September 19, 2016.

STIX Version 2.0, Release Candidate 3

The OASIS Cyber Threat Intelligence (CTI) Technical Committee (TC) released the Release Candidate of the Structured Threat Information Expression (STIX™) Version 2.0 Specification for the community on August 18, 2016.

STIX Version 2.0, Release Candidate – http://stixproject.github.io/stix2.0/

python-cybox Version 2.1.0.13 is now available for download from PyPI, and to view the source code in the CybOXProject repository on GitHub.com. Documentation for this release is hosted on ReadTheDocs.org.

IMPORTANT: If you upgrade to python-cybox 2.1.0.13, you MUST also upgrade to python-stix 1.2.0.1 and python-maec 4.1.0.13, as some of the internals have changed significantly in incompatible ways from their previous versions. However, all existing code that worked under the previous versions—python-cybox 2.1.0.12, python-stix 1.2.0.0, and python-maec 4.1.0.12—should continue to work unmodified, unless you really dug into the internals of the libraries.

Additionally, all of the libraries now support Python 3.3, 3.4, and 3.5 (in addition to 2.6 and 2.7). The release also contains a variety of bug fixes that were made since the previous releases, which were over a year ago.

The biggest change in these versions is introducing a dependency on "mixbox," a new library that extracts some of the common functionality from the existing library and makes the behavior and implementation more consistent.

The OASIS Cyber Threat Intelligence (CTI) Technical Committee (TC) released “Draft 3 of the Structured Threat Information Expression (STIX™) Version 3.0 Specification” for community review and comment on August 8, 2016.

Feedback is requested for:

• STIX Version 2.0, Draft 3

Draft documents are also available on the OASIS CTI TC Development page on the STIX website for Trusted Automated eXchange of Indicator Information (TAXII™) Version 2.0 and Cyber Observable eXpression (CybOX™) Version 3.0.

The OASIS Cyber Threat Intelligence (CTI) Technical Committee (TC) released "Draft 2 of the Structured Threat Information Expression (STIX™) Version 2.0 Specification" for community review and comment on July 27, 2016.

Feedback is requested for:

STIX Version 2.0, Draft 2

Draft documents are also available on the OASIS CTI TC Development page for:

Trusted Automated eXchange of Indicator Information (TAXII™) Version 2.0

Cyber Observable eXpression (CybOX™) Version 3.0

Structured Threat Information Expression (STIX™), Trusted Automated eXchange of Indicator Information (TAXII™), and Cyber Observable eXpression (CybOX™) are the main topics of a July 16, 2016 press release by OASIS entitled “OASIS Advances Automated Cyber Threat Intelligence Sharing with STIX, TAXII, CybOX”.

The release discusses the problems STIX, TAXII, and CybOX address, and lists several organizations from across the industry that support these efforts.

Also included is a quote from Senior Principal Analyst at Enterprise Strategy Group Jon Oltsik, who discusses the benefits of using STIX, TAXII, and CybOX:

"Security professionals are overwhelmed and simply don’t have time for analyzing data in disparate formats. STIX, TAXII, and CybOX streamline the process, putting the focus of cyber intelligence where it belongs—on prevention, detection, and remediation. Using data converted to these standard formats can help security practitioners rapidly identify and access current threats, and determine how they act, who is responsible and what course of action is needed. Threat intelligence standards are also a key building block for fulfilling the vision of ubiquitous threat intelligence sharing."