<html>
<head>
<style><!--
.hmmessage P
{
margin:0px;
padding:0px
}
body.hmmessage
{
font-size: 12pt;
font-family:Calibri
}
--></style></head>
<body class='hmmessage'><div dir='ltr'>I have a problem about using Application intelmq<br><br><div>> From: intelmq-dev-request@lists.cert.at<br>> Subject: Intelmq-dev Digest, Vol 6, Issue 2<br>> To: intelmq-dev@lists.cert.at<br>> Date: Mon, 8 Aug 2016 12:00:02 +0200<br>> <br>> Send Intelmq-dev mailing list submissions to<br>> intelmq-dev@lists.cert.at<br>> <br>> To subscribe or unsubscribe via the World Wide Web, visit<br>> http://lists.cert.at/cgi-bin/mailman/listinfo/intelmq-dev<br>> or, via email, send a message with subject or body 'help' to<br>> intelmq-dev-request@lists.cert.at<br>> <br>> You can reach the person managing the list at<br>> intelmq-dev-owner@lists.cert.at<br>> <br>> When replying, please edit your Subject line so it is more specific<br>> than "Re: Contents of Intelmq-dev digest..."<br>> <br>> <br>> Today's Topics:<br>> <br>> 1. Re: Taxonomies & Sharing mechanism [SEC=UNCLASSIFIED]<br>> (Clark, Andrew)<br>> <br>> <br>> ----------------------------------------------------------------------<br>> <br>> Message: 1<br>> Date: Mon, 8 Aug 2016 05:55:55 +0000<br>> From: "Clark, Andrew" <Andrew.Clark@cert.gov.au><br>> To: Otmar Lendl <lendl@cert.at>, "intelmq-dev@lists.cert.at"<br>> <intelmq-dev@lists.cert.at><br>> Subject: Re: [Intelmq-dev] Taxonomies & Sharing mechanism<br>> [SEC=UNCLASSIFIED]<br>> Message-ID:<br>> <454F4A633809FD40898A9D230EDFA93138B2E82B@ACTDC01MLD02V.agdnet.ag.gov.au><br>> <br>> Content-Type: text/plain; charset="utf-8"<br>> <br>> UNCLASSIFIED<br>> Hi Otmar,<br>> <br>> I have never really investigated what's out there in terms of taxonomies, to any great extent.<br>> <br>> We use MISP, and if you haven't seen it, take a look at how many taxonomies they've tried to accommodate: https://github.com/MISP/misp-taxonomies/<br>> <br>> If I'm reading the correct things, I suspect we might be lucky because the CERT.pt taxonomy looks very similar to the eCSIRT taxonomy used by IntelMQ (and supported by MISP).<br>> <br>> The CERT.pt taxonomy (from this site: http://www.cncs.gov.pt/cert-pt-2/documents-2/) includes 18 "incident types" and 10 "incident classes". The ClassificationType class from IntelMQ supports 20 values, including the 18 from the CERT.pt taxonomy, plus "unknown" and "blocklist". Based on this, I don't think there is a good reason to change what IntelMQ uses now.<br>> <br>> Regarding STIX and Cybox (and TAXII), here at CERT Australia we are using them heavily. STIX includes a 'TTP' object which can be associated with Indicators. TTPs include 'behaviours' and while STIX supports the CAPEC (capec.mitre.org) taxonomy natively, it would be easy to extend to support arbitrary taxonomies. <br>> <br>> Hope you're enjoying your vacation!<br>> <br>> Andrew<br>> <br>> -----Original Message-----<br>> From: Intelmq-dev [mailto:intelmq-dev-bounces@lists.cert.at] On Behalf Of Otmar Lendl<br>> Sent: Saturday, 6 August 2016 2:07 AM<br>> To: intelmq-dev@lists.cert.at<br>> Subject: [Intelmq-dev] Taxonomies & Sharing mechanism<br>> <br>> <br>> Folks,<br>> <br>> as I will attending the ENISA/EC3 workshop in The Hague this autumn, I got an invitation to a preparatory survey which asks questions about a consensus regarding taxonomies and information sharing formats to be used in CERT/CERT and CERT/LE information sharing.<br>> <br>> IntelMQ is based on eCSIRT II, which some working-group in the ENISA/EC3/EMPACT universe has declared to be obsolete.<br>> <br>> See this monster of a report:<br>> https://www.enisa.europa.eu/publications/information-sharing-and-common-taxonomies-between-csirts-and-law-enforcement<br>> <br>> Their new shiny pony is based on the work of CERT.pt, and they want to to use the meeting this year to finalize that decision. I have no clue how big the delta to eCSIRT II is.<br>> <br>> IMHO the IntelMQ community has to decide how to react. E.g.<br>> <br>> a) stay with eCSIRT II framework<br>> b) adopt the new one<br>> <br>> and<br>> <br>> what stance to take on an inter-organisational sharing mechanism.<br>> <br>> So what do you all think?<br>> <br>> otmar (who will be on vacation the next weeks, don't expect me to reply<br>> soon)<br>> <br>> ------------------<br>> <br>> The survey asks:<br>> <br>> Do you believe that the Common Taxonomy for the national network of CSIRT/LEA (formerly known as CERT.PT Taxonomy) is suitable for CSIRT/LEA communication?<br>> <br>> Yes / No / Other<br>> <br>> Have you ever used one of the following?<br>> <br>> STIX / CybOX / Other sharing Mechanism<br>> <br>> What do you think could be a suitable sharing mechanism for the Common Taxonomy for the national network of CSIRT/LEA?<br>> <br>> STIX / CybOX / Other sharing Mechanism<br>> <br>> Extract from 'Report on Information Sharing and Common Taxonomies between CSIRTs and Law Enforcement Agencies'<br>> <br>> A clear distinction should be made between a taxonomy, a sharing mechanism and a sharing platform to avoid any possible confusion. While a taxonomy is a way of describing information through classification, a sharing mechanism structures the way the information is encoded. For example, a sharing mechanism might provide rules for names and positions of XML tags to allow a file to be treated automatically. Finally, a sharing platform is a tool allowing to share information. It is not mandatory to have such a platform ? files containing information structured according to a standard and classified according to a taxonomy could simply be sent by e-mail, for example. Nevertheless, the use of a sharing platform allows users to easily share information in a structured way.<br>> <br>> <br>> --<br>> // Otmar Lendl <lendl@cert.at> - T: +43 1 5056416 711 // CERT Austria - http://www.cert.at/ // Eine Initiative der nic.at GmbH - http://www.nic.at/ // Firmenbuchnummer 172568b, LG Salzburg<br>> <br>> <br>> ---------------------------------------------------- <br>> If you have received this transmission in error please<br>> notify us immediately by return e-mail and delete all<br>> copies. If this e-mail or any attachments have been sent<br>> to you in error, that error does not constitute waiver<br>> of any confidentiality, privilege or copyright in respect<br>> of information in the e-mail or attachments.<br>> <br>> ------------------------------<br>> <br>> Subject: Digest Footer<br>> <br>> _______________________________________________<br>> Intelmq-dev mailing list<br>> Intelmq-dev@lists.cert.at<br>> http://lists.cert.at/cgi-bin/mailman/listinfo/intelmq-dev<br>> <br>> <br>> ------------------------------<br>> <br>> End of Intelmq-dev Digest, Vol 6, Issue 2<br>> *****************************************<br></div> </div></body>
</html>