search

CybOXProject / schemas

CybOX Schemas and Schema Development
42 stars 17 forks source link

Create Directory Object #14

Open bworrell opened 11 years ago

bworrell commented 11 years ago

Create an ObjectPropertiesType implementation for the representation of Directory information. It is possible that this has integration with the File Object. This would be a new schema under the objects directory.

Depends on #315

ikiril01 commented 11 years ago

We've had some additional requests for this Object, so I'm notionally adding it as a milestone for CybOX v2.1.

gtback commented 11 years ago

We want to keep this relatively simple for now, and not deal with the complexity of different file systems, until we separate the file content vs. file system properties on File/WinFile/UnixFile. The simple represntation should be in 2.1, though.

ikiril01 commented 11 years ago

Some possible properties for the v2.1 representation: is_compressed (Boolean; whether the directory is compressed or not) is_hidden (Boolean; whether the directory is hidden or not) is_offline (Boolean; whether the directory is offline or not) is_readonly (Boolean; whether the directory is readonly or not) is_symbolic_link (Boolean; whether the directory refers to a symbolic link or not) Directory_Path (String; the path to the directory, akin to the File_Path in the ObjectType)

ikiril01 commented 11 years ago

This requires more investigation of the nuances, especially with regards to the relationship with the File Object, so we will leave it out for 3.0.

ikiril01 commented 9 years ago

Context: this has been requested by several community members in the past, and would be useful for digital forensics related use cases, more accurately describing the operations of malware (i.e. in MAEC), and for specifying directory-related indicators (i.e. in STIX).

LOE: Medium