search

oasis-open / cti-stix-elevator

OASIS Cyber Threat Intelligence (CTI) TC Open Repository: Convert STIX 1.2 XML to STIX 2.x JSON
https://stix2-elevator.readthedocs.io/en/latest/
BSD 3-Clause "New" or "Revised" License
49 stars 23 forks source link

Ensure string literals adhere to specification #15

Open gtback opened 7 years ago

gtback commented 7 years ago

Lower case with -s. One specific example is kill chain names.

gtback commented 7 years ago

Might also want a special conversion for the LMCO kill chain, to convert from the old IDs to the values specified in 2.0.

rpiazza commented 6 years ago

Not sure what you mean here. We didn't put the LMCO kill chain into the spec like we did with TLP

gtback commented 6 years ago

I commented on November 16, 2016, not 2017 šŸ˜ How can you expect me to remember what I meant last year?

I think I meant this from the table in Section 2.7 of Part 1 of STIX 2.0:

The value of this property SHOULD be all lowercase (where lowercase is defined by the locality conventions) and SHOULD use hyphens instead of spaces or underscores as word separators.

I'm not sure if there are other parts of the spec that suggest certain formats (labels, etc.)

Regarding LMCO, I must have been referring to this:

When referencing the Lockheed Martin Cyber Kill Chainā„¢, the kill_chain_name MUST be lockheed-martin-cyber-kill-chain

And that we should detect the IDs we "defined" in STIX 1.2 and convert them to the correct LMCO Kill Chain phase names in 2.0.

The second thing is not a high priority, but would be nice.