[STIX] Guide for subclassing CybOX objects?

classic Classic list List threaded Threaded
4 messages Options
Reply | Threaded
Open this post in threaded view
|

[STIX] Guide for subclassing CybOX objects?

John-Mark Gurney
Is there a good guide for subclassing CybOX objects?  I've seen some references that seem to say that you can subclass/expand existing objects (otherwise how does CustomObj work?), but I'm not familiar enough w/ XML schema design to know how to do that myself.

Thanks.
Reply | Threaded
Open this post in threaded view
|

Re: [STIX] Guide for subclassing CybOX objects?

Jon Baker
Administrator

“This page is intended to explain the process of creating a new CybOX Object for characterizing cyber observable data outside the scope of the current CybOX Object set. The concept of a CybOX Object referred to here is, more specifically, a set of schema-defined properties that can be used to characterize a given object in the cyber domain.”

 

http://cyboxproject.github.io/documentation/creating-objects/

 

That page should get you started. Let us know if you have any questions after reviewing the walk through.

 

Thanks,

 

Jon

 

============================================

Jonathan O. Baker

J83D - Cyber Security Partnerships, Sharing, and Automation

The MITRE Corporation

Email: [hidden email]

 

From: John-Mark Gurney [mailto:[hidden email]]
Sent: Wednesday, May 06, 2015 1:31 PM
To: stix-discussion-list Structured Threat Information Expression/ST
Subject: [STIX] Guide for subclassing CybOX objects?

 

Is there a good guide for subclassing CybOX objects?  I've seen some references that seem to say that you can subclass/expand existing objects (otherwise how does CustomObj work?), but I'm not familiar enough w/ XML schema design to know how to do that myself.

 

Thanks.

Reply | Threaded
Open this post in threaded view
|

Re: [STIX] Guide for subclassing CybOX objects?

Back, Greg
Beyond what Jon said (that writeup is extremely thorough!), I wanted to point out that the Custom Object just leverages the capability inherent to every CybOX object to add Custom Properties. A Custom object is made up of just custom properties, and no "fixed" properties. If you are subclassing an existing object or creating your own, you shouldn't have a need for custom properties; you should just add the properties you need.

Greg

>-----Original Message-----
>From: Baker, Jon [mailto:[hidden email]]
>Sent: Wednesday, May 06, 2015 1:37 PM
>To: stix-discussion-list Structured Threat Information Expression/ST
>Subject: Re: [STIX] Guide for subclassing CybOX objects?
>
>“This page is intended to explain the process of creating a new CybOX
>Object for characterizing cyber observable data outside the scope of the
>current CybOX Object set
><http://cyboxproject.github.io/documentation/objects> . The concept of a
>CybOX Object referred to here is, more specifically, a set of schema-
>defined properties that can be used to characterize a given object in the
>cyber domain.”
>
>
>
>http://cyboxproject.github.io/documentation/creating-objects/
>
>
>
>That page should get you started. Let us know if you have any questions
>after reviewing the walk through.
>
>
>
>Thanks,
>
>
>
>Jon
>
>
>
>============================================
>
>Jonathan O. Baker
>
>J83D - Cyber Security Partnerships, Sharing, and Automation
>
>The MITRE Corporation
>
>Email: [hidden email] <mailto:[hidden email]>
>
>
>
>From: John-Mark Gurney [mailto:[hidden email]]
>Sent: Wednesday, May 06, 2015 1:31 PM
>To: stix-discussion-list Structured Threat Information Expression/ST
>Subject: [STIX] Guide for subclassing CybOX objects?
>
>
>
>Is there a good guide for subclassing CybOX objects?  I've seen some
>references that seem to say that you can subclass/expand existing objects
>(otherwise how does CustomObj work?), but I'm not familiar enough w/ XML
>schema design to know how to do that myself.
>
>
>
>Thanks.

Reply | Threaded
Open this post in threaded view
|

Re: [STIX] Guide for subclassing CybOX objects?

John-Mark Gurney
Thanks Jon and Greg.  This is exactly what I was looking for.  Not sure how I missed it earlier.

And yes, after going through the example, I see that CustomObj is not that useful.  Thanks for pointing that out.

On Wed, May 6, 2015 at 12:46 PM, Back, Greg <[hidden email]> wrote:
Beyond what Jon said (that writeup is extremely thorough!), I wanted to point out that the Custom Object just leverages the capability inherent to every CybOX object to add Custom Properties. A Custom object is made up of just custom properties, and no "fixed" properties. If you are subclassing an existing object or creating your own, you shouldn't have a need for custom properties; you should just add the properties you need.

Greg

>-----Original Message-----
>From: Baker, Jon [mailto:[hidden email]]
>Sent: Wednesday, May 06, 2015 1:37 PM
>To: stix-discussion-list Structured Threat Information Expression/ST
>Subject: Re: [STIX] Guide for subclassing CybOX objects?
>
>“This page is intended to explain the process of creating a new CybOX
>Object for characterizing cyber observable data outside the scope of the
>current CybOX Object set
><http://cyboxproject.github.io/documentation/objects> . The concept of a
>CybOX Object referred to here is, more specifically, a set of schema-
>defined properties that can be used to characterize a given object in the
>cyber domain.”
>
>
>
>http://cyboxproject.github.io/documentation/creating-objects/
>
>
>
>That page should get you started. Let us know if you have any questions
>after reviewing the walk through.
>
>
>
>Thanks,
>
>
>
>Jon
>
>
>
>============================================
>
>Jonathan O. Baker
>
>J83D - Cyber Security Partnerships, Sharing, and Automation
>
>The MITRE Corporation
>
>Email: [hidden email] <mailto:[hidden email]>
>
>
>
>From: John-Mark Gurney [mailto:[hidden email]]
>Sent: Wednesday, May 06, 2015 1:31 PM
>To: stix-discussion-list Structured Threat Information Expression/ST
>Subject: [STIX] Guide for subclassing CybOX objects?
>
>
>
>Is there a good guide for subclassing CybOX objects?  I've seen some
>references that seem to say that you can subclass/expand existing objects
>(otherwise how does CustomObj work?), but I'm not familiar enough w/ XML
>schema design to know how to do that myself.
>
>
>
>Thanks.