Description
PROBLEM
Deriving a specific OpenC2 target data model from STIX Cyber Observables requires some design tradeoffs. The Forum will need to decide on a single approach in order to develop the concrete command examples needed for interoperability.
POTENTIAL SOLUTIONS
1. Literal STIX Cyber Observables
Use SCO examples verbatim as targets:
{
"action": "scan",
"target": {
"0": {
"type": "domain-name",
"value": "www.example.com",
"resolves_to_refs": ["1", "2"] },
"1": {
"type": "ipv4-addr",
"value": "198.51.100.2" },
"2": {
"type": "domain-name",
"value": "ms34.example.com" }}}
2. Legacy OpenC2 with explicit Type and Specifiers properties
{
"action": "scan",
"target": {
"type": "domain-name",
"specifiers": {
"value": "www.example.com",
"resolves_to": [{
"type": "ipv4-addr",
"value": "198.51.100.2"
}, {
"type": "domain-name",
"value": "ms34.example.com" }]}}}
3. Use Types directly as property names
{
"action": "scan",
"target": {
"domain-name": {
"value": "www.example.com",
"resolves_to": [{
"ipv4-addr": {"value": "198.51.100.2"},
"domain-name": {"value": "ms34.example.com"}}]}}}
Advantage: For objects with just a type and a value it is more straightforward to encode as a single property: "mac-addr": "34:58:19:00:26:07" instead of as an object with type and value properties: "{ "type": "mac-addr", "value": "34:58:19:00:26:07" }. For objects that have properties other than value, even if optional, the value property must remain explicit as shown in the example. Note that the target has no separate "type" and "specifiers" properties; instead the target has a single object of the named type, and specifiers are properties of that object.
RECOMMENDATION
OpenC2 to use method 3 to derive targets from STIX Observables and CybOX 2.