Subject: [mile] Version 0.7 of the Cyber Observable eXpression (CybOX_v0.7) is now available

From: "Barnum, Sean D." <[email-masked]>
Date: Tue, 17 Jan 2012 19:40:57 +0000

If you are interested, version 0.7 of the Cyber Observable eXpression
(CybOX_v0.7) is now finished, has been released and is live on the website
(http://cybox.mitre.org/language/index.html).

The Version 0.7 release of CybOX includes a significant number of changes to
improve the expressiveness of the schema to better support the broad set of
use cases it targets (malware characterization, indicator and incident data
sharing, event management, etc.), to improve simplicity and efficiency, and
to mature descriptive formality for reference and implementation by other
standards and users.

We still have several things to work on and it is still evolving (as
evidenced by the sub-v1 version #) but we think that this release is a
significant improvement and a big step in the right direction.

Please take a look and give us your constructive feedback.

Release notes are on the site and highlight changes are included below.

Sean Barnum

[email-masked]

(703-473-8262)

Highlight changes from CybOX_v0.62 to CybOX_v0.7:

.        Annotated all Attributes, Elements & Types throughout the core
schema and most of the defined object schemas. A formal specification is in
the works.

.        Greatly increased the expressiveness of object attributes enabling
a variety of condition specifications including use of regex. The new
structure enables specification not only of attribute value "equal to"
something but also conditions such as: contains, does not contain, start
with, ends with, greater than, greater than or equal to, less than, less
than or equal to, is in range, is not in range, is in set, is not in set,
fits pattern (enabling use of regex, xpath or any other pattern syntax),
bitwise and, bitwise or.

.        Greatly enhanced the expressiveness of the Action construct to more
fully characterize cyber actions for use cases such as malware
characterization and event management. Details are in the bullets below.

.        Added the capability to describe Measure_Source content directly to
Event, Action and Object constructs to enable description of the
producing/observing source for each of these constructs.

.        Flattened out the core schema in several places through
restructuring for expressiveness, yielding a simpler and more efficient
schema.

.        For attributes and elements with enumerated value restrictions, the
inline restrictions for enumerated values have been replaced with enumerated
restriction types offering greater flexibility and maintainability.

.        Added global Pools at the highest level of the core schema for
Events, Actions, Objects and Attributes to enable potential reduction of
redundancy and referential efficiencies.