{"action":"created","issue":{"url":"https://api.github.com/repos/crits/crits/issues/503","labels_url":"https://api.github.com/repos/crits/crits/issues/503/labels{/name}","comments_url":"https://api.github.com/repos/crits/crits/issues/503/comments","events_url":"https://api.github.com/repos/crits/crits/issues/503/events","html_url":"https://github.com/crits/crits/issues/503","id":76787854,"number":503,"title":"New Object Type Vocabulary","user":{"login":"mgoffin","id":260873,"avatar_url":"https://avatars.githubusercontent.com/u/260873?v=3","gravatar_id":"","url":"https://api.github.com/users/mgoffin","html_url":"https://github.com/mgoffin","followers_url":"https://api.github.com/users/mgoffin/followers","following_url":"https://api.github.com/users/mgoffin/following{/other_user}","gists_url":"https://api.github.com/users/mgoffin/gists{/gist_id}","starred_url":"https://api.github.com/users/mgoffin/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mgoffin/subscriptions","organizations_url":"https://api.github.com/users/mgoffin/orgs","repos_url":"https://api.github.com/users/mgoffin/repos","events_url":"https://api.github.com/users/mgoffin/events{/privacy}","received_events_url":"https://api.github.com/users/mgoffin/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":5,"created_at":"2015-05-15T17:00:17Z","updated_at":"2015-05-18T10:47:35Z","closed_at":null,"body":"We need to come up with a new set of vocabulary for Object Types.\r\n\r\nCurrently they are based on CybOX vocabulary. They doesn't necessarily have to change if we all agree the current options are adequate. But it would mean de-coupling them from CybOX meaning it will not be updated if the CybOX vocabulary changes. If some don't seem to work well they can be removed. If there are ones we want to see that aren't listed we can add them.\r\n\r\nThe idea here is that we will maintain our own \"gold standard\" vocabulary that all CRITs users will have.\r\n\r\nObject Types is touchy because it handles several things:\r\n\r\n- IP Address types\r\n- Indicator types\r\n- Object types\r\n\r\nWe will no longer have this awkward hyphenated interpretation of the vocabulary where things are in sub-categories based on how we parse them. \r\n\r\nSince we will be controlling the vocabulary we will continue to make IP Address types a proper sub-set of Object Types. I am also going to propose the following:\r\n\r\n- Type\r\n- Threat Type\r\n\r\nWe have had so many requests for adding context to Indicators (outside of having to fill out a description). I think adding a Threat Type vocabulary will go a long way with helping this. For example, we can have an Indicator with:\r\n\r\n- Type: IPv4 Address\r\n- Threat Type: Proxy IP\r\n\r\nThis gives much more information to the analyst as to what this IP was used for. I want to extend this Threat Type to objects as well. This means when you add an Object to something like a Sample, instead of just seeing a Domain, you'll get to see some context as to what the domain is used for (like being a C2, hosting a malicious binary, etc.).\r\n\r\nRelated to #496 "},"comment":{"url":"https://api.github.com/repos/crits/crits/issues/comments/103014228","html_url":"https://github.com/crits/crits/issues/503#issuecomment-103014228","issue_url":"https://api.github.com/repos/crits/crits/issues/503","id":103014228,"user":{"login":"dsnellgrove","id":3044831,"avatar_url":"https://avatars.githubusercontent.com/u/3044831?v=3","gravatar_id":"","url":"https://api.github.com/users/dsnellgrove","html_url":"https://github.com/dsnellgrove","followers_url":"https://api.github.com/users/dsnellgrove/followers","following_url":"https://api.github.com/users/dsnellgrove/following{/other_user}","gists_url":"https://api.github.com/users/dsnellgrove/gists{/gist_id}","starred_url":"https://api.github.com/users/dsnellgrove/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/dsnellgrove/subscriptions","organizations_url":"https://api.github.com/users/dsnellgrove/orgs","repos_url":"https://api.github.com/users/dsnellgrove/repos","events_url":"https://api.github.com/users/dsnellgrove/events{/privacy}","received_events_url":"https://api.github.com/users/dsnellgrove/received_events","type":"User","site_admin":false},"created_at":"2015-05-18T10:47:35Z","updated_at":"2015-05-18T10:47:35Z","body":"I still have reservations but this makes more sense now. Sometimes you do have to break things a bit to fix them.\r\n\r\n:+1: "}}