Issues

• Consider making title/description optional on vulnerability, weakness, and configuration

  johnwunder/twigs#40 · Filter by author johnwunder opened on Jan 12, 2016

• Observations don't cover pre-exploit things like recon.

  johnwunder/twigs#39 · Filter by author terrymacdonald opened on Jan 4, 2016

• How should TWIGS represent infrastructure?

  johnwunder/twigs#38 · Filter by author johnwunder opened on Jan 3, 2016
  3

• We should be able to better describe each STIX object in words

  johnwunder/twigs#37 · Filter by author chipi opened on Dec 29, 2015

• Should relationship be "describable"

  johnwunder/twigs#36 · Filter by author johnwunder opened on Dec 23, 2015

• Clarify semantics of different types of TTPs

  johnwunder/twigs#34 · Filter by author johnwunder opened on Dec 14, 2015
  1

  

• Simplify structure for Controlled Vocabularies

  johnwunder/twigs#33 · Filter by author johnwunder opened on Dec 14, 2015
  

• Relationships should be a top-level object

  johnwunder/twigs#32 · Filter by author johnwunder opened on Dec 14, 2015
  1

  

• Extend core constructs from single base type

  johnwunder/twigs#31 · Filter by author johnwunder opened on Dec 14, 2015
  2

  

• Some Object names are confusing

  johnwunder/twigs#30 · Filter by author terrymacdonald opened on Dec 2, 2015
  1

• Are CybOX <Object> IDs used in STIX?

  johnwunder/twigs#29 · Filter by author terrymacdonald opened on Dec 2, 2015

• Which to use? Indicator Composition, Observable Composition, or referenced Object?

  johnwunder/twigs#28 · Filter by author terrymacdonald opened on Dec 2, 2015
  8

  

• TTPs are almost mandatory

  johnwunder/twigs#27 · Filter by author terrymacdonald opened on Dec 2, 2015

• Relationships are constrained to limited Objects within STIX

  johnwunder/twigs#26 · Filter by author terrymacdonald opened on Dec 2, 2015

• Cannot suggest hypotheses to a community through STIX

  johnwunder/twigs#25 · Filter by author terrymacdonald opened on Dec 2, 2015

• Difficult to group 'possibly' related things during an investigation

  johnwunder/twigs#24 · Filter by author terrymacdonald opened on Dec 2, 2015

• Interoperability is difficult if custom vocabularies are allowed

  johnwunder/twigs#23 · Filter by author terrymacdonald opened on Dec 2, 2015

• No STIX-wide way to handle aliases

  johnwunder/twigs#22 · Filter by author terrymacdonald opened on Dec 2, 2015

• Victim Targeting is embedded within a TTP

  johnwunder/twigs#21 · Filter by author terrymacdonald opened on Dec 2, 2015

• Difficult to ask for a referred object

  johnwunder/twigs#20 · Filter by author terrymacdonald opened on Dec 2, 2015

• Obfuscation of Producer Identity is Difficult

  johnwunder/twigs#19 · Filter by author terrymacdonald opened on Dec 2, 2015

• Difficult for third parties to show agreement or disagreement

  johnwunder/twigs#18 · Filter by author terrymacdonald opened on Dec 2, 2015
  1

• Embedded and Referencing Objects

  johnwunder/twigs#17 · Filter by author terrymacdonald opened on Dec 2, 2015

• Indicators/Observable, Composition/Object hierarchy is complicated

  johnwunder/twigs#16 · Filter by author terrymacdonald opened on Dec 2, 2015

• Too many ways to do things

  johnwunder/twigs#15 · Filter by author terrymacdonald opened on Dec 2, 2015