[GitHub] metron issue #689: METRON-1102: Add support for ingesting cybox URI observab...

2017-08-10 Thread ottobackwards
Github user ottobackwards commented on the issue: https://github.com/apache/metron/pull/689 +1 by inspection. --- If your project is set up for it, you can reply to this email and have your reply appear on GitHub as well. If your project does not have this feature enabled and

[GitHub] metron issue #689: METRON-1102: Add support for ingesting cybox URI observab...

2017-08-10 Thread ottobackwards
Github user ottobackwards commented on the issue: https://github.com/apache/metron/pull/689 I would like to see at least the version of Stix and Cybox that is supported documented. --- If your project is set up for it, you can reply to this email and have your reply appear on

[GitHub] metron issue #689: METRON-1102: Add support for ingesting cybox URI observab...

2017-08-10 Thread cestella
Github user cestella commented on the issue: https://github.com/apache/metron/pull/689 Yeah, it seems to me that we might need something like a location for discussion and description of architectural decisions made. --- If your project is set up for it, you can reply to this email

[GitHub] metron issue #689: METRON-1102: Add support for ingesting cybox URI observab...

2017-08-10 Thread cestella
Github user cestella commented on the issue: https://github.com/apache/metron/pull/689 Ah, for the moment we only have the StixExtractor. We could MAKE a cybox extractor and it could reuse the handler logic, but we haven't done that. --- If your project is set up for it, you can

[GitHub] metron issue #689: METRON-1102: Add support for ingesting cybox URI observab...

2017-08-10 Thread ottobackwards
Github user ottobackwards commented on the issue: https://github.com/apache/metron/pull/689 As for where... over in METRON-777 @mmiklavc is talking about a better documentation area... this may fall into that --- If your project is set up for it, you can reply to this email and have

[GitHub] metron issue #689: METRON-1102: Add support for ingesting cybox URI observab...

2017-08-10 Thread ottobackwards
Github user ottobackwards commented on the issue: https://github.com/apache/metron/pull/689 > Can we handle just Cybox What I mean is, can we import a file that is **ONLY** cybox observables, without Stix. Stix supports cybox. But they are separate things. --- If

[GitHub] metron issue #689: METRON-1102: Add support for ingesting cybox URI observab...

2017-08-10 Thread cestella
Github user cestella commented on the issue: https://github.com/apache/metron/pull/689 Ok, so good questions @ottobackwards . I'll do my best to answer them, but the answer to some of these expands past this PR and to the history of Taxii support for Metron (which was one of the

[GitHub] metron issue #689: METRON-1102: Add support for ingesting cybox URI observab...

2017-08-09 Thread ottobackwards
Github user ottobackwards commented on the issue: https://github.com/apache/metron/pull/689 So, I think this is a great addition, but I have some comments. - Where is the documentation for the version of Stix and the Version of Cybox metron supports? - How is the