OCSF v1.1.0 being synchronised with ITU-T SG17 X.icd-schemas

[taddhar]

As shared in #8 and as per discussions in our weekly calls, I want to update the team on the below:

I could submit 2 contributions in time to the next ITU-T SG17 meeting 20th of February - 1st of March in Geneva.

1. C611

The first contribution is

C611 4th Revised baseline text for X.icd-scheams, Vendor agnostic security data schemas for integrated cyber defence solutions.

This contribution will litterally erase the old Symantec ICDx schemas and replace them by a Word rendering of the documentation and the schema itself based on v1.1.0 as requested by @pagbabian-splunk in our calls.

The objective of this contribution is to make the full reset first and restart from a clean ground and in full synchronization of v1.1.0 apart from 1 (one) dictionary attribute: category_ids as, in the current circumstances would create a massive issue with some member states in regards to ITU PP22 Resolution 130 Resolve 5 (welcome to United Nations).

I am NOT sending this text for what is called 'consent' (the step before the Recommendation is approved and therefore published as X.yyyy). There are many reasons for this and before anything:

• I would like a chance to present this work to this community here,
• I would like a chance for the ITU-T SG17 menbers to review this work.

Among other reasons, I would like as well to change the name and bring OCSF vs ICD schemas and align a number of other things.

My hope is that the ITU-T SG17 community scrutinise the language and gives overall feedback but in particular gives feedback on any potential interpretation issue in the 6 languages that the text will be translated into: English, French, Spanish, Arabic, Chinese and Russian.

There are as well many editorial and formatting issues I would like to improve

2. C614

The second contribution is

C614 Proposed tutorial: Using tools to support the development of Recommendations

In this contribution I will share to SG17 members how to use tools such as metanorma, liquid templates and GitHub to produce Recommendations and use X.icd-schemas as an example. Indeed this was the only way so far I could automate the synchronisation of

• a set of JSON scripts and markdown documents,
• into a Word normative ITU Recommendation.

3. Way forward

At this stage these are contributions and we will see if I am successful or not at the meeting. Hoping for a successful outcome, I hope to then give a status here and share on the results.

Any questions for clarifications / comments / feedback welcome.