Jonathan Baker

@Cyb3rPandaH @kwm @Cyb3rWard0g @taosecurity @MITREattack @Hexacorn @Cyb3rWard0g @Cyb3rPandaH Let us know if you think we should add any of those utility functions to the example code we provide with the CTI repo (github.com/mitre/cti/blob…). Sometime this fall we will add a bit more code to the mitre-attack repo too.

@kwm @Cyb3rWard0g @taosecurity @MITREattack @Hexacorn Nice @kwm . We just added the function "get_techniques_by_datasources" to our python library. Two example were added to the notebook we used for @MITREattack #ATTACKcon . The function is case insensitive 😉. I hope this helps 🍻

For those using @MITREattack to measure or reason about *visibility*: 75-85% of ATT&CK techniques are consistently observable[1] via leading commercial EDR products. [1] Available for threat hunting, detection, investigation and similar use cases.

@MITREattack @Cyb3rWard0g @Cyb3rPandaH Great to see you building on the new STIX represtation of ATT&CK and the python-stix2 library.

@Cyb3rWard0g @Cyb3rPandaH @Cyb3rWard0g talking about the great ATTACK-Python-Client he created in order to work directly with ATT&CK information out of ATT&CK's TAXII server. #ATTACKcon

Next up, we're pleased to welcome the Rodriguez brothers: Roberto (@Cyb3rWard0g) and Jose Luis (@Cyb3rPandaH) present "Hunters ATT&CKing with the Right Data." #ATTACKcon

@fusionrace @MITREattack @MITREpreattack yeah, we need to make it easier for people to understand what has changed in an ATT&CK update. In the near future (maybe next week), we will start publishing a layer file for the ATT&CK Navigator with each release to help highlight changes.

The updates to ATT&CK and @mitrepreattack are out, now with more Initial Access! Check out the update log attack.mitre.org/wiki/Updates_A…

We are hiring! Do you know what OVAL is? Want to help make it better? Product Owner, OVAL buff.ly/2IpmiWF

@dallendoug dcrainmaker.com/2017/03/garmin…

@dallendoug Check out github.com/mitre/cti

@treyka bit.ly/1S3qY2a?16124i…

@adammontville bit.ly/22rqCay?53122w…

@workgerrym bit.ly/1RRijDk?13135o…

@jl_heronetwork bit.ly/1T1om7g?31642m…

@rattis @Digital4rensics STIX and TAXII are CTI specifications. OASIS is now leading the development of STIX and TAXII.

@Bry_Campbell @beast_fighter CRITS is just a tool. You can think of it as a threat intel platform.

@codeslack I am curious to know which MITRE schemas you have worked with and found to be bloated. We welcome any of your feedback.