Jason Keirstead

Any update on what is going on with Correlations? The provisional spec is approaching two years old... will it ever be mainline?

Should this be closed? Correlations seems to not be marked provisional anymore

Agree the new version addresses the 2nd part of this.

I would like to be kept in the loop on this / would like to attend.

Thanks, I will submit a PR shortly

Suggest this be matrix expanded to include - Specific product - Ingest vs Produce - Some way to specify feature/function area in the product. Some vendors have a lot of...

@jp-harvey I don't know, but there are several OCSF members who are likely focusing primarily on consume use case right now - us for example and I have to presume...

@StephenOTT Can you go into more detail as to what you're looking for here?

@StephenOTT First the data format and layout for the security data living in Mongo that we're trying to go against would need to be defined. Shifter doesn't work if it...

@StephenOTT Kind of, except with Elastic we have some standard schemas to target. MITRE has defined a translation to their CAR schema, and we will also be developing a translation...