[sarahj]

My guess is that for the most part the vendors wouldn't care - which would mean that every update cycle you would have to spend a day patching the platform to cope with whimsical proprietary format changes. Actively hostile vendors could easily make it very difficult to scale out the platform, even if they didn't target you for legal action.

Ultimately what we need here are open standards at all levels, that is the only way you can have a stable interaction of systems and keep the market open and competitive.

[walterbell]

One effort at a standard, http://stix.mitre.org

"STIX™ is a collaborative community-driven effort to define and develop a standardized language to represent structured cyber threat information. The STIX Language intends to convey the full range of potential cyber threat information and strives to be fully expressive, flexible, extensible, automatable, and as human-readable as possible. All interested parties are welcome to participate in evolving STIX as part of its open, collaborative community."

http://stix.mitre.org/language/version1.1.1/samples.html