Our guest is Danny Elliott. He is a senior product owner for, UDI and CAR integrations at IBM Security. Danny, did you have anything else you wanted to say for your intro?

No. That's that's pretty good.

Alright. Then we'll just jump into the first question, can you give me your elevator pitch on the STIX shifter project?

STIX shifter is, A, Python library that is able to get data from various security products and data repositories. Essentially, what it does is it takes a, STIX pattern. STIX is a structured threat, intel expression, information expression. So it'll take a STIX pattern, translate that into a native data source query for the target connector, uses that data source's APIs to do a search, gets the results back and then translates that back into Stix objects of observed data.

Okay. How is it important to you?

Well, it's important to me because it's a way to normalize the data across different security products. So, you know, different products are all you know, have their own API endpoints, their own query languages. They return results in, you know, their own specific fields and formats. What STIX shifter allows us to do is use the, you know, the open source STIX Standard to normalize that data. So a developer could, say, integrate that into their own security products where they're able to use 1 query in the form of a STIX pattern and then do federated search across multiple data sources, provided that there is a connector that has been built for for the STIX shifter project.

Okay. So kind of like a translator kind of..

Exactly. Yeah, a translator and and also, like, transmission. So it handles all of the, API calls that are needed to actually do the search For the targeted data source.

Gotcha. Where can the project use help? What what are you guys ... or are there certain areas that might need more help than others or.. just in general..

We're we're always looking for new integrations. So so new connectors, obviously, are are always welcome. So someone in the open source community sees a need for a security product that isn't yet represented in STIX shifter. You know, we definitely always welcome that addition, but also anyone that has specific domain expertise around an existing connector. Maybe you have expertise with querying against Splunk, and you see that there's, there's some gaps or some defects in the existing connector. By all means, like, either raise an issue or or better yet, like, raise a poll request to make that fix.

Great. Awesome. I think that completes our interview for today. Thanks, Danny.