Should CyboX events, actions and type enumerations live within the object that uses them?

[Terry MacDonald <terry@soltra.com>]

Hi All,

 

This might be unworkable, but I thought I’d throw it out there anyway.

 

I just was reading through the list of EventTypeEnum-1.0.1 here, and I thought to myself, as these objects are generally ‘derived from’ and related to each other in a tree like structure, it could make sense to actually house the enumerations relating to an object specifically with the object itself. That would then allow us to make sure that the enumerations available to use for each Observable Object are the relevant events, actions, etc for that particular object – all information that pertains to the object in one place.. within the object itself.

 

Should CyboX events, actions and type enumerations live within the object they refer to? Is that even a workable idea?

 

To be absolutely clear, I’ve not worked through the ramifications of doing so, but wanted to source other’s opinions on the idea. Plus its late on Friday – weird ideas are supposed to happen late on Fridays J.

 

Cheers

 

Terry MacDonald

Senior STIX Subject Matter Expert

SOLTRA | An FS-ISAC and DTCC Company

+61 (407) 203 206 | terry@soltra.com