Re: [cti-stix] Observation Rename

[Allan Thomson <athomson@lookingglasscyber.com>]

I would prefer “CyBox Data”.

The word “Fact” makes me nervous as it is a level of assessment that does not exist in the data that is provided.

Just because you captured data does not make that data accurate. One would have to determine how the data was captured, and measured to be translated into a Cybox/STIX object before you could say its ‘truth’. 

allan

On 7/6/16, 7:38 AM, "cti-stix@lists.oasis-open.org on behalf of Piazza, Rich" <cti-stix@lists.oasis-open.org on behalf of rpiazza@mitre.org> wrote:

Sounds like "Facts about CybOX"

-1

-----Original Message-----
From: cti-stix@lists.oasis-open.org [mailto:cti-stix@lists.oasis-open.org] On Behalf Of Kirillov, Ivan A.
Sent: Wednesday, July 06, 2016 10:30 AM
To: Trey Darley <trey@kingfisherops.com>; Jordan, Bret <bret.jordan@bluecoat.com>
Cc: cti-stix@lists.oasis-open.org
Subject: Re: [cti-stix] Observation Rename

+1 for CybOX Facts – I think it’s very clear and to the point. Also, it permits for the expression of cyber data that may be factual but not observed, such as future DGA-generated domains.

Regards,
Ivan

On 7/6/16, 8:05 AM, "Trey Darley" <cti-stix@lists.oasis-open.org on behalf of trey@kingfisherops.com> wrote:

>On 05.07.2016 17:41:12, Jordan, Bret wrote:
>> 
>> One option we talked about was just renaming one or both of the
>> objects.... What if we renamed "Observation" to "Observation Data"
>> or something similar? Would it then be more clear that this object
>> just contains data or facts?
>> 
>> Other options, since this object can only support CybOX is we call
>> it "CybOX Data". The term "Cyber Data" was shot down on the call.
>> 
>
>Occam's Razor: let's change Observation to CybOX Facts. Simple,
>obvious, straight to the point.
>
>-- 
>Cheers,
>Trey
>++--------------------------------------------------------------------------++
>Kingfisher Operations, sprl
>gpg fingerprint: 85F3 5F54 4A2A B4CD 33C4  5B9B B30D DD6E 62C8 6C1D
>++--------------------------------------------------------------------------++
>--
>"It is always possible to add another level of indirection." --RFC 1925

<<attachment: winmail.dat>>