[Date Prev] | [Thread Prev] | [Thread Next] | [Date Next] -- [Date Index] | [Thread Index] | [List Home]
Subject: Re: [cti] Text around bundle
Alright sorry for the double e-mail, talked through this a bit on Slack with Mark, Bret, and Ivan. We wanted to address Allan’s comments with the fewest changes to the existing text possible
given how many review cycles it’s been through. To that end, any objections to this? Ø
A Bundle is a collection of arbitrary STIX Objects grouped together in a single container. A Bundle does not have any semantic meaning and Objects are not considered related by
virtue of being in the same Bundle. Short, sweet, and to the point. John From:
<cti@lists.oasis-open.org> on behalf of John Wunder <jwunder@mitre.org> I like removing the SHOULD normative statement and your last sentence. I would also be fine with Rich’s suggestion. Allan, do you think something like what Bret wrote would work for you? If so and if nobody else has objections we can take this off list and do some word-smithing. John From:
<cti@lists.oasis-open.org> on behalf of "Bret Jordan (CS)" <Bret_Jordan@symantec.com> What about this: "A Bundle is a collection of arbitrary STIX Objects grouped together in a single container. Objects contained in a Bundle are not related solely by virtue of being in the same Bundle. Producers who wish to indicate that objects
are related should use SROs and / or the Report object to do so." Bret From: cti@lists.oasis-open.org <cti@lists.oasis-open.org> on behalf of Piazza, Rich <rpiazza@mitre.org> How about this then: Producers who wish to indicate that objects
within the Bundle are related should use SROs or the Report object to do so. From:
John Wunder <jwunder@mitre.org> Hm, I took it out because it seemed to imply that the objects could only be related if they were in the same bundle. Being in the same bundle has nothing to do with whether objects are
related and so IMO our language shouldn’t try to make those concepts overlap, even just as an example. From:
Rich Piazza <rpiazza@mitre.org> Fine, but I think the “within the Bundle” clause (applying to both SROs and Report) is clearer: Producers who wish to indicate that objects are related should use SROs or the Report object
within the Bundle to do so. From:
John Wunder <jwunder@mitre.org> With some slight changes that would work for me: A Bundle is a collection of arbitrary STIX Objects grouped together in a single container. Objects
in Note that the should is intentionally non-normative. From:
Rich Piazza <rpiazza@mitre.org> Here is some proposed text which use ideas from all suggestions: A Bundle is a collection of arbitrary STIX Objects grouped together in a single container. Objects contained with a Bundle
SHOULD NOT be assumed to be related solely by virtue of being in the same Bundle. Producers who wish to indicate that objects are related are encouraged to use SROs within the Bundle or the Report object to do so. From:
<cti@lists.oasis-open.org> on behalf of John Wunder <jwunder@mitre.org> Hm, we could add a sentence like: “Producers who wish to indicate that objects are related should use SROs and the Report object to do so.” From:
<cti@lists.oasis-open.org> on behalf of Patrick Maroney <oasis.individual@gmail.com> I think Allan's points are good. Can we add language in the Bundle descriptions that shows how one would make the assertion that objects in a bundle ARE related?
|
[Date Prev] | [Thread Prev] | [Thread Next] | [Date Next] -- [Date Index] | [Thread Index] | [List Home]