STIX Patterning - ALONG/OTHERWISE

["Kirillov, Ivan A." <ikirillov@mitre.org>]

Hi All,

 

On today’s call we discussed the addition of a new OTHERWISE operator that functions effectively as an OR between discrete Observation Expressions. During the call, many posed the question of why we call the AND/OR operators for Observations Expressions ALONGWITH/OTHERWISE, instead of, well, just AND and OR. Our rationale during writing the spec was that it would be easier to explain combinatorial patterns across multiple Observations using different terminology, but in hindsight this may well cause more confusion than anything, which seemed to be the consensus on today’s call.

 

Anyhow, I’ve gone and updated the STIX Patterning specification to use AND and OR for both Observation Expressions and Comparison Expressions. It still made sense to leave Observation Operators as a separate class (for FOLLOWEDBY) but to use the Boolean Operators for the aforementioned entities. If anyone has a chance to review the specification and subsequently these new changes, that would be great: https://docs.google.com/document/d/1suvd7z7YjNKWOwgko-vJ84jfGuxSYZjOQlw5leCswPY/edit#heading=h.4do73o99e2l7

 

Regards,

Ivan