Changes to section 4.6

The editors changed the text, related to the pattern property of the Indicator, to address concerns discussed in emails and working calls.

Please review this new text and respond if you have additional concerns.

Rich

pattern (required)

string

The detection pattern for this Indicator MAY be expressed as a STIX Pattern as specified in section 9 or another appropriate language such as SNORT, YARA, etc.

pattern_type (required)

open-vocab

The pattern language used in this indicator.

The value for this property SHOULD come from the pattern-type-ov open vocabulary..

The value of this property MUST match the type of pattern data included in the pattern property.

pattern_version (optional)

string

The version of the pattern language that is used for the data in the pattern property which MUST match the type of pattern data included in the pattern property.

For patterns that do not have a formal specification, the build or code version that the pattern is known to work with SHOULD be used.

For the STIX Pattern language the default value is inferred from the specification version of the object.

For other languages, the default value SHOULD be the latest version of the patterning language at the time of this object's creation.

cti message