Patterning MVP Operators

["Kirillov, Ivan A." <ikirillov@mitre.org>]

Looking at the current set of operators defined in the CybOX Patterning specification [1], I’ve been wondering if we need all of the current operators for the MVP release of patterning. In particular, it strikes me that the FOLLOWEDBY and REPEATED operators represent capabilities that are not seen in 99% of IOCs in use today. Does anyone have any real-world indicators that they need such operators for the _expression_ of? If not, it may make sense to consider moving them out to a future release, which will in turn make the patterning specification simpler and also easier to implement for end-users.

 

[1] https://docs.google.com/document/d/1suvd7z7YjNKWOwgko-vJ84jfGuxSYZjOQlw5leCswPY/edit#heading=h.t32x0azc539r

 

Regards,

Ivan