Re: Proposal - Change Report Object

[Aharon Chernin <achernin@soltra.com>]

+1

This was one of the original proposals for the report object. 

Aharon Chernin
CTO

SOLTRA | An FS-ISAC & DTCC Company

18301 Bermuda green Dr

Tampa, fl 33647

813.470.2173 | achernin@soltra.com

www.soltra.com

---

From: cti-stix@lists.oasis-open.org <cti-stix@lists.oasis-open.org> on behalf of Jordan, Bret <bret.jordan@bluecoat.com>
Sent: Monday, July 27, 2015 10:57 AM
To: cti-stix@lists.oasis-open.org
Subject: [cti-stix] Proposal - Change Report Object

 

In STIX 2.0 I would like to propose that we change the Report Object to contain just reference to the objects that it is binding.  I do not want to see it contain data itself.  

[soap box]

We need one way of doing things and the current data-model of STIX, while beautiful, makes writing a decision tree in code for some arbitrary data in a STIX package nearly impossible. .

[/soap box]

Thanks,

Bret

Bret Jordan CISSP

Director of Security Architecture and Standards | Office of the CTO

Blue Coat Systems

PGP Fingerprint: 63B4 FC53 680A 6B7D 1447  F2C0 74F8 ACAE 7415 0050

"Without cryptography vihv vivc ce xhrnrw, however, the only thing that can not be unscrambled is an egg."