Outstanding Items:
1) How do we handle an unknown start / end time? Do we just leave it blank or do we actually put in "unknown" or a zeroed out date/time?
2) Are these values good for the Confidence Vocab?
3) What should the Type Vocab be, is this really needed?
4) How do we handle a more elaborate object marking? Do we add a Marking_Detail as an object like I said earlier?
5) Do we really need multiple targets? Just trying to make sure John's question gets enough focus.
Thanks,
Bret
Bret Jordan CISSP
Director of Security Architecture and Standards | Office of the CTO
Blue Coat Systems
PGP Fingerprint: 63B4 FC53 680A 6B7D 1447 F2C0 74F8 ACAE 7415 0050
"Without cryptography vihv vivc ce xhrnrw, however, the only thing that can not be unscrambled is an egg."