OASIS Mailing List ArchivesView the OASIS mailing list archive below
or browse/search using MarkMail.

 


Help: OASIS Mailing Lists Help | MarkMail Help

cti-stix message

[Date Prev] | [Thread Prev] | [Thread Next] | [Date Next] -- [Date Index] | [Thread Index] | [List Home]


Subject: Re: [cti-stix] Versioning terminology


Wunder, John A. wrote this message on Wed, Jun 01, 2016 at 01:10 +0000:
>   *   Object: An object consists of all versions of a STIX object [this definition clause is now kind of circular, which suggests to me that the rename is probably smart], identified by having the exact same value in the id field. Only the original object creator of an object is permitted to issue new versions of that object.

maybe it should be STIX TLO.  Though TLO is an Object, it's a well
defined different "object"...

>      *   For example, an object might be created to describe a certain threat actor. Even as the description and other details of that threat actor change over time, the object ID stays the same. Thus, that threat actor representation by that producer is identified by the id field for that object.
>   *   Object Version: An object version is a single version (instance) of a STIX object. STIX object versions are immutable: if the fields and values of that version are changed and the changed object is shared in a STIX ecosystem, these versioning processes must be followed. An object version is identified by the id and revision fields. Only the original object creator (the creator that created the ID and published the first version of the object series) is permitted to issue new versions of an object.

should just use instance instead of version, to again prevent circular
definitions...

We could add an additional statement, to address Terry's issue:
Once an object is shared w/ a specific id and revision, then the
fields must be the same as the first whenever shared.

>      *   For example, a particular version of the object describing that threat actor, consisting of a single version of that object, is identified with the id and revision field.
> So…what do you think? Do you like these new terms? I do, I think they make it significantly more clear for the majority of people who think about objects and versions rather than object series and objects in that series.

Just need to resolve the circular issues, but otherwise good.

-- 
John-Mark


[Date Prev] | [Thread Prev] | [Thread Next] | [Date Next] -- [Date Index] | [Thread Index] | [List Home]