Re: [cti-stix] external-references keywords

[John-Mark Gurney <jmg@newcontext.com>]

Jason Keirstead wrote this message on Wed, Jun 01, 2016 at 09:28 -0300:
> The reason I brought it up is if we could combine the semantics, it would
> allow people to optionally EMBED the external resource into the STIX
> document.
> 
> This may be desired in some situations
> - where these external resources are subject to change and you want to
> ensure your document contains the current state at the time the document
> was created, in addition to the external URI.
> - where the external resource is proprietary / internal and thus can't be
> accessed by others, but you are OK sharing the content.
> 
> JIRA is a good example of this.. what if I add an external reference to a
> JIRA or Bugzilla entry living at https://10.0.0.1/? and share that... that
> external reference is useless to everyone. But maybe I want to also EMBED
> the content in my document, to make it not useless. The "Artifact" cybox
> object has this capability.

Yes, it does, but how are you wanting to share this information?  Are
you simply making it an Observation that you publish w/o further
information, or what?  Are you wanting to share the web page? or?

Also, the Artifact object wouldn't help you in this case, as it
explicitly states that if you provide a URL, that you cannot provide
a payload, and vice versa.  So you couldn't say here is a page what
was located here.  Anyways, an HTTP Request object would be better
when sharing this information...

-- 
John-Mark