Re: Reviewing External-Reference

I would prefer that we only add things to the Common TLO Properties section once we know that it is in fact needed on every TLO. I do not want to just artificially add things to TLOs that may never need them.

So lets use the external-reference type for Attack Pattern and see if anything else needs it in the future. My guess is that only a small handful of things will actually end up needing it.

Bret

From: cti-stix@lists.oasis-open.org <cti-stix@lists.oasis-open.org> on behalf of Piazza, Rich <rpiazza@mitre.org>
Sent: Tuesday, June 14, 2016 10:35 AM
To: cti-stix@lists.oasis-open.org
Subject: [cti-stix] Reviewing External-Reference

When reviewing the External Reference type (https://docs.google.com/document/d/1HJqhvzO35h62gQGPvghVRIAtQrZn3_J__0UcDAj-NXY/edit#heading=h.cez46v5quobo ), please consider the usages of it.

In the original proposal, as discussed on a previous working call, it was suggested that external_references be added as a Common TLO field.

However, the Common TLO section’s status was already “Consensus”, so your humble editors didn’t want to change that text without discussion.

An alternative is to only include it for particular TLOs. It originally was discussed by John Wunder as a way to support external_ids like CAPEC. Therefore, it would be make sense for it to be a field of Attack Pattern, for instance. However, it was broadened to include URLs, so it was thought that all TLOs might need this concept. So……

…as we finalize External References, we must also approve how it is used. The choices are:

· external_references is a Common TLO field

· external_references is a field on a TLO if there is an explicit use case for it (e.g., Attack Pattern).

cti-stix message