Items from 7/26 Working Call

["Wunder, John A." <jwunder@mitre.org>]

All,

 

We discussed a number of items on the 7/26 working call. A quick summary of the decisions is:

 

Custom Properties Text - https://docs.google.com/document/d/1HJqhvzO35h62gQGPvghVRIAtQrZn3_J__0UcDAj-NXY/edit#heading=h.8072zpptza86

 

1.       We removed a “SHOULD” statement suggesting that custom properties should only be 30 characters. The two “MUST” statements remained the same.

2.       The MUST statements were added to the “Conventions” section at the top of the document to denote that they apply to the entire spec.

3.       Numbers (0-9) were added to the allowed characters in custom properties.

4.       Similar changes were made to Custom Objects

 

Lists - https://docs.google.com/document/d/1HJqhvzO35h62gQGPvghVRIAtQrZn3_J__0UcDAj-NXY/edit#heading=h.9w329aiwpu1y

 

1.       We added a statement saying that each instance of a list in STIX had to have at least one element. We clarified that empty lists were not permitted anywhere in STIX…if the property is required then at least one element is required, if the property is optional then it should be omitted rather than provided with an empty list. Please review the text to make sure this is clear.

2.       We decided to review cases where a list was required to determine whether it should be optional. “Labels” properties seemed to be common targets.

 

Observed Data - https://docs.google.com/document/d/1F1c05GgYaJFV1Z04B8c_T3vEE-LRQTPExF24LvOQAsk/edit#heading=h.k5fndj2c7c1k

 

1.       We discussed the way counts and timestamps interact with observed data. There was a lot of confusion about how it was described, so we took an action to clean it up. We spent some time as editors working on the description to hopefully get there, please review.

 

Special comment on this topic: we’ve discussed this numerous times, and ended up with several “solutions”. The current approach has had consensus. At this point I think we may need to stop proposing changes…things are the way they are for specific reasons, and having another call with different people in a different frame of mind will just lead to circular arguments. We need to focus more on explaining what’s there and how it should be used. To that end I would really ask people to help us get the descriptions and use cases correct, both on Observed Data and on the related Sighting object. I think we’re making progress here but we can use all the help we can get.

 

Thanks,

John