[Date Prev] | [Thread Prev] | [Thread Next] | [Date Next] -- [Date Index] | [Thread Index] | [List Home]
Subject: Re: [cti-stix] version_comment field
I agree, I see it being very useful. Pretty much every product will have such a field internally. If it is not in STIX, then that information will be locked behind product walls, inhibiting cross-product communication. There are TIP products (multiple that I’m aware of) today that allow commenting on changes to intel made by human beings. Changing a field or object or creating a relationship by the human does not convey why they made that change. Therefore being able to comment on that change and communicate that reason is a good thing to do. It’s a useful feature in the products and I would suggest unless there is a big issue with keeping this optional field that we keep it. allan From: "cti-stix@lists.oasis-open.org" <cti-stix@lists.oasis-open.org> on behalf of Terry MacDonald <terry.macdonald@cosive.com> Date: Wednesday, August 3, 2016 at 1:13 PM To: "Jordan, Bret" <bret.jordan@bluecoat.com> Cc: "cti-stix@lists.oasis-open.org" <cti-stix@lists.oasis-open.org>, "Wunder, John" <jwunder@mitre.org> Subject: Re: [cti-stix] version_comment field This to me is useful internally as part of the workflow, but isn't that useful as part of something being shared. A computer will be able to discern what has changed in the object when it was updated, so this field only repeats that in human terms - which the recipients implementation would be able to do anyway. I don't think the field should be included. Cheers Terry MacDonald
Hey everyone, Back when we talked about versioning at the DC3 F2F, one of the properties we added to STIX Object common properties was “version_comment”. The intent was to allow people to add a comment saying why they created a particular version (e.g. “fixed a typo” or “corrected domain” or something like that). The property is optional on all STIX Objects. As we’ve been going through the properties though we started to wonder if version_comment would really be used in practice. Is that something that existing TIPS and other tools actually populate? Or would populate if they had such a field? We want to be careful not to add fields just because we think they might be useful…it’s easy enough to add things in 2.1 if we find we need them, it’s a lot harder to take things away. So what do you think? Should we keep the version_comment field for STIX 2.0? Thanks, John |
[Date Prev] | [Thread Prev] | [Thread Next] | [Date Next] -- [Date Index] | [Thread Index] | [List Home]