Labels versus marking

[Alexandre Dulaunoy <Alexandre.Dulaunoy@circl.lu>]

Hi All,

Going back to our discussion at the F2F meeting, I wanted to just put on the
table again the discussion on how to express a machine-parsable and human-readable
tag in a STIX 2.0. We evaluated various options and we came with some questions.

- What is the fundamental difference between label and marking?
- Could we reduce the label to a generic approach which is not a property (a list to a type)
  as it? but a simple reference like the marking?
- Are the open vocabulary limited to labels? or can we use them for the marking too?
- Can we imagine to reduce label and marking into a single concept? and share the vocabulary
  among the type without binding them to a specific type (malware->list of labels->malware vocabulary only)

This is just a series of open questions in the quest of simplification.

Thank you very much.

Cheers.

-- 
Alexandre Dulaunoy
CIRCL - Computer Incident Response Center Luxembourg
41, avenue de la gare L-1611 Luxembourg
info@circl.lu - www.circl.lu