[Date Prev] | [Thread Prev] | [Thread Next] | [Date Next] -- [Date Index] | [Thread Index] | [List Home]
Subject: Re: [cti-stix] Labels versus marking
Can you give some examples of what you are wanting to do? The current labels property is a way of tracking the old "malware type" for example. It also allows products to add extra labels or tags to an object for use in their classifications. I view this as means of mimicking Evernote's or GMail's labels. Bret Sent from my Commodore 64 > On Sep 20, 2016, at 9:52 AM, Alexandre Dulaunoy <Alexandre.Dulaunoy@circl.lu> wrote: > > Hi All, > > Going back to our discussion at the F2F meeting, I wanted to just put on the > table again the discussion on how to express a machine-parsable and human-readable > tag in a STIX 2.0. We evaluated various options and we came with some questions. > > - What is the fundamental difference between label and marking? > - Could we reduce the label to a generic approach which is not a property (a list to a type) > as it? but a simple reference like the marking? > - Are the open vocabulary limited to labels? or can we use them for the marking too? > - Can we imagine to reduce label and marking into a single concept? and share the vocabulary > among the type without binding them to a specific type (malware->list of labels->malware vocabulary only) > > This is just a series of open questions in the quest of simplification. > > Thank you very much. > > Cheers. > > -- > Alexandre Dulaunoy > CIRCL - Computer Incident Response Center Luxembourg > 41, avenue de la gare L-1611 Luxembourg > info@circl.lu - www.circl.lu > > --------------------------------------------------------------------- > To unsubscribe from this mail list, you must leave the OASIS TC that > generates this mail. Follow this link to all your TCs in OASIS at: > https://www.oasis-open.org/apps/org/workgroup/portal/my_workgroups.php >
[Date Prev] | [Thread Prev] | [Thread Next] | [Date Next] -- [Date Index] | [Thread Index] | [List Home]