Re: [cti-stix] RE: Indicators and patterning

[John-Mark Gurney <jmg@newcontext.com>]

Wunder, John A. wrote this message on Tue, Oct 25, 2016 at 22:28 +0000:
> Since an indicator can now have more than one pattern we need some text to call out how they're related (are they alternatives? do they need to test for the same exact things? Is one preferred?)

If we support both/multiple, they need to be equivalent.  Otherwise if
one implementation picks YARA, and the other picks native, they won't
operate the same.

-- 
John-Mark