Re: [cti-stix] Re: Possible items for STIX 2.1

[Trey Darley <trey@kingfisherops.com>]

On 10.11.2016 14:39:28, Shaun McCullough wrote:
> I would vote for having a the event_type attribute rather than
> separate objects. That way, the object can transition from event, to
> incident, to false_alarm, etc
> 

+100

-- 
Cheers,
Trey
++--------------------------------------------------------------------------++
Kingfisher Operations, sprl
gpg fingerprint: 85F3 5F54 4A2A B4CD 33C4  5B9B B30D DD6E 62C8 6C1D
++--------------------------------------------------------------------------++
--
"With sufficient thrust, pigs fly just fine. However, this is not
necessarily a good idea. It is hard to be sure where they are going to
land, and it could be dangerous sitting under them as they fly
overhead." --RFC 1925

Attachment: signature.asc
Description: Digital signature