Re: [cti-stix] Re: [EXT] Re: [cti-stix] Possible solution to conundrum of how to do patterns for Infrastructure and Malware

[Trey Darley <trey@kingfisherops.com>]

On 25.05.2017 13:14:58, Jason Keirstead wrote:
> 
> I am also not sure what having observables as TLOs gains you. I
> think it would make things quite messy actually and not contribute
> to solving this problem...
> 

While I was initially supportive of making STIX Observables (CybOX at
the time) into first-class TLOs during The Great Arglebargle Debate of
2016, doing so at this point would require a *significant* reworking
of STIX 2.0, Parts 3-5. Making such a radical change this late in the
process are negligible when compared to the impact of delaying STIX
2.0 by some months.

I recommend tabling the discussion of making Observables TLOs until
STIX 3.0.

-- 
Cheers,
Trey
++--------------------------------------------------------------------------++
Kingfisher Operations, sprl
gpg fingerprint: 85F3 5F54 4A2A B4CD 33C4  5B9B B30D DD6E 62C8 6C1D
++--------------------------------------------------------------------------++
--
"Good, Fast, Cheap: Pick any two (you can't have all three)." --RFC 1925

Attachment: signature.asc
Description: Digital signature