Re: [cti-stix] Event proposal updated

[Trey Darley <trey@newcontext.com>]

On 25.08.2017 20:39:44, Wunder, John A. wrote:
>
>   2. We have three sets of properties that people have suggested we
>   might want to exclude for Event in 2.1. Please review these and
>   let us know whether they should be included or removed.
>      * coa_taken and collected_data (observed data)
>      * Financial impact
>      * Aliases
>

I was the one questioning the usefulness of the `aliases` property.
Bret says that it's used all the time to characterize Event data. I'd
happily withdraw my objection if someone could give me a concrete real
world example. (Newsflash: I don't know everything. ^_^)

>
>   4. There were two sets of relationships that had a lot of semantic
>   overlap and we had trouble writing up separate descriptions:
>      * Event had “exploits”, “targets”, and “impacts” relationships
>        to Location and Identity. We consolidated that list to
>        “targets”, but if people feel we need all three (or two of
>        the three) they can be added back…the request though is that
>        if you want them added back, you need to provide a good
>        description for each one that lets us distinguish them.
>

The `impacts` property is semantically distinct from `targets` insofar
as (at least in my mind) it allows characterization of collateral
(i.e., probably unintended) effects.

-- 
Cheers,
Trey
++--------------------------------------------------------------------------++
Director of Standards Development, New Context
gpg fingerprint: 3918 9D7E 50F5 088F 823F  018A 831A 270A 6C4F C338
++--------------------------------------------------------------------------++
--
"The newest computer can merely compound, at speed, the oldest problem
in the relations between human beings, and in the end the communicator
will be confronted with the old problem, of what to say and how to say
it." --Edward R. Murrow

Attachment: signature.asc
Description: Digital signature