Yeah, the Note object here is just Intel Note as we’ve previously discussed (originally proposed by Allan). It has a standard embedded relationship to all SDOs. I think we have a really solid definition for the scope on that one and how
it’s distinct from other objects.
Event and Incident is a broader topic, we made a bunch of good progress on the working call earlier for that one, I owe a readout to the list.
John
From: "Bret Jordan (CS)" <Bret_Jordan@symantec.com>
Date: Tuesday, August 29, 2017 at 9:41 PM
To: Terry MacDonald <terry.macdonald@cosive.com>
Cc: John Wunder <jwunder@mitre.org>, "cti-stix@lists.oasis-open.org" <cti-stix@lists.oasis-open.org>
Subject: Re: [cti-stix] Re: [EXT] Re: [cti-stix] Rename of Intel Note to Note
The Note object was created to track notes, activities, analyst assessments, extra textual data, etc etc. So we are not conflating anything. In fact, we are doing the opposite. The event object had this concept
of an activity log, that has been removed in place of just using events. This will mean there is no longer two ways of recording this kind of information.
Bret
From: Terry MacDonald <terry.macdonald@cosive.com>
Sent: Tuesday, August 29, 2017 3:51:06 PM
To: Bret Jordan
Cc: Wunder, John A.; cti-stix@lists.oasis-open.org
Subject: Re: [cti-stix] Re: [EXT] Re: [cti-stix] Rename of Intel Note to Note
Before I agree with this, I'd like a bit more background on the relationships between the concepts of Note, Event and Incident. I think it is very important to make sure we aren't conflating multiple concepts into a single object.
Cheers
Terry MacDonald | Chief Product Officer
On Wed, Aug 30, 2017 at 9:04 AM, Bret Jordan <Bret_Jordan@symantec.com> wrote:
I second that motion.
From: Wunder, John A. <jwunder@mitre.org>
Sent: Tuesday, August 29, 2017 3:02:31 PM
To: Bret Jordan; cti-stix@lists.oasis-open.org
Subject: [EXT] Re: [cti-stix] Rename of Intel Note to Note
I’m fine either way, so if you all have already talked about it and agree then I would like to move that if we don’t hear any dissent in the next week that we make this change.
From: <cti-stix@lists.oasis-open.org> on behalf of "Bret Jordan (CS)" <Bret_Jordan@symantec.com>
Date: Tuesday, August 29, 2017 at 4:33 PM
To: "cti-stix@lists.oasis-open.org" <cti-stix@lists.oasis-open.org>
Subject: [cti-stix] Rename of Intel Note to Note
All,
As we look to using the new Intel-Note object to track Activity for events and other data/notes in STIX, it has became clear that the term intel-note is probably not general enough. We talked on slack yesterday with Allan and Jason and others about just renaming it to be a more general term called "Note". Everyone seemed to agree. However, I just wanted to send this to the list to allow anyone that disagrees to comment.
Bret