Re: [cti-stix] Current thoughts on Event Object

[Trey Darley <trey@newcontext.com>]

On 11.09.2017 15:38:20, Sean Barnum wrote:
> 
>   3. We believe Object 3 should be a new Investigation object that
>      is immutable, evolves over time, captures CTI-relevant metadata
>      about a cyber investigation and references CTI-relevant content
>      developed/derived from a cyber investigation.
>

Hey, Sean -

I'm struggling to grok the concept of an immutable object that evolves
over time.

Did you perhaps intend Object 3 to be *mutable*?

-- 
Cheers,
Trey
++--------------------------------------------------------------------------++
Director of Standards Development, New Context
gpg fingerprint: 3918 9D7E 50F5 088F 823F  018A 831A 270A 6C4F C338
++--------------------------------------------------------------------------++
--
"Gentlemen, you can't fight in here! This is the War Room!"
--President Merkin Muffley

Attachment: signature.asc
Description: Digital signature