Re: [cti-stix] Current thoughts on Event Object

[Sean Barnum <sean.barnum@FireEye.com>]

Doh!

Fat finger on my part.

The Investigation object should be MUTABLE.

Sorry about that. Thanks for catching it.


Sean Barnum
Principal Architect
FireEye
M: 703.473.8262
E: sean.barnum@fireeye.com

On 9/11/17, 11:44 AM, "Trey Darley" <cti-stix@lists.oasis-open.org on behalf of trey@newcontext.com> wrote:

    On 11.09.2017 15:38:20, Sean Barnum wrote:
    >
    >   3. We believe Object 3 should be a new Investigation object that
    >      is immutable, evolves over time, captures CTI-relevant metadata
    >      about a cyber investigation and references CTI-relevant content
    >      developed/derived from a cyber investigation.
    >

    Hey, Sean -

    I'm struggling to grok the concept of an immutable object that evolves
    over time.

    Did you perhaps intend Object 3 to be *mutable*?

    --
    Cheers,
    Trey
    ++--------------------------------------------------------------------------++
    Director of Standards Development, New Context
    gpg fingerprint: 3918 9D7E 50F5 088F 823F  018A 831A 270A 6C4F C338
    ++--------------------------------------------------------------------------++
    --
    "Gentlemen, you can't fight in here! This is the War Room!"
    --President Merkin Muffley


This email and any attachments thereto may contain private, confidential, and/or privileged material for the sole use of the intended recipient. Any review, copying, or distribution of this email (or any attachments thereto) by others is strictly prohibited. If you are not the intended recipient, please contact the sender immediately and permanently delete the original and any copies of this email and any attachments thereto.