Updated report proposal

["Wunder, John A." <jwunder@mitre.org>]

All,

 

As I mentioned in an e-mail yesterday, based on the straw poll that we had on the August 29 working call (notes here: https://www.oasis-open.org/committees/download.php/61462/OASIS-CTI-TC_WorkingSession_August29_2017.pdf) I put together a proposal to modify the report object to cover the concept of an evolving collection of content (i.e., the MISP use case).

 

Proposal is here: https://docs.google.com/document/d/1wiG6RoNEFaE2lrblfgjpu3RTAJZOK2q0b5OxXCaCV14/edit#heading=h.n8bjzg1ysgdq

 

The changes are:

1. The description of the Report object was modified slightly to remove the reference to it being “published”. There were also some additional examples added.
2. The published property was made optional, to allow for cases where the report is not yet published.
3. A new status property was added, based on a suggestion from Allan that what we were describing as “published” or “not published” was not really a binary flag. The vocabulary is still somewhat TBD, right now I just put “ongoing-analysis” and “final” in as placeholders.

 

On the call most folks seemed to think that the best option was to modify the Report object, but we did have a couple open questions:

 

1. Now that you’ve seen the proposal, does this general approach seem acceptable?
2. What are the possible values in the “status” vocabulary? The thought on the call was that there were more than two, but I couldn’t think of anything and I asked on Slack and didn’t get anything either.

 

Thanks,

John