Re: [cti-stix] RE: [Non-DoD Source] [cti-stix] Eight Arguments for an Infrastructure SDO for STIX 2.1

[John-Mark Gurney <jmg@newcontext.com>]

Katz, Gary CTR DC3\DCCI wrote this message on Mon, Nov 13, 2017 at 20:09 +0000:
> Option 3: Make Cyber Observables Top Level Objects

What would this look like?

I'm a bit curious because w/o the time information, you'd just need up
w/ an IP object or a DNS query object, which with out context doesn't
seem useful.  Most objects can on their own convey some information w/o
having to resolve references.

Can you at least give me a sample of what a cyber observable as a TLO
would look like?

Thanks.

-- 
John-Mark