Re: [cti-stix] Re: [EXT] [cti-stix] RE: [Non-DoD Source] [cti-stix] Eight Arguments for an Infrastructure SDO for STIX 2.1

[John-Mark Gurney <jmg@newcontext.com>]

Jason Keirstead wrote this message on Tue, Nov 14, 2017 at 16:48 +0000:
> I have yet to see someone present a concrete use case for why we should 
> make cyber observables a TLO. It has been proposed multiple times in the 
> past and debated to death - it is perhaps the second-most debated subject 
> in the TC (after timestamps).  I am all for the idea of "fixing what is 
> broken" in STIX, as Brett says, but to me if we are going to re-open 
> topics that have been extensively debated and yet voted on in another 
> direction, there is a significant burden on the proposer as to why it 
> should be re-opened. I don't see that burden being met here. 
> 
> What are the specific modeling problem(s) that would be solved by making 
> cyber observables top level objects, that can not be solved in any other 
> fashion?

I agree.  There is lots of talk, but little documentation on why the
change should be done, what it will look like, how it will be used, etc.

Yes, people have bits and pieces throughout emails, but there is not a
document that even a majority of the proponets of the concept even agree
upon things should look like.

-- 
John-Mark