Re: [EXT] Re: Bundle add Spec

We could do that or just be super clear in the description, something with a MUST statement so that it is flagged when people parse and extract things from the document.

Bret

Sent from my Commodore 64

PGP Fingerprint: 63B4 FC53 680A 6B7D 1447 F2C0 74F8 ACAE 7415 0050

On Sep 18, 2018, at 6:27 PM, Allan Thomson <athomson@lookingglasscyber.com> wrote:

Suggest to make it clear that is not the contained object versions then we should call the property something else.

Ideas:

- bundle_spec_version

- bundle_spec

- bundle_wrapper_spec

Allan Thomson,

CTO, Lookingglass Cyber Solutions

This electronic message transmission contains information from LookingGlass Cyber Solutions, Inc. which may be attorney-client privileged, proprietary and/or confidential. The information in this message is intended only for use by the individual(s) to whom it is addressed. If you believe that you have received this message in error, please contact the sender, delete this message, and be aware that any review, use, disclosure, copying or distribution of the contents contained within is strictly prohibited.

From: cti-stix@lists.oasis-open.org <cti-stix@lists.oasis-open.org> on behalf of Bret Jordan <Bret_Jordan@symantec.com>
Sent: Tuesday, September 18, 2018 11:41 AM
To: cti-stix@lists.oasis-open.org
Subject: [cti-stix] Bundle add Spec_version

All,

I would like to start a thread here to discuss adding back the spec_version property to the bundle in STIX. A little bit of history:

1) We had spec_version on the Bundle in 2.0. However, we had problems with it, as it was unclear if it meant the spec version of the objects in the bundle or the bundle wrapper itself.

2) Based on this, in 2.1 we added spec_version to every object and removed it from the bundle.

I am thinking that we may need to add it back to the bundle with a clear definition that it is the spec version of the bundle wrapper itself. Thoughts?

Bret

cti-stix message