STIX 2.1 example with Grouping object

["Jessie\(TWNCERT\)" <jessie@twncert.org.tw>]

Hi Forum members,

First of all, thanks Bret for answering the questions previously.

We had a lot's discussion in our organization and it's a bit tricky for us
to get a consensus.

One scenario is that our detection mechanism detects some suspicious
connections from X company, so we share this information with X company.

In this scenario,
X company is modeled using STIX Identity Object.
Detection mechanism is modeled using STIX Identity Object.
Suspicious connections are modeled using STIX Observed Data and Sighting
Objects.
Then we use STIX Grouping object to group all data together in order to
share the information with A company.

Is it the correct way using STIX Objects? Or could anyone provide some
examples for us to clarify the meaning of Grouping Object?


Thanks,
Jessie Chuang