Re: Common CybOX Object Refactoring

["Kirillov, Ivan A." <ikirillov@mitre.org>]

>> Since an email address isn’t always 1-to-1 with one user account - just having it as a property doesn’t make sense to me.

Agreed :) I was posing this question because it was raised, but I don’t think it really makes sense to have email address as a property; there are also cases where an email address is exchanged by itself, which would be awkward if it had to be packaged as part of a user account.

>> Does a File Object support a Directory?  Probably yes, by default – but then how do you interpret size properties?

The refactored one does – see: https://github.com/CybOXProject/schemas/wiki/CybOX-3.0:-File-Object-Refactoring#filesystemproperties. Yeah, things like size and hashes don’t really make sense when specifying a directory. Probably just something that we’ll have to make sure we document in the specifications/annotations.

-Ivan

From: Rich Piazza <rpiazza@mitre.org>
Date: Tuesday, February 9, 2016 at 12:41 PM
To: Ivan Kirillov <ikirillov@mitre.org>, "cti@lists.oasis-open.org" <cti@lists.oasis-open.org>
Subject: RE: Common CybOX Object Refactoring

-          Should Email Address be a separate Object, or should it instead be a property of a different Object (e.g., User Account)?

                Since an email address isn’t always 1-to-1 with one user account - just having it as a property doesn’t make sense to me J

 

-          Does a File Object support a Directory?  Probably yes, by default – but then how do you interpret size properties?