Re: [cti] Re: Moving content out of CTI-Common

[John-Mark Gurney <jmg@newcontext.com>]

Kirillov, Ivan A. wrote this message on Wed, Apr 06, 2016 at 18:59 +0000:
> It seems like this topic often boils down to questions around versioning, patterning, and data markings and whether they should be part of CybOX.
> 
> A few thoughts from my perspective:
> 
>   *   Versioning: this is something that I don’t see the purpose of for CybOX. If CybOX is a representation of some cyber “fact”, what does it mean to version a fact? Wouldn’t that just be a different fact altogether?

I agree...

>   *   Patterning: originally we wanted to move this out of CybOX to simplify the CybOX Object model and its underlying serialization. Given that we’re now pushing towards a domain specific patterning language, one with heavy ties to the CybOX Object model, I don’t see why this patterning language can’t live as a component of CybOX. Personally, I think it would make sense to define this as a separate work product (I.e., the “CybOX Patterning Language”), apart from the CybOX language.

There is addition information in STIX that isn't in cybox that is
needed, i.e. the time of the Observation..  we'd have to make CybOX a
full fledge object for the patterning to be entirely contained as
part of CybOX.

-- 
John-Mark