Re: [cti] STIX 2.0 specification - comment about 4.2 Custom Top Level Objects

["Wunder, John A." <jwunder@mitre.org>]

Alexandre,

Thanks for review this!

On the “revision” topic: you’re right, the word was changed from “revision” to “version” a few weeks ago and that changed hadn’t been made consistently. We’ll go through again and make sure it’s correct everywhere.

Regarding the comments on the “x_” prefix…we had a ballot for Custom Properties to determine the text for that section, which resulted in the current normative statements using a SHOULD without a registry. The intent was just to re-use the results of that ballot for the Custom Object text, and therefore use the text as is. One of the results of that was that we will probably investigate a registry in the future but for version 2.0 it won’t be a priority.

Yes, all TLO Common Properties are inherited by custom TLO. I’ll go through to make that clearer in the document.

Thanks again!
John

On 6/30/16, 9:30 AM, "cti@lists.oasis-open.org on behalf of Alexandre Dulaunoy" <cti@lists.oasis-open.org on behalf of Alexandre.Dulaunoy@circl.lu> wrote:

Hi All,

We did a quick review of 4.2 Custom Top Level Objects and especially with the idea
to implement a MISP custom TLO. We saw some small inconsistencies in the section.

In 4.2.1 in the required common property is "revision" but the example in 4.2.2 there
is no property "revision" but a "version" property. In this scope, what is the exact
meaning of the version? is this the format version of the custom TLO? If this is "version"
like defined in 6.1 TLO common properties, the example is fine but "revision" should
be "replaced"in 4.2.1.

In 4.2.1 type field SHOULD start with an "x_" to avoid any collision with future version
of STIX but it could be better to have a MUST if there is no registered name for custom
object and ensuring a public repository (IANA-like) for the custom object name. I'm not sure
if there is a structure within OASIS to keep track of assignment within a specific standard.

Are all TLO common properties applicable to custom TLO? If yes, it might be useful to
state it in the document.

I hope this helps.

Thank you very much.

-- 
Alexandre Dulaunoy
CIRCL - Computer Incident Response Center Luxembourg
41, avenue de la gare L-1611 Luxembourg
info@circl.lu - www.circl.lu

---------------------------------------------------------------------
To unsubscribe from this mail list, you must leave the OASIS TC that 
generates this mail.  Follow this link to all your TCs in OASIS at:
https://www.oasis-open.org/apps/org/workgroup/portal/my_workgroups.php