Re: [cti] Question on indicator patterns

["Wunder, John A." <jwunder@mitre.org>]

Thanks everyone. For the drafts that will go out today, we’ve used the MUST language for CybOX with an open vocabulary for other languages.

1) Yes – MUST language
2) Yes – open vocab

John

On 7/18/16, 9:03 AM, "Trey Darley" <trey@kingfisherops.com> wrote:

On 15.07.2016 13:24:27, John-Mark Gurney wrote:
> 
> The simplist solution is an open vocab, as we expand it in future
> revisions as people add support.. Similar to other parts of the
> spec...
> 
> So, My votes:
> 
> 1) yes
> 2) Yes - open vocab
> 

For the reasons enumerated by Allan, Jason, & John-Mark, my vote is
yes on MVP and yes on open vocab.

-- 
Cheers,
Trey
++--------------------------------------------------------------------------++
Kingfisher Operations, sprl
gpg fingerprint: 85F3 5F54 4A2A B4CD 33C4  5B9B B30D DD6E 62C8 6C1D
++--------------------------------------------------------------------------++
--
"It is always possible to aglutenate multiple separate problems into a
single complex interdependent solution. In most cases this is a bad
idea." --RFC 1925