Re: [cti] STIX Patterning - ALONG/OTHERWISE

I think the new write-up makes an argument for keeping `ALONGWITH` and `OTHERWISE`. You now have two tables which describe `AND/OR`, which is confusing. But you need two because the comparison Boolean ops are different than the observation Boolean ops, in that the former must apply to the same observation and the latter different observations. The operators have (slightly) different semantics, and using different name makes that clear.

I also don’t like the fact that we still have the FOLLOWEDBY operator – which is really an “AND w/order” operator. If we decide to go with AND, I much prefer ANDTHEN – notice one word J.

Rich

From: <cti@lists.oasis-open.org> on behalf of Ivan Kirillov <ikirillov@mitre.org>
Date: Tuesday, December 6, 2016 at 1:58 PM
To: "cti@lists.oasis-open.org" <cti@lists.oasis-open.org>
Subject: [cti] STIX Patterning - ALONG/OTHERWISE

Hi All,

On today’s call we discussed the addition of a new OTHERWISE operator that functions effectively as an OR between discrete Observation Expressions. During the call, many posed the question of why we call the AND/OR operators for Observations Expressions ALONGWITH/OTHERWISE, instead of, well, just AND and OR. Our rationale during writing the spec was that it would be easier to explain combinatorial patterns across multiple Observations using different terminology, but in hindsight this may well cause more confusion than anything, which seemed to be the consensus on today’s call.

Anyhow, I’ve gone and updated the STIX Patterning specification to use AND and OR for both Observation Expressions and Comparison Expressions. It still made sense to leave Observation Operators as a separate class (for FOLLOWEDBY) but to use the Boolean Operators for the aforementioned entities. If anyone has a chance to review the specification and subsequently these new changes, that would be great: https://docs.google.com/document/d/1suvd7z7YjNKWOwgko-vJ84jfGuxSYZjOQlw5leCswPY/edit#heading=h.4do73o99e2l7

Regards,

Ivan

cti message