Re: [cti] STIX Patterning - ALONG/OTHERWISE

["Jason Keirstead" <Jason.Keirstead@ca.ibm.com>]

I would argue though that makes that obvious
(or non-obvious) however are the square brackets or lack thereof, not the
operator name.


-
Jason Keirstead
STSM, Product Architect, Security Intelligence, IBM Security Systems
www.ibm.com/security| www.securityintelligence.com

Without data, all you are is just another person with an opinion - Unknown




From:      
 John-Mark Gurney <jmg@newcontext.com>
To:      
 Eric Burger <Eric.Burger@georgetown.edu>
Cc:      
 "cti@lists.oasis-open.org"
<cti@lists.oasis-open.org>
Date:      
 12/14/2016 04:24 PM
Subject:    
   Re: [cti] STIX
Patterning - ALONG/OTHERWISE
Sent by:    
   <cti@lists.oasis-open.org>

---

Eric Burger wrote this message on Tue, Dec 13, 2016
at 09:52 -0500:
> So if something does the same thing in the same way, we want to call
it something else?
> 
> I’m a bit slow here...

I prefer the different operators as it makes it more obvious that
[ipv4-addr:value = '192.0.2.5'] AND [ipv4-addr:value = '192.0.2.10']
and
[ipv4-addr:value = '192.0.2.5' AND ipv4-addr:value = '192.0.2.10']

are different.  And have VERY different meanings.

> > On Dec 12, 2016, at 9:49 AM, Kirillov, Ivan A. <ikirillov@mitre.org>
wrote:
> > 
> > Right – it’s just the name of the operator. The semantics are
the same.
> > 
> > Regards,
> > Ivan
> > 
> > On 12/12/16, 6:46 AM, "Trey Darley" <cti@lists.oasis-open.org
on behalf of trey@kingfisherops.com> wrote:
> > 
> >    On 12.12.2016 08:13:08, Eric Burger wrote:
> >> I could be convinced. What is the distinction between:
> >> 
> >> ([ipv4-addr:value = '192.0.2.5'] AND [ipv4-addr:value = '192.0.2.10'])
> >> 
> >> and
> >> 
> >> ([ipv4-addr:value = '192.0.2.5'] ALONGWITH [ipv4-addr:value
= '192.0.2.10'])
> >> 
> > 
> >    Six characters.

-- 
John-Mark

---------------------------------------------------------------------
To unsubscribe from this mail list, you must leave the OASIS TC that 
generates this mail.  Follow this link to all your TCs in OASIS at:
https://www.oasis-open.org/apps/org/workgroup/portal/my_workgroups.php