OASIS Mailing List ArchivesView the OASIS mailing list archive below
or browse/search using MarkMail.

 


Help: OASIS Mailing Lists Help | MarkMail Help

cti message

[Date Prev] | [Thread Prev] | [Thread Next] | [Date Next] -- [Date Index] | [Thread Index] | [List Home]


Subject: Re: [cti] Intel note and opinion


Overall, I don't think it matters.

I'm not wild about introducing "intel notes" into STIX in general - the world has enough messaging protocols - I'd rather host discussions outside of STIX and merely add pointers to them - but I appreciate I'm probably in the rough here. (Although if someone builds a distributed message board from STIX intel notes and TAXII I'll have to hunt them down).

As for whether we combine an opinion and a note or not - I honestly don't think it'll be life-changing whichever option anyone picks.

I do think, however, that this is classic bikeshed territory. That's not to belittle people who do have genuine concerns, but I'd personally be wary of making this into more of an issue than it really is.

I appreciate the desire to avoid having two ways to model the same thing, but I don't think any of those options truly promote two ways of modelling the same thing. They do allow it if one is being perverse - but surely some explanatory text is all that's needed here. I don't think the future of STIX balances on this issue.

On 10 April 2017 at 21:30, Wunder, John A. <jwunder@mitre.org> wrote:

Hey everyone,

 

After a lot of conversation on intel note and opinion, we’ve narrowed down a lot of the questions on these two objects but have one big one remaining. Specifically, with both intel note and opinion existing as separate objects a few people (notably Jason and Bret) have noted that there may be overlap and in fact the objects should be merged into one. The thinking is that giving an opinion is essentially the same as giving extra analysis about something (or is at least handled the same way most of the time) and having two separate objects will be confusing for people. So, here’s how I would outline the questions:

 

1.       Should opinion and intel note remain separate objects?

a.       Merging them would provide a single object to provide a simple opinion on a scale (agree/disagree), an opinion on a scale with a text explanation (agree and here’s why), and added analysis w/ no opinion scale (here’s extra info about this object).

b.       Separating them would distinguish providing an opinion (agree/disagree) from providing extra analysis

2.       If we go with option b and we have two separate objects, should opinion have an optional description field?

a.       Having a description on opinion keeps all information about the opinion in a single object.

b.       Not having a description on opinion would mean that opinions are just the agree/disagree statements. People would use the intel note object to capture their explanation and therefore all text commentary would be provided by intel note.

 

It seems like the key thing people are wrestling with is whether there’s a distinction between giving extra analysis or context to something and giving an opinion about something. I.e., when people are doing shared analysis is it important to distinguish me providing an opinion on your object (agree/disagree/neutral) from me adding extra context (human-readable notes) to your data?

 

So, combining those questions, we have three options:

 

1.       Opinion and intel note are separate objects, and opinion has a description. To have a text explanation of an opinion, you would use the description field on the opinion object.

2.       Opinion and intel note are separate objects, and opinion does not have a description. To have a text explanation of an opinion, you would use an intel note and link it to the opinion.

3.       Opinion and intel note are merged (likely calling it intel note, since not all of them would be opinions) and you would use that object to describe opinions, opinions w/ descriptions, and added analysis

 

People can reply with their reasoning and pros/cons, but I’m particularly interested in hearing people who have not chimed in yet. What is your preferred option? Any thoughts on the reasoning?

 

FYI, here are the latest working versions of intel note and opinion, in Google Docs. These are roughly option #1, based on the recent working call and a poll in Slack.

 

-          Intel note: https://docs.google.com/document/d/15qD9KBQcVcY4FlG9n_VGhqacaeiLlNcQ7zVEjc8I3b4/edit#heading=h.74spnst8naxc

-          Opinion: https://docs.google.com/document/d/15qD9KBQcVcY4FlG9n_VGhqacaeiLlNcQ7zVEjc8I3b4/edit#heading=h.haeazu2sh3sq

 

My own opinion (sorry I know this pun is getting old) is that giving an opinion is distinct from adding analyst notes or extra context and therefore I prefer #1. My second choice would be #2, because I think #3 results in an ambiguous object that does too many things and can have completely orthogonal sets of fields, which to me is an indication that it really should be two objects.

 

Thanks,

John




--

Dave Cridland

+448454681066
dave.cridland@surevine.com
dave.cridland.surevine

Surevine

Participate | Collaborate | Innovate

Surevine Limited, registered in England and Wales with number 06726289. Mailing Address : PO Box 1136, Guildford GU1 9ND
If you think you have received this message in error, please notify us.


[Date Prev] | [Thread Prev] | [Thread Next] | [Date Next] -- [Date Index] | [Thread Index] | [List Home]