[Date Prev] | [Thread Prev] | [Thread Next] | [Date Next] -- [Date Index] | [Thread Index] | [List Home]
Subject: Re: [cti] Re: [EXT] Re: [cti] type changing from "object" to "array" for cyber observable objects
All of the implementations that I have seen so far, treat these as first order citizens and link them in the graph directly. The way we have it now is a bit weird. We basically have a two layered graph that does not allow you to cross link things together. Further, we have two radically different ways of structuring the content. The STIX object way with a type and ID field and the Observable way of a dictionary.
My other problem is with the complexity of the Observed Data object. If you question that, please look at the length of text we as editors had to write to try and explain it. It would be SO much easier if the cyber observables were just first order citizens.
Bret
[Date Prev] | [Thread Prev] | [Thread Next] | [Date Next] -- [Date Index] | [Thread Index] | [List Home]