Correct me if this doesnât make sense but I think MITREâs use case in representing translations of ATT&CK content benefits from this this â as would other libraries of STIX content that you maintain and update over time.
We use STIX versioning to update ATT&CK â so when we update a technique (attack pattern in STIX) we just re-use the ID and update the modified time. Updates might include description updates, including new paragraphs, changes to existing
text, etc. We would use this property to indicate which version of the technique a translation applied to, which is important because of those changes to the description. This is different than other types of relationships, which donât care about the version,
because language-content is about the exact text in the fields.
That said I donât see why it needs to be required and you definitely donât need it for other use cases, so optional makes sense to me. Tools being able to ignore it would mean they might display old/incorrect translations, but thatâs probably
not the end of the world.
Iâm free today so can dial in to the call to talk about this.
John
From: <cti@lists.oasis-open.org> on behalf of "Bret Jordan (CS)" <Bret_Jordan@symantec.com>
Date: Tuesday, July 2, 2019 at 11:56 AM
To: Trey Darley <trey.darley@cert.be>
Cc: Allan Thomson <athomson@lookingglasscyber.com>, "masuoka.ryusuke@fujitsu.com" <masuoka.ryusuke@fujitsu.com>, "cti@lists.oasis-open.org" <cti@lists.oasis-open.org>
Subject: [cti] Re: [NEWSLETTER] [cti] Re: [EXT] RE: [cti] Changes to Language Content
We will discuss on the working call today, along with the other issues I pointed out in slides I sent. Please come to the call prepared to talk about them.
Bret
Sent from my Commodore 128D
PGP Fingerprint: 63B4 FC53 680A 6B7D 1447 F2C0 74F8 ACAE 7415 0050