OASIS Mailing List ArchivesView the OASIS mailing list archive below
or browse/search using MarkMail.

 


Help: OASIS Mailing Lists Help | MarkMail Help

cti message

[Date Prev] | [Thread Prev] | [Thread Next] | [Date Next] -- [Date Index] | [Thread Index] | [List Home]


Subject: Minor change to section 5.5.2 of the STIX specification based on issue 195


Issue 195 pointed out that in the embedded relationships table of Sightings â the following text seems to be in error:

               

observed_data_refs

list of type identifier (of type SCO)

 

Based on the definition of observed_data_refs in section 5.2.1, the editors agreed it should be changed to:

 

observed_data_refs

list of type identifier (of type observed-data)

 

However, the editors wanted to point out the implications of this change.

 

Given the change of SCOs to be top-level objects, it might be expected that an identifier of type SCO would also be valid.  For example, if one wants to share that they saw (using a sighting object) an IP address â they could just put the id of the IP address SCO in the observed_data_refs property of the sighting.

 

This change would make such a sighting object invalid.

 

Previously, it was necessary to âwrapâ the IP address in Observed Data object â because that was the only place the IP address could be specified.

With the change to top-level SCOs, this is no longer true.  It might seem unnecessary for the sighting to reference an Observed Data object, which then references the IP address SCO â but with this change â the specification requires it.

 

If you have objections to this â we can discuss it on the next working call.

 

                Rich

 

-- 

Rich Piazza

The MITRE Corporation

781-271-3760

 

signature_1179553494

 

 



[Date Prev] | [Thread Prev] | [Thread Next] | [Date Next] -- [Date Index] | [Thread Index] | [List Home]