OASIS Mailing List ArchivesView the OASIS mailing list archive below
or browse/search using MarkMail.


Help: OASIS Mailing Lists Help | MarkMail Help

cti message

[Date Prev] | [Thread Prev] | [Thread Next] | [Date Next] -- [Date Index] | [Thread Index] | [List Home]

Subject: Minor change to section 5.5.2 of the STIX specification based on issue 195

Issue 195 pointed out that in the embedded relationships table of Sightings â the following text seems to be in error:



list of type identifier (of type SCO)


Based on the definition of observed_data_refs in section 5.2.1, the editors agreed it should be changed to:



list of type identifier (of type observed-data)


However, the editors wanted to point out the implications of this change.


Given the change of SCOs to be top-level objects, it might be expected that an identifier of type SCO would also be valid.  For example, if one wants to share that they saw (using a sighting object) an IP address â they could just put the id of the IP address SCO in the observed_data_refs property of the sighting.


This change would make such a sighting object invalid.


Previously, it was necessary to âwrapâ the IP address in Observed Data object â because that was the only place the IP address could be specified.

With the change to top-level SCOs, this is no longer true.  It might seem unnecessary for the sighting to reference an Observed Data object, which then references the IP address SCO â but with this change â the specification requires it.


If you have objections to this â we can discuss it on the next working call.





Rich Piazza

The MITRE Corporation






[Date Prev] | [Thread Prev] | [Thread Next] | [Date Next] -- [Date Index] | [Thread Index] | [List Home]