[Date Prev] | [Thread Prev] | [Thread Next] | [Date Next] -- [Date Index] | [Thread Index] | [List Home]
Subject: Minor change to section 5.5.2 of the STIX specification based on issue 195
Issue 195 pointed out that in the embedded relationships table of Sightings â the following text seems to be in error:
Based on the definition of observed_data_refs in section 5.2.1, the editors agreed it should be changed to:
However, the editors wanted to point out the implications of this change.
Given the change of SCOs to be top-level objects, it might be expected that an identifier of type SCO would also be valid. For example, if one wants to share that they saw (using a sighting object) an IP address â they could just put the id of the IP address SCO in the observed_data_refs property of the sighting.
This change would make such a sighting object invalid.
Previously, it was necessary to âwrapâ the IP address in Observed Data object â because that was the only place the IP address could be specified.
With the change to top-level SCOs, this is no longer true. It might seem unnecessary for the sighting to reference an Observed Data object, which then references the IP address SCO â but with this change â the specification requires it.
If you have objections to this â we can discuss it on the next working call.
The MITRE Corporation