Patterns: Parentheses with multiple Qualifiers

["Lenk, Chris" <clenk@mitre.org>]

Hello,

How do parentheses interact with the patterning language requirement that an Observation Expression MUST NOT have more than one Qualifier of a particular type? Is the following pattern valid?

(<expr1> AND <expr2> REPEATS 2 TIMES) REPEATS 3 TIMES

If the requirement does not apply to parenthesized observation expressions (i.e. a parenthesized group doesn't count as an Observation Expression), then you could just use parentheses to get around this requirement. For example the following would be valid:

(<expr1> WITHIN 1 SECONDS) WITHIN 5 SECONDS

If the requirement does also apply to parenthesized observation expressions, then the following pattern would be invalid - how would you write it so it's valid?

(<exprA> FOLLOWEDBY <exprB> REPEATS 2 TIMES) REPEATS 3 TIMES

I guess you could expand it out by replacing REPEATS with ANDs and copying the expression being repeated, but I don't know that similar expansion is possible for other qualifiers like WITHIN or START/STOP. Is it okay that that is invalid?

We're fixing a bug in cti-pattern-validator and would appreciate some clarity to make sure we update it correctly.

Thank you,
Chris Lenk
MITRE