Yes.
Can you define multiple SDOs from a single extension? Thanks, Bret PGP Fingerprint: 63B4 FC53 680A 6B7D 1447 F2C0 74F8 ACAE 7415 0050 "Without cryptography vihv vivc ce xhrnrw, however, the only thing that can not be unscrambled is an egg."
Thanks for the reply. I just mostly wanted to confirm that I understood both use cases. I did assume that your rationale for combinatorial extensions was so you could âbundleâ related extensions. I was concerned with re-use of the extension definition by others. I was thinking it would be âcleanerâ to just have one extension defined. However, I see that you might want to introduce a whole new domain with lots of new SDOs, SCOs, and additional properties on existing objects, so it makes sense that you would want to put them all in one schema/extension. I was also thinking that when one is using a combinatorial extension that they need to use all of the parts. But there is nothing in the new spec language that implies that. So, I have changed my mind â I now am in favor of combinatorial extensions! Rich
Rich - the simplest analogy I can think of, is this.
I can write 1 word document with 2 paragraphs. Where the document describes a concept with two related aspects described in the document.
I can write 2 word documents, with 1 paragraph each. Where each document describes a separate concept entirely.
Your example below suggests the 2 extensions are completely unrelated to each other. In that case, it would make sense to write 2 separate documents (1 for each extension).
For examples, where authors want to publish related content as a single extension -> I propose that STIX extension should give authors the *option* to write the 1 document with 2 paragraphs *if* they want to.
And we should not force them to write 2 separate documents.
I didnât want to belabor the point on the call yesterday, but I wanted to check my understanding of the combinatorial extension.
Letâs assume that we have two extensions defined (similar to the spec examples):
I introduced new ids, so as not to confuse it with other extension examples.
âidâ: âstix-extension--9994a318-2a81-4b04-a79a-7c515cfae643â,
"type": "stix-extension",
"name": "Extension My Favorite SDO",
"description": "This schema adds a new object my-favorite-sdo",
"created_by": "identity--uuid1",
âextension_typesâ: [ ânew_sdoâ ]
âidâ: âstix-extension--29c8ae7a-6779-40dd-92e5-0806cb61a6faâ,
"type": "stix-extension",
"description": "This schema adds rank and toxicityâ
"created_by": "identity--uuid1",
âextension_typesâ: [ âextends_subcompâ ]
Using these extensions, Iâm not sure what would change in your instance on page 221, except the indicator would be using the extension stix-extension--29c8ae7a-6779-40dd-92e5-0806cb61a6fa instead
of the combinatorial extension that included both extension types (stix-extension--a932fcc6-e032-176c-126f-cb970a5a1fff).
So what is the advantage of the combinatorial extension? What am I missing?
|