Incident Extension Draft

["Mates, Jeffrey CIV DC3/TSD" <Jeffrey.Mates@dc3.mil>]

Based on a number of internal discussions I wanted to provide a draft for a 
proposed Incident property extension for general community consideration. 
I've attached the raw JSON Schema of the current draft (still not on GitHub) 
as well as three examples using it.  Since currently the Incident object 
exists as a stub I am hoping that with some community feedback this could be 
shared and provide a more general way to share this information.

While it is currently drafted as a property extension, if there is general 
agreement that whatever we arrive at is solid I could change this to a 
top-level extension before sharing to prepare it to eventually be moved into 
the spec as part of a future version of STIX.

//SIGNED//

Jeffrey Mates, Civ DC3/TSD
Computer Scientist
Technical Solutions Development
jeffrey.mates@dc3.mil
410-694-4335

Attachment: incident.json
Description: application/json

Attachment: incident_asset_context.json
Description: application/json

Attachment: incident_sample_activity.json
Description: application/json

Attachment: incident_sample_infrastructure.json
Description: application/json

Attachment: smime.p7s
Description: S/MIME cryptographic signature