Re: [cti-comment] STIX Custom Properties specs

Ringo,

 

We have received your comments on STIX 2.0 CSPRD02 below. Thanks for your feedback!

 

The TC maintains a log of all comments received on its work here: https://docs.google.com/spreadsheets/d/1YOPONeKzc6Uu1A1MS3WkICG26LKLQOWdr-KBDzM8K6Y/edit#gid=5055878.
 Your comment has been added as comment 2. When the public review period is over, the TC will consider all comments and note the resolutions in the log.

 

Again, thank you for your comment and please feel free to send along additional observations.

 

Sarah Kelley

STIX SC Co-Chair

 

 

Sarah Kelley

Senior Cyber Threat Analyst

Multi-State Information Sharing and Analysis Center (MS-ISAC)                   

31 Tech Valley Drive

East Greenbush, NY 12061

 



518-266-3493

24x7 Security Operations Center

 - 1-866-787-4722

 

      
           

 

From:
<> on behalf of ringo <>

Date: Friday, May 19, 2017 at 7:34 PM

To: "" <>

Subject: [cti-comment] STIX Custom Properties specs

 

From the specs (2.0 and 2.1)

"A STIX Object MAY have any number of Custom Properties."

for example:

{

  ...,

  "x_acme_org_confidence": 10,

  "x_acme_org_scoring": {

    "impact": "high",

    "probability": "low"

  },

  ...

}

 

I've been thinking of implementing this in my scala library at:

 

      [scalastix](https://github.com/workingDog/scalastix)

 

however it is turning into a mess to have unknown key names.

 

I would prefer to have a dedicated area/object, say "x_custom", such as:

{

  ...,

  "x_custom": {

      "x_acme_org_confidence": 10,

      "x_acme_org_scoring": {

        "impact": "high",

        "probability": "low"

      },

    ...

  }

}

 

Would this scheme of putting all custom properties into such "object" be a break from the specs?

 

...

This message and attachments may contain confidential information. If it appears that this message was sent to you by mistake, any retention, dissemination, distribution or copying of this message and attachments is strictly prohibited. Please notify the sender
 immediately and permanently delete the message and any attachments.

. . .