STIX 2.0 RC3

CHANGELOG

This changelog applies to the overall document structure and to the details of Parts 1 and 2. Parts 3a, 3b, and 4 have not been previously approved by the TC and therefore we don't have a changelog.


Major Changes
-  Made STIX 2.0 a multi-part specification, splitting the old STIX 2.0 specification into core and objects. All documents are:
  - STIX Core
  - STIX Objects
  - Cyber Observable Core
  - Cyber Observable Objects
  - Patterning
-  Merged CybOX into STIX as â??Cyber Observablesâ??
  - Added Cyber Observable and Patterning sections to the overall introduction in STIX Core
  - Added Float and Integer datatypes (used in Cyber Observables) to STIX Core, removed Number as duplicative
  - Renamed â??CybOXâ?? to â??Cyber Observablesâ?? in the text
  - Removed the â??cyboxâ?? layer from Observed Data (flattened data model structure)
-  Updated Observed Data text (per previous e-mail) to clarify that itâ??s supposed to capture a single observation
-  Removed location attributes (deferred to future)
-  Removed the optionality around pattern language (deferred to future)
  - Removed pattern_lang attribute, pattern-lang-ov from Indicator/vocabs
  - Updated text to indicator talking about multiple pattern languages
-  In Report Type vocabulary, changed â??victim-targetâ?? to â??identityâ?? to align with new TLO
-  Added conformance clauses to all documents

Minor Changes
-  Corrected a typo in malware vocabulary (summary table did not match actual values)
-  Corrected multiple examples for errors and data model changes to Cyber Observable Objects and Patterning
-  Corrected grammar/punctuation in several places
-  Added a clarification to the list type to address some confusion about what to do if a list was required but you didnâ??t have data to fill it (â??If the property is required, the list MUST be present and MUST have at least one value.â??)