Minor change to section 5.5.2 of the STIX specification based on issue 195

Issue 195 pointed out that in the embedded relationships table of Sightings â the following text seems to be in error:

                

observed_data_refs

list of type
identifier (of type
SCO)

 

Based on the definition of 
observed_data_refs in section 5.2.1, the editors agreed it should be changed to:

 

observed_data_refs

list of type
identifier (of type
observed-data)

 

However, the editors wanted to point out the implications of this change.

 

Given the change of SCOs to be top-level objects, it might be expected that an identifier of type SCO would also be valid.  For example, if one wants to share that they saw (using a sighting object) an IP
 address â they could just put the id of the IP address SCO in the observed_data_refs property of the sighting.

 

This change would make such a sighting object invalid.

 

Previously, it was necessary to âwrapâ the IP address in Observed Data object â because that was the only place the IP address could be specified.

With the change to top-level SCOs, this is no longer true.  It might seem unnecessary for the sighting to reference an Observed Data object, which then references the IP address SCO â but with this change
 â the specification requires it.

 

If you have objections to this â we can discuss it on the next working call.

 

                Rich

 

-- 

Rich Piazza

The MITRE Corporation

781-271-3760