You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Given all of the above, the basic structure of the Report object as it exists in STIX 1.2.1 should likely change significantly.
The purpose of the Report object is to convey some context to some set of STIX content.
In STIX 1.2.1, the Report object could be thought of as a file folder that specified some shared context (like a cover page to the folder) and then specified inline or referenced the set of content that the context applies to.
Given the above likely issue resolutions for STIX 2.0 the following will be true:
it will no longer be possible to specify the content embedded within the Report object itself
references to STIX content (which in reality are simply relationships between the Report and the content) will be specified using separate relationship-based constructs
the relationship-based constructs will very likely be IDable constructs themselves so the relationships to the content relevant for the Report will be specified external to the Report construct itself.
This leaves the Report construct much more like just the report cover page rather than a container like a folder. This cover page (Report construct) would still convey context like title & description (likely inherited from the IDable construct base class) and intent (likely the only remaining native property of the Report class.
Proposed:
make Report an extension from a common IDable construct class
remove all duplicate properties from Report that it gets from base IDable construct class
this means Report Header reduces down to only Intent which can be flattened out to a property directly of the Report class
remove all of the content list aggregators (e.g. Indicators) from Report class
Reports will be conveyed by specifying a Report object to capture the report context and then a set of externally defined relationship objects asserting a "Report Contains" relationship from the Report to the relevant content
This issue and proposed changes will be illustrated as part of the STIX 2.0 Round 1 Strawman set of proposals.
The text was updated successfully, but these errors were encountered:
This issue presumes that:
Given all of the above, the basic structure of the Report object as it exists in STIX 1.2.1 should likely change significantly.
The purpose of the Report object is to convey some context to some set of STIX content.
In STIX 1.2.1, the Report object could be thought of as a file folder that specified some shared context (like a cover page to the folder) and then specified inline or referenced the set of content that the context applies to.
Given the above likely issue resolutions for STIX 2.0 the following will be true:
This leaves the Report construct much more like just the report cover page rather than a container like a folder. This cover page (Report construct) would still convey context like title & description (likely inherited from the IDable construct base class) and intent (likely the only remaining native property of the Report class.
Proposed:
This issue and proposed changes will be illustrated as part of the STIX 2.0 Round 1 Strawman set of proposals.
The text was updated successfully, but these errors were encountered: