search

STIXProject / schemas

STIX Schema Development
http://stixproject.github.io/
76 stars 21 forks source link

Link reporting capabilities (e.g. screenshots, charts, etc) to constructs #10

Open johnwunder opened 11 years ago

johnwunder commented 11 years ago

This has been requested by several parties. Essentially they want to be able to link directly from text content to STIX constructs or from STIX constructs to external text content, images, etc.

benjaminxscott commented 10 years ago

Could be merged with #223

sbarnum commented 10 years ago

no, this is an issue above and beyond #223.

sbarnum commented 10 years ago

Sorry for the abrupt comment above. I started to write the explanation but had to jet to a meeting and did not want to forget to post. So, here is a little more explanation.

Item #10 is a longstanding issue that we have wanted to pursue (with widespread community interest) for quite a while. It involves fleshing out expressive capabilities for "reports" to enable more human readable forms of info (prose, images, etc.) to be included as reports within STIX and be able to link to and derive from included STIX constructs. This is regardless of what object (Package or Report) is used to capture such "reports". When some players say the support a "report object" this is actually what they mean rather than what is proposed within the FS-ISAC Report Object proposal.

If we decide to pursue the FS-ISAC proposal and create a new separate Report construct then pursuing and achieving this should be tracked separately form the effort to flesh out reporting capability. Whether or not your agree with the FS-ISAC proposal, actually implementing it would be fairly easy and quick. Fleshing out the reporting capabilities as specified in this tracker item will take significantly more discussion, effort and time.

We would not want to hold off closing issue #223 until all of issue #10 is accomplished.