search

STIXProject / schemas

STIX Schema Development
http://stixproject.github.io/
76 stars 21 forks source link

Remove @kill_chain_id from kill chain phase references #241

Open johnwunder opened 9 years ago

johnwunder commented 9 years ago

Right now KillChainPhaseReferenceType provides two IDs to reference kill chain phases: @phase_id (with the ID of the phase) and @kill_chain_id (with this ID of the kill chain that phase is in).

@kill_chain_id is arguably redundant because the phase_id should uniquely identify that phase. The only case this would not be true is if the phase is present in multiple kill chains, but that capability could be removed in order to simplify how phases are referenced.

There's also a related issue, #117, that discusses whether the reference type should include data from the type definition.

jordan2175 commented 9 years ago

Yes, lets remove this in STIX 2.0

jordan2175 commented 9 years ago

On KillChainPhaseReferenceTypeSTIX Common Schema we say there are three elements that should not be used... Lets just remove them.

@kill_chain_name, @ordinality, and @name. These attributes should not be used to redefine attributes in the referenced kill chain.