oasis-tcs / cti-stix2

OASIS CTI TC: Provides issue tracking and wiki pages for the STIX 2.x Work Products
https://github.com/oasis-tcs/cti-stix2
Other
24 stars 9 forks source link

The use of both object and granular markings on the same object is ambiguous in the spec #302

Open rpiazza opened 1 year ago

rpiazza commented 1 year ago

When granular markings are provided, does the object marking represent:

Whichever is chosen, it would probably make sense to have an object marking for every type of marking definition used in the object (i.e., a SHOULD). If one is not provided, the it should be interpreted as the non-granular marking properties are unmarked within that marking definition type.

The "levels" are only significant for the same data marking type. For instance, an object marking could be TLP:GREEN, and a granular marking for a property could be a statement about terms of use. In that case, the markings are independent. However, we should probably make it clear whether a TLP object marking applies to all properties, if any granular marking for a property does not also specify a TLP marking.

Also using different marking types for the same object/property - do all apply (AND) or just the one the consumer cares about (OR). If it can be either or both, how to do it would need to be added to the spec.

But in general, how to interpret a set of markings of different data marking types will remain beyond the scope of the spec.