ABCDEFGHIJKLMNOPQRSTUVWXYZ
1
Comment Resolution Account for STIX 2.0 CSPRD02
2
Prepared:21 June 2017
3
4
Comment #Public reviewDate providedLink to emailCommenterCategoryComment provided / Issue raisedTC decision on resolution Comments / Changes
5
1stix-2.0-csprd0219-05-2017
https://lists.oasis-open.org/archives/cti-comment/201705/msg00009.html
Terry MacDonald
Examples7.2.1 example bundle missing spec_versionaccept
6
2stix-2.0-csprd0220-05-2017
https://lists.oasis-open.org/archives/cti-comment/201705/msg00010.html
ringoSubstantiveMove all custom properties from anywhere in the object to a specific key called "custom_properties"reject
- prevents forwards compatibility, felt more like XML, maybe a language-specific issues, can find workarounds to any issues
7
3stix-2.0-csprd0220-05-2017
https://lists.oasis-open.org/archives/cti-comment/201705/msg00011.html
ringoEditorial"STIX™ Objects" section should say, "labels" are optional unless it is required.
accept
8
4stix-2.0-csprd0222-05-2017
https://lists.oasis-open.org/archives/cti-comment/201705/msg00012.html
ringoSubstantiveAdd "name" property to observed-datareject
this has been discussed, the TC feels that observed data is a wrapper for observable content, which is mainly machine-generated, and it probably doesn't have a lot of semantic meaning
9
5stix-2.0-csprd0230-05-2017
https://lists.oasis-open.org/archives/cti-comment/201705/msg00013.html
ozgur.yurektenSubstantiveDefine open vocabulary for common external reference source names (e.g. CVE, CAPEC)defer to 2.1
10
6stix-2.0-csprd0230-05-2017
https://lists.oasis-open.org/archives/cti-comment/201705/msg00013.html
ozgur.yurektenEditorialSome SDO object references in examples are not defined in documentreject
we may address some of this in 2.1
11
7stix-2.0-csprd0201-06-2017
https://lists.oasis-open.org/archives/cti-comment/201706/msg00000.html
Drew VarnerSubstantiveShould there be a requirement in Indicator that `valid_until` be after `valid_from` in Indicator objects?defer to 2.1
12
8stix-2.0-csprd0230-05-2017
https://lists.oasis-open.org/archives/cti-comment/201705/msg00013.html
ozgur.yurektenEditorialTypos in course of action exampleaccept (already fixed)
13
TC Comments Received Outside Comment Period
14
N/AN/A16-05-2017
https://lists.oasis-open.org/archives/cti-comment/201705/msg00006.html
Rich PiazzaEditorialThe header of section 2.7.6.3 should be ​Windows™ PE Optional Header Typeaccept
15
N/AN/A16-05-2017
https://lists.oasis-open.org/archives/cti-comment/201705/msg00005.html
Rich PiazzaSubstantivePart 4, section 2.7.6.3.: All properties of windows-pe-optional-header-type are optional. Do we need a normative statement that says at least one property should be populated?defer
add guidance outside the spec, document that we're OK with this forwards-breaking change
16
N/AN/A16-05-2017
https://lists.oasis-open.org/archives/cti-comment/201705/msg00004.html
Rich PiazzaEditorialpart 4, section 2.7.6.4.1, the example is wrong: missing commaaccept
17
N/AN/A15-05-2017
https://lists.oasis-open.org/archives/cti-comment/201705/msg00003.html
Rich PiazzaEditorialNumerous typos in Part 4accept
18
N/AN/A12-05-2017
https://lists.oasis-open.org/archives/cti-comment/201705/msg00002.html
Greg BackEditorialThe header for section 2.12 should be “Network Traffic Object”, not “Network Traffic” to be consistent with the other objects in section 2.accept
19
N/AN/A05-06-2017N/AEditorsEditorialCorrected examples to use "relationship_type" rather than "name" (2.9)accept
20
N/AN/A05-06-2017N/AEditorsEditorialPhrasing of the RFC2119 text in the e-mail object "body" and "body_multipart" fields was awkward (use of MAY). Text was rephrased to use MUST NOTaccept
21
N/AN/A12-06-2017
https://lists.oasis-open.org/archives/cti-comment/201706/msg00009.html
Rich PiazzaEditorialIn Part 4 of STIX 2.0 WD03, the Network Traffic Object extensions description (Section 2.12) uses “http-ext”, but the type name is listed in the HTTP Request Extension section (2.12.2) is “http-request-ext”accept
22
N/AN/A12-06-2017
https://lists.oasis-open.org/archives/cti-stix/201706/msg00001.html
John-Mark Gurney
EditorialIn Part 1 of STIX, Section 2.6, It looks like 53 was used instead of 63accept
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100