Re: [cti-stix] Top-level Sighting Object from last meeting

I think you're right, in fact, the logistics of even having sightings on indicators gets very complex, as an indicator can contain many observables that may or may not also have time factors. Saying you "saw" a complex indicator would be quite difficult for anyone to implement in practice. But sighting observables - essentially adding a +1 to a cybox signature - tools will be able to do this easily, at all levels of the network.

Sent from IBM Verse