Re: [cti-stix] RE: Some thoughts on Sightings and conversations to date (Part #2): the semantics of observation, indicator, incident, sightings, etc

On 11.11.2015 23:23:40, Jane Ginn -  wrote:
> 
> I'm inclined to go with the arguments for adding an Investigation
> construct, for this, and many other reasons.
> 

I think the reasoning for an Investigation construct is solid. QED, I
support the notion. +1

-- 
Cheers,
Trey
--
Trey Darley
Senior Security Engineer
4DAA 0A88 34BC 27C9 FD2B  A97E D3C6 5C74 0FB7 E430
Soltra | An FS-ISAC & DTCC Company
www.soltra.com
--
"It is easier to move a problem around (for example, by moving the
problem to a different part of the overall network architecture) than
it is to solve it." --RFC 1925