Re: [cti-stix] indicator type

I am fine with finding a word other than “type” but I think “label” or “tag” are too generic for the purpose of the field. Its purpose is to convey what “type” of indicator it is not just to apply some label. There are LOTS of others sorts/purposes of
 labels that someone could apply to an indicator that have nothing to do with what “type” of indicator it is and would thus have the potential of muddying the water significantly. It is really more about categorizing than about labeling or tagging.

I think the conversation on Tuesday’s call seemed to be heading towards the possibility of splitting the field along its differing axes of “type” (type of pattern, type of threat, etc.) anyway so maybe we can avoid the “type” word through thoughtful but
 meaningful selection of the names for these new split fields. Maybe something like “pattern_categorization” and “threat_categorization”?

sean

From: "" <> on behalf of "Jordan, Bret" <>

Date: Tuesday, February 23, 2016 at 2:23 PM

To: "" <>

Subject: [cti-stix] indicator type

I would like to propose that we rename this field, from Indicator_Type to something that indicates that it is a "label" or a "tag".  This can still be bound to a controlled vocabulary.  But not
 calling it a TYPE is a good thing, IMHO.  And I believe the world has gravitated to this idea that content can have labels or tags.  It also makes more sense to have a series of "labels" or a series of "tags" versus having a series of "types". 

Thanks,

Bret

Bret Jordan CISSP

Director of Security Architecture and Standards | Office of the CTO

Blue Coat Systems

PGP Fingerprint: 63B4 FC53 680A 6B7D 1447  F2C0 74F8 ACAE 7415 0050

"Without cryptography vihv vivc ce xhrnrw, however, the only thing that can not be unscrambled is an egg."