I think we should really look to see if Jason’s classification proposal can some how address the need better to say that this object or collection is not yet finished intel. Further, I really think we need this on all SDOs, not just this new collection.
I do think we also need to be really careful here. We are talking about creating a third object for sharing a collections of things.
Bret
Sent from my iPhone
On Oct 2, 2017, at 9:23 AM, Wunder, John A. <> wrote:
Hey all,
For the October 3 working call we’ll continue our discussion of Event. In particular, given last week’s conversation, we wanted to bring up the idea of deferring all or most Event capabilities until a future
release. That would give us a lot more breathing room to dig into it and get it right, and in the meantime the Grouping proposal meets the immediate needs identified by the MISP team. We realize that would be a big change though and so want to discuss it on
the working call. If consensus is to finish some capabilities for 2.1, we can talk about which ones are important and (if any) which can be deferred.
We’ll also give a quick status update of where all of the STIX 2.1 topics stand.
John
