Observed Data Proposal for Malware / Infrastructure

I wanted to share out a proposal to revise the Observed Data object that Gary
put together in order to allow mappings from STIX objects into the content of
the Observed Data  block while still respecting existing mappings.

This should allow for infrastructure and malware objects to more easily
reference fully mapped observed data graphs while limiting the overhead
associated with creating large numbers of additional observed data objects.

Jeffrey Mates, Civ DC3/DCCI
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Computer Scientist
Defense Cyber Crime Institute

410-694-4335