Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Refactor Report Object based on common IDableConstruct extension, no embedding and relationships as separate objects #385

Open
sbarnum opened this issue Dec 23, 2015 · 0 comments

Comments

@sbarnum
Copy link
Contributor

sbarnum commented Dec 23, 2015

This issue presumes that:

Given all of the above, the basic structure of the Report object as it exists in STIX 1.2.1 should likely change significantly.

The purpose of the Report object is to convey some context to some set of STIX content.
In STIX 1.2.1, the Report object could be thought of as a file folder that specified some shared context (like a cover page to the folder) and then specified inline or referenced the set of content that the context applies to.

Given the above likely issue resolutions for STIX 2.0 the following will be true:

  • it will no longer be possible to specify the content embedded within the Report object itself
  • references to STIX content (which in reality are simply relationships between the Report and the content) will be specified using separate relationship-based constructs
  • the relationship-based constructs will very likely be IDable constructs themselves so the relationships to the content relevant for the Report will be specified external to the Report construct itself.

This leaves the Report construct much more like just the report cover page rather than a container like a folder. This cover page (Report construct) would still convey context like title & description (likely inherited from the IDable construct base class) and intent (likely the only remaining native property of the Report class.

Proposed:

  • make Report an extension from a common IDable construct class
  • remove all duplicate properties from Report that it gets from base IDable construct class
  • this means Report Header reduces down to only Intent which can be flattened out to a property directly of the Report class
  • remove all of the content list aggregators (e.g. Indicators) from Report class
  • Reports will be conveyed by specifying a Report object to capture the report context and then a set of externally defined relationship objects asserting a "Report Contains" relationship from the Report to the relevant content

This issue and proposed changes will be illustrated as part of the STIX 2.0 Round 1 Strawman set of proposals.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

2 participants