- Gary presented his issues with the Grouping object - Needs timestamps and some other properties - - Also we have a new approach to add objects - JMG: - Suggest we don't call it a Grouping object - That made JMG realize - Sean: - This is different than grouping. This is about suspicious activity. That concept is being reopened. - Grouping was about not talking through that but rather doing a short-term - Sean is resistent to opening this Pandoras box now. We could go back and forth forever on this - Question: was confused by internal vs. external... - Gary: - Internal vs. external: was reading internal references vs. external references - This means you don't get pivoting via TAXII relationship pivoting - Bret: - Fully supports Gary's proposal, we should work on this. - JMG: - Discussion of not being able to query grouping objects. We need to address that deficiency in TAXII. It also applies to the report object - Are the links to the other objects canonical from the author's point of view? For report and grouping they do. - Gary: - Two things changed: - Getting pushed to go down the STIX/TAXII path. Would like the couple hundred companies to build to this. - We were spinning our wheels because it wasn't clear how to propose it. Now that we have clear guidance...DC3 can say it's an object to go with, - Call for sponsors - Bret and Trey: - Clarify we need functional tests for what it means to implement it in an interoperable way - JMG: - This doesn't have to be part of a shipping product - Sponsors are captured in the cover page - Label property names - Bret: isn't this really just classifications? Can we call it that? - Jason: the normative text calls it type, let's call it that - Sean: the text is trying to make it as clear as possible. Let's use the most clearly intuitive name - Some discussion of what the property is meant for. Human-defined tags vs. open vocab vs. closed vocab - Voting results are captured in Github