OASIS Open

LookingGlass

Yes, the spec should have normative text describing length limits for some fields.

Yes we should provide reommendations with "should" that will drive interop tests for common use cases and practical examples that most products "should" support.

For example if a router that has limited memory for regex mtching and that router can injest stix/cybox natively then knowing what is practical requirements for memory allocation for rule space is needed.

A router can always reject a rule that is too large but having recommendations from ti experts in the spec will be heflpful.