OASIS Open

DHS Cybersecurity and Infrastructure Secur...

Abstain

STIX Objects are organized into "SDO"s and "SRO"s. SROs are limited in the fact they can not be used as a "source" or "target" of a relationship. The working draft doesn't provide rules for determining what factors go in to considering whether an object should be a SDO or SRO. As the list of STIX Objects extends upon this version, the question of "whether an object should is (or should be) an SDO or SRO?" will continue to arise and we as a technical committee should provide clear documentation to explain how objects are categorized. Without doing so now, while we have already categorized objects and claimed unique features for each category, we leave ourselves open to inconsistencies.

We should provide clear documentation for determining SDO or SRO categorization and ensure our existing objects align accordingly.