-
Notifications
You must be signed in to change notification settings - Fork 5
Maturity: Observable (pattern)
Ivan Kirillov edited this page Oct 7, 2015
·
2 revisions
There are several open questions about the semantic nature of the existing Observable patterning model, including:
- Whether patterns and instances should be completely decoupled in Observables and Objects
- Pattern scoping - whether it should be applicable to Objects and Actions (as it is now), or just Objects, or to other entities as well.
There are several known missing features and capabilities in relation to Observable patterns:
Used predominantly in STIX Indicators, to define patterns for the malicious entity that the Indicator is written to detect.