From 5e34c96bbaffecd313516a6e8dfaf109648aee59 Mon Sep 17 00:00:00 2001 From: Rich Piazza Date: Thu, 18 Jul 2024 14:20:26 -0400 Subject: [PATCH] fix incident link --- .../incident-ef7/Incident Extension Suite.adoc | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/extension-definition-specifications/incident-ef7/Incident Extension Suite.adoc b/extension-definition-specifications/incident-ef7/Incident Extension Suite.adoc index 757f94ac537..1d9741d4a30 100644 --- a/extension-definition-specifications/incident-ef7/Incident Extension Suite.adoc +++ b/extension-definition-specifications/incident-ef7/Incident Extension Suite.adoc @@ -79,7 +79,7 @@ The current STIX 2.1 Incident object was defined as a stub with the expectation In the 1.0 version of the core incident extension, information on impact, events, and tasks were embedded within the Incident object itself, however this was found to have limitations. Therefore, the 2.0 version of this extension has been created in which these components have been separated into independent SDOs for more complex incidents to be accurately modeled. -These extensions allow incidents to be tracked across their life cycle where [stixtype]#<># are first flagged for investigation resulting in [stixtype]#{incident_url}incidents# with [stixtype]#<># being worked to resolve them. +These extensions allow incidents to be tracked across their life cycle where [stixtype]#<># are first flagged for investigation resulting in [stixtype]#{incident_url}[incidents]# with [stixtype]#<># being worked to resolve them. Incidents have [stixtype]#<># that change over time. [stixtype]#<># can cause or influence these [stixtype]#<># which are in turn mitigated and potentially resolved by [stixtype]#<># performed as part of the incident response process. Both [stixtype]#<># and [stixtype]#<># can exist independently of [stixtype]#{incident_url}[incidents]# and in most workflows will occur prior to an incident being declared.