{"action":"created","issue":{"url":"https://api.github.com/repos/CybOXProject/schemas/issues/381","labels_url":"https://api.github.com/repos/CybOXProject/schemas/issues/381/labels{/name}","comments_url":"https://api.github.com/repos/CybOXProject/schemas/issues/381/comments","events_url":"https://api.github.com/repos/CybOXProject/schemas/issues/381/events","html_url":"https://github.com/CybOXProject/schemas/issues/381","id":99699226,"number":381,"title":"Separate Patterns and Instances in CybOX Observables and Objects","user":{"login":"ikiril01","id":1538202,"avatar_url":"https://avatars.githubusercontent.com/u/1538202?v=3","gravatar_id":"","url":"https://api.github.com/users/ikiril01","html_url":"https://github.com/ikiril01","followers_url":"https://api.github.com/users/ikiril01/followers","following_url":"https://api.github.com/users/ikiril01/following{/other_user}","gists_url":"https://api.github.com/users/ikiril01/gists{/gist_id}","starred_url":"https://api.github.com/users/ikiril01/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ikiril01/subscriptions","organizations_url":"https://api.github.com/users/ikiril01/orgs","repos_url":"https://api.github.com/users/ikiril01/repos","events_url":"https://api.github.com/users/ikiril01/events{/privacy}","received_events_url":"https://api.github.com/users/ikiril01/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":12,"created_at":"2015-08-07T18:06:49Z","updated_at":"2015-11-06T04:40:20Z","closed_at":null,"body":"Currently, a CybOX Observable, in combination with an Object, can define either an observed instance of some data (e.g., a file), or a pattern for *detecting* some data. While this duality has its uses and benefits, particularly in terms of reducing schema complexity (i.e. essentially the same schema structures can be used for capturing both instances and patterns), it has a number of drawbacks, including:\r\n\r\n* Because all CybOX Object fields MUST support patterning, including against list membership (or lack thereof), this means that their inherent datatype is an unrestricted string. This has the following side-effects:\r\n    * No type (is it a valid integer?) or semantic validation (is it a valid IP address?) against these fields can be performed\r\n    * Lists are inherently more complex and cumbersome (see #380)\r\n* Because patterns are specified at the CybOX Object level, instead of an abstract pattern level, this makes it inherently more difficult to incorporate non-Object specific pattern elements. For example, things like temporal patterning or pre/post-conditions\r\n* As evidenced by community feedback and reactions, this duality and its implications (e.g., that an Object with a \"condition\" attribute represents a pattern) are not immediately obvious and can be difficult to understand\r\n\r\nFor these reasons, I propose the separation of instances and patterns in CybOX Observables and Objects. This will have a number of benefits, including:\r\n\r\n* It will clarify the issue of patterns vs. instances, as they will be captured in two separate locations, with their own distinct semantics\r\n* It will allow for type and semantic-based data validation on ALL CybOX Object fields\r\n    * This also supports the notion of atomic Objects, as in #379, given that the ability to validate their data is one of their supporting elements\r\n* It will allow for the creation of a domain-specific patterning language that facilitates the inclusion of more complex patterning constructs such as temporal patterning and variable based patterning\r\n\r\nAccordingly, this would entail deprecating the existing patterning based structures in CybOX, and would require revisions to all CybOX Objects, making this suitable only for a major revision. It would also require the definition of a new patterning object (e.g., \"PatternType\"), that functions as an implementation of a domain-specific patterning language. As a strawman, this could look something like:\r\n\r\n```xml\r\n<Observable id=\"obs-1\">\r\n  <Object>\r\n    <Properties xsi:type=\"AddressObj:AddressObjectType\">\r\n      <Address_Value id=\"value-1\">1.2.3.4</Address_Value>\r\n    </Properties>\r\n  </Object>\r\n</Observable>\r\n\r\n<Observable id=\"obs-2\">\r\n  <Object>\r\n    <Properties xsi:type=\"AddressObj:AddressObjectType\">\r\n      <Address_Value id=\"value-2\">2.3.4.5</Address_Value>\r\n    </Properties>\r\n  </Object>\r\n</Observable>\r\n\r\n<Pattern operator=\"AND\">\r\n  <Observable_Property condition=\"equals\" idref=\"value-1\"/>\r\n  <Observable_Property condition=\"equals\" idref=\"value-2\"/>\r\n  <Modifiers>\r\n    <Sequence>\r\n      <Ordinality>\r\n        <Ordinal_Position value=\"1\" idref=\"value-1\"/>\r\n        <Ordinal_Position value=\"2\" idref=\"value-2\"/>\r\n      </Ordinality>\r\n      <Time_Window units=\"minutes\">60</Time_Window>\r\n    </Sequence>\r\n  </Modifiers>\r\n</Pattern>\r\n```"},"comment":{"url":"https://api.github.com/repos/CybOXProject/schemas/issues/comments/154283973","html_url":"https://github.com/CybOXProject/schemas/issues/381#issuecomment-154283973","issue_url":"https://api.github.com/repos/CybOXProject/schemas/issues/381","id":154283973,"user":{"login":"athiasjerome","id":2775978,"avatar_url":"https://avatars.githubusercontent.com/u/2775978?v=3","gravatar_id":"","url":"https://api.github.com/users/athiasjerome","html_url":"https://github.com/athiasjerome","followers_url":"https://api.github.com/users/athiasjerome/followers","following_url":"https://api.github.com/users/athiasjerome/following{/other_user}","gists_url":"https://api.github.com/users/athiasjerome/gists{/gist_id}","starred_url":"https://api.github.com/users/athiasjerome/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/athiasjerome/subscriptions","organizations_url":"https://api.github.com/users/athiasjerome/orgs","repos_url":"https://api.github.com/users/athiasjerome/repos","events_url":"https://api.github.com/users/athiasjerome/events{/privacy}","received_events_url":"https://api.github.com/users/athiasjerome/received_events","type":"User","site_admin":false},"created_at":"2015-11-06T04:40:20Z","updated_at":"2015-11-06T04:40:20Z","body":"Reference to documentation (to be updated in case of changes)\r\nhttps://stixproject.github.io/documentation/suggested-practices/#observable"}}