{"action":"created","issue":{"url":"https://api.github.com/repos/STIXProject/schemas/issues/147","labels_url":"https://api.github.com/repos/STIXProject/schemas/issues/147/labels{/name}","comments_url":"https://api.github.com/repos/STIXProject/schemas/issues/147/comments","events_url":"https://api.github.com/repos/STIXProject/schemas/issues/147/events","html_url":"https://github.com/STIXProject/schemas/issues/147","id":29930989,"number":147,"title":"Capture Criticality/Importance of STIX Data","user":{"login":"ikiril01","id":1538202,"avatar_url":"https://avatars.githubusercontent.com/u/1538202?v=3","gravatar_id":"","url":"https://api.github.com/users/ikiril01","html_url":"https://github.com/ikiril01","followers_url":"https://api.github.com/users/ikiril01/followers","following_url":"https://api.github.com/users/ikiril01/following{/other_user}","gists_url":"https://api.github.com/users/ikiril01/gists{/gist_id}","starred_url":"https://api.github.com/users/ikiril01/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ikiril01/subscriptions","organizations_url":"https://api.github.com/users/ikiril01/orgs","repos_url":"https://api.github.com/users/ikiril01/repos","events_url":"https://api.github.com/users/ikiril01/events{/privacy}","received_events_url":"https://api.github.com/users/ikiril01/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/STIXProject/schemas/labels/Com-Components","name":"Com-Components","color":"0b02e1"},{"url":"https://api.github.com/repos/STIXProject/schemas/labels/Com-Core","name":"Com-Core","color":"444444"},{"url":"https://api.github.com/repos/STIXProject/schemas/labels/Pri-Medium","name":"Pri-Medium","color":"d7e102"},{"url":"https://api.github.com/repos/STIXProject/schemas/labels/Type-Enhancement","name":"Type-Enhancement","color":"02e10c"}],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":2,"created_at":"2014-03-21T19:51:06Z","updated_at":"2015-05-19T18:34:54Z","closed_at":null,"body":"We should consider adding the ability to capture the criticality/importance of STIX Data. For example, a reported Incident may be something that should be immediately acted upon, or on the other end of the spectrum it could be purely informational. It may be possible to achieve this via some sort of data marking, but we may need more granularity to allow for this to be specified on certain STIX constructs, e.g. Indicators and Incidents."},"comment":{"url":"https://api.github.com/repos/STIXProject/schemas/issues/comments/103625903","html_url":"https://github.com/STIXProject/schemas/issues/147#issuecomment-103625903","issue_url":"https://api.github.com/repos/STIXProject/schemas/issues/147","id":103625903,"user":{"login":"athiasjerome","id":2775978,"avatar_url":"https://avatars.githubusercontent.com/u/2775978?v=3","gravatar_id":"","url":"https://api.github.com/users/athiasjerome","html_url":"https://github.com/athiasjerome","followers_url":"https://api.github.com/users/athiasjerome/followers","following_url":"https://api.github.com/users/athiasjerome/following{/other_user}","gists_url":"https://api.github.com/users/athiasjerome/gists{/gist_id}","starred_url":"https://api.github.com/users/athiasjerome/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/athiasjerome/subscriptions","organizations_url":"https://api.github.com/users/athiasjerome/orgs","repos_url":"https://api.github.com/users/athiasjerome/repos","events_url":"https://api.github.com/users/athiasjerome/events{/privacy}","received_events_url":"https://api.github.com/users/athiasjerome/received_events","type":"User","site_admin":false},"created_at":"2015-05-19T18:34:54Z","updated_at":"2015-05-19T18:34:54Z","body":"+1\r\nI would recommend deep investigation.\r\nAs per my experience in XORCISM, as you already highlighted, this will be context-based.\r\nI identified a lot of parameters (relationships in my model) around Criticality (mainly based on Risk Analysis, so business risk, data classification, impact, etc.), but at the end, data is an Asset, and so IMHO, it's all around Assets first\r\n"}}