{"action":"opened","issue":{"url":"https://api.github.com/repos/johnwunder/twigs/issues/11","labels_url":"https://api.github.com/repos/johnwunder/twigs/issues/11/labels{/name}","comments_url":"https://api.github.com/repos/johnwunder/twigs/issues/11/comments","events_url":"https://api.github.com/repos/johnwunder/twigs/issues/11/events","html_url":"https://github.com/johnwunder/twigs/issues/11","id":119836662,"number":11,"title":"Observable Patterns and Observable Instances differences aren’t easily discerned","user":{"login":"terrymacdonald","id":5721772,"avatar_url":"https://avatars.githubusercontent.com/u/5721772?v=3","gravatar_id":"","url":"https://api.github.com/users/terrymacdonald","html_url":"https://github.com/terrymacdonald","followers_url":"https://api.github.com/users/terrymacdonald/followers","following_url":"https://api.github.com/users/terrymacdonald/following{/other_user}","gists_url":"https://api.github.com/users/terrymacdonald/gists{/gist_id}","starred_url":"https://api.github.com/users/terrymacdonald/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/terrymacdonald/subscriptions","organizations_url":"https://api.github.com/users/terrymacdonald/orgs","repos_url":"https://api.github.com/users/terrymacdonald/repos","events_url":"https://api.github.com/users/terrymacdonald/events{/privacy}","received_events_url":"https://api.github.com/users/terrymacdonald/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":0,"created_at":"2015-12-01T23:58:56Z","updated_at":"2015-12-01T23:58:56Z","closed_at":null,"body":"### PROBLEM\r\nObservables, Observable Patterns and Observable Instances aren’t easy for new Users to understand and discern the differences between. It took me months to realize that that Observables were actually made up of CybOX Observable Instances and CybOX Observable Patterns. \r\n\r\nThe difference between the CybOX Observable Instances and CybOX Observable Patterns and the rules to tell them apart are not obvious enough. \r\n\r\nThis leads on to the fact that Indicator Observables are often used to describe Observable Instances, when they really should be storing the things we are looking for - Observable Patterns. Observable Instances should instead be described separately within the STIX Observables construct and then referenced back as Sightings.\r\n\r\n### POTENTIAL ANSWER\r\nThe name of Observable Instances should be changed to become STIX ‘Observations’. This would provide the following hierarchy: \r\n\r\n    CybOX Observable -> STIX Observation.\r\n\r\nSTIX Observations should be restricted from used within the STIX Indicator object. \r\nThe name of Observable Patterns should be changed to become STIX ‘Patterns’. STIX Patterns should only be allowed to live within the STIX Indicator Object, describing what one would need to look for in order for the Indicator to trigger. This would provide the following hierarchy: \r\n\r\n    CybOX Observable -> STIX Pattern -> STIX Indicator.\r\n\r\nThis will help greatly with Sightings (in conjunction with the top-level relationship object), as a Sighting now becomes as easy as sending a new Sighting object and a relationship object back to the producer of the Indicator. This will allow Indicator producers to get independent feedback from third-parties with Sightings of that Indicator. This will potentially help producers refine their Indicators to make them reliable.\r\n"}}