oasis-open / cti-sep-repository Goto Github PK

It doesn't seem like a SEP is able to define the meanings of new values in open vocabularies, or labels for the already existing SDOs. This isn't a new STIX Object nor an extension to an existing one, which is what the current SEP scope covers. Trust groups will want to be on the same page about labels and custom open vocab values, and a SEP could help with that.

Trust groups will probably want to have their own marking definitions beyond TLP or Statement. DHS is working on one for AIS, which Marlon has asked me to write up using SEP.

I’m not sure the currently defined concept of SEP exactly fits with introducing a new marking definition type. If you look in the spec - for the definition property of a marking-definition it says , which of course is poorly defined. The statement and tlp definitions aren’t SDOs or SCOs. Adding a new marking definition object isn't the same as adding an extension, custom object or custom property.

The SEP template should probably be updated to reference the new 2.1 Extension syntax at https://docs.oasis-open.org/cti/stix/v2.1/cs02/stix-v2.1-cs02.html#_5fzuuhwycg2e in order to define the extension