Include "potential indicator" in maecVocabs:CollectionEntityTypeEnum

[dzbeck]

See proposal to deprecate MAEC Candidate Indicators in favor of STIX Indicators (which references the proposal to make MAEC Collections top-level Entities). The proposal involves using a MAEC Collection with the entity_type field set to "potential indicator."

[ikiril01]

@dzbeck should this instead be captured in the Name field in the new CollectionType? It seems a little odd to have "potential indicator", which is more of a label or description, in the same enumeration that captures possible MAEC/CybOX entity types such as "actions", "objects", and the like.

[dzbeck]

@ikiril01 it doesn't seem a good idea to embed such info in a Name... although I see that it's odd to have an entity type (potential indicator) that is comprised of maec entities (actions, behaviors). How about defining both the "maec_entity_type" field (which includes "various") and an optional "collection_type" field to include "potential_indicator" (and any other higher level things that a collection of maec entities could be).

[ikiril01]

@dzbeck I thought about this a bit more and I like your idea of having a separate field for having a standard way of specifying the contents of a Collection (including potential indicators), though I called it "type" for simplicity. I also thought it may be used for capture related "sets" of MAEC entities, such as file system entities, network entities, etc. Anyhow, what do you think of the corresponding changes in https://github.com/MAECProject/schemas/wiki/Proposal:-Make-Collections-Top-Level-Entities?

[dzbeck]

@ikiril01 I think the changes look great. I like the values in CollectionTypeEnum.