You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
When granular markings are provided, does the object marking represent:
The "high level" marking for the object. This would be similar to saying a document is "secret", but it also contains paragraphs that are unclassified. For a STIX object, it would be the highest level of the available granular markings
The default marking for the object. All properties have the default marking, except ones mentioned in the granular markings, which could be at a higher (or lower) level.
Whichever is chosen, it would probably make sense to have an object marking for every type of marking definition used in the object (i.e., a SHOULD). If one is not provided, the it should be interpreted as the non-granular marking properties are unmarked within that marking definition type.
The "levels" are only significant for the same data marking type. For instance, an object marking could be TLP:GREEN, and a granular marking for a property could be a statement about terms of use. In that case, the markings are independent. However, we should probably make it clear whether a TLP object marking applies to all properties, if any granular marking for a property does not also specify a TLP marking.
Also using different marking types for the same object/property - do all apply (AND) or just the one the consumer cares about (OR). If it can be either or both, how to do it would need to be added to the spec.
But in general, how to interpret a set of markings of different data marking types will remain beyond the scope of the spec.
The text was updated successfully, but these errors were encountered:
When granular markings are provided, does the object marking represent:
Whichever is chosen, it would probably make sense to have an object marking for every type of marking definition used in the object (i.e., a SHOULD). If one is not provided, the it should be interpreted as the non-granular marking properties are unmarked within that marking definition type.
The "levels" are only significant for the same data marking type. For instance, an object marking could be TLP:GREEN, and a granular marking for a property could be a statement about terms of use. In that case, the markings are independent. However, we should probably make it clear whether a TLP object marking applies to all properties, if any granular marking for a property does not also specify a TLP marking.
Also using different marking types for the same object/property - do all apply (AND) or just the one the consumer cares about (OR). If it can be either or both, how to do it would need to be added to the spec.
But in general, how to interpret a set of markings of different data marking types will remain beyond the scope of the spec.
The text was updated successfully, but these errors were encountered: