Skip to content

Issue 49 implement the stix 21 windows registry datatype enumeration #105

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Conversation

brett-heffelfinger
Copy link
Contributor

Closes #49

Need feedback/suggestions on the triples as they relate to the idea of enumeration, like in #103.

Comment on lines 2490 to 2496
gist:_WindowsRegistryDatatype_reg-binary
a gist:WindowsRegistryDatatype ;
skos:definition """STIX 2.1 description:
Binary data in any form."""^^xsd:string ;
skos:prefLabel "REG_BINARY"^^xsd:string ;
gist:stixTerm "REG_BINARY"^^xsd:string ;
.
Copy link
Contributor

@uscholdm uscholdm Jun 6, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

'reg' is redundant in the IRI. Suggest to make changes like this for each instance. If my memory serves me, this is consistent with what we have done elsewhere.

Suggested change
gist:_WindowsRegistryDatatype_reg-binary
a gist:WindowsRegistryDatatype ;
skos:definition """STIX 2.1 description:
Binary data in any form."""^^xsd:string ;
skos:prefLabel "REG_BINARY"^^xsd:string ;
gist:stixTerm "REG_BINARY"^^xsd:string ;
.
gist:_WindowsRegistryDatatype_binary
a gist:WindowsRegistryDatatype ;
skos:definition """STIX 2.1 description:
Binary data in any form."""^^xsd:string ;
skos:prefLabel "binary"^^xsd:string ;
gist:stixTerm "REG_BINARY"^^xsd:string ;
.

@rhohimer
Copy link
Collaborator

rhohimer commented Jun 7, 2025 via email

@uscholdm
Copy link
Contributor

uscholdm commented Jun 9, 2025

This holds true for all the STIX vocabularies. The implementations of these vocabularies and enumerations must support the writing of STIX 2.1 JSON. Because of this the implementation of gistCyber should capture the exact stix terms somewhere so that the knowledge is in the ontology not the translation code.
Two considerations:

  1. STIX Practitioner ease of use
  2. Ingest and Export of STIX 2.1 JSON

Using gist:stixTerm makes round-tripping possible, but its more work and for those already familiar with STIX, it could be initially confusing. For those unfamiliar with STIX, removing redundancy in labels may be preferred, and it is better practice (IMHO). It's a tradeoff. I'm ok with going the simple route for now, knowing that it might be adding a tad of technical debt.

@rhohimer rhohimer merged commit 6f91b9e into develop Jun 11, 2025
@brett-heffelfinger brett-heffelfinger deleted the issue-49-implement-the-stix-21-windows-registry-datatype-enumeration branch June 13, 2025 13:17
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Implement the STIX 2.1 Windows™ Registry Datatype Enumeration
3 participants