"created": "2016-05-01T06:13:14.000Z", "modified": "revoked": true } 5 { Consumer ignores this object because they already have a "type": "example", newer version of the object (the "id": "example--1", revoked version). "created": "2016-05-01T06:13:14.000Z", "modified": "2016-05-10T17:28:54.000Z" } Example object creator workflow This section describes an example workflow where a object creator publishes multiple updates to a particular object. This scenario assumes a human using a STIX implementation. (In this example, the STIX Objects have been truncated for brevity.) Step # STIX Object User Action 1 N/A STIX is not involved in this scenario. User clicks a create button in – the user interface, creates a SDO, then clicks save. This (Tools choose to create and track STIX versions for could action causes information to be internal changes, but it is not required by the specification.) stored in the product’s database. 2 { The user clicks the “share” button, delivering the "type": "example", intelligence to sharing partners. "id": "example--2", "created": "modified": "2016-05-01T06:13:14.000Z" } 3 N/A STIX is not involved in this scenario. The user performs additional – analysis within the STIX implementation, performing could choose to create and track STIX versions for multiple modifications and internal changes, but it is not required by the specification.) saving their work multiple times. 4 { The user, happy with the status of their work, decides to provide "type": "example", an update to some properties of "id": "example--2", the previously published object "created": "2016-05-01T06:13:14.000Z", (not shown). "modified": "2016-05-03T16:33:51.000Z"
"created": "2016-05-01T06:13:14.000Z", "modified": "revoked": true } 5 { "type": "example", "id": "example--1", "created": "2016-05-01T06:13:14.000Z", "modified": "2016-05-10T17:28:54.000Z" } Consumer ignores this object because they already have a newer version of the object (the revoked version). Example object creator workflow This section describes an example workflow where a object creator publishes multiple updates to a particular object. This scenario assumes a human using a STIX implementation. (In this example, the STIX Objects have been truncated for brevity.) Step # STIX Object User Action 1 N/A – STIX is not involved in this scenario. (Tools could choose to create and track STIX versions for internal changes, but it is not required by the specification.) User clicks a create button in the user interface, creates a SDO, then clicks save. This action causes information to be stored in the product’s database. 2 { "type": "example", "id": "example--2", "created": "modified": "2016-05-01T06:13:14.000Z" } The user clicks the “share” button, delivering the intelligence to sharing partners. 3 N/A – STIX is not involved in this scenario. could choose to create and track STIX versions for internal changes, but it is not required by the specification.) The user performs additional analysis within the STIX implementation, performing multiple modifications and saving their work multiple times. 4 { "type": "example", "id": "example--2", "created": "2016-05-01T06:13:14.000Z", "modified": "2016-05-03T16:33:51.000Z" The user, happy with the status of their work, decides to provide an update to some properties of the previously published object (not shown).
stix-v2.0-part1-stix-core.docx