From 7555fb6db5198a8affc02efb7c48acb2d8709d3a Mon Sep 17 00:00:00 2001 From: Rich Piazza Date: Wed, 16 Oct 2024 16:54:18 -0400 Subject: [PATCH] second draft --- .../incident-ef7/Incident Extension Suite.adoc | 15 +++------------ 1 file changed, 3 insertions(+), 12 deletions(-) diff --git a/extension-definition-specifications/incident-ef7/Incident Extension Suite.adoc b/extension-definition-specifications/incident-ef7/Incident Extension Suite.adoc index 7e214ad6b6f..e8568b76073 100644 --- a/extension-definition-specifications/incident-ef7/Incident Extension Suite.adoc +++ b/extension-definition-specifications/incident-ef7/Incident Extension Suite.adoc @@ -150,15 +150,6 @@ Events can be grouped into sequences based on the *next_events_refs* property of |A list of the impacts of this incident. All objects referenced in this list *MUST* be an [stixtype]#<># object. -|*impacted_entity_counts* (optional) -|[stixtype]#<># -|A listing of the entity types that were impacted by the incident, and how many of each type were affected. -Individual impacts objects may also record more detailed counts as appropriate. - -If this property is not present it should be assumed that this information is not being shared, not that there were no impacted entities. - -To affirmatively state no entities of a given class were impacted they should be included with the number of entities affected by it set to 0. - |*incident_types* (optional) |[stixtype]#{list_url}[list]# of type [stixtype]#{open_vocab_url}[open-vocab]# |A list of incident types of incident that occurred, if applicable. @@ -2256,8 +2247,8 @@ This should not be used when an incident was flagged correctly, but is of no imp |[stixliteral]#none# |There is no evidence of destruction or modification of this data type in the system. -|[stixliteral]#none# -|It is known if destruction or modification of this data type in the system has occurred. +|[stixliteral]#unknown# +|It is unknown if destruction or modification of this data type in the system has occurred. |=== [[physical-impact-enum]] @@ -2399,7 +2390,7 @@ Hours and minutes should be understood to establish the timezone for the activit |[stixliteral]#provable-accountability# |Accountability can be ensured from the traces that are present. -[stixliteral]#unknown-accountability# +|[stixliteral]#unknown-accountability# |Accountability is unknown. |===