Several of the attribute attributes refer to their context as "event", maybe C&P error?
acruise opened this issue · 3 comments
e.g.
misp-rfc/misp-core-format/raw.md.txt
Line 476 in 0d37c82
If the uuid/id really do refer to the presumed parent event, they should be described that way... If they are actually attributes of the attribute (meta-attribute?) the noun should be updated. :)
It would be good to clarify the relationship between id
and uuid
... is the id
locally unique within a given installation, but likely to change if an object is sent to a different org? Is the uuid
expected to stay the same under such a situation?
Edit: I read a bit more, the answer is yes. :)
Yup, clarification would be welcome. I get a lot of "Duplicate UUID found in attribute" in my logs. I think because I try to use the same UUID (for the same attribute) in a different event (from the same manifest.json). I would expect that if the attribute is the same (an IP address in this case) the UUID could stay the same.
Maybe a hint could be added on how to best create an attribute UUID.
Is it org UUID, event UUID and attribute value?