-
Notifications
You must be signed in to change notification settings - Fork 19
Open
Description
Right now KillChainPhaseReferenceType provides two IDs to reference kill chain phases: @phase_id (with the ID of the phase) and @kill_chain_id (with this ID of the kill chain that phase is in).
@kill_chain_id is arguably redundant because the phase_id should uniquely identify that phase. The only case this would not be true is if the phase is present in multiple kill chains, but that capability could be removed in order to simplify how phases are referenced.
There's also a related issue, #117, that discusses whether the reference type should include data from the type definition.
Reactions are currently unavailable