CycloneDX / CycloneDX/specification

threatScenario.threatActor references threatActorProfile

Open
#816 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
XSLT
Stars
547
Forks
93
Avg merge
7h 11m
Merged PRs (30d)
37

Description

While reviewing the cyclonedx-threat-2.0.schema.json in the 2.0-dev-threatmodeling branch, I noticed the following definition inside $defs.threatScenario:
```json
"threatActor": {
"$ref": "#/$defs/threatActorProfile"
}
```
However, the schema also defines a full threatActor object separately, which includes identity properties (bom-ref, name, type) and an embedded profile.

This appears to introduce a potential ambiguity in the intended semantics:
• Is threatScenario.threatActor meant to reference a defined threatActor entity?
• Or is the intent that a scenario only captures an assumed actor profile (without identity and bom-ref linkage)?

The current naming suggests a full actor, while the referenced type represents only a profile.

Depending on the intended modeling approach, alignment between naming and referenced type may be beneficial.

Before proposing any changes, I wanted to confirm the intended direction with the working group.

Happy to submit a PR aligned with the agreed semantics.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.