Hi, I looked into the STIX pattern grammar (see relevant parts below). I think what is needed for CACAO is different enough that it shouldn’t be tied to this grammar. Issues: $s are not acceptable identifier characters The left-side of a STIX _expression_ is an “objectPath”, which is how properties of SCOs are specified. From what I understand, object paths are not what will be used in CACAO. The STIX pattern grammar can certainly be used as a starting point for a CACAO _expression_ grammar, but they should be discussed and maintained separately. Rich -- Rich Piazza Lead Cyber Security Engineer The MITRE Corporation 781-271-3760 –––––––––––––––––––––––––––––––––––– MITRE - Solving Problems for a Safer World™ From the pattern grammar propTest : objectPath NOT? (EQ NEQ) primitiveLiteral # propTestEqual objectPath NOT? (GT LT GE LE) orderableLiteral # propTestOrder objectPath NOT? IN setLiteral # propTestSet objectPath NOT? LIKE StringLiteral # propTestLike objectPath NOT? MATCHES StringLiteral # propTestRegex objectPath NOT? ISSUBSET StringLiteral # propTestIsSubset objectPath NOT? ISSUPERSET StringLiteral # propTestIsSuperset LPAREN comparisonExpression RPAREN # propTestParen EXISTS objectPath # propTestExists ; objectPath : objectType COLON firstPathComponent objectPathComponent? ; objectType : IdentifierWithoutHyphen IdentifierWithHyphen ; firstPathComponent : IdentifierWithoutHyphen StringLiteral ; objectPathComponent : <assoc=left> objectPathComponent objectPathComponent # pathStep '.' (IdentifierWithoutHyphen StringLiteral) # keyPathStep LBRACK (IntPosLiteral IntNegLiteral ASTERISK) RBRACK # indexPathStep ; // After keywords, so the lexer doesn't tokenize them as identifiers. // Object types may have unquoted hyphens, but property names // (in object paths) cannot. IdentifierWithoutHyphen : [a-zA-Z_] [a-zA-Z0-9_]* ; IdentifierWithHyphen : [a-zA-Z_] [a-zA-Z0-9_-]* ;