From 093eb8f5ca31fb3ca5c3bf07b980a2a46a934be6 Mon Sep 17 00:00:00 2001
From: openmorse <26353417+openmorse@users.noreply.github.com>
Date: Tue, 22 Oct 2024 00:59:33 -0700
Subject: [PATCH] simplify object_refs allowed patterns regex

---
 schemas/sdos/observed-data.json | 21 +++++++++++++++++++--
 1 file changed, 19 insertions(+), 2 deletions(-)

diff --git a/schemas/sdos/observed-data.json b/schemas/sdos/observed-data.json
index 6fa2c71..9f9ce0e 100644
--- a/schemas/sdos/observed-data.json
+++ b/schemas/sdos/observed-data.json
@@ -123,7 +123,24 @@
           "type": "array",
           "description": "A list of SCOs and SROs representing the observation.",
           "items": {
-            "$ref": "../common/identifier.json"
+            "type" : "string",
+            "anyOf": [
+              {
+                "allOf": [
+                  {
+                    "$ref": "../common/identifier.json"
+                  },
+                  {
+                    "not": {
+                      "pattern": "^(attack-pattern|campaign|course-of-action|grouping|identity|incident|indicator|infrastructure|intrusion-set|location|malware-analysis|malware|note|observed-data|opinion|report|threat-actor|tool|vulnerability)"
+                    }
+                  }
+                ]
+              },
+              {
+                "pattern": "^(autonomous-system--|directory--|domain-name--|email-addr--|email-message--|file--|ipv4-addr--|ipv6-addr--|mac-addr--|mutex--|network-traffic--|process--|software--|url--|user-account--|windows-registry-key--|x509-certificate--|relationship--|sighting--)"
+              }
+            ]
           },
           "minItems": 1
         }
@@ -147,4 +164,4 @@
       ]
     }
   ]
-}
+}
\ No newline at end of file