observed-string should be defined as an extension SCO

[chisholm]

cti-python-stix2-extensions/observed-string-8b1/src/observed_string/observed_string.py

Lines 10 to 21 in ef0d690

	@stix2.v21.CustomExtension(
	applies_to = "sco",
	type = OBSERVED_STRING_EXTENSION_ID,
	properties =
	[
	# required fields
	('purpose', OpenVocabProperty(STRING_PURPOSE, required=True)),
	('value', StringProperty(required=True))
	]
	)
	class ObservedString:
	extension_type = 'new-sco'

is incorrect. That kinda defines it more along the lines of a property extension, but would be incorrect for that too (wrong extension_type). It fails to give the SCO the common SCO properties (e.g. defanged), doesn't assign a STIX type name (should be "observed-string"), and doesn't set the ID contributing properties. You use @CustomObservable to register custom/extension SCOs (and @CustomObject for other object extensions). @CustomExtension is for property-extension, toplevel-property-extension, and subtype extensions only.

[rpiazza]

It fails to give the SCO the common SCO properties (e.g. defanged),

I think this is done by the @customObservable decorator

[chisholm]

Yes, but the above code doesn't use @CustomObservable, so it doesn't work.