diff --git a/extension-definition-specifications/incident-ef7/Incident Extension Suite.adoc b/extension-definition-specifications/incident-ef7/Incident Extension Suite.adoc index 757f94ac537..1d9741d4a30 100644 --- a/extension-definition-specifications/incident-ef7/Incident Extension Suite.adoc +++ b/extension-definition-specifications/incident-ef7/Incident Extension Suite.adoc @@ -79,7 +79,7 @@ The current STIX 2.1 Incident object was defined as a stub with the expectation In the 1.0 version of the core incident extension, information on impact, events, and tasks were embedded within the Incident object itself, however this was found to have limitations. Therefore, the 2.0 version of this extension has been created in which these components have been separated into independent SDOs for more complex incidents to be accurately modeled. -These extensions allow incidents to be tracked across their life cycle where [stixtype]#<># are first flagged for investigation resulting in [stixtype]#{incident_url}incidents# with [stixtype]#<># being worked to resolve them. +These extensions allow incidents to be tracked across their life cycle where [stixtype]#<># are first flagged for investigation resulting in [stixtype]#{incident_url}[incidents]# with [stixtype]#<># being worked to resolve them. Incidents have [stixtype]#<># that change over time. [stixtype]#<># can cause or influence these [stixtype]#<># which are in turn mitigated and potentially resolved by [stixtype]#<># performed as part of the incident response process. Both [stixtype]#<># and [stixtype]#<># can exist independently of [stixtype]#{incident_url}[incidents]# and in most workflows will occur prior to an incident being declared.