CTI STIX Subcommittee

 View Only

Re: [cti-stix] relationships

  • 1.  Re: [cti-stix] relationships

    Posted 07-17-2016 20:33
    At this stage I would need to agree that I prefer a single relationship direction for clarity within the documentation.  That said, we allow relationships between any objects to allow for future scenarios that we haven't thought of, so in effect we already allow bi-directional relationships. We can describe and document 'official' relationships between objects in only a single direction if we want to simplify the relationship tables, but I do think that keeping the ability to connect any TLO to any other TLO is key to enable producers to describe relationships we haven't thought of. Cheers Terry MacDonald Cosive On 16/07/2016 2:17 AM, "Trey Darley" < trey@kingfisherops.com > wrote: On 15.07.2016 13:06:19, Wunder, John A. wrote: > > I had always thought we would just pick a consistent direction > (probably the active direction, so “can detect”) and use that > everywhere, minimizing cases where one org says “indicator detects > campaign” and another says “campaign is detected by indicator”. > Hey, John - I agree, let's avoid "passive voice" relationships insofar as humanly possible. -- Cheers, Trey ++--------------------------------------------------------------------------++ Kingfisher Operations, sprl gpg fingerprint: 85F3 5F54 4A2A B4CD 33C4  5B9B B30D DD6E 62C8 6C1D ++--------------------------------------------------------------------------++ -- "Conservative, n.: One who admires radicals centuries after they're dead." --Leo Rosten