All, Here are the currently relationships that we have defined on the TLOs... I know this is not all that needs to be there... PLEASE help us figure out what is missing... NOTE: these are all sorted as source relationships: attack-pattern uses malware attack-pattern uses tool attack-pattern targets identity campaign attributed-to threat-actor campaign uses attack-pattern campaign uses malware campaign uses tool campaign targets identity identity evidenced-by observation indicator indicates threat-actor indicator indicates malware indicator indicates tool indicator indicates campaign indicator indicates attack-pattern malware variant-of malware threat-actor attributed-to identity threat-actor uses-persona identity threat-actor impersonates identity threat-actor uses malware threat-actor uses attack-pattern threat-actor uses tool threat-actor targets identity Thanks, Bret Bret Jordan CISSP Director of Security Architecture and Standards Office of the CTO Blue Coat Systems PGP Fingerprint: 63B4 FC53 680A 6B7D 1447 F2C0 74F8 ACAE 7415 0050 Without cryptography vihv vivc ce xhrnrw, however, the only thing that can not be unscrambled is an egg. Attachment: signature.asc Description: Message signed with OpenPGP using GPGMail