As a reminder, we talked about relationships quite a bit in July:
https://lists.oasis-open.org/archives/cti-stix/201507/msg00009.html (
https://lists.oasis-open.org/archives/cti-stix/201507/threads.html )
— not sure how to link to one thread. We probably don’t want to lose all that context.
The last summary from that thread that I could find had this:
ID [1] [Required]: The ID of the relationship
Version [ 1] [Required]: The version of the relationship; a simple number to be used with the ID for version control (instead of timestamp)
Type [1] [Required]: The “type” of relationship being expressed. (Not sure of how this works yet)
Description [0..N] [Optional]: Words about the relationship.
Source_ID [1] [Required] : The ID of one source entity in the relationship
Target_ID [1..N] [Required]: The ID of one or more targets in the relationship
Start_Time [0..1] [Required]: A timestamp in UTC stating when the relationship between the objects started, or the text 'unknown'.
End_Time [0..1] [Required]: A timestamp in UTC stating when the relationship between the objects ended, or the text 'ongoing', or the text 'unknown'.
Reliability/Confidence [1] [Required]: A measure of confidence in the relationship using the Information Reliability scale.
Timestamp [0..1] [Required]: A timestamp in UTC stating when the relationship object was created.
John