Object Relationships - Metadata

["Kirillov, Ivan A." <ikirillov@mitre.org>]

It seems like we have come to general consensus that relationships between CybOX Objects should be expressed as embedded fields, e.g.,  a “redirects_to_ref” on the URL Object for pointing to another URL that the parent redirected to. However, recently Trey and I were wondering if this approach is too simplistic, in that it may not capture enough detail about the relationship being expressed. For instance, in the case of URL redirection, it’s useful to know the type of URL direction that was observed (e.g., the particular HTTP redirect code). Thus, we were wondering if we should consider expanding the embedded relationship structure to allow for additional metadata, which could perhaps (as a strawman) take on the form of additional keys in the relationship. For example, for URL redirection we could have something like:

 

                {

                    "type": "url-object",

                    "id": "url-object--1",

                    "spec_version": "cybox-3.0",

                    "value": "http://foo.bar.com/qwerty",

                    "redirects_to_ref": {"object_ref":"url-object--2",

                                         "http_redirect_code":"301"}

                }

 

We could also perhaps follow a more flattened approach and embed the metadata as a separate sibling field:

                {

                    "type": "url-object",

                    "id": "url-object--1",

                    "spec_version": "cybox-3.0",

                    "value": "http://foo.bar.com/qwerty",

                    "redirects_to_ref": "url-object--2"

                    "redirects_to_meta": {"http_redirect_code":"301"}

                }

 

Anyhow, just throwing this out there to see what everyone thinks about 1) us needing to support metadata in Object relationships and 2) the best way to do so (if needed). This will be one our discussion topics for tomorrow’s call.

 

Regards,

Ivan