Re: [cti-cybox] RE: Object Relationships - Metadata

["Wunder, John A." <jwunder@mitre.org>]

+1 to Jeff.

On 6/8/16, 12:45 PM, "Mates, Jeffrey CIV DC3/DCCI" <cti-cybox@lists.oasis-open.org on behalf of Jeffrey.Mates@dc3.mil> wrote:

>I definitely agree that we need to be able to capture rich data about embedded relationships and keeping them side by side helps do that.  However, I like keeping to the convention that every single item reference ends with "_ref" while list of references ends with "_refs".  So I'm in favor of a slightly modified version of number 1 
>
>{
>        "type": "url-object",
>        "id": "url-object--1",
>         "spec_version": "cybox-3.0",
>         "value": "http://foo.bar.com/qwerty";,
>         "redirects_to": {
>                 "object_ref":"url-object--2",
>                 "http_redirect_code":"301"
>         }
>}
>
>Jeffrey Mates, Civ DC3/DCCI
>~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
>Computer Scientist
>Defense Cyber Crime Institute
>jeffrey.mates@dc3.mil
>410-694-4335
>
>
>-----Original Message-----
>From: cti-cybox@lists.oasis-open.org [mailto:cti-cybox@lists.oasis-open.org] On Behalf Of Kirillov, Ivan A.
>Sent: Wednesday, June 08, 2016 12:18 PM
>To: cti-cybox@lists.oasis-open.org
>Subject: [Non-DoD Source] [cti-cybox] Object Relationships - Metadata
>
>It seems like we have come to general consensus that relationships between CybOX Objects should be expressed as embedded fields, e.g.,  a “redirects_to_ref” on the URL Object for pointing to another URL that the parent redirected to. However, recently Trey and I were wondering if this approach is too simplistic, in that it may not capture enough detail about the relationship being expressed. For instance, in the case of URL redirection, it’s useful to know the type of URL direction that was observed (e.g., the particular HTTP redirect code). Thus, we were wondering if we should consider expanding the embedded relationship structure to allow for additional metadata, which could perhaps (as a strawman) take on the form of additional keys in the relationship. For example, for URL redirection we could have something like:
>
> 
>
>                {
>
>                    "type": "url-object",
>
>                    "id": "url-object--1",
>
>                    "spec_version": "cybox-3.0",
>
>                    "value": "http://foo.bar.com/qwerty";,
>
>                    "redirects_to_ref": {"object_ref":"url-object--2",
>
>                                         "http_redirect_code":"301"}
>
>                }
>
> 
>
>We could also perhaps follow a more flattened approach and embed the metadata as a separate sibling field:
>
>                {
>
>                    "type": "url-object",
>
>                    "id": "url-object--1",
>
>                    "spec_version": "cybox-3.0",
>
>                    "value": "http://foo.bar.com/qwerty";,
>
>                    "redirects_to_ref": "url-object--2"
>
>                    "redirects_to_meta": {"http_redirect_code":"301"}
>
>                }
>
> 
>
>Anyhow, just throwing this out there to see what everyone thinks about 1) us needing to support metadata in Object relationships and 2) the best way to do so (if needed). This will be one our discussion topics for tomorrow’s call.
>
> 
>
>Regards,
>
>Ivan
>
> 
>