[Date Prev] | [Thread Prev] | [Thread Next] | [Date Next] -- [Date Index] | [Thread Index] | [List Home]
Subject: Re: [cti-stix] Proposal - Top Level Relationship Object
So to summarize where we landed (once again):
ID [1] [Required]: The ID of the relationship
Version [1] [Required]: The version of the relationship; a simple number to be used with the ID for version control (instead of timestamp)
Type [1] [Required]: The “type” of relationship being expressed. (Not sure of how this works yet)
Description [0..N] [Optional]: Words about the relationship.
Source_ID [1] [Required] : The ID of one or more source entities in the relationship as a URI (not QName)
Target_ID [1..N] [Required]: The ID of one or more targets in the relationship as a URI (not QName)
Start_Time [0..1] [Required]: A timestamp in UTC stating when the relationship between the objects started, or the text 'unknown'.
End_Time [0..1] [Required]: A timestamp in UTC stating when the relationship between the objects ended, or the text 'ongoing', or the text 'unknown'.
Reliability/Confidence [1] [Required]: A measure of confidence in the relationship using the Information Reliability scale.
Timestamp [0..1] [Required]: A timestamp in UTC stating when the relationship object was created.
To be honest I still don't like that the Target is 1..N (complexity) and would prefer that we change anything with an "unknown" to just be optional but I suppose I can live with those two things and otherwise this looks really good to me.
#progress
John
From: "Jordan, Bret"
Date: Wednesday, July 29, 2015 at 6:57 PM To: Patrick Maroney Cc: Terry MacDonald, Jason Keirstead, "cti-stix@lists.oasis-open.org", Chris O'Brien, JG on CTI-TC, Jon Baker, "Wunder, John A.", Aharon Chernin Subject: Re: [cti-stix] Proposal - Top Level Relationship Object
I will choose to argue that if you have any level of context, then by definition you have some level of Reliability / Confidence / or what ever end up calling it.
Thanks,
Bret
Bret Jordan CISSP
Director of Security Architecture and Standards | Office of the CTO
Blue Coat Systems
PGP Fingerprint: 63B4 FC53 680A 6B7D 1447 F2C0 74F8 ACAE 7415 0050
"Without cryptography vihv vivc ce xhrnrw, however, the only thing that can not be unscrambled is an egg."
|
[Date Prev] | [Thread Prev] | [Thread Next] | [Date Next] -- [Date Index] | [Thread Index] | [List Home]