Great discussion topic!
The conversation seemed (to me) to settle on the idea that there were three concepts that are related in some way:
1. Relationships
– A link between objects (e.g., this TTP is related to that Indicator)
2. Assertions
– The +1/-1 concept
3. Sightings
– “I saw that, too!”
It seems that the structures are similar across the three concepts (e.g., id, from, to, assertion, source/confidence/rationale) and that the larger open question is
whether humans are benefitted by these things being variations of the same concept or three different concepts (or something else).
I personally think there is a single set of common properties that can do Relationships, Assertions, and Sightings, and that it looks roughly like what Aharon posted.
However, there was a counter-point that this combining of concepts makes it more difficult to understand.
I’ll leave the group with these questions:
1. Is
there a single set of properties that makes sense for Relationships, Assertions, and Sightings?
2. If
there is a single set of properties, does it make sense to combine them, as Aharon has mentioned?
3. What
clarifying questions, if any, do you have that will help you answer #1 or #2?
a. Note
that this might be the most important of the three questions!
Thank you.
- Mark
This should be "sightings object rethought". While coming up with a proposal, I spotted a different way of thinking about Sightings. In my opinion, the most important thing is determining which STIX object
is being sighted. However, there is some other bits of information that is useful: sightings producer and date/time of sighting.
Now take a look at the recent relationship object discussions:
Relationship Object Discussion:
ID [1]: The ID of the relationship,
a simple random GUID
Marking[1]: The ID of the marking object that
you should reference
Version [1]: The version of the relationship; a simple number to be used with the ID for version control
Type [1]: The “type” of relationship being expressed. (Not sure of how this works yet)
Description [1]: A single simple and short description
Source [1] : The ID of one or more source entities in the relationship as a URI (not QName)
Targets [1..N]: The ID of one or more targets in the relationship as a URI (not QName)
Start [1]: A timestamp in UTC stating when the relationship between the objects started, or the text 'unknown'.
End [1]: A timestamp in UTC stating when the relationship between the objects ended, or the text 'ongoing', or the text 'unknown'.
Reliability/Confidence [1]: A measure of confidence in the relationship using the Information Reliability scale.
Producer [1]: A simple producer object like what John calls out
Timestamp [1]: A timestamp in UTC stating
when the relationship object was created.
Could a sighting be a type of Relationship?
Relationship Object Discussion:
Marking[1]: TLP Green
Version [1]: 1
Type [1]: Sighting
Description [1]: Soltra Edge reported Sighting
Source [1] : Soltra
Targets [1..N]: soltra:indicator-<GUID>
Start [1]:
End [1]:
Reliability/Confidence [1]:
Producer [1]: Soltra
Timestamp [1]: <timestamp>
Or is there more meta data we need to collect regarding sightings that a sighting deserves it's own object?
SOLTRA |
An FS-ISAC & DTCC Company