CybOX Objects/Relationships

["Kirillov, Ivan A." <ikirillov@mitre.org>]

We’ve put together a writeup on the questions surrounding CybOX Object and Relationships that stemmed from the CTI Common discussion (I’ve also attached a PDF copy for those who can’t access Google docs):

https://docs.google.com/document/d/1AQoxQ0YasnJ875EgDDyjDXX7cAQS10-b0WJRciOjACA/edit?usp=sharing

Fundamentally, the questions that this is trying to address are:

• Should CybOX define a set of top-level objects (TLOs) and be capable of being used in a standalone capacity? Or should it just define a set of types that are used in languages that incorporate CybOX?
• Should CybOX Objects be defined using a relationship-driven approach, or one based on embedded Objects?

Feel free to add any comments directly to the Google doc, or to this email thread. This is likely to be one of the main topics of discussion for next Thursday’s CybOX working session call.

Regards,

Ivan

Attachment: CybOXObjectsRelationships.pdf
Description: CybOXObjectsRelationships.pdf