Re: [cti-cybox] CybOX Objects/Relationships

[Trey Darley <trey@soltra.com>]

On 12.04.2016 21:36:32, Kirillov, Ivan A. wrote:
> 
> However, as John mentioned, the way we design the data models around
> our CybOX Objects is fundamentally impacted by whether we support
> relationships or not. Thus, it would require a major revision of
> CybOX, including overhauling the majority of the CybOX Object data
> models, if we decided that we don’t wish to support relationships
> today and then decide to add them in a future release.
> 

Bingo!

Apart from the use cases for CybOX relationships already identified in
the observable types we're currently working through, as we iterate
through different domains in future point releases (digital forensics,
malware analysis, virtualized infrastructure, mobile devices, etc)
there's a high probability of needing CybOX relationships.

QED, let's incorporate the relationship primitive into our CybOX 3.0
Core and use it judiciously.

-- 
Cheers,
Trey
--
Trey Darley
Senior Security Engineer
4DAA 0A88 34BC 27C9 FD2B  A97E D3C6 5C74 0FB7 E430
Soltra | An FS-ISAC & DTCC Company
www.soltra.com
--
"It is easier to move a problem around (for example, by moving the
problem to a different part of the overall network architecture) than
it is to solve it." --RFC 1925

Attachment: signature.asc
Description: Digital signature