Re: [cti-cybox] CybOX Objects/Relationships

["Jordan, Bret" <bret.jordan@bluecoat.com>]

I agree completely 

Bret 

Sent from my Commodore 64

> On Apr 13, 2016, at 12:16 PM, John-Mark Gurney <jmg@newcontext.com> wrote:
> 
> Kirillov, Ivan A. wrote this message on Wed, Apr 13, 2016 at 14:23 +0000:
>> That seems reasonable to me – I also think it doesn’t make sense that CybOX Objects would be globally unique. Therefore, what if we say something like:
>> 
>>  *   CybOX Object IDs: are unique only to the local container in which the CybOX Object is captured. There is no assumption or expectation that such IDs are globally unique.
> 
> If we do this, then I would argue that we need to make sure that we
> do not use IDs that could be globally unique.. i.e. an ID is a simple
> integer that is < 999,999,999...  If we use a UUID or something
> similar, someone will use them as such....
> 
>>  *   Object Relationships:  are valid only between CybOX Objects captured in the same local encapsulating container (i.e., sibling Objects). That is, relationships MUST NOT be defined between Objects that are captured in different containers (even in the same document).
> 
> A small number, like the above will help enforce this...
> 
> I'm still not a fan of relationships between cybox objects, but I can
> see their use in limited cases...  We need to make sure that we make
> the spec so that people have to do the right thing, and not invent
> 20 different ways to store an IP for a simple watchlist...
> 
> I'm worried that adding freeform relationships will make it
> difficult/impossible for one person's indicator/pattern to match
> another person's observations because they generated their cybox
> differently...  If each orginization has to rewrite an indicator's
> pattern to match how their tool collects data, then we have failed
> in our mission...
> 
> -- 
> John-Mark
> 
> ---------------------------------------------------------------------
> To unsubscribe from this mail list, you must leave the OASIS TC that 
> generates this mail.  Follow this link to all your TCs in OASIS at:
> https://www.oasis-open.org/apps/org/workgroup/portal/my_workgroups.php 
>