Top-level relationships

["Wunder, John A." <jwunder@mitre.org>]

As a reminder, we talked about relationships quite a bit in July: https://lists.oasis-open.org/archives/cti-stix/201507/msg00009.html (https://lists.oasis-open.org/archives/cti-stix/201507/threads.html) — not sure how to link to one thread. We probably don’t want to lose all that context.

The last summary from that thread that I could find had this:

ID [1] [Required]: The ID of the relationship

Version [1] [Required]: The version of the relationship; a simple number to be used with the ID for version control (instead of timestamp)

Type [1] [Required]: The “type” of relationship being expressed.  (Not sure of how this works yet)

Description [0..N] [Optional]: Words about the relationship.

Source_ID [1] [Required] : The ID of one source entity in the relationship

Target_ID [1..N] [Required]: The ID of one or more targets in the relationship

Start_Time [0..1] [Required]: A timestamp in UTC stating when the relationship between the objects started, or the text 'unknown'.

End_Time [0..1] [Required]: A timestamp in UTC stating when the relationship between the objects ended, or the text 'ongoing', or the text 'unknown'.

Reliability/Confidence [1] [Required]: A measure of confidence in the relationship using the Information Reliability scale.

Timestamp [0..1] [Required]: A timestamp in UTC stating when the relationship object was created.

John