Re: [cti-stix] relationships

cti-stix message

At this stage I would need to agree that I prefer a single relationship direction for clarity within the documentation.

That said, we allow relationships between any objects to allow for future scenarios that we haven't thought of, so in effect we already allow bi-directional relationships.

We can describe and document 'official' relationships between objects in only a single direction if we want to simplify the relationship tables, but I do think that keeping the ability to connect any TLO to any other TLO is key to enable producers to describe relationships we haven't thought of.

On 16/07/2016 2:17 AM, "Trey Darley" <trey@kingfisherops.com> wrote:

On 15.07.2016 13:06:19, Wunder, John A. wrote:
>
> I had always thought we would just pick a consistent direction
> (probably the active direction, so “can detect”) and use that
> everywhere, minimizing cases where one org says “indicator detects
> campaign” and another says “campaign is detected by indicator”.
>

Hey, John -

I agree, let's avoid "passive voice" relationships insofar as humanly
possible.

--
Cheers,
Trey
++--------------------------------------------------------------------------++
Kingfisher Operations, sprl
gpg fingerprint: 85F3 5F54 4A2A B4CD 33C4 5B9B B30D DD6E 62C8 6C1D
++--------------------------------------------------------------------------++
--
"Conservative, n.: One who admires radicals centuries after they're
dead." --Leo Rosten