I am coming around to Terry's way of thinking on this. The single level relationship is much easier to parse and multiple relationships between SDOs only enriches the story we are trying to convey.
The relationship we have defined now, attributed-to, is the generic use case. It can be used with a minimum of information, and in many cases is a mere assertion.
What Gary and the others are suggesting are more nuanced relationships that convey a deeper meaning. I would expect that if someone were to use a planned-by relationship, there is more evidence to support that, versus a generic attribution. Same for executed-by
and others yet to come.
We are not restricted to adding these additional relationships. Perhaps it may make more sense to stop at the generic case for 2.0 and if we see significant adoption of some of these other relationship types to add them to the vocabulary in 2.1 and beyond.
--
Rob Coderre
iDefense, Director of Product Management
Verisign, Inc.
I much prefer district single level relationships. We should suggest a list of relationships in an open vocab (as we do now) allowing people to add to the list of relationship types for each object type. Over time the popular ones will become apparent
and we should codify their popularity by adding them to the next release of STIX.
We absolutely need this multi-relationship connectivity between SDOs to provide the flexibility for users to accurately describe the nuances of the Threat Intel they are wanting to portray. The suggested open vocabulary will provide the structure
to allow automation to occur, and the extensibility of that open vocab will provide flexibility to describe accurately.
I do not like adding another layer to the relationships at all. I would prefer keeping them single level. All a double layer relationship would do is classify the object type at the other end of the relationship, which is an unnecessary addition
as the relationship is already able to do that as the id in the target_ref field contains the object_type.
Cheers
Terry MacDonald
Cosive