cti-stix — archive

[John Wunder <achernin@soltra.com>]

Are you actually forced to use the relationship object to have sighting work there? I see that as a separate use case from relationships, and in cases like this we can still have the target_id field directly there without the need for a new object. Same thing for an indicator pattern, for example. While those are references between top-level constructs they seem different than the normal type of relationships we’ve been discussing. John BTW: Any thoughts on setting up a slack channel for STIX dev discussions? Sometimes I think that would be more conducive to these questions than e-mail. On Aug 20, 2015, at 11:58 AM, Aharon Chernin < achernin@soltra.com > wrote: Bret, I almost always prefer atomic objects. If we do both a relationship object and a Sightings atomic object together, it just seems... well weird.... (not very scientific I know) Example Sightings Object - ID: Sighting GUID Marking: Sighting TLP Producer: Who made the sighting Timestamp: ?Target_ID: Replaced by Relationship Object Now I am going to be forced to use the relationship object to make the Sighting work. I am also going to be forced to make a potentially large number of new Sighting Objects (since there is a timestamp). Also, a sighting by itself, without the looking into the Relationship object is kind of useless. We can eliminate this extra complexity by eliminating the atomic Sightings object and replacing it with a relationship type. Just debating <OutlookEmoji-