Re: [cti] [EXT] [cti] Embedded Relationships

Revoked -> this relationship was created in error and we want to remove its existence from future consideration

No longer active -> this relationship was active, is legitimate but we (as source of the reln) have determined that the connection is no longer at time X

Semantically they are different. I can see why you might think it’s the same but they’re not. At least in my mind. ☺

allan

From: "cti@lists.oasis-open.org" <cti@lists.oasis-open.org> on behalf of "Wunder, John" <[email protected]>
Date: Wednesday, May 3, 2017 at 1:35 PM
To: "cti@lists.oasis-open.org" <cti@lists.oasis-open.org>
Subject: Re: [cti] [EXT] [cti] Embedded Relationships

I don’t think I really follow the difference…can you give a couple examples (of no longer valid vs. no longer active)?

From: <cti@lists.oasis-open.org> on behalf of Allan Thomson <[email protected]>
Date: Wednesday, May 3, 2017 at 4:31 PM
To: John Wunder <jwunder@mitre.org>, Patrick Maroney <[email protected]>
Cc: Terry MacDonald <terry.macdonald@cosive.com>, "Jason Mr. Keirstead" <[email protected]>, "Bret Jordan (CS)" <[email protected]>, "Reller, Nathan S." <[email protected]>, "[email protected]" <[email protected]>, "John-Mark Mr. Gurney" <jmg@newcontext.com>, "[email protected]" <[email protected]>
Subject: Re: [cti] [EXT] [cti] Embedded Relationships

Revoked does not mean ‘no longer active’. It means the data is no longer valid. That’s semantically different.

I think we need a different attribute to represent no longer active.

allan

From: "Wunder, John" <jwunder@mitre.org>
Date: Wednesday, May 3, 2017 at 1:27 PM
To: Allan Thomson <athomson@lookingglasscyber.com>, Patrick Maroney <[email protected]>
Cc: Terry MacDonald <terry.macdonald@cosive.com>, Jason Keirstead <[email protected]>, Bret Jordan <[email protected]>, "Reller, Nathan S." <[email protected]>, "Struse, Richard" <[email protected]>, John-Mark Gurney <[email protected]>, "cti@lists.oasis-open.org" <cti@lists.oasis-open.org>
Subject: Re: [cti] [EXT] [cti] Embedded Relationships

Relationships are just a type of STIX Object and so already have a `revoked` property. Is that what we’re talking about here? If so I think we’re already covered.

From: <cti@lists.oasis-open.org> on behalf of Allan Thomson <[email protected]>
Date: Wednesday, May 3, 2017 at 4:20 PM
To: Patrick Maroney <pmaroney@wapacklabs.com>
Cc: Terry MacDonald <terry.macdonald@cosive.com>, "Jason Mr. Keirstead" <[email protected]>, "Bret Jordan (CS)" <[email protected]>, "Reller, Nathan S." <[email protected]>, "[email protected]" <[email protected]>, "John-Mark Mr. Gurney" <jmg@newcontext.com>, "[email protected]" <[email protected]>
Subject: Re: [cti] [EXT] [cti] Embedded Relationships

Pat – not sure I follow.

All of our CRUD operations/versioning are timestamped based in the current STIX 2.0 spec.

I don’t believe I’m suggesting something that is different from what we already have. Just making sure we follow that design.

Regards

allan

From: Patrick Maroney <pmaroney@wapacklabs.com>
Date: Wednesday, May 3, 2017 at 1:18 PM
To: Allan Thomson <athomson@lookingglasscyber.com>
Cc: Terry MacDonald <terry.macdonald@cosive.com>, Jason Keirstead <[email protected]>, Bret Jordan <[email protected]>, "Reller, Nathan S." <[email protected]>, "Struse, Richard" <[email protected]>, John-Mark Gurney <[email protected]>, "cti@lists.oasis-open.org" <cti@lists.oasis-open.org>
Subject: Re: [cti] [EXT] [cti] Embedded Relationships

Re Allan's comments:

"But the ability to model and represent data changes (CRUD) is important. We just need to agree on how that is done in the STIX model.

My response to this thread was suggesting we model deletion of relationships with a timestamp of when the reln is no longer active."

Since this topic has surfaced again, I'll throw out the Time Based Versioning Concept again.

Whoa! Whoa! Rocinante*!!! Relax.. We are not attacking this windmill again!!

Rocinante (Spanish pronunciation: [roθiˈnante]) is Don Quixote's horse in the novel Don Quixote by Miguel de Cervantes.

In many ways, Rocinante is not only Don Quixote's horse, but also his double: like Don Quixote,

he is awkward, past his prime, and engaged in a task beyond his capacities

Patrick Maroney

Principal Engineer - Data Science & Analytics

Wapack Labs LLC

(609)841-5104

pmaroney@wapacklabs.com

Public Key: http://pgp.mit.edu/pks/lookup?op=get&search=0x7C810C9769BD29AF

cti message