relationships & sighting objects about cti-stix-validator

[tlhampton13]

@ikiril01 Thank you for pointing out the specific language in the Spec.

[longdhnguyen]

I have created a new issue #72 for the comment above. Thanks @gtback

[gtback]

Thanks, @tlhampton13 ! I thought there was a statement in the spec that SROs could never be the source_ref or target_ref in a relationship; I know that was the intent. The only things I can find in the spec right now only seem to suggest rather than require that.

This is certainly something we need to address, either (most likely) as an error or (possibly) as a warning.

[tlhampton13]

Thanks, @gtback

I know this comment is not applicable to the validator and that the STIX 2 spec is already published, but I would prefer the Sighting object to be an SDO instead of an SRO. Connected to the other SDOs by "sighting-of", "where-sighted", and "observed" relationships. That's what some of our folks are trying to do with the above. It would make some things easier. Oh well, can't change the spec.

Given that the validator may enforce we'll avoid creating relationships to SROs.

[ikiril01]

I think the language is fairly clear in the definition of the Relationship SRO that it can only reference SDOs. If you look at the definition of source_ref/target_ref:

"The id of the source (from) object. The value MUST be an ID reference to an SDO (i.e., it cannot point to an SRO, Bundle, or Marking Definition)."

[gtback]

Thanks @ikiril01 , that's exactly what I was looking for!

[longdhnguyen]

Edited August 11, 2018: Issue #72

[gtback]

I would say that's a separate issue, @longdhnguyen (enforcing that all referenced objects are contained within the same bundle). There's nothing in the STIX spec that prohibits STIX objects from referencing objects not included in the same bundle. There may be some restrictions in the interoperability specification, in which case I can imagine adding a mode to the validator to check that, but I wouldn't make it the default.

[tlhampton13]

@gtback are you responding to @longdhnguyen comment or the original issue?

[gtback]

Sorry, that was for @longdhnguyen . I edited the above issue. Thanks for pointing that out.

[clenk]

The validator currently enforces this. The above stix content should result in the following error:

    [X] relationship--5b6c5dc9-5d0b-4f0b-be23-626531b250f3: source_ref: Relationships cannot link bundles, marking definitions, sightings, or other relationships. This field must contain the id of an SDO.

I'm closing this, but if you are still facing this issue @tlhampton13 feel free to reopen!