search

MAECProject / schemas

MAEC Schemas and Schema Development
83 stars 16 forks source link

package_multi_partite_malware_example.json is invalid #147

Closed chisholm closed 4 years ago

chisholm commented 4 years ago

This one had what seemed like an obvious pattern: five references to SCOs with IDs "0" through "4", and five SCOs with all of those ID's except "3". Instead, there was an SCO with some buggy looking suspicious ID. I decided maybe that one was supposed to be "3". So I changed it to that. No way of knowing whether that was the intent, but it translates now.

There is another thing we might do too: some of those relationship types are close to ones in the spec, but not quite. E.g. it uses "dropped by" instead of "dropped-by", which is not wrong (spec only has a "should" rule), but silly. The translator translates non-spec relationship types to "related-to", so the result is a bunch of SDOs related via "related-to". Not terribly informative. We could improve that by using the actual spec relationships where possible. Also, why do we need the inverse relationships (drops, downloads)? We could delete half those relationships and simplify the content.

clenk commented 4 years ago

I agree that we should use relationships already in the spec as much as possible, and reduce the number of relationships since half of them are redundant.

chisholm commented 4 years ago

Ok, relationships are fixed.