search

STIXProject / schemas

STIX Schema Development
http://stixproject.github.io/
76 stars 21 forks source link

Remove Related_Identities #339

Open johnwunder opened 9 years ago

johnwunder commented 9 years ago

IdentityType has a field for Related_Identities but it's not clear what that means in the context of any specific identity usage. Consider removing it to simplify things.

athiasjerome commented 8 years ago

do not agree e.g. Threat Actor (abstracted as an 'Asset': Organisation/Person/IT-Asset), let's say identified as a Person (Identity). You would like to link the accomplices (Related_Identities)

johnwunder commented 8 years ago

Couldn't you just use related threat actors? Though it sounds like in that ontology you've collapsed the threat actor and the identity together (in STIX 1.2 they're separate, and you can have both a related identity and a related threat actor) so maybe that's the same thing.