ucoProject / UCO

This repository is for development of the Unified Cyber Ontology.
Apache License 2.0
73 stars 34 forks source link

`observable:ObservableRelationship` should constrain the types on the objects it is relating #573

Closed ajnelson-nist closed 2 months ago

ajnelson-nist commented 6 months ago

Background

The observable:ObservableRelationship class is a subclass of core:Relationship. It currently encodes no specializations or restrictions on core:Relationship's properties.

Informal discussion has noted at times that the source and target on an ObservableRelationship should be observable objects. On review of the class hierarchy, and in deference to the freedom currently present in core:Relationship, it appears they should be observable:Observables, instead of observable:ObservableObjects. (For a diagram of where differences arise between observable:Observable and observable:ObservableObject, see the "Solution Suggestion" section of Issue 544.)

Requirements

Requirement 1

An object asserted to be an ObservableRelationship should require that the objects it is relating (via core:source and core:target) are Observables.

Risk / Benefit analysis

Benefits

Risks

Competencies demonstrated

Competencies are omitted from this proposal, as the effects are new restrictions on data, and hence do not enable new expressive abilities.

Solution suggestion

Add the following to UCO for its next pre-2.0.0 release:

observable:ObservableRelationship
    sh:property
        [
            sh:class observable:Observable ;
            sh:message "The source on an ObservableRelationship is expected to be typed as an Observable, and the noted value node is not.  This will be an error in UCO 2.0.0."@en ;
            sh:path core:source ;
            sh:severity sh:Warning ;
        ] ,
        [
            sh:class observable:Observable ;
            sh:message "The target on an ObservableRelationship is expected to be typed as an Observable, and the noted value node is not.  This will be an error in UCO 2.0.0."@en ;
            sh:path core:target ;
            sh:severity sh:Warning ;
        ]
        ;
    .

For 2.0.0, reduce that addition to this:

observable:ObservableRelationship
    sh:property
        [
            sh:class observable:Observable ;
            sh:path core:source ;
        ] ,
        [
            sh:class observable:Observable ;
            sh:path core:target ;
        ]
        ;
    .

Coordination

ajnelson-nist commented 6 months ago

The ITAM example I noted under Risks turns out to already have had an analogy hanging around among CASE-Examples. The Cell Site example uses that pattern - a cell tower Located_At a location, and the relationship is an ObservableRelationship. This object got flagged when I merged the PRs for this Issue into the unstable test branches:

https://github.com/casework/CASE-Examples/blob/60ba58d/examples/illustrations/cell_site/cell_site.json#L153-L172

ajnelson-nist commented 6 months ago

The CASE website had some other examples where just one side of an ObservableRelationship is a subclass of Observable (links are to today's data):

ajnelson-nist commented 5 months ago

The meeting discussion date has been set to January 18th.

sbarnum commented 5 months ago

I agree with the proposal that the constraint should be to observable:Observable rather than observable:ObservableObject.

I believe that the constraint should be that at least one of either source or target should be observable:Observable rather than requiring both be observable:Observable.

ajnelson-nist commented 5 months ago

In the meeting, we hit a stumbling point on the "either or both" matter. The summary of the discussion was that the spelling of Requirement 1 in this proposal remains as is: We are voting to require ObservableRelationship constrain both core:source and core:target to be observable:Observables. Due to a participating committee member getting interrupted from the meeting, we are holding the Requirements Review vote in February's call.

The concerns boiled down to:

ajnelson-nist commented 3 months ago

CASE examples have updating PRs posted, which adapt data for the requirements voted on in last month's meeting: