relationship

Documentation

Overview

Package relationship implements the STIX 2.1 Relationship object.

The following information comes directly from the STIX 2.1 specification.

The Relationship object is used to link together two SDOs or SCOs in order to describe how they are related to each other. If SDOs and SCOs are considered "nodes" or "vertices" in the graph, the Relationship Objects (SROs) represent "edges".

STIX defines many relationship types to link together SDOs and SCOs. These relationships are contained in the "Relationships" table under each SDO and SCO definition. Relationship types defined in the specification SHOULD be used to ensure consistency. An example of a specification-defined relationship is that an indicator indicates a campaign. That relationship type is listed in the Relationships section of the Indicator SDO definition.

STIX also allows relationships from any SDO or SCO to any SDO or SCO that have not been defined in this specification. These relationships MAY use the related-to relationship type or MAY use a user-defined relationship type. As an example, a user might want to link malware directly to a tool. They can do so using related-to to say that the Malware is related to the Tool but not describe how, or they could use delivered-by (a user-defined name they determined) to indicate more detail.

Note that some relationships in STIX may seem like "shortcuts". For example, an Indicator doesn't really detect a Campaign: it detects activity (Attack Patterns, Malware, Infrastructure, etc.) that are often used by that campaign. While some analysts might want all of the source data and think that shortcuts are misleading, in many cases it's helpful to provide just the key points (shortcuts) and leave out the low-level details. In other cases, the low-level analysis may not be known or sharable, while the high-level analysis is. For these reasons, relationships that might appear to be "shortcuts" are not excluded from STIX.

Index

• type Relationship
  • func Decode(data []byte) (*Relationship, error)
  • func New() *Relationship
  • func (o *Relationship) Encode() ([]byte, error)
  • func (o *Relationship) EncodeToString() (string, error)
  • func (o *Relationship) GetPropertyList() []string
  • func (o *Relationship) SetSourceRef(s string) error
  • func (o *Relationship) SetSourceTarget(s, t string) error
  • func (o *Relationship) SetStartTime(t interface{}) error
  • func (o *Relationship) SetStopTime(t interface{}) error
  • func (o *Relationship) SetTargetRef(s string) error
  • func (o *Relationship) SetType(s string) error
  • func (o *Relationship) UnmarshalJSON(b []byte) error
  • func (o *Relationship) Valid() (bool, int, []string)

Types

type Relationship

type Relationship struct {
	objects.CommonObjectProperties
	RelationshipType string `json:"relationship_type,omitempty"`
	properties.DescriptionProperty
	SourceRef string `json:"source_ref,omitempty"`
	TargetRef string `json:"target_ref,omitempty"`
	StartTime string `json:"start_time,omitempty"`
	StopTime  string `json:"stop_time,omitempty"`
}

Relationship - This type implements the STIX 2 Relationship SRO and defines

all of the properties and methods needed to create and work with this object. All of the methods not defined local to this type are inherited from the individual properties.

func Decode

func Decode(data []byte) (*Relationship, error)

Decode - This function is a simple wrapper for decoding JSON data. It will

decode a slice of bytes into an actual struct and return a pointer to that object along with any errors.

func New

func New() *Relationship

New - This function will create a new STIX Relationship object and return

it as a pointer. It will also initialize the object by setting all of the basic properties.

func (*Relationship) Encode

func (o *Relationship) Encode() ([]byte, error)

Encode - This method is a simple wrapper for encoding an object into JSON

func (*Relationship) EncodeToString

func (o *Relationship) EncodeToString() (string, error)

EncodeToString - This method is a simple wrapper for encoding an object into

JSON

func (*Relationship) GetPropertyList

func (o *Relationship) GetPropertyList() []string

GetProperties - This method will return a list of all of the properties that

are unique to this object. This is used by the custom UnmarshalJSON for this object. It is defined here in this file to make it easy to keep in sync.

func (*Relationship) SetSourceRef

func (o *Relationship) SetSourceRef(s string) error

SetSourceRef - This method takes in a string value that represents a STIX

identifier of the source STIX object in the relationship and updates the source ref property.

func (*Relationship) SetSourceTarget

func (o *Relationship) SetSourceTarget(s, t string) error

SetSourceTarget - This methods takes in two string values where both

represent a STIX identifier. This is a convenience function for setting both ends of the relationship at the same time. The first identifier is for the source and the second is for the target.

func (*Relationship) SetStartTime

func (o *Relationship) SetStartTime(t interface{}) error

SetStartTime - This method will take in a timestamp in either time.Time or

string format and will set the valid_from property to that value.

func (*Relationship) SetStopTime

func (o *Relationship) SetStopTime(t interface{}) error

SetStopTime - This method will take in a timestamp in either time.Time or

string format and will set the valid_from property to that value.

func (*Relationship) SetTargetRef

func (o *Relationship) SetTargetRef(s string) error

SetTargetRef - This method takes in a string value that represents a STIX

identifier of the target STIX object in the relationship and updates the target ref property.

func (*Relationship) SetType

func (o *Relationship) SetType(s string) error

SetType - This method takes in a string value that represents the type name

of the relationship and updates the relationship type property.

func (*Relationship) UnmarshalJSON

func (o *Relationship) UnmarshalJSON(b []byte) error

UnmarshalJSON - This method will over write the default UnmarshalJSON method

to enable custom properties that this library does not know about. It will store them as map where the value of each key is a byte arrays. This way a tool that does know how to deal with them can then further process them after this is done. This will also allow the storage of the raw JSON data.

func (*Relationship) Valid

func (o *Relationship) Valid() (bool, int, []string)

Valid - This method will verify and test all of the properties on an object

to make sure they are valid per the specification. It will return a boolean, an integer that tracks the number of problems found, and a slice of strings that contain the detailed results, whether good or bad.