opencti icon indicating copy to clipboard operation
opencti copied to clipboard

Remove "linked to" nested relationship

Open securitiz opened this issue 3 years ago • 0 comments

Use case

Based on my research in STIX 2.1 specs, there is no functional difference between the "linked to" nested relationship and "relates to". The only difference appears to be in the permissions - who can create a relationships between objects (https://github.com/oasis-tcs/cti-stix2/issues/285)

As such, it is confusing to have two "generic" relationship types, and it seems best to do away with one of them. I'm offering up "linked to", since it is the one that was added most recently.

Current Workaround

Hope that "linked to" and "related to" relationships are treated the same way within OpenCTI. I doubt this is the case, because filtering in Investigations view on "related to" relationships won't return "linked to" relationships

Proposed Solution

Combine/merge the two, so that only one exists in OpenCTI. On the backend, "linked to" relationships can be supported, and interpreted as "related to" relationships, in order to not break already existing "linked to" relationships

Additional Information

If the feature request is approved, would you be willing to submit a PR?

Yes / No (Help can be provided if you need assistance submitting a PR)

securitiz avatar Aug 16 '22 01:08 securitiz