Relationships should be a top-level object

[johnwunder]

The current way relationships are conveyed (only in objects) has two issues.

Firstly, is that I cannot currently 'agree' with a relationship that someone has asserted between objects they have published. In some cases it is extremely valuable for someone to say they also think that object A and Object B are related. Currently I would need to produce my own object and assert the relationship from my own object to that object. Its for this reason that I would like to propose that Relationships should be able to be sent independently of the objects they refer to. In that case a third-party will be able to send their agreement that a relationship is valid. A subsequent consumer can then easily see that 14 others agree the suggested relationship is valid and only 2 say its not - therefore the relationship is more likely to be valid.

e.g. mycompany agrees completely with the assertion that thirdparty made that there is a relationship between the two objects that thirdparty published.

<stix:Relationships>
    <stix:Relationship id="mycompany:relationship-2c560b47-7b11-48a1-bcda-968dfbe0ceba" timestamp="2015-03-11T01:01:01+00:00" xsi:type='relationship:RelationshipType'>
        <stixCommon:Confidence>
            <stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
        </stixCommon:Confidence>
        <stixCommon:Information_Source>
            <stixCommon:Identity id="mycompany:Identity-50790476-b684-11e3-9149-0800271e87d2">
                <stixCommon:Name>MyCompany, Inc.</stixCommon:Name>
            </stixCommon:Identity>
        </stixCommon:Information_Source>
        <relationship:Object>
            <indicator:Indicator id="thirdparty:Indicator-33fe3b22-0201-47cf-85d0-97c02164528d" xsi:type='indicator:IndicatorType' timestamp="2015-02-20T09:00:00.000000Z">
        </relationship:Object>
        <stixCommon:Relationship xsi:type="stixVocabs:AssertionAgreementVocab-1.0">Agrees</stixCommon:Relationship>
        <relationship:Related_Object>
            <indicator:Indicator id="thirdparty:Indicator-8cc8061e-2bed-496b-882e-2c4ad1b30f23" xsi:type='indicator:IndicatorType' timestamp="2015-02-27T13:00:00.000000Z">
        </relationship:Related_Object>
    </stix:Relationship>

^ That's effectively a [+1] from mycompany!.

The second use of the Top-level relationship object is to agree with the object that someone else sent. Note this is different from agreeing with the relationship between objects (the edges) that the previous example was describing. This use of the relationship object is agreeing with the object itself (the nodes in knowledge-graph-speak).

e.g. mycompany agrees completely that the assertion that thirdparty made in their info is correct.

<stix:Relationships>
    <stix:Relationship id="mycompany:relationship-2c560b47-7b11-48a1-bcda-968dfbe0ceba" timestamp="2015-03-11T01:01:01+00:00" xsi:type='relationship:RelationshipType'>
        <stixCommon:Confidence>
            <stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
        </stixCommon:Confidence>
        <stixCommon:Information_Source>
            <stixCommon:Identity id="mycompany:Identity-50790476-b684-11e3-9149-0800271e87d2">
                <stixCommon:Name>MyCompany, Inc.</stixCommon:Name>
            </stixCommon:Identity>
        </stixCommon:Information_Source>
        <relationship:Object>
            <indicator:Indicator id="thirdparty:Indicator-33fe3b22-0201-47cf-85d0-97c02164528d" xsi:type='indicator:IndicatorType' timestamp="2015-02-20T09:00:00.000000Z">
        </relationship:Object>
        <stixCommon:Relationship xsi:type="stixVocabs:AssertionAgreementVocab-1.0">Agrees</stixCommon:Relationship>
    </stix:Relationship>
</stix:Relationships>

I think we need this functionality to crowdsource agreement from communities.

Issue 291, 201 from STIX.

[terrymacdonald]

Also see #13 as it is slightly related.