Enforce referenced objects in relationship objects about cti-stix-validator HOT 2 CLOSED

Hi @longdhnguyen, thanks for the feedback! So you want to verify that the SDOs being referenced by the SRO are contained within the same bundle? I believe the STIX 2.0 specification allows referencing objects that are not distributed within the same bundle. The indicator with an id starting with 'b' could be a valid object that just isn't included in the bundle.

We could add this check as an option, however.

from cti-stix-validator.

Hello @clenk, yes that is what I'd like to have as an option or to have the script raising a warning for this.

Also, I have found the exact part where you said "I believe the STIX 2.0 specification allows referencing objects that are not distributed within the same bundle":

STIX™ Version 2.0. Part 1: STIX Core Concepts section ​3.2​ IDs and References:

ID references can refer to objects to which the consumer/producer may not currently have. This specification does not address the implementation of ID reference resolution.

This was sneaky since I expect this information is covered in the Relationship section :)

from cti-stix-validator.