Identify issue w/ LinkObject namespace

[mghenderson]

Using the following snippet in the STIX.py schema, I was able to map a LinkObject in STIX. However, it seems that the Indicator is created incorrectly, with the Properties element of the Observable Object having an incorrect namespace of LinkObj instead of cybox.

Created Indicator

<stix:Indicator id="CFM:Indicator-indicator-28c8a3f7-0837-11e6-bcfd-eccd6dca155c" timestamp="2016-04-25T14:46:31+00:00" xsi:type='indicator:IndicatorType' version="2.1.1">
    <indicator:Title>Malicious Link Indicator</indicator:Title>
    <indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">URL Watchlist</indicator:Type>
    <indicator:Description>Embedded Link</indicator:Description>
    <indicator:Observable id="CFM:Observable-8b57eea7-d16c-4a0d-a3f6-b866a334a188">
        <cybox:Object id="CFM:Object-28c8a3f8-0837-11e6-91da-eccd6dca155c">
            <LinkObj:Properties xsi:type="LinkObj:LinkObjectType">
                <URIObj:Value condition="Equals">http://www.malware.com/test/link</URIObj:Value>
            </LinkObj:Properties>
        </cybox:Object>
    </indicator:Observable>
</stix:Indicator>

Corrected Indicator

<stix:Indicator id="CFM:Indicator-indicator-28c8a3f7-0837-11e6-bcfd-eccd6dca155c" timestamp="2016-04-25T14:46:31+00:00" xsi:type='indicator:IndicatorType' version="2.1.1">
    <indicator:Title>Malicious Link Indicator</indicator:Title>
    <indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">URL Watchlist</indicator:Type>
    <indicator:Description>Embedded Link</indicator:Description>
    <indicator:Observable id="CFM:Observable-8b57eea7-d16c-4a0d-a3f6-b866a334a188">
        <cybox:Object id="CFM:Object-28c8a3f8-0837-11e6-91da-eccd6dca155c">
            <cybox:Properties xsi:type="LinkObj:LinkObjectType">
                <URIObj:Value condition="Equals">http://www.malware.com/test/link</URIObj:Value>
            </cybox:Properties>
        </cybox:Object>
    </indicator:Observable>
</stix:Indicator>

Schema element in stix.json

"observable_object_link_value": {
    "description": "The malicious link object information",
    "valuemap": "observable;object;properties;value;value",
    "datatype": "string",
    "required": false,
    "requiredIfReferenceField": "observable_object_xsitype",
    "requiredIfReferenceValuesMatch": [ "LinkObjectType" ],
    "ontologyMappingType": "simple",
    "ontologyMapping": "http://www.anl.gov/cfm/transform.owl#LinkObjectIndicatorSemanticComponent"
}

[mghenderson]

I traced this all the way through the STIX & CYBOX package calls (minus the last couple write statements, which were a mess of recursive calls that I'll have to spend time untangling), and was unable to see any meaningful difference between a failure with a link object and a success with an IP address. Regardless, I believe the error is burried in those two pacakges, so I'll be looking into updating our references to them in the future, which is complicated by the fact I believe those projects to be written in Python2.