Questions for tomorrows call

[Bret Jordan <Bret_Jordan@symantec.com>]

I am not sure I will be able to make the call tomorrow, so here are my views on the questions that were asked via Slack.

The problem we have with the tests as written is there is no way in TAXII to actually do this, other than asking for content by 'added_after` filter parameter.   But a test like this, that uses added_after, could contain any data, not just Identity.  

My proposal:

1) We build a test that takes in 2 different bundles of data at a defined time such as now() and the test is that if you ask the TAXII server for content now()-1 that you get all of the data from both bundles. 

Bundle 1 = indicator1, indicator2, relationship_from_1-2

Bundle 2 = sighting_of_indicator1, identity_for_these_objects

POST Bundle 1 -> /api1/collections/<collection id>/objects/ 

POST Bundle 2 -> /api1/collections/<collection id>/objects/ 

GET /api1/collections/<collection id>/objects/?added_after=[now()-1]

 

Success: Bundle with Indicator1, Indicator2, Relationship1, Sighting1, Identity1

Failure: Not getting all of the records in a single bundle

2) We remove Identity from all tests as they are currently defined. 

3) We add the ability in TAXII to auto dereference content so that you can say, give me this Indicator and auto dereference the created_by_ref and give me the Identity as well.  The current tests would be a very valid, once we have this feature.  The trick will be just returning the Identity ONCE and not each time it is found in an indicator. 

Bret