OASIS Mailing List ArchivesView the OASIS mailing list archive below
or browse/search using MarkMail.

 


Help: OASIS Mailing Lists Help | MarkMail Help

cti-stix message

[Date Prev] | [Thread Prev] | [Thread Next] | [Date Next] -- [Date Index] | [Thread Index] | [List Home]


Subject: STIX 2.0 - Bundle and collection of arbitrary STIX objects - improvement?


Hi All,

While reading the STIX 2.0 document, I would like to share with you a current
issue we have with large set of STIX objects or packages (v1.1). Large objects are becoming
more common in threatintel sharing platforms. We have seen a significant grow in the MISP
instances that we know about of indicators or additional information like malware samples.

The section 7. mentions the use of bundle which improves the situation while exchanging
over non-TAXII interfaces. It's indeed an improvement but we saw many limitations with
current JSON parsers which are often non-stream based and load the whole JSON structure in
memory. Could we extend the use of bundle to have a simple MANIFEST file approach
where the STIX objects are only referenced in the bundle without adding the full object by itself?
This would avoid the parsing of the full JSON object and having a simple way to create
bundle in packages (like ZIP, tar.gz...) with each STIX objects as file.

Thank you very much.

Cheers.

PS: Also, we would be very interested on hearing about best-practices when it comes to sharing large datasets in STIX 1.1/1.2.


-- 
Alexandre Dulaunoy
CIRCL - Computer Incident Response Center Luxembourg
41, avenue de la gare L-1611 Luxembourg
info@circl.lu - www.circl.lu


[Date Prev] | [Thread Prev] | [Thread Next] | [Date Next] -- [Date Index] | [Thread Index] | [List Home]