Re: [cti-stix] STIX 2.0 - Bundle and collection of arbitrary STIX objects - improvement?

["Jordan, Bret" <bret.jordan@bluecoat.com>]

Can you put together a proposal for what this would need to look like / how it should work?  I am sure we can easily do this / add this for 2.1.

Thanks,

Bret

Bret Jordan CISSP

Director of Security Architecture and Standards | Office of the CTO

Blue Coat Systems

PGP Fingerprint: 63B4 FC53 680A 6B7D 1447  F2C0 74F8 ACAE 7415 0050

"Without cryptography vihv vivc ce xhrnrw, however, the only thing that can not be unscrambled is an egg." 

On Aug 19, 2016, at 00:55, Alexandre Dulaunoy <Alexandre.Dulaunoy@circl.lu> wrote:

Hi All,

While reading the STIX 2.0 document, I would like to share with you a current
issue we have with large set of STIX objects or packages (v1.1). Large objects are becoming
more common in threatintel sharing platforms. We have seen a significant grow in the MISP
instances that we know about of indicators or additional information like malware samples.

The section 7. mentions the use of bundle which improves the situation while exchanging
over non-TAXII interfaces. It's indeed an improvement but we saw many limitations with
current JSON parsers which are often non-stream based and load the whole JSON structure in
memory. Could we extend the use of bundle to have a simple MANIFEST file approach
where the STIX objects are only referenced in the bundle without adding the full object by itself?
This would avoid the parsing of the full JSON object and having a simple way to create
bundle in packages (like ZIP, tar.gz...) with each STIX objects as file.

Thank you very much.

Cheers.

PS: Also, we would be very interested on hearing about best-practices when it comes to sharing large datasets in STIX 1.1/1.2.


--
Alexandre Dulaunoy
CIRCL - Computer Incident Response Center Luxembourg
41, avenue de la gare L-1611 Luxembourg
info@circl.lu - www.circl.lu

---------------------------------------------------------------------
To unsubscribe from this mail list, you must leave the OASIS TC that
generates this mail.  Follow this link to all your TCs in OASIS at:
https://www.oasis-open.org/apps/org/workgroup/portal/my_workgroups.php

Attachment: signature.asc
Description: Message signed with OpenPGP using GPGMail