Re: [cti-taxii] TAXII Envelope

[Allan Thomson <athomson@lookingglasscyber.com>]

Bret â the bundle was supposed to be the wrapper. Changing that would result in inconsistency.

 

Suggest we consider adding âmoreâ to the bundle itself

 

{

    "type": "bundle",

    "more": false,

    "objects": [

      ...list of stix objects

    ]

}

 

 

 

Allan Thomson

CTO (+1-408-331-6646)

LookingGlass Cyber Solutions

 

From: <cti-taxii@lists.oasis-open.org> on behalf of Bret Jordan <Bret_Jordan@symantec.com>
Date: Monday, December 10, 2018 at 3:07 PM
To: "cti-taxii@lists.oasis-open.org" <cti-taxii@lists.oasis-open.org>
Subject: [cti-taxii] TAXII Envelope

 

All,

 

When we added the TAXII envelope to working draft 04, we said that the `data` property should contain a STIX `bundle`.  Now that I have code written for it, I think this is a mistake.  What this gives us is two useless layers.  I think it would be much better to say the `data` property in the TAXII envelope is just a list of STIX objects, instead of saying that it is a STIX Bundle that has an objects property that is a list of STIX objects.

 

So in a nutshell we have:

{

  "more": false,

  "data": {

    "type": "bundle",

    "objects": [

      ...list of stix objects

    ]

  }

}

 

What I would suggest we do is:

 

{

  "more": false,

  "data": [

    ...list of stix objects

  ]

}

 

This make things cleaner and easier to work with in code.  I would like to hear from people that either support this or are against it.  If you are against it, I would like to understand why. 

 

The plan would be to make this change in Working Draft 06 after the Public Review Period.

 

Thanks

Bret