Re: [cti-users] Re: Isolate STIX as file after transfer through TAXII 2

[ringo <ringowathelet@gmail.com>]

Hi Stanley,

In your question you say, …"Whereas TAXII 2.0, a collection is a bundle encapsulating everything at top-level.”

This is not correct, as far as I know, the TAXII-2 collection is not a bundle encapsulating everything at top-level. A collection is just a list of STIX objects.

But when a client ask for STIX objects from the server, the server puts the STIX objects in a bundle and then send the bundle to the client. 

Also when you send STIX objects to the server, 

you have to send them in a bundle. At the TAXII server, the STIX objects are extracted and put into the list of objects of the collection. 

A bundle is only used to “transport" the STIX objects.

Hope I am reading your question correctly.

Ringo

P.S

There is also Bret's library in Golang  at: https://github.com/freetaxii/libstix2