Re: [cti-users] Re: Isolate STIX as file after transfer through TAXII 2

[Bret Jordan <jordan2175@gmail.com>]

Ringo that is correct.  Instead of defining a TAXII wrapper, we just used the STIX Bundle, which is effectively the same thing.

The STIX bundle is not designed to be stored.  It is just a JSON wrapper

Bret 

Sent from my Commodore 64 

PGP Fingerprint: 63B4 FC53 680A 6B7D 1447  F2C0 74F8 ACAE 7415 0050

On Mar 9, 2018, at 7:53 PM, ringo <ringowathelet@gmail.com> wrote:

Hi Stanley,

In your question you say, …"Whereas TAXII 2.0, a collection is a bundle encapsulating everything at top-level.”

This is not correct, as far as I know, the TAXII-2 collection is not a bundle encapsulating everything at top-level. A collection is just a list of STIX objects.

But when a client ask for STIX objects from the server, the server puts the STIX objects in a bundle and then send the bundle to the client. 

Also when you send STIX objects to the server, 

you have to send them in a bundle. At the TAXII server, the STIX objects are extracted and put into the list of objects of the collection. 

A bundle is only used to “transport" the STIX objects.

Hope I am reading your question correctly.

Ringo

P.S

There is also Bret's library in Golang  at: https://github.com/freetaxii/libstix2