[Date Prev] | [Thread Prev] | [Thread Next] | [Date Next] -- [Date Index] | [Thread Index] | [List Home]
Subject: Re: [cti] type changing from "object" to "array" for cyber observable objects
On 29.09.2017 00:41:19, Cheolho Lee wrote: > > I currently have a problem to implement search functions on cyber > observable ojbects of STIX 2.0. > > It's caused by the fact that JSON type for cyber observable objects > is "OBJECT", not "ARRAY". > Hi, Cheolho - Why did we choose a dict over an array for STIX 2.0 Observable Data? By definition an array represents an ordered sequence of objects whereas a dictionary is a key:value mapping represents data that does not necessary imply ordering. Because there were clearly articulated use cases to support *both* ordered and un-ordered Observed Data, we chose to use a dictionary instead of an array to accommodate both. It's important to bear in mind that STIX is a data-exchange format between systems and not intended to imply an implementation-specific database schema. Every vendor and organization is encouraged to map STIX 2.0 content into whatever data structures they feel are necessary in order to support their specific use cases. -- Cheers, Trey ++--------------------------------------------------------------------------++ Director of Standards Development, New Context gpg fingerprint: 3918 9D7E 50F5 088F 823F 018A 831A 270A 6C4F C338 ++--------------------------------------------------------------------------++ -- "The possession of a book becomes a substitute for reading it." --Anthony Burgess
Attachment:
signature.asc
Description: Digital signature
[Date Prev] | [Thread Prev] | [Thread Next] | [Date Next] -- [Date Index] | [Thread Index] | [List Home]