OASIS Mailing List ArchivesView the OASIS mailing list archive below
or browse/search using MarkMail.

 


Help: OASIS Mailing Lists Help | MarkMail Help

cti message

[Date Prev] | [Thread Prev] | [Thread Next] | [Date Next] -- [Date Index] | [Thread Index] | [List Home]


Subject: Re: [cti] type changing from "object" to "array" for cyber observable objects


On 29.09.2017 00:41:19, Cheolho Lee wrote:
> 
> I currently have a problem to implement search functions on cyber
> observable ojbects of STIX 2.0.
> 
> It's caused by the fact that JSON type for cyber observable objects
> is "OBJECT", not "ARRAY".
> 

Hi, Cheolho -

Why did we choose a dict over an array for STIX 2.0 Observable Data?

By definition an array represents an ordered sequence of objects
whereas a dictionary is a key:value mapping represents data that does
not necessary imply ordering. Because there were clearly articulated
use cases to support *both* ordered and un-ordered Observed Data, we
chose to use a dictionary instead of an array to accommodate both.

It's important to bear in mind that STIX is a data-exchange format
between systems and not intended to imply an implementation-specific
database schema. Every vendor and organization is encouraged to map
STIX 2.0 content into whatever data structures they feel are necessary
in order to support their specific use cases.

-- 
Cheers,
Trey
++--------------------------------------------------------------------------++
Director of Standards Development, New Context
gpg fingerprint: 3918 9D7E 50F5 088F 823F  018A 831A 270A 6C4F C338
++--------------------------------------------------------------------------++
--
"The possession of a book becomes a substitute for reading it."
--Anthony Burgess

Attachment: signature.asc
Description: Digital signature



[Date Prev] | [Thread Prev] | [Thread Next] | [Date Next] -- [Date Index] | [Thread Index] | [List Home]