CTI TAXII Subcommittee

 View Only
  • 1.  TAXII Envelope

    Posted 12-10-2018 23:07
    All, When we added the TAXII envelope to working draft 04, we said that the `data` property should contain a STIX `bundle`.  Now that I have code written for it, I think this is a mistake.  What this gives us is two useless layers.  I think it would be much better to say the `data` property in the TAXII envelope is just a list of STIX objects, instead of saying that it is a STIX Bundle that has an objects property that is a list of STIX objects. So in a nutshell we have: {   "more": false,   "data": {     "type": "bundle",     "objects": [       ...list of stix objects     ]   } } What I would suggest we do is: {   "more": false,   "data": [     ...list of stix objects   ] } This make things cleaner and easier to work with in code.  I would like to hear from people that either support this or are against it.  If you are against it, I would like to understand why.  The plan would be to make this change in Working Draft 06 after the Public Review Period. Thanks Bret