Bret â the bundle was supposed to be the wrapper. Changing that would result in inconsistency.
Suggest we consider adding âmoreâ to the bundle itself
{
"type": "bundle",
"more": false,
"objects": [
...list of stix objects
]
}
Allan Thomson
CTO ( +1-408-331-6646)
LookingGlass Cyber Solutions
From: <
cti-taxii@lists.oasis-open.org> on behalf of Bret Jordan <
Bret_Jordan@symantec.com>
Date: Monday, December 10, 2018 at 3:07 PM
To: "cti-taxii@lists.oasis-open.org" <
cti-taxii@lists.oasis-open.org>
Subject: [cti-taxii] TAXII Envelope
All,
When we added the TAXII envelope to working draft 04, we said that the `data` property should contain a STIX `bundle`. Now that I have code written for it, I think this is a mistake. What this
gives us is two useless layers. I think it would be much better to say the `data` property in the TAXII envelope is just a list of STIX objects, instead of saying that it is a STIX Bundle that has an objects property that is a list of STIX objects.
So in a nutshell we have:
{
"more": false,
"data": {
"type": "bundle",
"objects": [
...list of stix objects
]
}
}
What I would suggest we do is:
{
"more": false,
"data": [
...list of stix objects
]
}
This make things cleaner and easier to work with in code. I would like to hear from people that either support this or are against it. If you are against it, I would like to understand why.
The plan would be to make this change in Working Draft 06 after the Public Review Period.
Thanks
Bret