On 29.09.2017 00:41:19, Cheolho Lee wrote:
>
> I currently have a problem to implement search functions on cyber
> observable ojbects of STIX 2.0.
>
> It's caused by the fact that JSON type for cyber observable objects
> is "OBJECT", not "ARRAY".
>
Hi, Cheolho -
Why did we choose a dict over an array for STIX 2.0 Observable Data?
By definition an array represents an ordered sequence of objects
whereas a dictionary is a key:value mapping represents data that does
not necessary imply ordering. Because there were clearly articulated
use cases to support *both* ordered and un-ordered Observed Data, we
chose to use a dictionary instead of an array to accommodate both.
It's important to bear in mind that STIX is a data-exchange format
between systems and not intended to imply an implementation-specific
database schema. Every vendor and organization is encouraged to map
STIX 2.0 content into whatever data structures they feel are necessary
in order to support their specific use cases.
--
Cheers,
Trey
++--------------------------------------------------------------------------++
Director of Standards Development, New Context
gpg fingerprint: 3918 9D7E 50F5 088F 823F 018A 831A 270A 6C4F C338
++--------------------------------------------------------------------------++
--
"The possession of a book becomes a substitute for reading it."
--Anthony Burgess
