chisholm
chisholm
For that commit message that says it removes "STIX2-isms", I meant python 2-isms... similarly to the next commit! /sigh....
> > May 16 11:31:44 ip-100-64-0-10 medallion[810]: File "/usr/local/lib/python3.8/dist-packages/medallion/**init**.py", line 105, in handle_error > > May 16 11:31:44 ip-100-64-0-10 medallion[810]: "description": str(error.args[0]), > > May 16 11:31:44 ip-100-64-0-10 medallion[810]: IndexError:...
> @chisholm I'd disagree on the inefficiency of mongodb. It can handle millions of records with and without filters. Mongodb takes it quite smoothly. Something is wrong with the query...
You can use any string you want since it's an open vocab. The spec-defined values are included in a module stix2.v21.vocab. E.g. `stix2.v21.vocab.GROUPING_CONTEXT_SUSPICIOUS_ACTIVITY`.
Some of my thoughts: It seems to me that a "delete" function isn't consistent with typical source/sink abstractions, where the former is read-only and the latter write-only. Sources and sinks...
Some of my initial reaction: The STIX generator was written with an assumption that ref/refs properties would contain STIX IDs. It essentially is looking for "connection points" within an object....
That is the STIX ID of an extension definition. All STIX IDs are of the form `--`. It is expected to identify a (separate) `extension-definition` object. That's how the consumer...
There is some related discussion in [issue 177](https://github.com/oasis-open/cti-python-stix2/issues/177#issuecomment-389927427). That's about observables, but they're just another kind of immutable object. As described there, I have come to think of dicts as...
>> With this API we wanted to make it hard for people to create invalid STIX content. > is there a reason, apart from educating people on STIX2 spec, to...
See also [this](https://github.com/oasis-open/cti-python-stix2/issues/243#issuecomment-454528079) comment. As you noted, that function is basically written to assume everything is a datetime unless proven otherwise.