Driving me crazy :)

Help
2013-06-07
2013-06-07
  • Shay Harding
    Shay Harding
    2013-06-07

    I am trying to generate bindings for Mitre's STIX and TAXII schema, which I can successfully do but what I am having trouble with is using the resulting bindings. To give some background information on some things I've tried or done:

    http://taxii.mitre.org/specifications/version1.0/TAXII_XMLMessageBinding_Schema.xsd
    http://stix.mitre.org/language/version1.0/stix_v1.0_offline.zip

    Issue #1: TAXII doesn't reference STIX directly, just shoves its data in a mixed type element so using the TAXII bindings is difficult since the mixed content doesn't really seem to be well-supported and I get an array of "stuff" instead that is a pain to parse.

    My Solution #1: Regex out <stix:Stix_Package>...</stix:Stix_Package> and call the STIX bindings separately.

    Issue #2: STIX does some overriding of types in stix_core.xsd via xsi:type (see Indicator specifically) so I get XML like <indicator:Indicator>...</indicator:Indicator> but if I pass it to the stix core binding, it knows nothing about it since it doesn't reference it, it references a "stub" indicator within stix_common.xsd.

    Solution #2: No idea... I've tried all sorts of ways to generate the bindings to stix core knows about other items but since none of them are actually used in stix_core.xsd, it only generates what it actually references.

    There are more instances of the above in the STIX schema, but I figured a solution to one would present a solution to the rest. My assumption is I can take a <Stix_Package>...</Stix_Package> XML segment, pass it into a stix core binding and reference the objects via there... can you give me some clues how to make this work?

    Thanks!

     
  • Peter A. Bigot
    Peter A. Bigot
    2013-06-07

    These are pretty general questions, and I don't know how to answer them. For #1, mixed content is indeed a pain (and is pretty unusual), but I have no idea what "stuff" would be, or how it ends up being presented. The simple answer is that if whatever program you're using has already loaded the bindings for stix, the mixed content should include properly-converted instances for elements within that content.

    For issue #2, STIX appears to be a pretty complex set of schemas, and you probably need to generate the bindings with advanced techniques like http://pyxb.sourceforge.net/userref_pyxbgen.html#generating-related-namespaces and http://pyxb.sourceforge.net/userref_pyxbgen.html#fine-grained-namespace-control. Again, I don't know what you've done so can't comment on whether it's the right approach.

    I do see Stix already has Python bindings, so the motivation for using PyXB isn't obvious.

    If you'd like help, you'd need to provide enough information that I can reproduce what you see. That includes how you generated the bindings, complete examples of code that use them, the necessary sample documents to run the example code, and a clear description of what you feel isn't working properly. Note that the time I have available for free support is limited, so if I can't reproduce the issue quickly I'm afraid you're on your own.