STIXProject/stix-ramrod

No support for converting packages with "STIX_Packages" root node

johnmccash opened this issue · 3 comments

johnmccash commented

I just tried to convert a STIX 1.0 package (obtained from FS_ISAC) which has a "STIX_Packages" root node. I get the following error:

[!] Update Error: Document root node must be one of ['Observables', 'STIX_Package']. Found: 'STIX_Packages'

Thanks

bworrell commented

Hi @johnmccash, thanks for the issue! The STIX_Packages element is not a valid STIX root-level element and will not validate against the STIX schemas. The stix-ramrod library supports the processing of CybOX Observables and STIX STIX_Package instance documents, which are referred to in that error message.

Is it possible to extract the STIX_Package elements from the STIX_Packages collection? If so, you could then update them iteratively.

bworrell commented

I am going to close this out since the error is the result of passing a non-STIX/CybOX document into stix-ramrod. I can reopen it if we want to discuss this more in the future. Thanks!

johnmccash commented

Bryan
I’m not sure, but I thought this element was actually legal in 1.0, but was deprecated in 1.1. It may be that it was part of a prerelease version of 1.0 which was on Github, and so was used by some people in error. In any case, it’s no longer an issue for me. I was trying to convert an old indicator dump, for which I now have a more recent update that does not include the offending element.
Thanks
John

From: Bryan Worrell [mailto:notifications@github.com]
Sent: Saturday, February 14, 2015 7:29 PM
To: STIXProject/stix-ramrod
Cc: John Mccash
Subject: Re: [stix-ramrod] No support for converting packages with "STIX_Packages" root node (#4)

I am going to close this out since the error is the result of passing a non-STIX/CybOX document into stix-ramrod. I can reopen it if we want to discuss this more in the future. Thanks!

—
Reply to this email directly or view it on GitHubhttps://urldefense.proofpoint.com/v2/url?u=https-3A__github.com_STIXProject_stix-2Dramrod_issues_4-23issuecomment-2D74399892&d=AwMCaQ&c=K5gMqH44tVpW9Mb7NvpzqAFAhrpSdUITR819D8huNsU&r=sJCE6izyLG2FavzcHWpZ_Q&m=vZLkJC0JKRN5uUYpZHbFrCgfYexFwMxpfZfjMJJW-FE&s=4qHTQq27lIULhA1zq1ttJl5GrcPCl5-WH_oxWfEuLhM&e=.