You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
At the moment, users have to manually dereference idrefs that they encounter. We brief this in our "Python Walkthrough", suggesting that users build up dictionaries and then use the dictionary to look up an id when they hit an idref.
Example:
ALL_TTPS= {}
forttpinpackage.ttps:
all_ttps[ttp.id_] =ttp# build dictionary# ...# do some work and get an indicator# ...forindicated_ttpinindicator.indicated_ttps:
ttp_id=indicated_ttp.item.idrefttp=ALL_TTPS[ttp_id] # dereference indicated ttp idref
It would be nice to not require users to dereference that data themselves, and instead do it for them. This would normalize access of related items so items with an idref and fully defined items are accessed in the same way.
forindicated_ttpinindicator.indicated_ttps:
ttp=indicated_ttp.item# lookup of idref done behind the scenes# no need to build a dictionary!
It was suggested that we could also provide an extension interface that allowed users to develop their own "idref lookup" code that would query their own backend storage. This means that if our lookup failed (as idrefs aren't required to resolve locally), their lookup method would be invoked and attempt to resolve the idref.
Example (none of this code actually works)
defparse_item(item):
# do something to return a python-stix itemdefmy_resolver(id, connection_params):
db=connection_manager.connection(connection_params)
stix=db.stixitem=stix.find_one({'id_': id})
py_item=parse_item(item)
returnpy_item# now for the extension hookstix.utils.idresolvers.add_resolver(my_resolver)
Thanks to @treyka for this idea! (hopefully I'm recording it accurately)
The text was updated successfully, but these errors were encountered:
bworrell
changed the title
Add extension interface for dereferencing idrefs
Add extension interface for resolving idrefs
Jul 23, 2014
This is related to #98
At the moment, users have to manually dereference idrefs that they encounter. We brief this in our "Python Walkthrough", suggesting that users build up dictionaries and then use the dictionary to look up an
id
when they hit anidref
.Example:
It would be nice to not require users to dereference that data themselves, and instead do it for them. This would normalize access of related items so items with an
idref
and fully defined items are accessed in the same way.It was suggested that we could also provide an extension interface that allowed users to develop their own "idref lookup" code that would query their own backend storage. This means that if our lookup failed (as idrefs aren't required to resolve locally), their lookup method would be invoked and attempt to resolve the idref.
Example (none of this code actually works)
Thanks to @treyka for this idea! (hopefully I'm recording it accurately)
The text was updated successfully, but these errors were encountered: