search

CYBEX-P / tahoe

A Cyberthreat Language (CTL) to replace STIX
Other
0 stars 1 forks source link

tahoe core: Object index failed, large key #2

Closed qclassified closed 5 years ago

qclassified commented 5 years ago

Object cannot be indexed because of large data in data field

possible solution:

  1. index _ref field of object
  2. lookup attribute using type,value
  3. lookup all other using _ref
  4. separate raw collection
qclassified commented 5 years ago

Test reply

qclassified commented 5 years ago

Solved for Attribute with value = "large_value" To do same for Session with identifiers = "large_identifiers"

While doing so, consider: -- json schema validation because identifiers is object not string -- modifying Session.duplicate() similar to Attribute.duplicate() to consider large_identifiers

qclassified commented 5 years ago

No need to do for Session, schema changed, refer Issue #7