AISMarking Structure Not Implemented

[grleblanc]

I am working on Parsing TAXII messages with the STIX Package (I've tried 1.1.1.6 and 1.1.1.7) and I am receiving the following exception:

NotImplementedError: Marking structure type not implemented AISMarkingStructure

I can confirm that the AISMarkingStructure is in the etensions/marking/ais.py file:

$ egrep -r -nw "AIS:AISMarkingStructure" lib/
lib/python2.7/site-packages/stix/test/extensions/marking/ais.py:18:        'xsi:type': 'AIS:AISMarkingStructure'
lib/python2.7/site-packages/stix/test/extensions/marking/ais.py:31:        'xsi:type': 'AIS:AISMarkingStructure'
lib/python2.7/site-packages/stix/extensions/marking/ais.py:304:    _XSI_TYPE = "AIS:AISMarkingStructure"

I have cleared the pip cache and recreated my virtualenv thinking it may have been a cacheing error.

Here's the Python Code that's creating the document:

...
from stix.core import STIXPackage
#Using XML dump from test TAXII Message. Below command created the testAIS.taxii file
#print taxii_message.content_blocks[0].content
stix_package = STIXPackage.from_xml('/tmp/testAIS.taxii')

And the exception:

File "local/lib/python2.7/site-packages/stix/bindings/data_marking.py", line 352, in buildChildren
    raise NotImplementedError('Marking structure type not implemented ' + typeinfo.typename)
NotImplementedError: Marking structure type not implemented AISMarkingStructure

[gtback]

Hi, @gleblanc1783!

Did you import stix.extensions.marking.ais first? Unlike the other marking extensions, we don't automatically load AIS markings, since they aren't a published part of the STIX specification. We included them in this library since they're common enough that it's not worth a separate package for.

[grleblanc]

Nope I didn't!! Thank you so much, I will try this later/tomorrow.

By any chance, do you know if this was mentioned in the documentation somewhere? [either AIS or STIX]. I swear I read, re-read, googled and tried everything but I couldn't find that.

[packet-rat]

Gregory,
Well thanks to you we have it documented now 👍
Thanks Mate!

Patrick Maroney

On Nov 1, 2016, at 5:54 PM, Gregory LeBlanc notifications@github.com wrote:

Nope I didn't!! Thank you so much, I will try this later/tomorrow.

By any chance, do you know if this was mentioned in the documentation somewhere? [either AIS or STIX]. I swear I read, re-read, googled and tried everything but I couldn't find that.

—
You are receiving this because you are subscribed to this thread.
Reply to this email directly, view it on GitHub, or mute the thread.

[grleblanc]

That worked great. Thank you! I will close this issue.

I wouldn't mind updating documentation with a mention to this, just point me in the right direction. Or - like Pat said, we can leave it as a closed issue for those who need to search.

[gtback]

@gleblanc1783, nope it's not in the documentation anywhere 🙁 . But it should be!

Since AIS is only supported in 1.1.1.x versions for now, it might be confusing if we put it into the default documentation which is for STIX 1.2. That said, I don't necessarily think people will go into the 1.1.1.7 documentation looking for AIS help. If anyone has suggestions, I'm happy to implement them.

[brlogan]

Hey @gtback, do you guys intend to implement the AIS marking extension in 1.2.x?

[gtback]

@brlogan: What are you trying to do with the AIS extension in 1.2? I believe that DHS only accepts 1.1.1 content for AIS, so (as I understand it), there's not much you can do with AIS-marked 1.2 content. It's not too much work to add it (I don't think), but don't want to confuse people by supporting AIS in 1.2.

I'll mention @emmanvg so he sees this conversation.

[brlogan]

@gtback: Well, I wanted to upgrade to 1.2 so I could support 1.2 content. The idea was that my DHS content would be converted to 1.2 using Ramrod, but it fails because I get the "NotImplementedError" for AIS.

[gtback]

Ahh, that makes sense. I'm wondering whether it makes sense to have ramrod strip out the AIS markings. Or, if you need the AIS marking data in 1.2, we can add support for AIS in 1.2.0.x.

I hadn't thought about the "consuming AIS content" angle as much as trying to prevent people from creating 1.2 content with AIS markings.

[brlogan]

If my goal is to be able to consume AIS data, I think I'd want to keep the AIS markings so I can consume that piece as well. Plus, if DHS does decide to move to 1.2, it would be good to have it in there.

[gtback]

I expect at this point DHS is more likely to move to STIX 2.0 than 1.2, but your point about wanting to consume AIS content in python-stix 1.2.0.x makes a lot of sense. I need to think more about this, but I think it's reasonable for us to add some level of AIS support in the 1.2 branch.