object "type" field only included in metadata about threatexchange

[jessek]

We could add a field, object_type, which indicated the type of object being retrieved. The values would be: THREAT_DESCRIPTOR, THREAT_INDICATOR, MALWARE_FAMILY, and MALWARE_ANALYSIS. My thinking would be not to enable this field by default, you have to ask for it specifically. Thoughts?

[mgoffin]

I'm on the fence about having to request the type all the time. Can we think of any scenarios where we might want to include it by default? Connections come to mind if people can't/don't want to derive that from the connection type?

What URL parameter would we use to say that we want to include this field?

For pytx it would be useful to have it all the time so we can throw an exception if someone attempts to populate a class with the wrong object contents. We could technically always add the required URL parameter to every request but that would get a bit hackish when trying to protect the developer from doing the wrong thing :)

[jessek]

We can easily include the object_type field by default, but then it will always be included by default. In other words, when requesting to view 856783741064689, yes, it would be good to include the object_type field so that you know the object is a malware analysis, e.g.

{
  "object_type": "MALWARE_ANALYSIS",
  "added_on": "2015-06-09T00:23:27+0000", 
  "md5": "9037a098b8b835cde8c3e2005fce6d3c", 
  "sha1": "6ff25da8a9de99956d385747c6318e28ab693519", 
  "sha256": "89b4d488fa02d85dcb19c43b6e6953fc4eb60fb27613609be56d6bb780243e1f", 
  "status": "UNKNOWN", 
}

But because of how the Graph API works, a default field will always be included. In other words, if you search for /malware_analyses?since=yesterday, you'll get 25 blobs, each of which contain the (now redundant) object_type field.

I don't know if that's a concern, but it's something I thought about.

You can always request specific fields using the 'fields' parameter, e.g

/856783741064689?fields=sha256,password
or
/malware_analyses?since=today&fields=sha256,password

[Note: That's a real ID, but I've changed the hashes]

[ivanlei]

Adding object_type, whether I have special request it or I always get it, would be nice.

[jessek]

I've been working on this and our team feels strongly that the Right Way(tm) to get the object's type is to specify 'metadata=1' in the request.

I'm sorry, but this is a won't fix.