Why is the 'id' changing ever time I hit limo.anomali.com


Can’t find anywhere else to post this, so I’ll ask it here.

I’m hitting the ‘limo.anomali.com/taxii’ server using a TAXII/STIX 2.0 client.

All discovery works fine and I can download all the Indicators from the various feeds.

BUT if I try and download again, all of the ‘id’ elements in all of the indicators change. The information is the same, all dates (created, modified, etc) are the same, title, etc. But the ‘id’ is new each time.

From the STIX spec, I can’t think of any reason for this to happen. Is it just an artifact of the limo server?

Very confused.



I’m experiencing the same issue, any information on why this is the case would much appreciated.