cti-taxii message
[Date Prev]
| [Thread Prev]
| [Thread Next]
| [Date Next]
--
[Date Index]
| [Thread Index]
| [List Home]
Subject: Re: [cti-taxii] Re: [EXT] Re: [cti-taxii] TAXII X headers
- From: "Jason Keirstead" <Jason.Keirstead@ca.ibm.com>
- To: Bret Jordan <Bret_Jordan@symantec.com>
- Date: Tue, 28 Nov 2017 08:53:35 -0400
I added my comment to Github prior - I
agree it needs to be based on the collection. I can't see any use case
for it being based on the server.
-
Jason Keirstead
STSM, Product Architect, Security Intelligence, IBM Security Systems
www.ibm.com/security
"Things may come to those who wait, but only the things left by those
who hustle." - Unknown
From:
Bret Jordan <Bret_Jordan@symantec.com>
To:
Allan Thomson <athomson@lookingglasscyber.com>,
"cti-taxii@lists.oasis-open.org" <cti-taxii@lists.oasis-open.org>
Date:
11/27/2017 09:17 PM
Subject:
[cti-taxii]
Re: [EXT] Re: [cti-taxii] TAXII X headers
Sent by:
<cti-taxii@lists.oasis-open.org>
Thanks Allan for the comments. What
do others think? If you can, please make your comments either in the document
or in the Github Issue tracker.
Thanks
Bret
From: Allan Thomson <athomson@lookingglasscyber.com>
Sent: Monday, November 27, 2017 9:23:09 AM
To: Bret Jordan; cti-taxii@lists.oasis-open.org
Subject: [EXT] Re: [cti-taxii] TAXII X headers
Bret – I suggest we should be careful
to keep the TAXII specification clear.
The only way to add something to a TAXII
server is via the collection push mechanism.
NOTE: There may be software that supports
integration of a database and other functionality that is combined with
a TAXII server but that is not mandatory. The TAXII spec focuses on objects/sharing
via collections.
There is no separate addition mechanism
specified without collections being used and I would suggest for clarity
we should keep semantics of those timestamps to be based on when the object
was added to the collection.
Allan Thomson,
CTO, Lookingglass
Cyber Solutions
This electronic message transmission
contains information from LookingGlass Cyber Solutions, Inc. which may
be attorney-client privileged, proprietary and/or confidential. The information
in this message is intended only for use by the individual(s) to whom it
is addressed. If you believe that you have received this message
in error, please contact the sender, delete this message, and be aware
that any review, use, disclosure, copying or distribution of the contents
contained within is strictly prohibited
From: <cti-taxii@lists.oasis-open.org>
on behalf of Bret Jordan <Bret_Jordan@symantec.com>
Date: Monday, November 20, 2017 at 9:44 PM
To: "cti-taxii@lists.oasis-open.org" <cti-taxii@lists.oasis-open.org>
Subject: [cti-taxii] TAXII X headers
All,
In the spec we defined two headers `X-TAXII-Date-Added-First`
and `X-TAXII-Date-Added-Last`. My question is, should these be the
time the object was added to the server or the time it was added to the
collection that you are pulling from...
When I wrote this originally, I was
thinking about the time it was added to the server. But now that
I have working code and am trying to implement this feature, there is a
difference between when an object is added to a server and when it was
put in a collection. Some times these will be the same time, other times,
an object may be added to a collection after some sort of analysis, which
means it was already in the server.
Bret
[Date Prev]
| [Thread Prev]
| [Thread Next]
| [Date Next]
--
[Date Index]
| [Thread Index]
| [List Home]