OASIS Mailing List ArchivesView the OASIS mailing list archive below
or browse/search using MarkMail.


Help: OASIS Mailing Lists Help | MarkMail Help

cti-comment message

[Date Prev] | [Thread Prev] | [Thread Next] | [Date Next] -- [Date Index] | [Thread Index] | [List Home]

Subject: Re: [cti-comment] STIX/TAXII Data Life Cycling


Thanks for reaching out to the community. 

Can you tell us a little more about your specific Use Case?  For specific indicators or STIX Domain Objects (SDOs) we have a revoke property that can be invoked by the original producer of that SDO.  We also have a Modified property if a producer finds out additional information and wants to update. 

From the consumer side, it would help to know a little more. Is your Use Case related to duplicates?  Or is it related to an indicator or set of indicators that you no longer need for your analysis?  Please describe the problem you are trying to solve.

Jane Ginn

On 2/20/2020 9:55 AM, Jeff LoSpinoso wrote:



How are indicators removed from a collection, more specifically how does a consumer of a TAXII Feed know when to remove an indicator from its synchronized copy of the collection?


Your insights would be most appreciated.




Jeff LoSpinoso, CISSP

TCP Cybersecurity Team



Jane Ginn, MSIA, MRP
Secretary, OASIS CTI TC
Sponsor, TAC TC
Sponsor, BP TC
001 (928) 399-0509

[Date Prev] | [Thread Prev] | [Thread Next] | [Date Next] -- [Date Index] | [Thread Index] | [List Home]