This email and any attachments thereto may contain private, confidential, and/or privileged material for the sole use of the intended recipient. Any review, copying, or distribution of this email (or any attachments thereto) by others is strictly prohibited. If you are not the intended recipient, please contact the sender immediately and permanently delete the original and any copies of this email and any attachments thereto.Terry,
I’m intrigued as it seems we’re back to looking at how to provide query capabilities in STIX/TAXII instead of just “what someone has shared”. This is something a lot of our customers are demanding and having to fill with our own solutions.
Paul Patrick
From: <cti-stix@lists.oasis-open.org
> on behalf of Terry MacDonald <terry.macdonald@cosive.com>
Date: Thursday, December 22, 2016 at 9:01 PM
To: "cti-stix@lists.oasis-open.org" <cti-stix@lists.oasis-open.org >, "cti-users@lists.oasis-open. org " <cti-users@lists.oasis-open.org >
Subject: [cti-stix] STIX 2.1 Proposal - STIX Question and STIX Answer
Hi All,
In my discussion with colleagues, community groups and customers, one of the question's I keep getting asked about STIX is "Can I ask the community I'm in if anyone has information about a particular IP address?". At present my answer is …."Well, actually no. Not at present. You can only see what others have sent out."
This proposal outlines a way that we could implement this functionality, allowing STIX/TAXII to support requests for information, and responses to those requests.
Note: This initial proposal is for community-wide requests and community-wide responses. Future enhancements in later versions of STIX could allow for responses back to a single user if there was enough demand for this functionality.
Cheers
Terry MacDonald | Chief Product Officer
