Re: [cti-taxii] TAXII Architecture

[Adam Cooper <adam.cooper@digital.cabinet-office.gov.uk>]

I have to agree with Terry... Option 1 but with MUST rather than MAY.

On 15 December 2015 at 19:32, Terry MacDonald <terry.macdonald@threatloop.com> wrote:

Hi Bret,

I'm rarely a fan of MAY in standards, unless it is absolutely necessary. Is it possible to tweak Option 1 so that it becomes:

Option 1: A compliant TAXII server MUST implement either the message broker solution, the cyber information repository solution, or both. 

Then it would get my vote. I envisage some TAXII servers just acting as a distribution mechanism to share the threat intelligence around (e.g. within threat intel sharing trustgroups, just like their mailing list servers do now) and others acting as threat intel repository (e.g. Soltra and EclecticIQ) and others being both. But I also want to ensure that at least one of them MUST be implemented in order for the TAXII Server to call itself a compliant TAXII Server.

Cheers

Terry MacDonald​

--

Adam Cooper

Identity Assurance Programme

Government Digital Service

125 Kingsway, London, WC2B 6NH

Tel: 07973 123 038

official: adam.cooper@digital.cabinet-office.gov.uk

official sensitive: adam.cooper@govdigital.gsi.gov.uk