Re: [cti-taxii] Content Types

["Jason Keirstead" <Jason.Keirstead@ca.ibm.com>]

To be clear Brett is talking about MIME types not STIX types.

There are folks that want collections to be able to intermix STIX 1.x and STIX 2.0 and PDF and <random other mime type> all at once.

For the record, my opinion is any one collection should contain only one content mime type. If you want to have a collection that has normalized TI data tied to a PDF, we have objects and mechanisms to do that in STIX 2.0 itself (report object relation to artifact object(s)), there is no need to do this in TAXII.



--
Sent from my mobile device, please excuse any typos.

Terry MacDonald --- Re: [cti-taxii] Content Types ---

From:	"Terry MacDonald" <terry.macdonald@cosive.com>
To:	"Bret Jordan (CS)" <Bret_Jordan@symantec.com>
Cc:	cti-taxii@lists.oasis-open.org
Date:	Fri, Feb 3, 2017 3:05 PM
Subject:	Re: [cti-taxii] Content Types

---

We shouldn't restrict to a single content type as it may restrict is in the future of we decide to add additional types of content. I'm thinking about STIX Question and Answer objects (or whatever else we decide to add at a later date). I think maintaining future flexibility here makes sense.

Cheers

Terry MacDonald

Cosive

On 4 Feb. 2017 05:46, "Bret Jordan" <Bret_Jordan@symantec.com> wrote:

All,

We have a quick question for this group.  Should TAXII Collections be limited / restricted to one content-type or content-type family?  There has been some concerns that filtering, sorting, searching, etc could be really hard if you had different content types in the same collection.  

Bret