Re: [cti-taxii] TAXII X headers

[Allan Thomson <athomson@lookingglasscyber.com>]

Bret – I suggest we should be careful to keep the TAXII specification clear.

 

The only way to add something to a TAXII server is via the collection push mechanism.

 

NOTE: There may be software that supports integration of a database and other functionality that is combined with a TAXII server but that is not mandatory. The TAXII spec focuses on objects/sharing via collections.

 

There is no separate addition mechanism specified without collections being used and I would suggest for clarity we should keep semantics of those timestamps to be based on when the object was added to the collection.

 

Allan Thomson,

CTO, Lookingglass Cyber Solutions

This electronic message transmission contains information from LookingGlass Cyber Solutions, Inc. which may be attorney-client privileged, proprietary and/or confidential. The information in this message is intended only for use by the individual(s) to whom it is addressed.  If you believe that you have received this message in error, please contact the sender, delete this message, and be aware that any review, use, disclosure, copying or distribution of the contents contained within is strictly prohibited

 

 

From: <cti-taxii@lists.oasis-open.org> on behalf of Bret Jordan <Bret_Jordan@symantec.com>
Date: Monday, November 20, 2017 at 9:44 PM
To: "cti-taxii@lists.oasis-open.org" <cti-taxii@lists.oasis-open.org>
Subject: [cti-taxii] TAXII X headers

 

All,

 

In the spec we defined two headers `X-TAXII-Date-Added-First` and `X-TAXII-Date-Added-Last`.  My question is, should these be the time the object was added to the server or the time it was added to the collection that you are pulling from...  

 

When I wrote this originally, I was thinking about the time it was added to the server.  But now that I have working code and am trying to implement this feature, there is a difference between when an object is added to a server and when it was put in a collection. Some times these will be the same time, other times, an object may be added to a collection after some sort of analysis, which means it was already in the server.

 

Bret