Re: [cti-taxii] Re: [EXT] [cti-taxii] The "meaning" of media types in STIX 2.x

[Bret Jordan <Bret_Jordan@symantec.com>]

Trey,

I was not suggesting that the STIX Bundle go away.  I am sorry if I gave that perception.  What I was saying is should TAXII define its own Bundle.  

Bret

---

From: Trey Darley <trey@newcontext.com>
Sent: Thursday, September 13, 2018 3:16:55 AM
To: Bret Jordan
Cc: Drew Varner; cti-taxii@lists.oasis-open.org
Subject: Re: [cti-taxii] Re: [EXT] [cti-taxii] The "meaning" of media types in STIX 2.x

 

On 13.09.2018 00:35:37, Bret Jordan wrote:
>
> Another part of the question is, should the Bundle wrapper really be
> defined in TAXII as well?  Meaning, should the Bundle we a TAXII
> thing.  This would keep the wrapper under the TAXII media type,
> which would simplify some things.
>

Not all STIX will be transported via TAXII. I've seen several threat
feeds lately that make STIX2 available via a proprietary REST
API. STIX2 without the Bundle would be invalid JSON. TAXII2 may need
some type of JSON wrapper - that's a separate question. But the Bundle
must remain in STIX.

--
Cheers,
Trey
++--------------------------------------------------------------------------++
Director of Standards Development, New Context
gpg fingerprint: 3918 9D7E 50F5 088F 823F  018A 831A 270A 6C4F C338
++--------------------------------------------------------------------------++
--
"It is in the admission of ignorance and the admission of uncertainty
that there is a hope for the continuous motion of human beings in some
direction that doesn't get confined, permanently blocked, as it has so
many times before in various periods in the history of man." --Richard
Feynman