RE: Meeting Recap

This seems reasonable to me. For #3, no preference here on URL parameter vs. X-Header, either seems fine.

John

From: cti-taxii@lists.oasis-open.org <cti-taxii@lists.oasis-open.org> On Behalf Of Bret Jordan
Sent: Friday, September 21, 2018 5:45 PM
To: cti-taxii@lists.oasis-open.org
Subject: [cti-taxii] Meeting Recap

All,

We had a TAXII call today to talk about media types and a TAXII wrapper. The following were on the call:

Matt Pladna

Drew Varner

Allan Thomson

Jason Keirstead

Ron Williams

Bret Jordan

John Anderson (was on for a few minutes at the start)

We talked through the problems and by the end of the hour had rough consensus on the following:

1) All endpoints will use a TAXII media type. This will eliminate the problem of sometimes getting a STIX media type and sometimes getting a TAXII media type on the same endpoint.

2) We need to create some sort of wrapper in TAXII to hold STIX content. This may just be a copy-n-paste of the STIX Bundle. STIX still needs to define its own Bundle for times when STIX is used outside of TAXII.

3) We need a way of filtering STIX content that will be returned inside the TAXII bundle. Originally we talked about doing this via a URL parameter, but Ron suggested that this would be best done as an X-header. Either way we would allow a comma separated list of STIX versions or the keyword "all".

What does everyone else think?

Bret

cti-taxii message