F2F Recap for TAXII

All,

Today at the F2F we talked about a few additional TAXII topics. Please review them and comment over email. It is important for us to know if you support these changes or not.

1) The consensus in the room is that we do not need to do anything more with pagination at this point. What we already have with the added_after URL parameter will work with the 80-90%+ use case. We did identify a few areas where this could be a problem, such as when a server writes more records per single timestamp than the server is capable of delivering in a single request. This could also be a problem in the future when we add other advanced queries. The view in the room is that we would revisit this at a later time if needed. https://github.com/oasis-tcs/cti-taxii2/issues/50

2) We talked about adding support for a "limit" URL parameter. This would allow the client to tell the server that it wanted a smaller subset of records than the server is willing to send. The room was in favor of this change. We will propose some changes to the TC to approve. https://github.com/oasis-tcs/cti-taxii2/issues/89

3) We talked about adding additional clarification around the timestamps for the date added value in TAXII. Some thought it should be at millisecond precision and some thought it should be at microsecond precision. We will investigate where the changes need to be made and propose them back to the TC. https://github.com/oasis-tcs/cti-taxii2/issues/52

4) We discussed the call we had last week about adding a TAXII envelop so that all endpoints in TAXII will respond with a TAXII media type. We also talked about the need for defining a URL parameter or x-header to allow the client to specify which versions of STIX content it can support. The consensus on the call last week and in the room today was that we should do this. We will propose some text and changes to the TC for approval. https://github.com/oasis-tcs/cti-taxii2/issues/91

5) We talked about the need for adding support for a collection ID alias. This alias would be found in the collection resource. This could either be a full URI or a relative path. While the consensus in the room was that this would be a good idea, some care need to be taken to understand the normative statements that would be required to support this. We would also need to ensure that there are no additional security considerations that would come about because of this. https://github.com/oasis-tcs/cti-taxii2/issues/90

Thanks

Bret

cti-taxii message