TAXII Collections

I’m wondering if anyone could shed some light on how they map Collections in TAXII to the data they produce. In implementation discussions with our developer, it makes logical sense to us to align a TAXII Collection with an individual feed we might provide to a customer, thus n customers results in n Collections. Does that seem like a correct approach, assuming here that individual customers might have different permissions surrounding what data they’re allowed to receive?

Similar to the above question, we’re planning to use the Data Feed type, rather than a Data Set. Since it seems that some type of order would be needed to reliably retrieve data from a Poll Service, what is the use case for a Data Set type collection? The only thing I could come up with is a canned, proof of concept, type data for use in something like a POC.

Josh Larkins

Sr Threat Intel Analyst

PhishMe

Office: 703-350-4321

Web: www.phishme.com

Twitter: @phishme

cti-users message