OASIS Mailing List ArchivesView the OASIS mailing list archive below
or browse/search using MarkMail.


Help: OASIS Mailing Lists Help | MarkMail Help

cti message

[Date Prev] | [Thread Prev] | [Thread Next] | [Date Next] -- [Date Index] | [Thread Index] | [List Home]

Subject: Re: RE: [cti] Missing MTI - what to do?

On Sat, Jan 30, 2016 at 6:26 AM, Jason Keirstead <Jason.Keirstead@ca.ibm.com> wrote:
Myself, I disagree that TAXII  should strip or alter documents. It should send them as-is. TAXII shouldn't be messing with the content flowing over it.

The question is at what level?  Do you mean you can't break up a STIX package?  So that means that you don't want a TAXII server to be able to query a specific Observable/Incident/etc by ID since that would break up a STIX package?

or do you mean that TAXII should not be modifying the objects that flow over it, but mix/matching, say demoting an object inline to reference is fine, or only sending the Indicators from a STIX package, but not the other info?


[Date Prev] | [Thread Prev] | [Thread Next] | [Date Next] -- [Date Index] | [Thread Index] | [List Home]