Re: RE: [cti] Missing MTI - what to do?

[John-Mark Gurney <jmg@newcontext.com>]

On Sat, Jan 30, 2016 at 6:26 AM, Jason Keirstead <Jason.Keirstead@ca.ibm.com> wrote:

Myself, I disagree that TAXII  should strip or alter documents. It should send them as-is. TAXII shouldn't be messing with the content flowing over it.

The question is at what level?  Do you mean you can't break up a STIX package?  So that means that you don't want a TAXII server to be able to query a specific Observable/Incident/etc by ID since that would break up a STIX package?

or do you mean that TAXII should not be modifying the objects that flow over it, but mix/matching, say demoting an object inline to reference is fine, or only sending the Indicators from a STIX package, but not the other info?

John-Mark