[Date Prev] | [Thread Prev] | [Thread Next] | [Date Next] -- [Date Index] | [Thread Index] | [List Home]
Subject: Re: RE: [cti] Missing MTI - what to do?
Jason Keirstead wrote this message on Mon, Feb 01, 2016 at 15:49 -0400: > What I mean is if I create a STIX document and push it to a TAXII server on > a channel, I expect anyone else subscribed to that channel should either > receive the document as I created it, or not receive it at all. I myself do > not think TAXII should be diving into the STIX and modifying the documents, > removing attributes from them. My point is that STIX documents could be very large, , and I don't think it's good to think of them like that... More like a node in a graph w/ links (idref) to other nodes... > Imagine if some vendors got together and made a tempoary extension to the > indicator property called "Risk" or something, but whenever a producer sent > it onto the wire, the TAXII server stripped it off. That value might be > useful for a consumer.. the TAXII server has no idea what values will be of > use to whom, it should not be stripping off a property just because it > doesn't recognize it. I do agree that unknown properties should not be stripped from objects... All properties of an object MUST be passed, unchanged, through. John-Mark
[Date Prev] | [Thread Prev] | [Thread Next] | [Date Next] -- [Date Index] | [Thread Index] | [List Home]