OASIS Mailing List ArchivesView the OASIS mailing list archive below
or browse/search using MarkMail.

 


Help: OASIS Mailing Lists Help | MarkMail Help

cti message

[Date Prev] | [Thread Prev] | [Thread Next] | [Date Next] -- [Date Index] | [Thread Index] | [List Home]


Subject: Re: RE: [cti] Missing MTI - what to do?


Jason Keirstead wrote this message on Mon, Feb 01, 2016 at 15:49 -0400:
> What I mean is if I create a STIX document and push it to a TAXII server on
> a channel, I expect anyone else subscribed to that channel should either
> receive the document as I created it, or not receive it at all. I myself do
> not think TAXII should be diving into the STIX and modifying the documents,
> removing attributes from them.

My point is that STIX documents could be very large, , and I don't think it's
good to think of them like that...  More like a node in a graph w/ links
(idref) to other nodes...

> Imagine if some vendors got together and made a tempoary extension to the
> indicator property called "Risk" or something, but whenever a producer sent
> it onto the wire, the TAXII server stripped it off. That value might be
> useful for a consumer.. the TAXII server has no idea what values will be of
> use to whom, it should not be stripping off a property just because it
> doesn't recognize it.

I do agree that unknown properties should not be stripped from objects...
All properties of an object MUST be passed, unchanged, through.

John-Mark


[Date Prev] | [Thread Prev] | [Thread Next] | [Date Next] -- [Date Index] | [Thread Index] | [List Home]