Re: [cti] Missing MTI - what to do?

[John-Mark Gurney <jmg@newcontext.com>]

Eric Burger wrote this message on Mon, Feb 01, 2016 at 19:03 -0500:
> I agree with Bret here. The question is what do we do with mixed-level TLP. For example, the whole STIX document is TLP amber, but these elements are TLP red. While the TAXII server might pass or store the whole document, if someone with amber but not red access asks for the document, does the whole document fail? I would offer if the source took the effort to separately indicate amber vs. red, they mean to pass the amber stuff with their trusted TAXII server partner “doing the right thing” with the red elements.

To me, it seems like the document should be marked w/ the highest
classification that it contains, so if it has elements which are red,
then the document must be red...  If that's the case, then it should
be less of an issue...

John-Mark