Re: [EXT] [cti] RE: TAXII Version Filter - Please review

[Bret Jordan <Bret_Jordan@symantec.com>]

Comments in line:

 

For your first two paragraphs and proposed solutions, I would be in favor of having a broader discussion with the group members. The important part is to reach consensus upon the behavior for the filter. That should make for three options now.

Jordan: This is why we are doing this on the email list and not slack

 

In regards to what version of TAXII should address this problem. Ideally it would be good to have for TAXII 2.1, otherwise it would leave a gap in that area. It was present in 2.0 with the marking-definition object but it was not as apparent/significant to those making requests. I think the problem will be more pronounced with Cyber Observables since they are more valuable/more likely to be shared among others.

 

Jordan: Yes, but by the time STIX 2.1 gets done with the new cyber observable bits, we will probably be ready to do TAXII 2.2.

Bret