Top-level Sighting Object from last meeting

Once TAXII is easier to use and implement, hopefully it will gain more adoption.  TAXII 2.0 should get us a lot of traction.  Especially if we can get a TAXII server in the cloud that allows people to create ad-hoc channel groups and share data.
Thanks,
Bret
Bret Jordan CISSP
Director of Security Architecture and Standards
Office of the CTO  Blue Coat Systems
PGP Fingerprint: 63B4 FC53 680A 6B7D 1447  F2C0 74F8 ACAE 7415 0050
Without cryptography vihv vivc ce xhrnrw, however, the only thing that can not be unscrambled is an egg.
On Oct 30, 2015, at 14:53, Terry MacDonald < 
> wrote:
Adding cti-taxii (it involves taxii talk)  I'm still of the opinion that this falls under the realm of STIX. Joep's comment that the question/answer functionality needs to work across non-TAXII communication methods made the decision for me.
If we add that functionality to TAXII and not STIX then we lose the ability to request and respond if TAXII isn't used.
I'm now wondering if we should have some kind of combination of TAXII and STIX query functionality....  What if TAXII handled the TAXII to TAXII content distribution (delivery of CTI content), and the querying of a local TAXII repository (local TAXII client to local TAXII Server lookup if it has a data repo).  And what if STIX handled any threat intel questions asked of the sharing community via STIX request and STIX response?
This separation would allow STIX request/responses to still be asked even if communication was via email (imagine attaching that to a post to an email community) allowing people who do have a STIX implementation but no TAXII implementation to participate in Threat Intel sharing. It may even help drive STIX/TAXII adoption by prompting more people to start using STIX...  Cheers  Terry MacDonald Senior STIX Subject Matter Expert SOLTRA   An FS-ISAC and DTCC Company +61 (407) 203 206