Trey,
I was not suggesting that the STIX Bundle go away. I am sorry if I gave that perception. What I was saying is should TAXII define its own Bundle.
Bret
From: Trey Darley <>
Sent: Thursday, September 13, 2018 3:16:55 AM
To: Bret Jordan
Cc: Drew Varner;
Subject: Re: [cti-taxii] Re: [EXT] [cti-taxii] The "meaning" of media types in STIX 2.x
On 13.09.2018 00:35:37, Bret Jordan wrote: >
> Another part of the question is, should the Bundle wrapper really be
> defined in TAXII as well? Meaning, should the Bundle we a TAXII
> thing. This would keep the wrapper under the TAXII media type,
> which would simplify some things.
>
Not all STIX will be transported via TAXII. I've seen several threat feeds lately that make STIX2 available via a proprietary REST API. STIX2 without the Bundle would be invalid JSON. TAXII2 may need some type of JSON wrapper - that's a separate question. But the Bundle must remain in STIX.
--
Cheers, Trey ++
--------------------------------------------------------------------------
++ Director of Standards Development, New Context gpg fingerprint: 3918 9D7E 50F5 088F 823F 018A 831A 270A 6C4F C338 ++
--------------------------------------------------------------------------
++ -- "It is in the admission of ignorance and the admission of uncertainty that there is a hope for the continuous motion of human beings in some direction that doesn't get confined, permanently blocked, as it has so many times before in various periods in the history of man." --Richard Feynman
