cti-taxii — archive

Meeting Recap

From: Bret Jordan <[email protected]>
To: [email protected]
Date: Fri, 21 Sep 2018 21:48:00 -0000

I meant to say "filtering on STIX spec_versions" Bret From: [email protected] <[email protected]> on behalf of Bret Jordan <[email protected]> Sent: Friday, September 21, 2018 3:45:13 PM To: [email protected] Subject: [EXT] [cti-taxii] Meeting Recap All, We had a TAXII call today to talk about media types and a TAXII wrapper. The following were on the call: Matt Pladna Drew Varner Allan Thomson Jason Keirstead Ron Williams Bret Jordan John Anderson (was on for a few minutes at the start) We talked through the problems and by the end of the hour had rough consensus on the following: 1) All endpoints will use a TAXII media type. This will eliminate the problem of sometimes getting a STIX media type and sometimes getting a TAXII media type on the same endpoint. 2) We need to create some sort of wrapper in TAXII to hold STIX content. This may just be a copy-n-paste of the STIX Bundle. STIX still needs to define its own Bundle for times when STIX is used outside of TAXII. 3) We need a way of filtering STIX content that will be returned inside the TAXII bundle. Originally we talked about doing this via a URL parameter, but Ron suggested that this would be best done as an X-header. Either way we would allow a comma separated list of STIX versions or the keyword "all". What does everyone else think? Bret