Re: [cti-taxii] Re: [EXT] Re: [cti-taxii] TAXII X headers

I added my comment to Github prior - I
 agree it needs to be based on the collection. I can't see any use case
 for it being based on the server.
- Jason Keirstead STSM, Product Architect, Security Intelligence, IBM Security Systems
www.ibm.com/security
"Things may come to those who wait, but only the things left by those
 who hustle." - Unknown
From:
    Bret Jordan <>
To:
    Allan Thomson <>,
 "" <>
Date:
    11/27/2017 09:17 PM
Subject:
      [cti-taxii]
 Re: [EXT] Re: [cti-taxii] TAXII X headers
Sent by:
      <>
Thanks Allan for the comments.  What
 do others think? If you can, please make your comments either in the document
 or in the Github Issue tracker.
Thanks
Bret
From:  Allan Thomson <>  Sent:  Monday, November 27, 2017 9:23:09 AM
To:  Bret Jordan; 
Subject:  [EXT] Re: [cti-taxii] TAXII X headers

Bret – I suggest we should be careful
 to keep the TAXII specification clear.

The only way to add something to a TAXII
 server is via the collection push mechanism.

NOTE: There may be software that supports
 integration of a database and other functionality that is combined with
 a TAXII server but that is not mandatory. The TAXII spec focuses on objects/sharing
 via collections.

There is no separate addition mechanism
 specified without collections being used and I would suggest for clarity
 we should keep semantics of those timestamps to be based on when the object
 was added to the collection.

Allan Thomson,
CTO,
Lookingglass
 Cyber Solutions
This electronic message transmission
 contains information from LookingGlass Cyber Solutions, Inc. which may
 be attorney-client privileged, proprietary and/or confidential. The information
 in this message is intended only for use by the individual(s) to whom it
 is addressed.  If you believe that you have received this message
 in error, please contact the sender, delete this message, and be aware
 that any review, use, disclosure, copying or distribution of the contents
 contained within is strictly prohibited
From:  <>
 on behalf of Bret Jordan <>
Date:  Monday, November 20, 2017 at 9:44 PM
To:  "" <>
Subject:  [cti-taxii] TAXII X headers

All,

In the spec we defined two headers `X-TAXII-Date-Added-First`
 and `X-TAXII-Date-Added-Last`.  My question is, should these be the
 time the object was added to the server or the time it was added to the
 collection that you are pulling from...

When I wrote this originally, I was
 thinking about the time it was added to the server.  But now that
 I have working code and am trying to implement this feature, there is a
 difference between when an object is added to a server and when it was
 put in a collection. Some times these will be the same time, other times,
 an object may be added to a collection after some sort of analysis, which
 means it was already in the server.

Bret