Jason Keirstead wrote this message on Mon, Feb 01, 2016 at 15:49 -0400:
> What I mean is if I create a STIX document and push it to a TAXII server on
> a channel, I expect anyone else subscribed to that channel should either
> receive the document as I created it, or not receive it at all. I myself do
> not think TAXII should be diving into the STIX and modifying the documents,
> removing attributes from them.
My point is that STIX documents could be very large, , and I don't think it's
good to think of them like that... More like a node in a graph w/ links
(idref) to other nodes...
> Imagine if some vendors got together and made a tempoary extension to the
> indicator property called "Risk" or something, but whenever a producer sent
> it onto the wire, the TAXII server stripped it off. That value might be
> useful for a consumer.. the TAXII server has no idea what values will be of
> use to whom, it should not be stripping off a property just because it
> doesn't recognize it.
I do agree that unknown properties should not be stripped from objects...
All properties of an object MUST be passed, unchanged, through.
John-Mark
