cti-taxii — archive

Re: [cti-taxii] Re: [EXT] Re: [cti-taxii] TAXII X headers

From: Jason Keirstead
To: [email protected]
Date: Tue, 28 Nov 2017 12:54:00 -0000

I added my comment to Github prior - I agree it needs to be based on the collection. I can't see any use case for it being based on the server. - Jason Keirstead STSM, Product Architect, Security Intelligence, IBM Security Systems www.ibm.com/security "Things may come to those who wait, but only the things left by those who hustle." - Unknown From: Bret Jordan <[email protected]> To: Allan Thomson <[email protected]>, "[email protected]" <[email protected]> Date: 11/27/2017 09:17 PM Subject: [cti-taxii] Re: [EXT] Re: [cti-taxii] TAXII X headers Sent by: <[email protected]> Thanks Allan for the comments. What do others think? If you can, please make your comments either in the document or in the Github Issue tracker. Thanks Bret From: Allan Thomson <[email protected]> Sent: Monday, November 27, 2017 9:23:09 AM To: Bret Jordan; [email protected] Subject: [EXT] Re: [cti-taxii] TAXII X headers Bret – I suggest we should be careful to keep the TAXII specification clear. The only way to add something to a TAXII server is via the collection push mechanism. NOTE: There may be software that supports integration of a database and other functionality that is combined with a TAXII server but that is not mandatory. The TAXII spec focuses on objects/sharing via collections. There is no separate addition mechanism specified without collections being used and I would suggest for clarity we should keep semantics of those timestamps to be based on when the object was added to the collection. Allan Thomson, CTO, Lookingglass Cyber Solutions This electronic message transmission contains information from LookingGlass Cyber Solutions, Inc. which may be attorney-client privileged, proprietary and/or confidential. The information in this message is intended only for use by the individual(s) to whom it is addressed. If you believe that you have received this message in error, please contact the sender, delete this message, and be aware that any review, use, disclosure, copying or distribution of the contents contained within is strictly prohibited From: <[email protected]> on behalf of Bret Jordan <[email protected]> Date: Monday, November 20, 2017 at 9:44 PM To: "[email protected]" <[email protected]> Subject: [cti-taxii] TAXII X headers All, In the spec we defined two headers `X-TAXII-Date-Added-First` and `X-TAXII-Date-Added-Last`. My question is, should these be the time the object was added to the server or the time it was added to the collection that you are pulling from... When I wrote this originally, I was thinking about the time it was added to the server. But now that I have working code and am trying to implement this feature, there is a difference between when an object is added to a server and when it was put in a collection. Some times these will be the same time, other times, an object may be added to a collection after some sort of analysis, which means it was already in the server. Bret