STIX/TAXII Data Life Cycling

Hello,

 

How are indicators removed from a collection, more specifically how does a consumer of a TAXII Feed know when to remove an indicator from its synchronized copy of the collection?

 

Your insights would be most appreciated.

 

Regards,

 

Jeff LoSpinoso, CISSP

TCP Cybersecurity Team

919.244.9359