On Sat, Jan 30, 2016 at 6:26 AM, Jason Keirstead <> wrote:
Myself, I disagree that TAXII should strip or alter documents. It should send them as-is. TAXII shouldn't be messing with the content flowing over it.
The question is at what level? Do you mean you can't break up a STIX package? So that means that you don't want a TAXII server to be able to query a specific Observable/Incident/etc by ID since that would break up a STIX package?
or do you mean that TAXII should not be modifying the objects that flow over it, but mix/matching, say demoting an object inline to reference is fine, or only sending the Indicators from a STIX package, but not the other info?
John-Mark
