BLOB Store about cti-taxii2 HOT 6 OPEN

I guess we need a DELETE on this too.

from cti-taxii2.

From my perspective, I do not see why this should be part of TAXII. TAXII is not supposed to be a database API, nor should it be trying to be the one-and-only API that a security product use.

from cti-taxii2.

I think this should be optional. I don't think every server needs to implement it.

from cti-taxii2.

We know that organizations will want to, for example, share malware samples via TAXII. Doing this in STIX is really kind of ugly, and we know that. It would be nice if TAXII allowed you to deliver this. In fact, we have talked about needing this sort of feature for some time.

from cti-taxii2.

@jordan2175 I think it is very weird to assume someone wants to POST and GET raw malware samples without any STIX, via TAXII. That use case makes no sense to me at all. All of the use cases around sharing malware with TAXII include the context in a STIX document. Otherwise you've just make a really complicated API around an object store.

TAXII is not an FTP server or a web object store. Object stores already exist, we should not be trying to re-invent the wheel here.

from cti-taxii2.

The BLOBs would not be posted without STIX. They'd be tied via the url field of STIX Artifact objects in the TAXII server.

from cti-taxii2.