TAXII XML Message Binding Schema 1.0 Draft 11/13/2012 Copyright (c) 2012, The MITRE Corporation. All rights reserved. The contents of this file are subject to the terms of the TAXII License located at http://taxii.mitre.org/about/termsofuse.html. See the TAXII License for the specific language governing permissions and limitations for use of this schema. When distributing copies of the TAXII XML Message Binding Schema, this license header must be included. XML schema associated with the TAXII XML Message Binding Specification. Note that in case of conflict, the specification is considered normative. Needed for the STIX payloads The root of all TAXII messages. This is used to define header fields. This will never be instantiated directly but the TAXII Message Body types all extend this type. For extension headers. Holds the message ID of this message. Uses a GUID. If this message is responding to some other TAXII message, this field holds the original message's MessageID value. Type used by MessageID and InResponseTo fields, a GUID. Type used by TAXII Error Messages Machine-readable information about this message. See the specification for details. An additional message intended for human consumption This identifies the type of error conveyed in this message. Can either be one of the defined Error Types or a user-defined value. The defined TAXII error message types Bad Message - TAXII Server could not interpret the message Unsupported Service - Requested service not supported Unauthorized - Authentication required or incorrect Denied - Rejected for reasons other than authentication Unsupported Protocol - Requested Protocol Binding not supported Unsupported Message Binding - Requested Message Binding not supported Unsupported Content Binding - Requested Content Binding not supported Not Found - Request was for an unknown target Unrecognized Field Value - Unable to interpret a field value Protection Unsupported - Unable to comply with requested encryption protections Failure - General indication of failure Pending - Unable to respond within current session but queued for later response Request to a Discovery Service for a listing of services. Response to a Discovery Request. Contains 0 or more Service records. Each instance holds one service record. Describes one TAXII service. The supported protocol, identified using a TAXII Protocol Binding Version ID string or some other string value denoting a non-standard protocols One or more supported message bindings, identified using a TAXII Message Binding Version ID string or some other string value denoting a non-standard message binding. Required if protocol = INBOX, ignored otherwise. One or more supported content bindings and version, identified using the appropriate STIX Release Version ID(s) The address used to contact the identified service. Should be a valid address using the identified protocol binding. A message with regard to the named service The type of the service. True if the requester is known to be allowed to use the given service. False if the requester is not allowed or if the requester's access is unknown. Identify the TAXII Services version that defines this service. The defined TAXII services Discovery Service Feed Management Service Inbox Service Poll Service A request for information about offered feeds from a Feed Management Service A response to a Feed Information Request. Contains 0 or more feed records. One element provided for each feed in the response A record for a data feed A prose description of this feed The method by which feed content can be delivered, identified using a TAXII Protocol Binding Version ID string or some other string value denoting a non-standard protocols One or more message bindings by which feed content can be delivered, identified using a TAXII Message Binding Version ID string or some other string value denoting a non-standard message binding. One or more supported content bindings and version by which feed content can be expressed, identified using the appropriate STIX Release Version ID(s) A locally unique name for this service. True if the requester is known to be allowed to access the given feed. False if the requester is not allowed or if the requester's access is unknown. Request management of a feed subscription (including creation of a new subscription) The feed whose subscription is being managed. The action to take on this feed. The subscription ID being managed MUST be present for SUBSCRIBE and MODIFY actions and ignored for all other actions. Indicates the subscription details to be applied to a new or modified subscription. Create a new subscription. Delete an existing subscription. Pause delivery of an existing subscription without deleting it. Resume deliver of a paused subscription. Change an existing subscription. Ask about the requesters established subscriptions for this feed. Indicates a successful response to a Feed Management Request message. The feed whose subscription is being managed. An additional message intended for human consumption This element will appear exactly once for request actions other than QUERY. It may appear zero or more times in response to a QUERY action. Each instance of this element represents a subscription to the named feed. The ID assigned to the given subscription Message used to alert a consumer as to changes in a subscription. The feed whose subscription is being managed. The action to take on this feed. The time when the action will come into effect. This identifies the type of error conveyed in this message. Can either be one of the defined Error Types or a user-defined value. The subscription ID being managed Present for SUBSCRIBE and MODIFY actions. Indicates the new delivery mechanisms of the subscription. A message with regard to the named subscription The defined TAXII error message types Success - The action was successful A request to Poll a data feed. The feed to poll. The earliest timestamp of content to retrieve The latest timestamp of content to retrieve The subscription ID being polled The content binding and version by which the requester wants the poll content expressed, identified using the appropriate STIX Release Version ID(s) Type for the Poll Response Messages The earliest timestamp of content to retrieve The latest timestamp of content to retrieve The subscription ID being polled An additional message intended for human consumption One or more supported content bindings and version by which feed content can be expressed, identified using the appropriate STIX Release Version ID(s) Zero or more STIX document. STIX content The subcription from which this content was collected, if any. An additional message intended for human consumption One or more supported content bindings and version by which feed content can be expressed, identified using the appropriate STIX Release Version ID(s) One or more STIX document. Records subscription parameters True if the requester requires feed content be encrypted. The method by which the requester wants feed content delivered, identified using a TAXII Protocol Binding Version ID string or some other string value denoting a non-standard protocols The message binding by which the requester wants feed content delivered, identified using a TAXII Message Binding Version ID string or some other string value denoting a non-standard message binding. The content binding and version by which the requester wants feed content expressed, identified using the appropriate STIX Release Version ID(s) The address to which content will be pushed. May be empty if the delivery-method indicates polling only. This must be a valid address according to the given delivery-method. Abstract super-type of all message elements