Subject: [mile] 5070bis-scoping discussion #1: Cyber Intelligence -- RESULTS

From: "Roman D. Danyliw" <[email-masked]>
Date: Thu, 29 Aug 2013 17:38:43 +0000

Hello!

Based on the feedback of four individuals to this thread, the interest is summarized below.

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]] On Behalf Of
> Roman D. Danyliw
> Sent: Monday, August 05, 2013 4:38 PM
> To: [email-masked]
> Subject: [mile] 5070bis-scoping discussion #1: Cyber Intelligence
> 
> Hello!
> 
> Per the earlier announcement in [1], this note initiates topic discussion #1 on
> the 5070bis scope discussion.  A power-point formatted version of this text
> can be found in slides 4 and 5 of [2].  If you have a feelings on the matter,
> please provide input by August 26th.  To repeat, the intent here is to assess
> interest in including the information listed below in the 5070bis data model.
> Opinions to add it in or explicitly avoid it are welcome.  In the case of the
> former, proposals are welcome but not required.
> 
> (1) How much cyber intelligence information should be represented?
> **(a)** Description of the source and target of the event

NO ACTION.  No new information was identified that required WG action.

> **(b)** Description of the technical pattern of a given tactic used in an attack
> (e.g., indicators or signatures)
> **(c)** Description of the actors perpetrating the attack?

ACTION REQUIRED.  Some basic free-form and structured information was requested.   The matter is tracked in Issue #22 (http://trac.tools.ietf.org/wg/mile/trac/ticket/22).

> **(d)** Description of the capabilities and  intent of the actors?

NO ACTION.  No interest in representing this information.

> (2) What other indicator data fields should be add?
> **(a)** File information (e.g., size, attributes, ACLs, ADS, PE information)
> **(b)** Process information (e.g., pids, chains, loaded libraries)
> **(c)** Mutex names
> **(d)** Device state (e.g., ARP or routing table, disk geometry, BIOS,
> network settings)

ACTION REQUIRED.  There wasn't interest in adding more classes to represent additional information, but there was interest in reviewing how extensions for this data could be supported.  The matter is tracked in Issue #23 (http://trac.tools.ietf.org/wg/mile/trac/ticket/23).

> **(e)** Email (e.g., arbitrary headers, structure of contents)

ACTION REQUIRED.  Additional text is likely required to clarify how this data could be represented using other standards as extensions.  The matter is tracked in Issue #24 (http://trac.tools.ietf.org/wg/mile/trac/ticket/24).

> **(f)** Currently already support From, Subject, X-Mailer
> **(g)** HTTP (e.g., arbitrary headers)
> **(h)** Currently already support URL and UserAgent

(f) and (h) aren't legitimate questions, but a cut-and-paste error.

As to (g), ACTION REQUIRED.  There wasn't interest in adding more classes to represent additional information, but there was interest in reviewing how extensions for this data could be supported.  The matter is tracked in Issue #26 (http://trac.tools.ietf.org/wg/mile/trac/ticket/26).

> **(i)** TLS Certificate or certificate chains

ACTION REQUIRED.  Representing certificates is desired.  Implementation details need to be resolved.  The matter is tracked in Issue #25 (http://trac.tools.ietf.org/wg/mile/trac/ticket/25).

> **(j)** External signatures languages (e.g., Yara, snort, Bro)

ACTION REQUIRED.  Some interest was expressed in providing an annotated means to capture this information.  The matter is tracked in Issue #27 (http://trac.tools.ietf.org/wg/mile/trac/ticket/27).

> (3) Explicitly express a relationships between indicators? e.g., "(From: Email1
> and Email1) OR (X-Mailer)"
> 
> (4) Absence of an indicator?

ACTION REQUIRED.  There was interest in including these features.  This matter was already been tracked in Issue #14.  The refinement provided by this discussion has been added (http://trac.tools.ietf.org/wg/mile/trac/ticket/14).

> (5) Valid time to apply the indicator (EventData/StartTime and EndTime?)

ACTION REQUIRED.  There was interest in including this feature.  This matter is being tracked in Issue #28 (http://trac.tools.ietf.org/wg/mile/trac/ticket/28).

Roman

> Regards,
> Roman
> 
> [1] http://www.ietf.org/mail-archive/web/mile/current/msg01146.html
> [2] http://www.ietf.org/proceedings/87/slides/slides-87-mile-4.pdf
> _______________________________________________
> mile mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/mile