Subject: [mile] 5070-bis scoping discussion #2: Indicator IDs and RelatedActivity

From: "Roman D. Danyliw" <[email-masked]>
Date: Mon, 26 Aug 2013 18:41:42 +0000

Hello!

Per the announcement in [1], this note initiates topic discussion #2 on the 5070bis scope.  Discussion #1 can be found in [2].

Discussion #2 is intended to clarify what construct should be used to reference indicators and what information should be added to RelatedActivity.  The power-point formatted version of this text can be found in slides 6 and 7 of [3].  If you have a feelings on the matter, please provide input by noon of September 9th.  Opinions to add something in or explicitly avoid it are welcome.  In the case of the former, proposals are welcome but not required.

(6) What is the implementation experience of using @Indicator-UID or @Indicator-Set-ID?
**(a)** How should the @indicator-UID be interpreted when aggregate classes are present?  Is the entire collection of data an indicator?  For example, consider the following:

<Service indicator-UID="csirt-2013-9083-3094f" ip_protocol="6">
  <Port>80</Port>
  <ProtoField>SYN-FIN</ProtoField>
  <Application>
     <URL>http://httpd.apache.org</URL>
  </Application>
</Section>

Is indicator #csirt-2013-9083-3094f: 80/tcp? 80/tcp+SYN-FIN? SYN-FIN? The affected classes include: Service, Assessment, HistoryItem, Expectation, EmailDetails, and RecordData

**(b)** Are the attributes defined in all of the right classes?
Currently in <HistoryItem>, <Expectation>, <Reference>, <Assessment>, <Address>, <Service>, <EmailDetails>, <RecordData>, <RegistryKeyItem>,<FileName>.
Should it be added to <DomainData>?  Anything else?

**(c)** Is a data element not an officially sanctioned indicator if it doesn't have these attributes?  This speaks to how to write the text describing the attribute.

**(d)** If these a desire to provide a means to describe an @indicator-set-id in anyway in an IODEF-Document?  Or is it an opaque identified defined out-of-band?

(7) What further information should be included in the RelatedActivity class?
**(a)** Label describing activity as a campaign (e.g., APT1)
**(b)** A Confidence class to express certainty in assigning the label in (a) or in the IncidentID
**(c)** A Description class to explain the means or rational for this attribution
**(d)** Anything else?

Regards,
Roman

[1] http://www.ietf.org/mail-archive/web/mile/current/msg01146.html
[2] http://www.ietf.org/mail-archive/web/mile/current/msg01147.html
[3] http://www.ietf.org/proceedings/87/slides/slides-87-mile-4.pdf

---

From: "Harrington, Christopher" <[email-masked]>
Date: Wed, 28 Aug 2013 08:33:34 -0400

(6) What is the implementation experience of using @Indicator-UID or
@Indicator-Set-ID?
**(a)** How should the @indicator-UID be interpreted when aggregate classes
are present?  Is the entire collection of data an indicator?  

Yes, in the example cited the entire collection is an indicator. The
individual components themselves are not actionable.  Where I would use an
Indicator-set-ID is to show multiple groups of indicators being related. In
our data model at EMC we then roll up Indicator-Sets into Campaigns.

Thanks,

--Chris

Christopher Harrington
Consulting Security Engineer
GSO - Critical Incident Response Center
EMC - Where Information Lives
174 Middlesex Turnpike
Bedford, MA 01730
781-515-5862 (work)
603-583-1585 (cell)