Subject: [mile] one simple question on the rfc5070-bis-06 draft

From: "Takeshi Takahashi" <[email-masked]>
Date: Tue, 10 Jun 2014 19:37:51 +0900

Hello Roman,

Let me ask you one question regarding the
http://tools.ietf.org/html/draft-ietf-mile-rfc5070-bis-06.

An Incident class has {1..*} Assessment elements, according to Figure 2.
Nevertheless, I am wondering whether we sometimes would like to send IODEF
document without any Assessment element.
For instance, we would like to notify that a particular system is something
wrong (possible compromised).
(we could identify the system by IODEF-Document -> Incident -> EventData ->
Flow -> System.)

Wouldn't it be better to have {0...*} Assessment elements instead of {1...*}
Assessment elements?
I might be totally wrong, so I would appreciate any comments on this.

Thank you.

Kind regards,
Take

---

From: "Roman D. Danyliw" <[email-masked]>
Date: Tue, 10 Jun 2014 13:26:33 +0000

Hello Take!

You're right.  A cardinality of {0..*} for Incident/Assessment seems more appropriate to ensure maximum flexibility.

I'll make the change in -07.

Roman

> -----Original Message-----
> From: mile [mailto:[email-masked]] On Behalf Of Takeshi Takahashi
> Sent: Tuesday, June 10, 2014 6:38 AM
> To: [email-masked]
> Subject: [mile] one simple question on the rfc5070-bis-06 draft
> 
> Hello Roman,
> 
> Let me ask you one question regarding the http://tools.ietf.org/html/draft-
> ietf-mile-rfc5070-bis-06.
> 
> Nevertheless, I am wondering whether we sometimes would like to send
> IODEF document without any Assessment element.
> (we could identify the system by IODEF-Document -> Incident -> EventData -
> > Flow -> System.)
> 
> _______________________________________________
> mile mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/mile

---

From: John Field <[email-masked]>
Date: Tue, 10 Jun 2014 09:27:51 -0400

+1

It's very possible there is an incident for which no assessment is (yet)
available.

John

On Tue, Jun 10, 2014 at 9:26 AM, Roman D. Danyliw <[email-masked]> wrote:

> Hello Take!
>
> You're right.  A cardinality of {0..*} for Incident/Assessment seems more
> appropriate to ensure maximum flexibility.
>

-- 

John P. Field | Security Architect | Pivotal

Direct: (908) 962-3394 | [email-masked]

**
*goPivotal.com <http://www.goPivotal.com>*