Subject: [mile] [Issue #17] Additional values in Incident@purpose

From: "Roman D. Danyliw" <[email-masked]>
Date: Mon, 29 Jul 2013 13:52:53 +0000

Hi!

Tracking at http://trac.tools.ietf.org/wg/mile/trac/ticket/17.

The intent of the IODEF data model has expanded in scope with MILE.  In addition to incident reporting and requesting mitigation, sending indicators and threat information is now done.  This change likely warrants additional values in Incident@purpose.  Currently, this attribute is defined as follows:

      1.  traceback.  The document was sent for trace-back purposes.

      2.  mitigation.  The document was sent to request aid in
          mitigating the described activity.

      3.  reporting.  The document was sent to comply with reporting
          requirements.

      4.  other.  The document was sent for purposes specified in the
          Expectation class.

      5.  ext-value.  An escape value used to extend this attribute.
          See Section 5.1.

I would propose adding two new values:

6.  indicators.  The document was sent to convey indicators to threat activity.

7.  awareness.  The document was sent to provide awareness of threat activity.

Are there any other?

Roman