Subject: [mile] Attributes of the Key class

From: "Roman D. Danyliw" <[email-masked]>
Date: Tue, 14 Jan 2014 15:25:11 +0000

Hello,

In reviewing the -03 draft, I have a few questions on the definition of the Key class (Section 3.22.1).

** RegistryKeyModified/Key has the @ext-category attribute whose text  reads "extension category".  Could someone please explain the purpose of this attribute or provide better text.  It seems like this attribute was a typo and should really be named @ext-registryaction to extend @registryaction when it is set to "ext-value".

** RegistryKeyModified/Key also has the attributes @type and @type-ext listed in the text, but not in the schema.  It is not documented but is described as having two enumerated values of "watchlist" and "ext-value".  Could someone please explain this attribute or provide better text.  Also, the numerated value of "ext-value" for @type is being used in a way inconsistently with Section 5.1.  We need to fix that.

Roman

---

From: "Moriarty, Kathleen" <[email-masked]>
Date: Wed, 22 Jan 2014 19:19:45 -0500

Hi Roman,

I'll answer in line.  Others, please chime in.

Thanks!
Kathleen

-----Original Message-----
From: mile [mailto:[email-masked]] On Behalf Of Roman D. Danyliw
Sent: Tuesday, January 14, 2014 10:25 AM
To: [email-masked]
Subject: [mile] Attributes of the Key class

Hello,

KM> I am having trouble finding this one in the current document..

KM> Ah, okay from my last response, this additional context helps to see the intent.  I think this was to provide a watchlist.  The schema just had a comment to see if it should be included.  As long as you can include a watchlist, the intent would be met.  The watchlist would be a list of values that may be ORed with other values in the list and an AND with the EventData in the set.

Roman
_______________________________________________
mile mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/mile

---

From: "Panos Kampanakis (pkampana)" <[email-masked]>
Date: Thu, 23 Jan 2014 15:20:49 +0000

My thoughts in in PK>

KM> I am having trouble finding this one in the current document..
PK> I think this existed in the -03 doc but removed in -04. Yes, @ext-registryaction is the right attribute IMO.

PK> Agree. I propose the attribute to be 

       <xs:attribute name="type" use="optional">
         <xs:simpleType>
           <xs:restriction base="xs:NMTOKEN">
             <xs:enumeration value="registry_key-watchlist"/>
             <xs:enumeration value="ext-value"/>
           </xs:restriction>
         </xs:simpleType>
       </xs:attribute>

BTW, the RegistryKeyModified should be WindowsRegistryKeysModified which seems to be fixed in the -04 version of the doc.

Panos

-----Original Message-----
From: mile [mailto:[email-masked]] On Behalf Of Moriarty, Kathleen
Sent: Wednesday, January 22, 2014 7:20 PM
To: Roman D. Danyliw; [email-masked]
Subject: Re: [mile] Attributes of the Key class

Hi Roman,

Thanks!
Kathleen

-----Original Message-----
From: mile [mailto:[email-masked]] On Behalf Of Roman D. Danyliw
Sent: Tuesday, January 14, 2014 10:25 AM
To: [email-masked]
Subject: [mile] Attributes of the Key class

Hello,

Roman

---

From: "Roman D. Danyliw" <[email-masked]>
Date: Fri, 24 Jan 2014 01:52:05 +0000

Hello,

Comments inline ...

> From: Panos Kampanakis (pkampana) [mailto:[email-masked]]
> Sent: Thursday, January 23, 2014 10:21 AM
> To: Moriarty, Kathleen; Roman D. Danyliw; [email-masked]
> Subject: RE: Attributes of the Key class
> 
> My thoughts in in PK>
> 
> >> ** RegistryKeyModified/Key has the @ext-category attribute whose text
> reads "extension category".  Could someone please explain the purpose of
> this attribute or provide better text.  It seems like this attribute was a typo
> and should really be named @ext-registryaction to extend @registryaction
> when it is set to "ext-value".
> 
> PK> I think this existed in the -03 doc but removed in -04. Yes, @ext-
> registryaction is the right attribute IMO.

RD> Panos is right.  In the -04, it was assumed that @ext-category was at typo and renamed to be @ext-registryaction.

> >> ** RegistryKeyModified/Key also has the attributes @type and @type-ext
> listed in the text, but not in the schema.  It is not documented but is
> described as having two enumerated values of "watchlist" and "ext-value".
> Could someone please explain this attribute or provide better text.  Also, the
> numerated value of "ext-value" for @type is being used in a way
> inconsistently with Section 5.1.  We need to fix that.
> 
> KM> Ah, okay from my last response, this additional context helps to see the
> intent.  I think this was to provide a watchlist.  The schema just had a
> comment to see if it should be included.  As long as you can include a
> watchlist, the intent would be met.  The watchlist would be a list of values
> that may be ORed with other values in the list and an AND with the
> EventData in the set.
> 
> BTW, the RegistryKeyModified should be WindowsRegistryKeysModified
> which seems to be fixed in the -04 version of the doc.

RD> Like above, yes the misnamed "RegistryKeyModified" was changed to "WindowsRegistryKeysModified" in the -04 version.  I also tried to make all complex classes in the schema have a name similar to the element name to reduce confusion (e.g., EmailDetails complexType for an element named EmailInfo)

Roman

> ** RegistryKeyModified/Key has the @ext-category attribute whose text
> reads "extension category".  Could someone please explain the purpose of
> this attribute or provide better text.  It seems like this attribute was a typo
> and should really be named @ext-registryaction to extend @registryaction
> when it is set to "ext-value".
> 
> ** RegistryKeyModified/Key also has the attributes @type and @type-ext
> listed in the text, but not in the schema.  It is not documented but is
> described as having two enumerated values of "watchlist" and "ext-value".
> Could someone please explain this attribute or provide better text.  Also, the
> numerated value of "ext-value" for @type is being used in a way
> inconsistently with Section 5.1.  We need to fix that.
> 
> KM> Ah, okay from my last response, this additional context helps to see the
> intent.  I think this was to provide a watchlist.  The schema just had a
> comment to see if it should be included.  As long as you can include a
> watchlist, the intent would be met.  The watchlist would be a list of values
> that may be ORed with other values in the list and an AND with the
> EventData in the set.
> 
> Roman