Subject: [mile] I-D Action: draft-ietf-mile-iodef-guidance-04.txt

From: [email-masked]
Date: Mon, 19 Oct 2015 08:48:04 -0700

A New Internet-Draft is available from the on-line Internet-Drafts directories.
 This draft is a work item of the Managed Incident Lightweight Exchange Working Group of the IETF.

        Title           : IODEF Usage Guidance
        Authors         : Mio Suzuki
                          Panos Kampanakis
	Filename        : draft-ietf-mile-iodef-guidance-04.txt
	Pages           : 27
	Date            : 2015-10-19

Abstract:
   The Incident Object Description Exchange Format [RFC5070] defines a
   data representation that provides a framework for sharing information
   commonly exchanged by Computer Security Incident Response Teams
   (CSIRTs) about computer security incidents.  Since the IODEF model
   includes a wealth of available options that can be used to describe a
   security incident or issue, it can be challenging for implementers to
   develop tools that can Leverage IODEF for incident sharing.  This
   document provides guidelines for IODEF implementers.  It will also
   address how common security indicators can be represented in IODEF
   and use-cases of how IODEF is being used so far.The goal of this
   document is to make IODEF's adoption by vendors easier and encourage
   faster and wider adoption of the model by Computer Security Incident
   Response Teams (CSIRTs) around the world.

The IETF datatracker status page for this draft is:
https://datatracker.ietf.org/doc/draft-ietf-mile-iodef-guidance/

There's also a htmlized version available at:
https://tools.ietf.org/html/draft-ietf-mile-iodef-guidance-04

A diff from the previous version is available at:
https://www.ietf.org/rfcdiff?url2=draft-ietf-mile-iodef-guidance-04

Please note that it may take a couple of minutes from the time of submission
until the htmlized version and diff are available at tools.ietf.org.

Internet-Drafts are also available by anonymous FTP at:
ftp://ftp.ietf.org/internet-drafts/

---

From: Mio SUZUKI <[email-masked]>
Date: Tue, 20 Oct 2015 01:19:37 +0900

Hello all,

This is Mio from NICT.

At first, I apologize for my slow work.

The summaries of this -04 update are
   (1)  Expanded on the Extensions section using Take's suggestion.
   (2)  Moved Future use-cases under the Other section.
   (3)  CIF and APWG were consolidated in one "Implementation" section
   (4)  Added abstract of RFC7495 to the "External References" section
   (5)  Added Kathleen's example of malware delivery URL to "Appendix"
   (6)  Added a little description to "Recommended classes to implement"
        section

(1) to (3) are Panos-san's work.

To-Do lists are
   (1) Add more to "Recommended classes to implement" section, 
       "Decide what IODEF will be used for" section,
       "Unnecessary Fields" section, 
       "External References" section, and
       "Restrictions in IODEF" section.
   (2) Convert and add Kathleen's other examples to "Appendix".
   (3) Modify examples in "Appendix" to follow the current schema.
       (following IODEFv2 is better?)

Could you please give me all sorts of comments or feedbacks?

Regards,
mio

> 2015/10/20 0:48、[email-masked]:
> 
> 
> _______________________________________________
> mile mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/mile

---

From: "Panos Kampanakis (pkampana)" <[email-masked]>
Date: Mon, 26 Oct 2015 14:00:48 +0000

Hi Mio,

It looks good. I have some nits and suggestions below:

- Need a space at the end of the sentence in "so far. The goal of this".

- Add "...plenty of data..." in "contains plenty data constructs"

- Change "which he will chose to implement various IODEF classes" to "which of the various IODEF classes he will chose to implement "

- Remove "what" from " know what the most common "

- Add period "." in " classes to implement (or not)"

- Move sentence " An EventData class with multiple Flows..." to the previous paragraph, as this paragraph will be talking about the EventData class.

- Put " For Records, the Records in an event ..." in its own paragraph. I think that will be better since this paragraph will be talking about records.

- Use https://tools.ietf.org/html/draft-ietf-mile-rfc5070-bis instead of RFC5070 when the -bis document is officially an RFC.

- Add "...as explained in Section 4.4." in sentence " Multiple Flows in the EventData Class follow AND logic."

- Make " virous" to " virus".

- Remove " Similarly, " at the end of 4.6.

Looking forward to finishing off the doc for the WG to drive it to conclusion.

Panos

-----Original Message-----
From: mile [mailto:[email-masked]] On Behalf Of Mio SUZUKI
Sent: Monday, October 19, 2015 12:20 PM
To: [email-masked]
Subject: Re: [mile] I-D Action: draft-ietf-mile-iodef-guidance-04.txt

Hello all,

This is Mio from NICT.

To-Do lists are

Regards,
mio

> Please note that it may take a couple of minutes from the time of 
> submission until the htmlized version and diff are available at tools.ietf.org.
>