Subject: [mile] I-D Action: draft-ietf-mile-rfc5070-bis-16.txt

From: [email-masked]
Date: Mon, 01 Feb 2016 14:05:52 -0800

A New Internet-Draft is available from the on-line Internet-Drafts directories.
 This draft is a work item of the Managed Incident Lightweight Exchange Working Group of the IETF.

        Title           : The Incident Object Description Exchange Format v2
        Author          : Roman Danyliw
	Filename        : draft-ietf-mile-rfc5070-bis-16.txt
	Pages           : 163
	Date            : 2016-02-01

Abstract:
   The Incident Object Description Exchange Format (IODEF) defines a
   data representation for sharing information commonly exchanged by
   Computer Security Incident Response Teams (CSIRTs) about computer
   security incidents.  This document describes the information model
   for the IODEF and provides an associated data model specified with
   XML Schema.

The IETF datatracker status page for this draft is:
https://datatracker.ietf.org/doc/draft-ietf-mile-rfc5070-bis/

There's also a htmlized version available at:
https://tools.ietf.org/html/draft-ietf-mile-rfc5070-bis-16

A diff from the previous version is available at:
https://www.ietf.org/rfcdiff?url2=draft-ietf-mile-rfc5070-bis-16

Please note that it may take a couple of minutes from the time of submission
until the htmlized version and diff are available at tools.ietf.org.

Internet-Drafts are also available by anonymous FTP at:
ftp://ftp.ietf.org/internet-drafts/

---

From: "Roman D. Danyliw" <[email-masked]>
Date: Tue, 2 Feb 2016 02:44:05 +0000

The changelog for this draft is as follows:

** (schema) added XML declaration at the top of the schema
** (text) Improve write-up of @translation-id (Section 2.4)
** (text) Added the EXTENSION type (iodef:ExtensionType) and reference it for AdditionalData , RecordItem, FileProperties  
(Section 2.16)
** (schema) Added ExtensionType@name attribute to name the field (Section 2.16)
** (schema) Made iodef:SoftwareType be a formal UML type, SOFTWARE.  Reference it for Application, Operating System and  
AssociatedSoftware (Section 2.17)
** (text) Defined 0:1 cardinality of IndicatorData in Incident consistent with schema (Section 3.2)
** (text) Fixed type of Incident@observable-id in diagram (Section 3.2)
** (schema) Made @restriction optional in the schema per the text (Section 3.3.1)
** (schema) Redefined PostalAddress, Email, Telephone and Fax for improved internationalization (Section 3.10.2-4) 
** (text) Removed Section 2.12, Person or Organization (PERSON data type) as it was not used
** (text) Removed Section 3.11 that described the time classes (Section 3.11)
** (text) Clarify IntendedImpact (Section 3.14)
** (schema) Consistent cardinality in child classes of RelatedActivity (Section 3.6)
** (schema) Define ThreatActor/{ThreatActorID,Description} as O:M consistently in text, diagram and schema (Section 3.7)
** (schema) Define Campaign/{CampaignID,Description} as 0:M consistently in text, diagram and schema (Section 3.8)
** (schema) Added @ext-dtype to ExtensionType missing from the schema but in the text
** (schema) Added AdditionalData@observable-id attribute (Section 3.9)
** (schema) Redefined SystemImpact, BusinessImpact, IntendedImpact and NodeRole to have a child Description class instead of  
extending iodef:MLStringType per https://mailarchive.ietf.org/arch/msg/mile/ZFL57YU1nYr2vSobRHd1a-OohJQ (Section 3.13)
** (text) Use Reference as the field name in the description of Method (Section 3.13)
** (text) Fixed formatting of Reference class (Section 3.13.1)
** (text) Use enum:ReferenceName as the field name in the description of Reference (Section 3.13.1)
** (schema) {SystemImpact, BusinessImpact}@type is required with a default of 'unknown' per the text (Section 3.14.1 and  
Section 3.14.2)
** (schema) SystemImpact@{severity,completion} optional per the text (Section 3.14.1)
** (schema) Removed SystemImpact@type="admin" from schema (Section 3.14.1)
** (schema) Added TimeImpact@{ext-metric,ext-duration} to schema per the text (Section 3.14.3)
** (text) Corrected field names in the TimeImpact diagram (Section 3.14.3)
** (schema) Define Confidence as an extension of iodef:PositiveFloatType per the text (Section 3.14.5)
** (schema) Removed inline SystemImpact@completion definition
** (schema) Set System/Node to be 1:1 per the text (Section 3.19)
** (schema) Redefined RelatedDNS to be of type EXTENSION (Section 3.20) (Issue #39)
** (schema) Define Counter to be "xs:float" to be consistent with REAL from UML (Section 3.20)
** (schema) Added Counter@ext-unit missing from the schema but in the text (Section 3.20.3)
** (text) Added missing STRING definition of Address in the class diagram (Section 3.20.1)
** (text) Removed Node/DateTime from the Node diagram (Section 3.20)
** (schema) Removed Node/NodeRole from the schema per the text (Section 3.20)
** (text) Updated diagram of Address to reflect base type (Section 3.20.1)
** (schema) Make Address@category="ipv6-addr" the default (Section 3.20.1)
** (text) Consistent use of "Zero or more" and "One or more" to describe cardinality
** (schema) Removed yes-no-type from schema as it was not used 
** (text) Renamed NodeRole@category="c2" to "c2-server" to make the text consistent with the schema (Section 3.20.2)
** (text) Added translation-id and/or xml:lang to diagrams/text where ML_STRING is used (Section 3.20.2)
** (text) Require that Nameserver/Address@category={"ipv4-addr" or "ipv6-addr"} (Section 3.21.2)
** (schema) Redefined ApplicationHeader to use iodef:ExtensionType and use the protocol information from a parent Service  
class (Section 3.21.2)
** (schema) Redefined EmailHeaderField to use iodef:ExtensionType (section 3.23)
** (text) Clarify cardinality of the classes in Assessment (Section 3.14)
** (text) Added reference to EMAIL data type in definition of EmailFrom (Section 3.24)
** (schema) Added EmailData/EmailTo (Section 3.24)
** (schema) Changed EmailTo, EmailFrom, EmailSubject and EmailX-Mailer to be xs:string (Section 3.24)
** (schema) Reference SignatureData and AssociatedSoftware in File per the text (Section 3.27.1)
** (schema) Added Indicator/AdditionalData per the text (Section 3.31)
** (schema) Added Indicator/{NodeRole, AttackPhase} (Section 3.31)
** (text) Consistent definitions of xml:lang in the text
** (text) Updated description of all ext-* attributes that doesn't include the use of the phrase "escape value"
** (text) Simplified Section 4.3, Validation, by removing the list of parsing considerations
** (text) Ensure all classes that are of defined types (e.g., STRING) reference their data type
** (text) Consistent use of cross references for sub-classes when defining the parent class
** (text) Consistent introduction of the attribute count in the description of a class
** (text) Consistent introduction of the sub-classes in the description of a class
** (text) Consistent documentation of classes that do not have child classes
** (text) Consistent depiction of class diagrams
** (text) Reference the element content of ML_STRING derived classes as STRING
** (schema) Define File/Application as "iodef:Application" (not a nested definition of type="iodef:SoftwareType")
** (schema) Consistent order of recurring attributes (e.g., restriction, observable-id) in all classes
** (text) Removed Paul Stoecker as editor per Chair direction
** (text) reformatted schema to have consistent spacing (Issue #54)

> -----Original Message-----
> From: mile [mailto:[email-masked]] On Behalf Of internet-
> [email-masked]
> Sent: Monday, February 1, 2016 5:06 PM
> To: [email-masked]
> Cc: [email-masked]
> Subject: [mile] I-D Action: draft-ietf-mile-rfc5070-bis-16.txt
> 
> 
> _______________________________________________
> mile mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/mile

---

From: Alexey Melnikov <[email-masked]>
Date: Sun, 7 Feb 2016 18:29:49 +0000

Roman,
Are there any outstanding issue?

All,
Can you check that issues you've raised (or changes in general) are to your satisfaction?

Best Regards,
Alexey

> On 2 Feb 2016, at 02:44, Roman D. Danyliw <[email-masked]> wrote:
>

---

From: Alexey Melnikov <[email-masked]>
Date: Fri, 12 Feb 2016 16:49:08 +0000

Hi Roman,
A few quick comments after reviewing the most recent diff:

In 2.17:

formatid might need a bit more details. Can you provide some examples?

In 3.9.4:

When one would use "direct" or when "mobile"? Is "direct" referring to a landline number or something else?

In 3.21:

In EmailHeaderField description: I don't know what is "SMTP header field". I think you should revert the change to make it "email header field" again.

Also, it should be "zero or more", not "zero or one".

In 3.25.1:

FileType - this is just media type name, right?