Subject: [sacm] Data Formats for Endpoint Data Model

From: "Cokus, Michael S." <[email-masked]>
Date: Thu, 16 Jun 2016 17:41:16 +0000

All,

As the IM document gets closer to completion, I'd like to queue up discussion pertaining to data models based on OVAL.  I propose that as a pilot effort we look at selecting a data format for representing a data model for configuration endpoint information.

Since data formats are potentially a lively subject, I'd like to suggest some questions we should consider when discussing the merits of a data format.

1 - Does the data format meet SACM requirements? [1]

2 - Does the data format support the SACM IM? [2]

3 - What are the PROs and CONs of the data format with respect to SACM?

The purpose of the questions above is to focus discussion.  What do you think?  Are there other ideas?

Assuming we can agree to the first step, I think the way to begin is to determine which of the SACM requirements are relevant to data formats.  I'm guessing that many of the requirements have no effect on which data format(s) to use.  So narrowing these down would be a good idea.  Would anyone like to take a look at the requirements document [1] and come up with a list of data-format-relevant requirements?

Thanks,

--mike

[1] https://datatracker.ietf.org/doc/draft-ietf-sacm-requirements/

[2] https://datatracker.ietf.org/doc/draft-ietf-sacm-information-model/

Mike Cokus
Systems Engineer
The MITRE Corporation