Subject: [mile] Discussion #4 closed (was: RE: 5070-bis scoping discussion #4: workflow)

From: "Roman D. Danyliw" <[email-masked]>
Date: Tue, 8 Oct 2013 19:41:13 +0000

Hello!

Thank you for your feedback on discussion #4.  Per the timing announced in the original announcement, discussions are closed.  A summary write-up of the results will be forthcoming.

Roman

From: [email-masked] [mailto:[email-masked]] On Behalf Of Roman D. Danyliw
Sent: Monday, October 07, 2013 8:38 AM
To: [email-masked]
Subject: [mile] Discussion #4 reminder (was: RE: 5070-bis scoping discussion #4: workflow)

Hello!

I wanted to send out a reminder to provide comments on the last 5070bis discussion by noon tomorrow (October 8th).  The items being discussed are below.  Please check the email archive for the latest comments.

Roman

From: [email-masked]<mailto:[email-masked]> [mailto:[email-masked]] On Behalf Of Roman D. Danyliw
Sent: Tuesday, September 24, 2013 10:20 AM
To: [email-masked]<mailto:[email-masked]>
Subject: [mile] 5070-bis scoping discussion #4: workflow

Hello!

Per the announcement in [1], this note initiates topic discussion #4 on the 5070bis scope.  Please refer to discussion #1 [2], #2 [3], and #3 [4] in the archive.  This is the last of the discussion threads.  For those expecting this call yesterday as was planned, sorry for the delay.

Discussion #4 is intended to clarify what additional work to the data model is required to support specific work-flows.  The power-point formatted version of this text can be found in slides 10 of [4].  If you have a feelings on the matter, please provide input by noon of October 8th.  Opinions to add something or explicitly avoid it are welcome.  In the case of the former, proposals are welcome but not required.

(12) How should indicator matches be returned?  There has been much discuss on which indicators to represent.  With the Expectation class and the Incident@purpose the reason for sending the document is conveyed.  Should specific support be provided to convey that a particular indicator matched.  If so, how?

(13) How should document updates be sent?  Understanding of an event will evolve over the course of an investigation.  Is there a desire to support, change or provide additional guidance on how a sender should transmit an update to a previously sent IODEF document?

Regards,

Roman

[1] http://www.ietf.org/mail-archive/web/mile/current/msg01146.html

[2] http://www.ietf.org/mail-archive/web/mile/current/msg01147.html

[3] http://www.ietf.org/mail-archive/web/mile/current/msg01182.html

[4] http://www.ietf.org/mail-archive/web/mile/current/msg01189.html

[5] http://www.ietf.org/proceedings/87/slides/slides-87-mile-4.pdf