Subject: [mile] Details on ReportID

From: "Roman D. Danyliw" <[email-masked]>
Date: Fri, 18 Oct 2013 17:02:44 +0000

Hello!

Per issue #15 (http://trac.tools.ietf.org/wg/mile/trac/ticket/15), there are a few changes in the schema not described in the text, discussed on the mailing list, or in a presentation at a meeting.  I was hoping to get insight into Incident/ReportID.  This text is currently in the -01 schema:

--[snip]--
    <xs:element name="Incident">
      <xs:complexType>
        <xs:sequence>
          <xs:choice>
            <xs:element ref="iodef:IncidentID"/>
            <!-- CHANGE - the incidentID can still be used, 
              but when you have a set of indictaors or include
              a watch list, a ReportID may be preferred.  If 
              this is agreed upon, do we make them both unique
              so the same key can be used in databases?  This 
              should not be used as your index value unless you
              are the issueing entity. -->
            <xs:element name="ReportID" type="IncidentIDType"/>
          </xs:choice>
--[ snip ]--

TXML comment suggests the ReportID is motivated by a use case where only indicators are shared.
>From the name alone, I don't want to jump to any conclusions.  A few questions:

** When does one use a ReportID instead of an IncidentID (the schema suggests they're mutually exclusive)?
** Are there any advantages or disadvantages in supporting both at the same time?
** Is a ReportID a unique identifier for a given IODEF-Document?  IODEF-Document/Incident?
** In discussion #4, there was talk of providing document updates.  Does a ReportID change when an update is provided?** Is there a format for the ReportID?
** What does it mean when an Incident/AlternativeID is included and no Incident/IncidentID provided?

Roman

---

From: "Stoecker, Paul" <[email-masked]>
Date: Fri, 18 Oct 2013 19:28:02 +0000

It almost seems like you would use it because you don't necessarily like
the term IncidentID.  That is all you want to do is to share some IOCs or
a watch list and it isn't in any way related to an Incident, so you call
it a Report.  I would stick with one term.  There is an incidentID and it
can be just information that you want to share that is related to
Incidents.  I say we keep it simple.

Paul W. Stoecker, Ph.D.
Security Analytics Product Management Team
RSA, The Security Division of EMC
cell: 302.379.3375 | e: [email-masked]

On 10/18/13 1:02 PM, "Roman D. Danyliw" <[email-masked]> wrote:

>Hello!
>
>Per issue #15 (http://trac.tools.ietf.org/wg/mile/trac/ticket/15), there
>are a few changes in the schema not described in the text, discussed on
>the mailing list, or in a presentation at a meeting.  I was hoping to get
>insight into Incident/ReportID.  This text is currently in the -01 schema:
>
>--[snip]--
>** In discussion #4, there was talk of providing document updates.  Does
>a ReportID change when an update is provided?** Is there a format for the
>ReportID?
>_______________________________________________
>mile mailing list
>[email-masked]
>https://www.ietf.org/mailman/listinfo/mile
>

---

From: "Panos Kampanakis (pkampana)" <[email-masked]>
Date: Fri, 18 Oct 2013 19:56:59 +0000

+1

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of Stoecker, Paul
Sent: Friday, October 18, 2013 3:28 PM
To: Roman D. Danyliw; [email-masked]
Subject: Re: [mile] Details on ReportID

It almost seems like you would use it because you don't necessarily like the term IncidentID.  That is all you want to do is to share some IOCs or a watch list and it isn't in any way related to an Incident, so you call it a Report.  I would stick with one term.  There is an incidentID and it can be just information that you want to share that is related to Incidents.  I say we keep it simple.

Paul W. Stoecker, Ph.D.
Security Analytics Product Management Team RSA, The Security Division of EMC
cell: 302.379.3375 | e: [email-masked]

On 10/18/13 1:02 PM, "Roman D. Danyliw" <[email-masked]> wrote:

>Hello!
>
>Per issue #15 (http://trac.tools.ietf.org/wg/mile/trac/ticket/15), 
>there are a few changes in the schema not described in the text, 
>discussed on the mailing list, or in a presentation at a meeting.  I 
>was hoping to get insight into Incident/ReportID.  This text is currently in the -01 schema:
>
>--[snip]--
>** In discussion #4, there was talk of providing document updates.  
>Does a ReportID change when an update is provided?** Is there a format 
>for the ReportID?

---

From: "Moriarty, Kathleen" <[email-masked]>
Date: Fri, 18 Oct 2013 16:04:28 -0400

I am fine with either approach, but am hoping the folks who pushed for another term chime in as well.  It would be great to hear their perspective.

Thanks!
Kathleen
________________________________________
From: [email-masked] [[email-masked]] On Behalf Of Panos Kampanakis (pkampana) [[email-masked]]
Sent: Friday, October 18, 2013 3:56 PM
To: Stoecker, Paul; Roman D. Danyliw; [email-masked]
Subject: Re: [mile] Details on ReportID

+1

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of Stoecker, Paul
Sent: Friday, October 18, 2013 3:28 PM
To: Roman D. Danyliw; [email-masked]
Subject: Re: [mile] Details on ReportID

Paul W. Stoecker, Ph.D.