Subject: [mile] Feedback for draft-ietf-mile-rolie-csirt-05

From: "Nelson, Alexander J. (Fed)" <[email-masked]>
Date: Mon, 28 Oct 2019 19:12:27 +0000

Hello all,

I was asked to review this document.  From some travel timing, the version of the document I looked at was 05, but Stephen informed me that these still happen to apply to version 06.

Nits:
* Section 1, paragraph 4 ("Indicator information describes..."): "Everything from system vulnerabilities to unexpected network traffic..." - the word "unexpected" is a little odd in this sentence as a descriptor of data packaged for analysts' consumption. Would "malice-signaling," or "recognized-malicious" work better?
* Section 4.3.2, paragraph 4: Mentioning "Conversion" of metadata here implies a possibly-destructive data transformation. I don't think that is technically or spiritually what is happening, though. Could this be described as *deriving* a ROLIE repository from the MISP data sources?
* Section 5.1, paragraph 1: The sentence of this paragraph appears to be truncated.
* Table 1, "evidence" through "vector" rows, Description: "...resources that provides..." should say "...resources that provide...".
* Section 8, paragraph 3: "at the workspace level, as such, keeping..." - this first comma joins two sentences that shouldn't be joined.
* Appendix A, XML samples: there are a couple issues that I think xmllint would catch, like attributes needing one or both double-quote characters for their values (see the rolie:property elements, and rolie:format in the STIX example). The STIX example's summary element also has a trailing whitespace.
 
The document otherwise looks straightforward to me.

--Alex