Subject: Re: [mile] [EXT] WGLC for CSIRT draft

From: "Haynes Jr., Dan" <[email-masked]>
Date: Mon, 21 Oct 2019 20:37:40 +0000

Hi Nancy and Stephen,

I have some minor nits and questions.

  *   Abstract
     *   Change “This document extends…to add the information type categories…(CSIRT) use cases.” to “This document extends…to add the indicator and incident information type categories…(CSIRT) use cases.”
     *   Remove “The indicator and incident information types are defined as ROLIE extensions.”
  *   Section 2
     *   Should this also reference RFC 8174?
  *   Section 3.1
     *   Change “…that in is the abstract realm…” to “…that is in the abstract realm…”.
  *   Section 3.1
     *   Change “Some examples of indicator information is provided below,…” to “Some examples of indicator information are provided below,…”.
  *   Section 4.2.2
     *   Is “Feed” a defined term?
  *   Section 4.3
     *   Change “day-to=day” should be “day-to-day”.
  *   Section 4.3.1
     *   Bullet 4: Change “…element in the attached MISP Event .” to “…element in the attached MISP Event.”.
     *   Bullet 5: Change “This ensures better compatibility…and a MISP Manifest” to “This ensures better compatibility…and a MISP Manifest.”.
  *   Section 5.1
     *   Change “If a ROLIE server supports…MUST be support” to “If a ROLIE server supports the incident information-type, then these link relations MUST be supported.”
  *   Section 5.2
     *   Change “If a ROLIE server supports…MUST be supported.” to “If a ROLIE server supports the indicator information-type, then these link relations MUST be supported.”
  *   Section 8
     *   Change “When sharing IODEF 2 documents…” to “When sharing IODEF Version 2 documents.”.

Beyond that, I am comfortable with moving this draft forward.

Thanks,

Danny

From: mile <[email-masked]> on behalf of "Nancy Cam-Winget (ncamwing)" <[email-masked]>
Date: Monday, September 23, 2019 at 4:29 PM
To: "[email-masked]" <[email-masked]>
Subject: [EXT] [mile] WGLC for CSIRT draft

Fellow MILE participants,

This is a Working Group Last Call for https://datatracker.ietf.org/doc/draft-ietf-mile-rolie-csirt/

Please provide your review and feedback to the draft’s readiness by Oct 21st so that we can move it forward.

Warm regards,
                Nancy

---

From: Jessica Fitzgerald-McKay <[email-masked]>
Date: Mon, 21 Oct 2019 18:10:51 -0400

A few more nits. When these and Danny's edits are addresses, this document
is ready to move forward.

Thanks,
Jess

Introduction- Expand CSIRT on first use
                  - change "ensure the security of their systems" to
"improve the security of their systems"
Section 4.3- edit MISP document section to avoid ending on a preposition
("actively being worked on")
      - link to the MISP drafts, as informative references
Section 8- edit first comma in first sentence to a semi colon or period

On Mon, Oct 21, 2019 at 4:38 PM Haynes Jr., Dan <[email-masked]> wrote:

>    - Abstract
>       - Change “This document extends…to add the information type
>       categories…(CSIRT) use cases.” to “This document extends…to add the
>       indicator and incident information type categories…(CSIRT) use cases.”
>       - Remove “The indicator and incident information types are defined
>       as ROLIE extensions.”
>    - Section 2
>       - Should this also reference RFC 8174?
>    - Section 3.1
>       - Change “…that in is the abstract realm…” to “…that is in the
>       abstract realm…”.
>    - Section 3.1
>       - Change “Some examples of indicator information is provided
>       below,…” to “Some examples of indicator information are provided below,…”.
>    - Section 4.2.2
>       - Is “Feed” a defined term?
>    - Section 4.3
>       - Change “day-to=day” should be “day-to-day”.
>    - Section 4.3.1
>       - Bullet 4: Change “…element in the attached MISP Event .” to
>       “…element in the attached MISP Event.”.
>       - Bullet 5: Change “This ensures better compatibility…and a MISP
>       Manifest” to “This ensures better compatibility…and a MISP Manifest.”.
>    - Section 5.1
>       - Change “If a ROLIE server supports…MUST be support” to “If a
>       ROLIE server supports the incident information-type, then these link
>       relations MUST be supported.”
>    - Section 5.2
>       - Change “If a ROLIE server supports…MUST be supported.” to “If a
>       ROLIE server supports the indicator information-type, then these link
>       relations MUST be supported.”
>    - Section 8
>       - Change “When sharing IODEF 2 documents…” to “When sharing IODEF
>       Version 2 documents.”.
>
>
>
> *From: *mile <[email-masked]> on behalf of "Nancy Cam-Winget
> (ncamwing)" <[email-masked]>
> *Date: *Monday, September 23, 2019 at 4:29 PM
> *To: *"[email-masked]" <[email-masked]>
> *Subject: *[EXT] [mile] WGLC for CSIRT draft
>
>
>
> This is a Working Group Last Call for
> https://datatracker.ietf.org/doc/draft-ietf-mile-rolie-csirt/
>
>
>
> _______________________________________________
> mile mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/mile
>

---

From: "Banghart, Stephen A. (Fed)" <[email-masked]>
Date: Mon, 28 Oct 2019 16:07:02 +0000

Jess and Danny,

Thanks for the reviews, I’ll provide my responses to both of your comments inline below.

From: mile <[email-masked]> On Behalf Of Jessica Fitzgerald-McKay
Sent: Monday, October 21, 2019 6:11 PM
To: Haynes Jr., Dan <[email-masked]>
Cc: [email-masked]
Subject: Re: [mile] [EXT] WGLC for CSIRT draft

A few more nits. When these and Danny's edits are addresses, this document is ready to move forward.

Thanks,
Jess

The first use is in the abstract and is expanded, I’ll expand it in the introduction as well.

                  - change "ensure the security of their systems" to "improve the security of their systems"

Changed

Section 4.3- edit MISP document section to avoid ending on a preposition ("actively being worked on")

Updated to “MISP is defined by a family of internet drafts currently being developed in the IETF”.

Moved from normative to informative

Changed

On Mon, Oct 21, 2019 at 4:38 PM Haynes Jr., Dan <dhaynes@mitre..org<mailto:[email-masked]>> wrote:
Hi Nancy and Stephen,

  *   Abstract

Updated both of these.

  *   Section 2

Changed

  *   Section 3.1

Fixed

  *   Section 3.1

Fixed

  *   Section 4.2.2

I added text in the terminology section that references RFC8322

  *   Section 4.3

Fixed

  *   Section 4.3.1

Fixed

  *   Section 5.1

  *   Section 5.2

  *   Section 8

All fixed.

Thanks,

Danny

From: mile <[email-masked]<mailto:[email-masked]>> on behalf of "Nancy Cam-Winget (ncamwing)" <[email-masked]<mailto:[email-masked]>>
Date: Monday, September 23, 2019 at 4:29 PM
To: "[email-masked]<mailto:[email-masked]>" <[email-masked]<mailto:[email-masked]>>
Subject: [EXT] [mile] WGLC for CSIRT draft

This is a Working Group Last Call for https://datatracker.ietf.org/doc/draft-ietf-mile-rolie-csirt/<https://gcc01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fdatatracker.ietf.org%2Fdoc%2Fdraft-ietf-mile-rolie-csirt%2F&data=02%7C01%7Cstephen.banghart%40nist.gov%7C8aa124fb649e4a5e8c8508d75673984b%7C2ab5d82fd8fa4797a93e054655c61dec%7C1%7C0%7C637072926786418770&sdata=3juX7azJHBlXLcsIYcuxo6ft7bbwOtyjjQ88YBMV6jc%3D&reserved=0>

Warm regards,
                Nancy
_______________________________________________
mile mailing list
[email-masked]<mailto:[email-masked]>
https://www.ietf.org/mailman/listinfo/mile<https://gcc01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.ietf.org%2Fmailman%2Flistinfo%2Fmile&data=02%7C01%7Cstephen.banghart%40nist.gov%7C8aa124fb649e4a5e8c8508d75673984b%7C2ab5d82fd8fa4797a93e054655c61dec%7C1%7C0%7C637072926786418770&sdata=7Lv4FDm7hiJz%2BmYfWkH93vTu5BcE9%2BpSLGDXcIaX1s8%3D&reserved=0>