Subject: Re: [sacm] SACM IM Terminology/Glossary

From: "Waltermire, David A." <[email-masked]>
Date: Tue, 11 Nov 2014 19:44:41 +0000

This older post was discussed in our side meeting today. I don't believe we have addressed these comments yet.

Any thoughts on including any of these terms in the terminology draft?

Thanks,
Dave

-----Original Message-----
From: sacm [mailto:[email-masked]] On Behalf Of Henk Birkholz
Sent: Monday, September 15, 2014 8:55 AM
To: [email-masked]
Subject: [sacm] SACM IM Terminology/Glossary

Hello!

my action item was to create an updated list of terms found in the current combined SACM IM draft (draft-combined-sacm-information-model-00). This list of terms is intended to focus a discussion on global terminology: which terms might already be defined in other places, which might be redundant or conflicting, which might be appropriate and which might have to be reconsidered.

Some of the terms already are in the process of being discussed (e.g. 
task, process & activity) and relationships between singular terms (e.g. 
attribute and event, or device and endpoint) seem to be an important topic (in order to convey the "bigger picture").
Some of the terms highlighted are now located in the appendices and therefore could potentially move to the corresponding SACM drafts.

As a default, terms that are agreed upon could be covered in the terminology draft (draft-ietf-sacm-terminology-05) or--alternatively-- be defined in the drafts they are used in. We do not have to decide this now and can work on the terms themselves.

Please feel free to suggest new terms or comment on having them removed if there seems to be no actual need to provide (or improve) an explicit definition.

Sincerely,

Henk

---

[Terms listed include a reference and an example of their usage in the combined SACM IM draft.]

- configuration (e.g. Abstract: "model for aggregated configuration and operational data")
- operation (e.g. 1. "technology that performs operations to support
collection")
- report (e.g. 1. "to support collection, evaluation, and reporting")
- policy (e.g. 1. "4. Policy evaluation expression")
- activity (e.g. 2. "The activities and processes described within this
document")
- process (e.g. 2. "The activities and processes described within this
document")
- network interface (e.g. 4. Figure 1)
- address (e.g. 4.4.1. A network session generally is associated with addresses, such as MAC and IP addresses.)
- value (e.g. 4.7.7. "expected values for the data elements and attributes")
- attribute value (e.g. 4.7.7. "an acceptable data element or attribute
value")
- event (e.g. 4.7.7. "In contrast, an *event* occurs at a moment in time.")
- guidance (e.g. 4.13. "Guidance is generally configurable by human
administrators")
- task (e.g. 4.13.5. "A Reporting Task typically needs Reporting Guidance")
- metadata (e.g. 5.5. "A metadata item is the basic unit of information, and is attached to an identifier or to a link.")
- status (e.g. C.1. "status of the endpoint")
- entity (e.g. C.2. "Every entity (human or machine) that notifies, queries, or")
- continuous monitoring (e.g. C.2. "Operators of a continuous monitoring or security automation system")
- trigger (e.g. C.2. "Guidance may be retrieved in event of a collection or evaluation trigger")
- component (e.g. C.3. "core architectural components as the basis for determining information elements")
- expression (e.g. D.1. "sustainable collection, expression, and
evaluation")
- device (e.g. D.1. "what devices are on the network")
- data element (e.g. D.2. "This requires populating the data elements and attributes")
- collected instances (e.g. D.2. "the actual collected instances of asset data")
- state (e.g. E.3.2.1.1.2.1. "State(platform specific): A generalized construct that is extended in platform schema")

---

From: "Gonzalez, Juan" <[email-masked]>
Date: Tue, 11 Nov 2014 20:32:36 +0000

I also found the following terms throughout the documents that may need to be defined:

*         Asserter

*         Assessment

*         Assertion

*         Endpoint Attribute Assertion

*         Configuration Checklist

*         Ecosystem

*         Filtering

*         Physical Inventory System

*         Inventory

*         Profiler

*         Request

*         Query

*         Publication

*         Posture

*         Node

*         Results

*         Reputation

Regards,

Juan M. Gonzalez

Senior Strategist

Office of the Chief Technology Officer

Cybersecurity and Communications

U.S. Department of Homeland Security

(o)    703 235 5476

(bb) 202 713 0447

-----Original Message-----
From: sacm [mailto:[email-masked]] On Behalf Of Waltermire, David A.
Sent: Tuesday, November 11, 2014 9:45 AM
To: Henk Birkholz; [email-masked]
Subject: Re: [sacm] SACM IM Terminology/Glossary

Thanks,

Dave

-----Original Message-----

To: [email-masked]<mailto:[email-masked]>

Hello!

Sincerely,

Henk

---

collection")

document")

document")

value")

administrators")

evaluation")

_______________________________________________

sacm mailing list

[email-masked]<mailto:[email-masked]>

https://www.ietf.org/mailman/listinfo/sacm