Re: [Dots] DOTS Telemetry: Interop Clarification #3

["Konda, Tirumaleswar Reddy" <[e-mail]>]

I meant attack mapping details can be sent in the DOTS data channel and no need to use DOTS signal channel. The capabilities of a DOTS mitigator cannot be updated dynamically during mitigation that would warrant the need to send the attack-description in the DOTS signal channel during attack mitigation. Identifying a new attack requires update to the DOTS mitigator, human-intervention is required to create the attack description and attack-id.

In short, no need overload DOTS signal channel to send the attack description.

-Tiru

From: [e-mail] <[e-mail]>
Sent: Friday, June 26, 2020 11:34 AM
To: Konda, Tirumaleswar Reddy <[e-mail]>; kaname nishizuka <[e-mail]>
Cc: [e-mail]
Subject: RE: DOTS Telemetry: Interop Clarification #3


CAUTION: External email. Do not click links or open attachments unless you recognize the sender and know the content is safe.

________________________________
Hi Tiru,

Not sure to get your comment. Can you please clarify?

Cheers,
Med

De : Konda, Tirumaleswar Reddy [mailto:[e-mail]]
Envoyé : vendredi 26 juin 2020 07:15
À : BOUCADAIR Mohamed TGI/OLN; kaname nishizuka
Cc : [e-mail]<mailto:[e-mail]>
Objet : RE: DOTS Telemetry: Interop Clarification #3

Hi Med,

I don't think the capabilities of the mitigator will get updated dynamically during an active attack to send the new attack details (attack-name) in the DOTS signal channel protocol.

Cheers,
-Tiru

From: Dots <[e-mail]<mailto:[e-mail]>> On Behalf Of [e-mail]<mailto:[e-mail]>
Sent: Friday, June 26, 2020 1:02 AM
To: kaname nishizuka <[e-mail]<mailto:[e-mail]>>
Cc: [e-mail]<mailto:[e-mail]>
Subject: [Dots] DOTS Telemetry: Interop Clarification #3


CAUTION: External email. Do not click links or open attachments unless you recognize the sender and know the content is safe.

________________________________
Re-,

You reported the following in the interim :
==
3."DOTS agents MUST NOT include 'attack-name' attribute except if the corresponding attack mapping details were not shared with the peer DOTS agent". But how can the DOTS server know they're shared or not?
===

This is implementation-specific. The DOTS server may record which version of the mapping table it shared with a DOTS client.

Do you think that we need to include such details in the spec? or do you have mind something else?

Thanks.

Cheers,
Med



_________________________________________________________________________________________________________________________



Ce message et ses pieces jointes peuvent contenir des informations confidentielles ou privilegiees et ne doivent donc

pas etre diffuses, exploites ou copies sans autorisation. Si vous avez recu ce message par erreur, veuillez le signaler

a l'expediteur et le detruire ainsi que les pieces jointes. Les messages electroniques etant susceptibles d'alteration,

Orange decline toute responsabilite si ce message a ete altere, deforme ou falsifie. Merci.



This message and its attachments may contain confidential or privileged information that may be protected by law;

they should not be distributed, used or copied without authorisation.

If you have received this email in error, please notify the sender and delete this message and its attachments.

As emails may be altered, Orange is not liable for messages that have been modified, changed or falsified.

Thank you.