Re: [mile] Request for draft reviews - review of IODEF Enumeration Reference

"Panos Kampanakis (pkampana)" <pkampana@cisco.com> Thu, 06 June 2013 19:41 UTC

Return-Path: <pkampana@cisco.com>
X-Original-To: mile@ietfa.amsl.com
Delivered-To: mile@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 0D63D21F9289 for <mile@ietfa.amsl.com>; Thu, 6 Jun 2013 12:41:52 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -10.598
X-Spam-Level:
X-Spam-Status: No, score=-10.598 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_HI=-8]
Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id h2ZgnOrdDsk3 for <mile@ietfa.amsl.com>; Thu, 6 Jun 2013 12:41:46 -0700 (PDT)
Received: from rcdn-iport-9.cisco.com (rcdn-iport-9.cisco.com [173.37.86.80]) by ietfa.amsl.com (Postfix) with ESMTP id 9255A11E80FD for <mile@ietf.org>; Thu, 6 Jun 2013 12:41:43 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=@cisco.com; l=25759; q=dns/txt; s=iport; t=1370547703; x=1371757303; h=from:to:subject:date:message-id:references:in-reply-to: mime-version; bh=z0jfjn0KiDoM1Os+Nkw5AbyGFRRDzZoBdvVyO16RA3U=; b=mS5FzL743K4E9MbAcDdUoyNb6w8EtfHCk6IkE/PeO4M+M7FFPSg7wASP iSF6nKk271iMb+OpzVTRT3AILXnFzbWS0vIcw49KeUUB9EFAk0hHerMpu 9n7rbwZ9fYrYOAbMDKTOdyQ1IrAQgyTyNq822ICdYO24TvhPdYgo9Ws3T 0=;
X-IronPort-Anti-Spam-Filtered: true
X-IronPort-Anti-Spam-Result: AqgFAPnksFGtJXG+/2dsb2JhbABZgkVEMK1QiTWIRXoWdIIjAQEBBC1cAgEIEQQBAQsWBwcyFAkIAQEEARIIAYgEDLtZjwEGBwIoAQIEgnRhA5hokBeDD4In
X-IronPort-AV: E=Sophos; i="4.87,817,1363132800"; d="scan'208,217"; a="216771908"
Received: from rcdn-core2-3.cisco.com ([173.37.113.190]) by rcdn-iport-9.cisco.com with ESMTP; 06 Jun 2013 19:41:41 +0000
Received: from xhc-aln-x03.cisco.com (xhc-aln-x03.cisco.com [173.36.12.77]) by rcdn-core2-3.cisco.com (8.14.5/8.14.5) with ESMTP id r56JfejX018152 (version=TLSv1/SSLv3 cipher=AES128-SHA bits=128 verify=FAIL); Thu, 6 Jun 2013 19:41:40 GMT
Received: from xmb-rcd-x10.cisco.com ([169.254.15.56]) by xhc-aln-x03.cisco.com ([173.36.12.77]) with mapi id 14.02.0318.004; Thu, 6 Jun 2013 14:41:40 -0500
From: "Panos Kampanakis (pkampana)" <pkampana@cisco.com>
To: Adam Montville <Adam.Montville@cisecurity.org>, "mile@ietf.org" <mile@ietf.org>, Adam Montville <amontville@tripwire.com>
Thread-Topic: [mile] Request for draft reviews - review of IODEF Enumeration Reference
Thread-Index: Ac5iywbBL2OPl7oFTvaNQKS+LaneQQAET99QAAROS4A=
Date: Thu, 06 Jun 2013 19:41:39 +0000
Message-ID: <1C9F17D1873AFA47A969C4DD98F98A753C8B6E@xmb-rcd-x10.cisco.com>
References: <1C9F17D1873AFA47A969C4DD98F98A753C880A@xmb-rcd-x10.cisco.com> <05BCCEB107AF88469B9F99783D47C1D66F2D3B@CISEXCHANGE1.msisac.org.local>
In-Reply-To: <05BCCEB107AF88469B9F99783D47C1D66F2D3B@CISEXCHANGE1.msisac.org.local>
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
x-originating-ip: [64.102.89.113]
Content-Type: multipart/alternative; boundary="_000_1C9F17D1873AFA47A969C4DD98F98A753C8B6Exmbrcdx10ciscocom_"
MIME-Version: 1.0
Subject: Re: [mile] Request for draft reviews - review of IODEF Enumeration Reference
X-BeenThere: mile@ietf.org
X-Mailman-Version: 2.1.12
Precedence: list
List-Id: "Managed Incident Lightweight Exchange, IODEF extensions and RID exchanges" <mile.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/mile>, <mailto:mile-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/mile>
List-Post: <mailto:mile@ietf.org>
List-Help: <mailto:mile-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/mile>, <mailto:mile-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 06 Jun 2013 19:41:52 -0000

You probably have seen this http://www.ietf.org/rfc/rfc2434.txt but I am pointing it out anyway


From: Adam Montville [mailto:Adam.Montville@cisecurity.org]
Sent: Thursday, June 06, 2013 1:39 PM
To: Panos Kampanakis (pkampana); Moriarty, Kathleen; mile@ietf.org; Adam Montville
Subject: RE: [mile] Request for draft reviews - review of IODEF Enumeration Reference

Thank you!  I'll make the changes you recommend.

Also, are there good IANA-related RFCs I can look at to tighten this draft up a bit?  What I was intending for the IANA section is to convey both what the registry contains and the format of each element therein.

If there's a better way to do this, let's do it.

Adam

From: mile-bounces@ietf.org<mailto:mile-bounces@ietf.org> [mailto:mile-bounces@ietf.org] On Behalf Of Panos Kampanakis (pkampana)
Sent: Thursday, June 06, 2013 8:33 AM
To: Moriarty, Kathleen; mile@ietf.org<mailto:mile@ietf.org>; Adam Montville (amontville@tripwire.com<mailto:amontville@tripwire.com>)
Subject: Re: [mile] Request for draft reviews - review of IODEF Enumeration Reference

Hi Adam,

I think this is close to being done. I had reviewed in the past and the registry format is as we had all agreed.
I did a fresh review and had some minor nits and suggestions, and some confusion for the IANA considerations section.


- maybe rephrase "but one that seems the most appropriate at this point is to..." to "but the most appropriate at this point is to..."



- "especially enumerations such as

   CEE, CVE, CCE" maybe put informative references for CEE, CVE and CCE?



- "Where id_type is an IANA-registered type having the form..." I am proposing to rephrase the paragraph a little to avoid the "And where..."

"The format of the ReferenceName MUST follow the form of

      id_type:version:id

   where id_type is an IANA-registered type having the form

      <Abbreviation>

   The version is an IANA-registered type having the form

      <Version>

   The id is the actual enumeration identifier string."



- In section "4  IANA Considerations", it is not very clear to me what each paragraph is trying to convey. It this section trying to describe the IANA registry or the format of a registry update request? To me it seems it is mostly the former with some info on the latter.

Should the "Name of the Registry: "Enumeration Reference Type Identifiers"" be in the "Fields to record in the registry: "?

Does the paragraph "The registry is intended to enable enumeration value additions..." describe what the IANA registry represents or should it be in the registry request for a new value?

Rgs,
Panos



From: mile-bounces@ietf.org<mailto:mile-bounces@ietf.org> [mailto:mile-bounces@ietf.org] On Behalf Of Moriarty, Kathleen
Sent: Friday, May 17, 2013 2:13 PM
To: mile@ietf.org<mailto:mile@ietf.org>
Subject: [mile] Request for draft reviews

Greetings!

We have had a number of documents updated since the last meeting.  Thank you to all of the editors for making the requested changes!  The current list of drafts up for review (including those that will be a part of the WG after the charter update) include:

RFC5070-bis (IODEF Revision):
http://datatracker.ietf.org/doc/draft-ietf-mile-rfc5070-bis/

Draft on IODEF Guidance:
(input from experience, real use cases, and draft review will be helpful)
http://datatracker.ietf.org/doc/draft-ietf-mile-iodef-guidance/

Structured Cybersecurity Information draft (close to final):
http://datatracker.ietf.org/doc/draft-ietf-mile-sci/

IODEF Enumeration Reference Format:
http://datatracker.ietf.org/doc/draft-montville-mile-enum-reference-format/

Resource-Oriented Lightweight Indicator Exchange (ROLIE):
http://datatracker.ietf.org/doc/draft-field-mile-rolie/

Please take some time to review the drafts and provide feedback to the list.  It would be helpful if we can iterate on most of them prior to the next meeting.  A couple of the drafts are very close to being done.  The list of current drafts and published RFCs can be found at the following link:
http://datatracker.ietf.org/wg/mile/

We will follow up soon on the charter update as well.

Thank you all in advance!
Kathleen



...

This message and attachments may contain confidential information. If it appears that this message was sent to you by mistake, any retention, dissemination, distribution or copying of this message and attachments is strictly prohibited. Please notify the sender immediately and permanently delete the message and any attachments.