Re: [mile] Request for draft reviews - review of FC5070-bis

["Roman D. Danyliw" <[e-mail]>]

Hi Daniel:

From: "Daniel Piggott" <daniel.piggott at switch2it.co.uk>
Date: Fri, 14 Jun 2013 13:30:37 +0100
In-reply-to: <1C9F17D1873AFA47A969C4DD98F98A753C8AC8 at xmb-rcd-x10.cisco.com>
References: <1C9F17D1873AFA47A969C4DD98F98A753C8AC8 at xmb-rcd-x10.cisco.com>
List-id: "Managed Incident Lightweight Exchange, IODEF extensions and RID exchanges" <mile.ietf.org>

> Hello, is there any update to my response to the document reviewed below? 
> Sent 6th June 22:57? Kathleen informed me it only made part of the distribution list.
> Thks
> Daniel
> 
> Structured Cybersecurity Information draft (close to final):
> http://datatracker.ietf.org/doc/draft-ietf-mile-sci/
> 
> Having looked through this draft and the example  11.  Appendix III: An XML Example
> 
> Would these be worth considering in the IODEF incident schema?
>
[snip] 
> A field for whether any device is virtual or physical?

That's a good idea.  Would a new attribute in System mean the need?  Perhaps something like the following?

   +------------------------------+
   | System                       |
   +------------------------------+
   | ENUM restriction      |
   | ENUM category         |
   | STRING ext-category | 
   | STRING interface       |    
   | ENUM spoofed          |
   | ENUM virtualized      |
   +------------------------------+

virtualized
      Optional.  ENUM.  An indication of whether the system is
      a physical or virtual device.

      1.  unknown.  The disposition of the system is unknown.

      2.  yes.  The system is virtual.

      3.  no.  The system is physical.

    <xs:element name="System">
      <xs:complexType>
        <xs:sequence>
...
        <xs:attribute name="virtual"
                      default="unknown">
          <xs:simpleType>
            <xs:restriction base="xs:NMTOKEN">
              <xs:enumeration value="unknown"/>
              <xs:enumeration value="yes"/>
              <xs:enumeration value="no"/>
            </xs:restriction>
          </xs:simpleType>
        </xs:attribute>
      </xs:complexType>
    </xs:element>

As an aside, {unknown, yes, and no} are used in a few places in the schema.  These should be abstracted.

Roman