[mile] [Issue #17] Additional values in Incident@purpose

"Roman D. Danyliw" <rdd@cert.org> Mon, 29 July 2013 13:54 UTC

From: "Roman D. Danyliw" <rdd@cert.org>
To: "mile@ietf.org" <mile@ietf.org>
Thread-Topic: [Issue #17] Additional values in Incident@purpose
Thread-Index: Ac6MYd7FymU8Ca+OQiGWe3LqYXfjsw==
Date: Mon, 29 Jul 2013 13:52:53 +0000
Message-ID: <359EC4B99E040048A7131E0F4E113AFC13C561E2@marathon>
Accept-Language: en-US
Content-Language: en-US
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
Subject: [mile] [Issue #17] Additional values in Incident@purpose
Precedence: list

Hi!

Tracking at http://trac.tools.ietf.org/wg/mile/trac/ticket/17.

The intent of the IODEF data model has expanded in scope with MILE.  In addition to incident reporting and requesting mitigation, sending indicators and threat information is now done.  This change likely warrants additional values in Incident@purpose.  Currently, this attribute is defined as follows:

      1.  traceback.  The document was sent for trace-back purposes.

      2.  mitigation.  The document was sent to request aid in
          mitigating the described activity.

      3.  reporting.  The document was sent to comply with reporting
          requirements.

      4.  other.  The document was sent for purposes specified in the
          Expectation class.

      5.  ext-value.  An escape value used to extend this attribute.
          See Section 5.1.

I would propose adding two new values:

6.  indicators.  The document was sent to convey indicators to threat activity.

7.  awareness.  The document was sent to provide awareness of threat activity.

Are there any other?

Roman

[mile] [Issue #17] Additional values in Incident@… Roman D. Danyliw