Re: [mile] I-D Action: draft-ietf-mile-iodef-guidance-05.txt

Hello all,

This is Mio from NICT.

So sorry for my slow work.
Except for examples in “Appendix” section, almost all sections have been filled.
Could you please give me all sorts of comments or feedbacks?

The summaries of this -05 update are
  (1)  Fix some sentences following Panos-san’s suggestion 
  (2)  Changed section title from "Restrictions in IODEF" to "Disclosure level of IODEF" and added some description
  (3)  Mixed "Recommended classes to implement" section with "Unnecessary Fields" section into "Minimal IODEF document" section
  (4)  Added description to "Decide what IODEF will be used for" section, "Implementations" section, and "Security Considerations” section

To-Do lists are
  (1) Convert and add examples of spear phishing and watchlist/malware to "Appendix".
  (2) Modify examples in "Appendix" to follow the current schema.
      Following IODEFv2 is better? Currently, only “Malware Delivery URL” sample follows IODEFv2 schema.

Regards,
mio

> 2016/04/04 17:12, internet-drafts@ietf.org:
> 
> 
> A New Internet-Draft is available from the on-line Internet-Drafts directories.
> This draft is a work item of the Managed Incident Lightweight Exchange of the IETF.
> 
>        Title           : IODEF Usage Guidance
>        Authors         : Mio Suzuki
>                          Panos Kampanakis
> 	Filename        : draft-ietf-mile-iodef-guidance-05.txt
> 	Pages           : 28
> 	Date            : 2016-04-04
> 
> Abstract:
>   The Incident Object Description Exchange Format [RFC5070] defines a
>   data representation that provides a framework for sharing information
>   commonly exchanged by Computer Security Incident Response Teams
>   (CSIRTs) about computer security incidents.  Since the IODEF model
>   includes a wealth of available options that can be used to describe a
>   security incident or issue, it can be challenging for implementers to
>   develop tools that can Leverage IODEF for incident sharing.  This
>   document provides guidelines for IODEF implementers.  It will also
>   address how common security indicators can be represented in IODEF
>   and use-cases of how IODEF is being used so far.  The goal of this
>   document is to make IODEF's adoption by vendors easier and encourage
>   faster and wider adoption of the model by Computer Security Incident
>   Response Teams (CSIRTs) around the world.
> 
> 
> The IETF datatracker status page for this draft is:
> https://datatracker.ietf.org/doc/draft-ietf-mile-iodef-guidance/
> 
> There's also a htmlized version available at:
> https://tools.ietf.org/html/draft-ietf-mile-iodef-guidance-05
> 
> A diff from the previous version is available at:
> https://www.ietf.org/rfcdiff?url2=draft-ietf-mile-iodef-guidance-05
> 
> 
> Please note that it may take a couple of minutes from the time of submission
> until the htmlized version and diff are available at tools.ietf.org.
> 
> Internet-Drafts are also available by anonymous FTP at:
> ftp://ftp.ietf.org/internet-drafts/
> 
> _______________________________________________
> mile mailing list
> mile@ietf.org
> https://www.ietf.org/mailman/listinfo/mile

Re: [mile] I-D Action: draft-ietf-mile-iodef-guidance-05.txt

Attachment: smime.p7s