[mile] Security alert reporting - the firstMILE

[Robert Moskowitz <[e-mail]>]

The MILE charter starts off with:

"The Managed Incident Lightweight Exchange (MILE) working group develops
standards to support computer and network security incident management"

So even though further down it says:

"The MILE WG is focused on two areas: IODEF, the data format and extensions
to represent incident and indicator data, and RID, the policy and
transport for structured data."

I have been puzzled by the lack of a standardized security alert 
reporting process.  After a few discussions and a lot of thought on the 
problem, I have come up with firstMILE:

https://www.ietf.org/internet-drafts/draft-moskowitz-firstmile-00.txt

Which proposes a sub/pub model including initial registration for 
security alerts reporting.

At this point the draft is more a skeleton for hanging how the three 
components:

Registration of security device to monitor(s).
Subscription of monitors for specific reporting.
Publication of security reports to subscribed monitors.

I have covered some of the requirements for these components.  I bring 
this to the MILE workgroup for:

Is this something the MILE wg should talk on?
And am I correct that currently security alert reporting is not covered 
within the IETF.
How much coordination for this should there be with DOTS and I2NSF?
     Note that I have proposed a DOTS messaging protocol and parts of 
firstMILE overlap with i2rs.

For the pub portion, I hold that the requirements align with the DOTS 
requirements, other than the bi-directional communications needs.  Do 
others agree?  If so, I have a DOTS draft:

https://www.ietf.org/internet-drafts/draft-moskowitz-dots-ssls-02.txt

DOTS Secure Session Layer Services

This introduces a real session layer, something really not present in 
the IETF stack, that provides a set of services.  SSLS and its services 
are laid out in:

https://www.ietf.org/internet-drafts/draft-hares-i2nsf-ssls-00.txt

Sue (and I) put the design for SSLS in i2nsf, as it is broadly 
applicable in a number of areas under i2nsf.

Two other drafts that fit into this architecture are:

https://www.ietf.org/internet-drafts/draft-moskowitz-sse-03.txt
and
https://www.ietf.org/internet-drafts/draft-moskowitz-gpcomp-00.txt

SO.....

I open the floor to discussion.

I would be interested in how others see this part of the security 
defense environment.

I am interested in how others see SLS and particularly SSLS and its use 
for firstMILE pub.  I have a slot in the meeting to cover my work.