Re: [mile] Request for draft reviews - review of FC5070-bis

"Panos Kampanakis (pkampana)" <pkampana@cisco.com> Thu, 06 June 2013 18:25 UTC

Return-Path: <pkampana@cisco.com>
X-Original-To: mile@ietfa.amsl.com
Delivered-To: mile@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id EC72921E809B for <mile@ietfa.amsl.com>; Thu, 6 Jun 2013 11:25:52 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -10.598
X-Spam-Level:
X-Spam-Status: No, score=-10.598 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_HI=-8]
Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id S5jVUJuYMR2r for <mile@ietfa.amsl.com>; Thu, 6 Jun 2013 11:25:45 -0700 (PDT)
Received: from rcdn-iport-1.cisco.com (rcdn-iport-1.cisco.com [173.37.86.72]) by ietfa.amsl.com (Postfix) with ESMTP id 9E29E21E805E for <mile@ietf.org>; Thu, 6 Jun 2013 11:25:44 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=@cisco.com; l=18960; q=dns/txt; s=iport; t=1370543144; x=1371752744; h=from:to:subject:date:message-id:mime-version; bh=vnR0tLxjQvDEsGhm4w3HKzXYzUXPbzHM/ETTAb6zPpU=; b=hvLUGTEvZ+MYLldXW5VZoOHfsPzuUUXMdvoyWwGLSiY7pM6+EcvTcBeg mORmubuY4qWfoRphNQ6yl0FUctYJ26opyyGU7V3VdOPX4fjOtIsLjcvkt ONLG67Y0XenTJfLCMoJO37sKC+o6+DpB7e6QhqsS/pAxyeLM64Lnxa4tk Y=;
X-IronPort-Anti-Spam-Filtered: true
X-IronPort-Anti-Spam-Result: AqgFABvTsFGtJXHB/2dsb2JhbABZgkVEMK1NiTWIRXoWdIIjAQEBBC1eAQgRBAEBCx05FAkJAQQBEgiIBQy7dY8BN4J7YQOYaJAXgw+CJw
X-IronPort-AV: E=Sophos; i="4.87,816,1363132800"; d="scan'208,217"; a="219516465"
Received: from rcdn-core2-6.cisco.com ([173.37.113.193]) by rcdn-iport-1.cisco.com with ESMTP; 06 Jun 2013 18:25:43 +0000
Received: from xhc-rcd-x14.cisco.com (xhc-rcd-x14.cisco.com [173.37.183.88]) by rcdn-core2-6.cisco.com (8.14.5/8.14.5) with ESMTP id r56IPhgd008596 (version=TLSv1/SSLv3 cipher=AES128-SHA bits=128 verify=FAIL); Thu, 6 Jun 2013 18:25:43 GMT
Received: from xmb-rcd-x10.cisco.com ([169.254.15.56]) by xhc-rcd-x14.cisco.com ([173.37.183.88]) with mapi id 14.02.0318.004; Thu, 6 Jun 2013 13:25:43 -0500
From: "Panos Kampanakis (pkampana)" <pkampana@cisco.com>
To: "Moriarty, Kathleen" <kathleen.moriarty@emc.com>, "mile@ietf.org" <mile@ietf.org>, "'Paul.Stoecker@rsa.com' (Paul.Stoecker@rsa.com)" <Paul.Stoecker@rsa.com>
Thread-Topic: Request for draft reviews - review of FC5070-bis
Thread-Index: Ac5i4z6UXWFgBViZRm66bWD5p9F0Rw==
Date: Thu, 06 Jun 2013 18:25:43 +0000
Message-ID: <1C9F17D1873AFA47A969C4DD98F98A753C8AC8@xmb-rcd-x10.cisco.com>
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
x-originating-ip: [64.102.89.113]
Content-Type: multipart/alternative; boundary="_000_1C9F17D1873AFA47A969C4DD98F98A753C8AC8xmbrcdx10ciscocom_"
MIME-Version: 1.0
Subject: Re: [mile] Request for draft reviews - review of FC5070-bis
X-BeenThere: mile@ietf.org
X-Mailman-Version: 2.1.12
Precedence: list
List-Id: "Managed Incident Lightweight Exchange, IODEF extensions and RID exchanges" <mile.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/mile>, <mailto:mile-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/mile>
List-Post: <mailto:mile@ietf.org>
List-Help: <mailto:mile-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/mile>, <mailto:mile-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 06 Jun 2013 18:25:53 -0000

Hi Paul,

Good starting point. Some comments and nits below from my first pass.
There should be more when I review again.

I remember sometime in the past there was a discussion  about what is an incidents if that should be updated in the 5070. I see that in your draft an incident is used as it was in 5070. I was just wondering if we had reached a consensus on it.


I also didn't see "uid" and "set id" definitions in the draft.


I don't see the EMailDetails class described in the document.

Nits:

- Should "This document contains changes with respect to its predecessor
      RFC5070:" be bulleted?

- The list in "This class will contain indicators from

      the list below " is not exactly below. The same for "the

      following included indicators are ones commonly used ". And the same for me occurrences of "following" in this section

- I am not sure if we want to keep the "<!-- CHANGE:" comments in the draft

- there are some XML complexType like "SoftwareType" that are described as classes in the comments IODEF schema, but these are not classes.



I aqlso see that you will have usecases-examples in this doc, so mayne I will remove mine from the guidance document.


Rgs,
Panos



From: mile-bounces@ietf.org [mailto:mile-bounces@ietf.org] On Behalf Of Moriarty, Kathleen
Sent: Friday, May 17, 2013 2:13 PM
To: mile@ietf.org
Subject: [mile] Request for draft reviews

Greetings!

We have had a number of documents updated since the last meeting.  Thank you to all of the editors for making the requested changes!  The current list of drafts up for review (including those that will be a part of the WG after the charter update) include:

RFC5070-bis (IODEF Revision):
http://datatracker.ietf.org/doc/draft-ietf-mile-rfc5070-bis/

Draft on IODEF Guidance:
(input from experience, real use cases, and draft review will be helpful)
http://datatracker.ietf.org/doc/draft-ietf-mile-iodef-guidance/

Structured Cybersecurity Information draft (close to final):
http://datatracker.ietf.org/doc/draft-ietf-mile-sci/

IODEF Enumeration Reference Format:
http://datatracker.ietf.org/doc/draft-montville-mile-enum-reference-format/

Resource-Oriented Lightweight Indicator Exchange (ROLIE):
http://datatracker.ietf.org/doc/draft-field-mile-rolie/

Please take some time to review the drafts and provide feedback to the list.  It would be helpful if we can iterate on most of them prior to the next meeting.  A couple of the drafts are very close to being done.  The list of current drafts and published RFCs can be found at the following link:
http://datatracker.ietf.org/wg/mile/

We will follow up soon on the charter update as well.

Thank you all in advance!
Kathleen