[mile] Hello, my comments on draft-banghart-mile-rolie-csirt-01:

["Xialiang (Frank)" <[e-mail]>]

Hi authors,
I have reviewed this draft, it's a useful extension of ROLIE for CSIRT team for security information sharing.
Right now, I can see that this draft is generally not complicated so that in a good shape and well written. I just have several comments on it as follows:

1.       Table 1~3 have the same title causing the difficulty to know what they are respectively for, it would be helpful to have more specific title for each table;

2.       Current draft covers two primary types of information: incidents and indicators. Is there plan to add more types in future, given IODEF actually has more types of security related information that can be referenced?

3.       For people who are not CSIRT experts, they may not be clear why you propose current information elements required for the CSIRT exchange in Section 6. Is it helpful to have some background information for explaining?

Generally, I think this draft is useful and in a good direction, but I still find there are some parts missed or not fully described. So go ahead and encourage more discussions in WG~~

B.R.
Frank