From nobody Mon Feb 1 14:05:53 2016 Return-Path: X-Original-To: mile@ietf.org Delivered-To: mile@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id 54E3D1B375D; Mon, 1 Feb 2016 14:05:52 -0800 (PST) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: internet-drafts@ietf.org To: X-Test-IDTracker: no X-IETF-IDTracker: 6.13.0 Auto-Submitted: auto-generated Precedence: bulk Message-ID: <20160201220552.16506.51013.idtracker@ietfa.amsl.com> Date: Mon, 01 Feb 2016 14:05:52 -0800 Archived-At: Cc: mile@ietf.org Subject: [mile] I-D Action: draft-ietf-mile-rfc5070-bis-16.txt X-BeenThere: mile@ietf.org X-Mailman-Version: 2.1.15 List-Id: "Managed Incident Lightweight Exchange, IODEF extensions and RID exchanges" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 01 Feb 2016 22:05:52 -0000 A New Internet-Draft is available from the on-line Internet-Drafts directories. This draft is a work item of the Managed Incident Lightweight Exchange Working Group of the IETF. Title : The Incident Object Description Exchange Format v2 Author : Roman Danyliw Filename : draft-ietf-mile-rfc5070-bis-16.txt Pages : 163 Date : 2016-02-01 Abstract: The Incident Object Description Exchange Format (IODEF) defines a data representation for sharing information commonly exchanged by Computer Security Incident Response Teams (CSIRTs) about computer security incidents. This document describes the information model for the IODEF and provides an associated data model specified with XML Schema. The IETF datatracker status page for this draft is: https://datatracker.ietf.org/doc/draft-ietf-mile-rfc5070-bis/ There's also a htmlized version available at: https://tools.ietf.org/html/draft-ietf-mile-rfc5070-bis-16 A diff from the previous version is available at: https://www.ietf.org/rfcdiff?url2=draft-ietf-mile-rfc5070-bis-16 Please note that it may take a couple of minutes from the time of submission until the htmlized version and diff are available at tools.ietf.org. Internet-Drafts are also available by anonymous FTP at: ftp://ftp.ietf.org/internet-drafts/ From nobody Mon Feb 1 18:44:16 2016 Return-Path: X-Original-To: mile@ietfa.amsl.com Delivered-To: mile@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 217511A6EF0 for ; Mon, 1 Feb 2016 18:44:15 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 2.298 X-Spam-Level: ** X-Spam-Status: No, score=2.298 tagged_above=-999 required=5 tests=[BAYES_05=-0.5, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FRT_STOCK2=3.988, J_CHICKENPOX_26=0.6, J_CHICKENPOX_34=0.6, RCVD_IN_DNSWL_MED=-2.3, T_FILL_THIS_FORM_SHORT=0.01] autolearn=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id hfmuaxiOahch for ; Mon, 1 Feb 2016 18:44:13 -0800 (PST) Received: from plainfield.sei.cmu.edu (plainfield.sei.cmu.edu [192.58.107.45]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id EA6731A6EE9 for ; Mon, 1 Feb 2016 18:44:12 -0800 (PST) Received: from timber.sei.cmu.edu (timber.sei.cmu.edu [10.64.21.23]) by plainfield.sei.cmu.edu (8.14.4/8.14.4/1408) with ESMTP id u122iBu6015934 for ; Mon, 1 Feb 2016 21:44:11 -0500 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cert.org; s=jthatj15xw2j; t=1454381051; bh=qFTIQn4CpvZejQID4w0KF/bmqjq9d0KjwY6mgk7Yp4I=; h=From:To:Subject:Date:Message-ID:References:In-Reply-To: Content-Type:Content-Transfer-Encoding:MIME-Version:Sender: Reply-To:Cc; b=m1FxxzOFhnQW2jxtsxHDbvt+VJbRNEcOPv3BhCwA/D3aWLjh1MnyBDWd+qddmyTVC 75r4+2mdYrCN488qPcpnbyANjgHd1mF/jst40XRH+owjCCJsrYb+yIfoRuxeHNPx9+ KjR3o25TAd3cTA7aWjNFzayHSI7T4r5cpquQk8SM= Received: from CASCADE.ad.sei.cmu.edu (cascade.ad.sei.cmu.edu [10.64.28.248]) by timber.sei.cmu.edu (8.14.4/8.14.4/1456) with ESMTP id u122i70c019152 for ; Mon, 1 Feb 2016 21:44:07 -0500 Received: from MARATHON.ad.sei.cmu.edu ([10.64.28.250]) by CASCADE.ad.sei.cmu.edu ([10.64.28.248]) with mapi id 14.03.0266.001; Mon, 1 Feb 2016 21:44:06 -0500 From: "Roman D. Danyliw" To: "mile@ietf.org" Thread-Topic: [mile] I-D Action: draft-ietf-mile-rfc5070-bis-16.txt Thread-Index: AQHRXT91TJA3LDC0mk2tekVZ52U1nZ8YDBZA Date: Tue, 2 Feb 2016 02:44:05 +0000 Message-ID: <359EC4B99E040048A7131E0F4E113AFCD969F185@marathon> References: <20160201220552.16506.51013.idtracker@ietfa.amsl.com> In-Reply-To: <20160201220552.16506.51013.idtracker@ietfa.amsl.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [10.64.22.6] Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Archived-At: Subject: Re: [mile] I-D Action: draft-ietf-mile-rfc5070-bis-16.txt X-BeenThere: mile@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: "Managed Incident Lightweight Exchange, IODEF extensions and RID exchanges" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 02 Feb 2016 02:44:15 -0000 The changelog for this draft is as follows: ** (schema) added XML declaration at the top of the schema ** (text) Improve write-up of @translation-id (Section 2.4) ** (text) Added the EXTENSION type (iodef:ExtensionType) and reference it f= or AdditionalData , RecordItem, FileProperties =20 (Section 2.16) ** (schema) Added ExtensionType@name attribute to name the field (Section 2= .16) ** (schema) Made iodef:SoftwareType be a formal UML type, SOFTWARE. Refere= nce it for Application, Operating System and =20 AssociatedSoftware (Section 2.17) ** (text) Defined 0:1 cardinality of IndicatorData in Incident consistent w= ith schema (Section 3.2) ** (text) Fixed type of Incident@observable-id in diagram (Section 3.2) ** (schema) Made @restriction optional in the schema per the text (Section = 3.3.1) ** (schema) Redefined PostalAddress, Email, Telephone and Fax for improved = internationalization (Section 3.10.2-4)=20 ** (text) Removed Section 2.12, Person or Organization (PERSON data type) a= s it was not used ** (text) Removed Section 3.11 that described the time classes (Section 3.1= 1) ** (text) Clarify IntendedImpact (Section 3.14) ** (schema) Consistent cardinality in child classes of RelatedActivity (Sec= tion 3.6) ** (schema) Define ThreatActor/{ThreatActorID,Description} as O:M consisten= tly in text, diagram and schema (Section 3.7) ** (schema) Define Campaign/{CampaignID,Description} as 0:M consistently in= text, diagram and schema (Section 3.8) ** (schema) Added @ext-dtype to ExtensionType missing from the schema but i= n the text ** (schema) Added AdditionalData@observable-id attribute (Section 3.9) ** (schema) Redefined SystemImpact, BusinessImpact, IntendedImpact and Node= Role to have a child Description class instead of =20 extending iodef:MLStringType per https://mailarchive.ietf.org/arch/msg/mile= /ZFL57YU1nYr2vSobRHd1a-OohJQ (Section 3.13) ** (text) Use Reference as the field name in the description of Method (Sec= tion 3.13) ** (text) Fixed formatting of Reference class (Section 3.13.1) ** (text) Use enum:ReferenceName as the field name in the description of Re= ference (Section 3.13.1) ** (schema) {SystemImpact, BusinessImpact}@type is required with a default = of 'unknown' per the text (Section 3.14.1 and =20 Section 3.14.2) ** (schema) SystemImpact@{severity,completion} optional per the text (Secti= on 3.14.1) ** (schema) Removed SystemImpact@type=3D"admin" from schema (Section 3.14.1= ) ** (schema) Added TimeImpact@{ext-metric,ext-duration} to schema per the te= xt (Section 3.14.3) ** (text) Corrected field names in the TimeImpact diagram (Section 3.14.3) ** (schema) Define Confidence as an extension of iodef:PositiveFloatType pe= r the text (Section 3.14.5) ** (schema) Removed inline SystemImpact@completion definition ** (schema) Set System/Node to be 1:1 per the text (Section 3.19) ** (schema) Redefined RelatedDNS to be of type EXTENSION (Section 3.20) (Is= sue #39) ** (schema) Define Counter to be "xs:float" to be consistent with REAL from= UML (Section 3.20) ** (schema) Added Counter@ext-unit missing from the schema but in the text = (Section 3.20.3) ** (text) Added missing STRING definition of Address in the class diagram (= Section 3.20.1) ** (text) Removed Node/DateTime from the Node diagram (Section 3.20) ** (schema) Removed Node/NodeRole from the schema per the text (Section 3.2= 0) ** (text) Updated diagram of Address to reflect base type (Section 3.20.1) ** (schema) Make Address@category=3D"ipv6-addr" the default (Section 3.20.1= ) ** (text) Consistent use of "Zero or more" and "One or more" to describe ca= rdinality ** (schema) Removed yes-no-type from schema as it was not used=20 ** (text) Renamed NodeRole@category=3D"c2" to "c2-server" to make the text = consistent with the schema (Section 3.20.2) ** (text) Added translation-id and/or xml:lang to diagrams/text where ML_ST= RING is used (Section 3.20.2) ** (text) Require that Nameserver/Address@category=3D{"ipv4-addr" or "ipv6-= addr"} (Section 3.21.2) ** (schema) Redefined ApplicationHeader to use iodef:ExtensionType and use = the protocol information from a parent Service =20 class (Section 3.21.2) ** (schema) Redefined EmailHeaderField to use iodef:ExtensionType (section = 3.23) ** (text) Clarify cardinality of the classes in Assessment (Section 3.14) ** (text) Added reference to EMAIL data type in definition of EmailFrom (Se= ction 3.24) ** (schema) Added EmailData/EmailTo (Section 3.24) ** (schema) Changed EmailTo, EmailFrom, EmailSubject and EmailX-Mailer to b= e xs:string (Section 3.24) ** (schema) Reference SignatureData and AssociatedSoftware in File per the = text (Section 3.27.1) ** (schema) Added Indicator/AdditionalData per the text (Section 3.31) ** (schema) Added Indicator/{NodeRole, AttackPhase} (Section 3.31) ** (text) Consistent definitions of xml:lang in the text ** (text) Updated description of all ext-* attributes that doesn't include = the use of the phrase "escape value" ** (text) Simplified Section 4.3, Validation, by removing the list of parsi= ng considerations ** (text) Ensure all classes that are of defined types (e.g., STRING) refer= ence their data type ** (text) Consistent use of cross references for sub-classes when defining = the parent class ** (text) Consistent introduction of the attribute count in the description= of a class ** (text) Consistent introduction of the sub-classes in the description of = a class ** (text) Consistent documentation of classes that do not have child classe= s ** (text) Consistent depiction of class diagrams ** (text) Reference the element content of ML_STRING derived classes as STR= ING ** (schema) Define File/Application as "iodef:Application" (not a nested de= finition of type=3D"iodef:SoftwareType") ** (schema) Consistent order of recurring attributes (e.g., restriction, ob= servable-id) in all classes ** (text) Removed Paul Stoecker as editor per Chair direction ** (text) reformatted schema to have consistent spacing (Issue #54) > -----Original Message----- > From: mile [mailto:mile-bounces@ietf.org] On Behalf Of internet- > drafts@ietf.org > Sent: Monday, February 1, 2016 5:06 PM > To: i-d-announce@ietf.org > Cc: mile@ietf.org > Subject: [mile] I-D Action: draft-ietf-mile-rfc5070-bis-16.txt >=20 >=20 > A New Internet-Draft is available from the on-line Internet-Drafts direct= ories. > This draft is a work item of the Managed Incident Lightweight Exchange > Working Group of the IETF. >=20 > Title : The Incident Object Description Exchange Format= v2 > Author : Roman Danyliw > Filename : draft-ietf-mile-rfc5070-bis-16.txt > Pages : 163 > Date : 2016-02-01 >=20 > Abstract: > The Incident Object Description Exchange Format (IODEF) defines a > data representation for sharing information commonly exchanged by > Computer Security Incident Response Teams (CSIRTs) about computer > security incidents. This document describes the information model > for the IODEF and provides an associated data model specified with > XML Schema. >=20 >=20 > The IETF datatracker status page for this draft is: > https://datatracker.ietf.org/doc/draft-ietf-mile-rfc5070-bis/ >=20 > There's also a htmlized version available at: > https://tools.ietf.org/html/draft-ietf-mile-rfc5070-bis-16 >=20 > A diff from the previous version is available at: > https://www.ietf.org/rfcdiff?url2=3Ddraft-ietf-mile-rfc5070-bis-16 >=20 >=20 > Please note that it may take a couple of minutes from the time of submiss= ion > until the htmlized version and diff are available at tools.ietf.org. >=20 > Internet-Drafts are also available by anonymous FTP at: > ftp://ftp.ietf.org/internet-drafts/ >=20 > _______________________________________________ > mile mailing list > mile@ietf.org > https://www.ietf.org/mailman/listinfo/mile From nobody Sun Feb 7 10:25:30 2016 Return-Path: X-Original-To: mile@ietfa.amsl.com Delivered-To: mile@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 53A001A046D for ; Sun, 7 Feb 2016 10:25:28 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 3.196 X-Spam-Level: *** X-Spam-Status: No, score=3.196 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FRT_STOCK2=3.988, J_CHICKENPOX_26=0.6, J_CHICKENPOX_34=0.6, RP_MATCHES_RCVD=-0.001, SPF_PASS=-0.001, T_FILL_THIS_FORM_SHORT=0.01] autolearn=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id jbVJD5jmgUhv for ; Sun, 7 Feb 2016 10:25:26 -0800 (PST) Received: from statler.isode.com (Statler.isode.com [62.232.206.189]) by ietfa.amsl.com (Postfix) with ESMTP id 653A61A0469 for ; Sun, 7 Feb 2016 10:25:26 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; t=1454869525; d=isode.com; s=selector; i=@isode.com; bh=UC0dEJJ0DuAOc3Shda0b6TO1QroxBQ95YVYTLSWKZVQ=; h=From:Sender:Reply-To:Subject:Date:Message-ID:To:Cc:MIME-Version: In-Reply-To:References:Content-Type:Content-Transfer-Encoding: Content-ID:Content-Description; b=c4LqaWH90yujYdodJWE4AeyvDJUrobNiUFA/38amJdYWFq2q3IXsYkdECM7jJT9dH6eE75 5Sv0BLCfqhGEJSn1YU2GqeyAhvZgt7XotWilyZ1601lACGWFx0vkAEf47JgwqHoTni4Ib4 /cyN4DU10lkXvhrH75j0kaDpD84SRb8=; Received: from [192.168.0.6] (cpc5-nmal20-2-0-cust24.19-2.cable.virginm.net [92.234.84.25]) by statler.isode.com (submission channel) via TCP with ESMTPSA id ; Sun, 7 Feb 2016 18:25:25 +0000 X-SMTP-Protocol-Errors: PIPELINING From: Alexey Melnikov X-Mailer: iPad Mail (13D15) In-Reply-To: <359EC4B99E040048A7131E0F4E113AFCD969F185@marathon> Date: Sun, 7 Feb 2016 18:29:49 +0000 Message-Id: References: <20160201220552.16506.51013.idtracker@ietfa.amsl.com> <359EC4B99E040048A7131E0F4E113AFCD969F185@marathon> To: "Roman D. Danyliw" MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: quoted-printable Archived-At: Cc: "mile@ietf.org" Subject: Re: [mile] I-D Action: draft-ietf-mile-rfc5070-bis-16.txt X-BeenThere: mile@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: "Managed Incident Lightweight Exchange, IODEF extensions and RID exchanges" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 07 Feb 2016 18:25:28 -0000 Roman, Are there any outstanding issue? All, Can you check that issues you've raised (or changes in general) are to your s= atisfaction? Best Regards, Alexey > On 2 Feb 2016, at 02:44, Roman D. Danyliw wrote: >=20 > The changelog for this draft is as follows: >=20 > ** (schema) added XML declaration at the top of the schema > ** (text) Improve write-up of @translation-id (Section 2.4) > ** (text) Added the EXTENSION type (iodef:ExtensionType) and reference it f= or AdditionalData , RecordItem, FileProperties =20 > (Section 2.16) > ** (schema) Added ExtensionType@name attribute to name the field (Section 2= .16) > ** (schema) Made iodef:SoftwareType be a formal UML type, SOFTWARE. Refer= ence it for Application, Operating System and =20 > AssociatedSoftware (Section 2.17) > ** (text) Defined 0:1 cardinality of IndicatorData in Incident consistent w= ith schema (Section 3.2) > ** (text) Fixed type of Incident@observable-id in diagram (Section 3.2) > ** (schema) Made @restriction optional in the schema per the text (Section= 3.3.1) > ** (schema) Redefined PostalAddress, Email, Telephone and Fax for improved= internationalization (Section 3.10.2-4)=20 > ** (text) Removed Section 2.12, Person or Organization (PERSON data type) a= s it was not used > ** (text) Removed Section 3.11 that described the time classes (Section 3.= 11) > ** (text) Clarify IntendedImpact (Section 3.14) > ** (schema) Consistent cardinality in child classes of RelatedActivity (Se= ction 3.6) > ** (schema) Define ThreatActor/{ThreatActorID,Description} as O:M consiste= ntly in text, diagram and schema (Section 3.7) > ** (schema) Define Campaign/{CampaignID,Description} as 0:M consistently i= n text, diagram and schema (Section 3.8) > ** (schema) Added @ext-dtype to ExtensionType missing from the schema but i= n the text > ** (schema) Added AdditionalData@observable-id attribute (Section 3.9) > ** (schema) Redefined SystemImpact, BusinessImpact, IntendedImpact and Nod= eRole to have a child Description class instead of =20 > extending iodef:MLStringType per https://mailarchive.ietf.org/arch/msg/mil= e/ZFL57YU1nYr2vSobRHd1a-OohJQ (Section 3.13) > ** (text) Use Reference as the field name in the description of Method (Se= ction 3.13) > ** (text) Fixed formatting of Reference class (Section 3.13.1) > ** (text) Use enum:ReferenceName as the field name in the description of R= eference (Section 3.13.1) > ** (schema) {SystemImpact, BusinessImpact}@type is required with a default= of 'unknown' per the text (Section 3.14.1 and =20 > Section 3.14.2) > ** (schema) SystemImpact@{severity,completion} optional per the text (Sect= ion 3.14.1) > ** (schema) Removed SystemImpact@type=3D"admin" from schema (Section 3.14.= 1) > ** (schema) Added TimeImpact@{ext-metric,ext-duration} to schema per the t= ext (Section 3.14.3) > ** (text) Corrected field names in the TimeImpact diagram (Section 3.14.3)= > ** (schema) Define Confidence as an extension of iodef:PositiveFloatType p= er the text (Section 3.14.5) > ** (schema) Removed inline SystemImpact@completion definition > ** (schema) Set System/Node to be 1:1 per the text (Section 3.19) > ** (schema) Redefined RelatedDNS to be of type EXTENSION (Section 3.20) (I= ssue #39) > ** (schema) Define Counter to be "xs:float" to be consistent with REAL fro= m UML (Section 3.20) > ** (schema) Added Counter@ext-unit missing from the schema but in the text= (Section 3.20.3) > ** (text) Added missing STRING definition of Address in the class diagram (= Section 3.20.1) > ** (text) Removed Node/DateTime from the Node diagram (Section 3.20) > ** (schema) Removed Node/NodeRole from the schema per the text (Section 3.= 20) > ** (text) Updated diagram of Address to reflect base type (Section 3.20.1)= > ** (schema) Make Address@category=3D"ipv6-addr" the default (Section 3.20.= 1) > ** (text) Consistent use of "Zero or more" and "One or more" to describe c= ardinality > ** (schema) Removed yes-no-type from schema as it was not used=20 > ** (text) Renamed NodeRole@category=3D"c2" to "c2-server" to make the text= consistent with the schema (Section 3.20.2) > ** (text) Added translation-id and/or xml:lang to diagrams/text where ML_S= TRING is used (Section 3.20.2) > ** (text) Require that Nameserver/Address@category=3D{"ipv4-addr" or "ipv6= -addr"} (Section 3.21.2) > ** (schema) Redefined ApplicationHeader to use iodef:ExtensionType and use= the protocol information from a parent Service =20 > class (Section 3.21.2) > ** (schema) Redefined EmailHeaderField to use iodef:ExtensionType (section= 3.23) > ** (text) Clarify cardinality of the classes in Assessment (Section 3.14) > ** (text) Added reference to EMAIL data type in definition of Email=46rom (= Section 3.24) > ** (schema) Added EmailData/EmailTo (Section 3.24) > ** (schema) Changed EmailTo, EmailFrom, EmailSubject and EmailX-Mailer to b= e xs:string (Section 3.24) > ** (schema) Reference SignatureData and AssociatedSoftware in File per the= text (Section 3.27.1) > ** (schema) Added Indicator/AdditionalData per the text (Section 3.31) > ** (schema) Added Indicator/{NodeRole, AttackPhase} (Section 3.31) > ** (text) Consistent definitions of xml:lang in the text > ** (text) Updated description of all ext-* attributes that doesn't include= the use of the phrase "escape value" > ** (text) Simplified Section 4.3, Validation, by removing the list of pars= ing considerations > ** (text) Ensure all classes that are of defined types (e.g., STRING) refe= rence their data type > ** (text) Consistent use of cross references for sub-classes when defining= the parent class > ** (text) Consistent introduction of the attribute count in the descriptio= n of a class > ** (text) Consistent introduction of the sub-classes in the description of= a class > ** (text) Consistent documentation of classes that do not have child class= es > ** (text) Consistent depiction of class diagrams > ** (text) Reference the element content of ML_STRING derived classes as ST= RING > ** (schema) Define File/Application as "iodef:Application" (not a nested d= efinition of type=3D"iodef:SoftwareType") > ** (schema) Consistent order of recurring attributes (e.g., restriction, o= bservable-id) in all classes > ** (text) Removed Paul Stoecker as editor per Chair direction > ** (text) reformatted schema to have consistent spacing (Issue #54) >=20 >> -----Original Message----- >> From: mile [mailto:mile-bounces@ietf.org] On Behalf Of internet- >> drafts@ietf.org >> Sent: Monday, February 1, 2016 5:06 PM >> To: i-d-announce@ietf.org >> Cc: mile@ietf.org >> Subject: [mile] I-D Action: draft-ietf-mile-rfc5070-bis-16.txt >>=20 >>=20 >> A New Internet-Draft is available from the on-line Internet-Drafts direct= ories. >> This draft is a work item of the Managed Incident Lightweight Exchange >> Working Group of the IETF. >>=20 >> Title : The Incident Object Description Exchange Format v= 2 >> Author : Roman Danyliw >> Filename : draft-ietf-mile-rfc5070-bis-16.txt >> Pages : 163 >> Date : 2016-02-01 >>=20 >> Abstract: >> The Incident Object Description Exchange Format (IODEF) defines a >> data representation for sharing information commonly exchanged by >> Computer Security Incident Response Teams (CSIRTs) about computer >> security incidents. This document describes the information model >> for the IODEF and provides an associated data model specified with >> XML Schema. >>=20 >>=20 >> The IETF datatracker status page for this draft is: >> https://datatracker.ietf.org/doc/draft-ietf-mile-rfc5070-bis/ >>=20 >> There's also a htmlized version available at: >> https://tools.ietf.org/html/draft-ietf-mile-rfc5070-bis-16 >>=20 >> A diff from the previous version is available at: >> https://www.ietf.org/rfcdiff?url2=3Ddraft-ietf-mile-rfc5070-bis-16 >>=20 >>=20 >> Please note that it may take a couple of minutes from the time of submiss= ion >> until the htmlized version and diff are available at tools.ietf.org. >>=20 >> Internet-Drafts are also available by anonymous FTP at: >> ftp://ftp.ietf.org/internet-drafts/ >>=20 >> _______________________________________________ >> mile mailing list >> mile@ietf.org >> https://www.ietf.org/mailman/listinfo/mile >=20 > _______________________________________________ > mile mailing list > mile@ietf.org > https://www.ietf.org/mailman/listinfo/mile From nobody Fri Feb 12 08:49:28 2016 Return-Path: X-Original-To: mile@ietfa.amsl.com Delivered-To: mile@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E53B71A6FAE for ; Fri, 12 Feb 2016 08:49:26 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.102 X-Spam-Level: X-Spam-Status: No, score=-0.102 tagged_above=-999 required=5 tests=[BAYES_20=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RP_MATCHES_RCVD=-0.001, SPF_PASS=-0.001] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id k3H4e65YRvt3 for ; Fri, 12 Feb 2016 08:49:25 -0800 (PST) Received: from statler.isode.com (Statler.isode.com [62.232.206.189]) by ietfa.amsl.com (Postfix) with ESMTP id 630A01A6F91 for ; Fri, 12 Feb 2016 08:49:25 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; t=1455295764; d=isode.com; s=selector; i=@isode.com; bh=o/Ld2S8RBj2e7Kt8/2btY/mTpj+XqCZTA480kedxLsQ=; h=From:Sender:Reply-To:Subject:Date:Message-ID:To:Cc:MIME-Version: In-Reply-To:References:Content-Type:Content-Transfer-Encoding: Content-ID:Content-Description; b=Yy8FeJlOgAAGQmNnJShrUBnE4pcWM8gsR7Di8FSOFUNwbVf61g4qNBWWpwgKMWEy2j8FJp W/QfoOto55TBrks0W5PBo0IDGPf10EjAEhoqWC5/0ub9TYqfuySdJ/S0PlBNVtZzSznIP5 c1YGZMiWc+I8F4NMK8hVgjhbOTeyyG0=; Received: from [172.20.1.215] (dhcp-215.isode.net [172.20.1.215]) by statler.isode.com (submission channel) via TCP with ESMTPSA id ; Fri, 12 Feb 2016 16:49:24 +0000 To: "Roman D. Danyliw" References: <20160201220552.16506.51013.idtracker@ietfa.amsl.com> <359EC4B99E040048A7131E0F4E113AFCD969F185@marathon> From: Alexey Melnikov Message-ID: <56BE0D04.5090307@isode.com> Date: Fri, 12 Feb 2016 16:49:08 +0000 User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:38.0) Gecko/20100101 Thunderbird/38.5.1 In-Reply-To: MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="------------010603040607040104030300" Archived-At: Cc: "mile@ietf.org" Subject: Re: [mile] I-D Action: draft-ietf-mile-rfc5070-bis-16.txt X-BeenThere: mile@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: "Managed Incident Lightweight Exchange, IODEF extensions and RID exchanges" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 12 Feb 2016 16:49:27 -0000 This is a multi-part message in MIME format. --------------010603040607040104030300 Content-Type: text/plain; charset=windows-1252; format=flowed Content-Transfer-Encoding: 7bit Hi Roman, A few quick comments after reviewing the most recent diff: In 2.17: formatid might need a bit more details. Can you provide some examples? In 3.9.4: When one would use "direct" or when "mobile"? Is "direct" referring to a landline number or something else? In 3.21: In EmailHeaderField description: I don't know what is "SMTP header field". I think you should revert the change to make it "email header field" again. Also, it should be "zero or more", not "zero or one". In 3.25.1: FileType - this is just media type name, right? --------------010603040607040104030300 Content-Type: text/html; charset=windows-1252 Content-Transfer-Encoding: 7bit 
Hi Roman,
A few quick comments after reviewing the most recent diff:


In 2.17:

formatid might need a bit more details. Can you provide some examples?

In 3.9.4:

When one would use "direct" or when "mobile"? Is "direct" referring to a landline number or something else?


In 3.21:

In EmailHeaderField description: I don't know what is "SMTP header field". I think you should revert the change to make it "email header field" again.

Also, it should be "zero or more", not "zero or one".

In 3.25.1:

FileType - this is just media type name, right?
--------------010603040607040104030300-- From nobody Mon Feb 15 23:25:26 2016 Return-Path: X-Original-To: mile@ietf.org Delivered-To: mile@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id 97C341B29CE; Thu, 11 Feb 2016 03:50:48 -0800 (PST) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: "\"IETF Meeting Session Request Tool\"" To: X-Test-IDTracker: no X-IETF-IDTracker: 6.14.0 Auto-Submitted: auto-generated Precedence: bulk Message-ID: <20160211115048.23930.86024.idtracker@ietfa.amsl.com> Date: Thu, 11 Feb 2016 03:50:48 -0800 Archived-At: X-Mailman-Approved-At: Mon, 15 Feb 2016 23:25:25 -0800 Cc: mile@ietf.org, mile-chairs@ietf.org Subject: [mile] mile - New Meeting Session Request for IETF 95 X-BeenThere: mile@ietf.org X-Mailman-Version: 2.1.15 List-Id: "Managed Incident Lightweight Exchange, IODEF extensions and RID exchanges" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 11 Feb 2016 11:50:48 -0000 A new meeting session request has just been submitted by Alexey Melnikov, a Chair of the mile working group. --------------------------------------------------------- Working Group Name: Managed Incident Lightweight Exchange Area Name: Security Area Session Requester: Alexey Melnikov Number of Sessions: 1 Length of Session(s): 1 Hour Number of Attendees: 25 Conflicts to Avoid: First Priority: saag sacm radext dime tls dane kitten appsawg netmod dispatch Second Priority: oauth httpauth ace Special Requests: ---------------------------------------------------------